Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
httpcaddyfile: Carry bind setting through to ACME issuer (fixes #3232)
Matthew Holt committed
Apr 6, 2020 at 12:24 UTC
145aebbba50e9ed5487ecc24b0e0ca384842ccc0
1 file changed
+55
-7
caddyconfig/httpcaddyfile/tlsapp.go
+55
-7
@@ -100,15 +100,58 @@ func (st ServerType) buildTLSApp(
100
return nil, warnings, err
101
}
102
}
103
- encoded := caddyconfig.JSONModuleObject(issuer, "module", issuer.(caddy.Module).CaddyModule().ID.Name(), &warnings)
104
- if ap == catchAllAP && ap.IssuerRaw != nil && !bytes.Equal(ap.IssuerRaw, encoded) {
105
- return nil, warnings, fmt.Errorf("conflicting issuer configuration: %s != %s", ap.IssuerRaw, encoded)
103
+ if ap == catchAllAP && !reflect.DeepEqual(ap.Issuer, issuer) {
104
+ return nil, warnings, fmt.Errorf("automation policy from site block is also default/catch-all policy because of key without hostname, and the two are in conflict: %#v != %#v", ap.Issuer, issuer)
105
}
107
- ap.IssuerRaw = encoded
106
+ ap.Issuer = issuer
107
}
108
}
109
110
+ // custom bind host
111
+ for _, cfgVal := range sblock.pile["bind"] {
112
+ // either an existing issuer is already configured (and thus, ap is not
113
+ // nil), or we need to configure an issuer, so we need ap to be non-nil
114
+ if ap == nil {
115
+ ap, err = newBaseAutomationPolicy(options, warnings, true)
116
+ if err != nil {
117
+ return nil, warnings, err
118
+ }
119
+ }
120
+
121
+ // if an issuer was already configured and it is NOT an ACME
122
+ // issuer, skip, since we intend to adjust only ACME issuers
123
+ var acmeIssuer *caddytls.ACMEIssuer
124
+ if ap.Issuer != nil {
125
+ var ok bool
126
+ if acmeIssuer, ok = ap.Issuer.(*caddytls.ACMEIssuer); !ok {
127
+ break
128
+ }
129
+ }
130
+
131
+ // proceed to configure the ACME issuer's bind host, without
132
+ // overwriting any existing settings
133
+ if acmeIssuer == nil {
134
+ acmeIssuer = new(caddytls.ACMEIssuer)
135
+ }
136
+ if acmeIssuer.Challenges == nil {
137
+ acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
138
+ }
139
+ if acmeIssuer.Challenges.BindHost == "" {
140
+ // only binding to one host is supported
141
+ var bindHost string
142
+ if bindHosts, ok := cfgVal.Value.([]string); ok && len(bindHosts) > 0 {
143
+ bindHost = bindHosts[0]
144
+ }
145
+ acmeIssuer.Challenges.BindHost = bindHost
146
+ }
147
+ ap.Issuer = acmeIssuer // we'll encode it later
148
+ }
149
+
150
if ap != nil {
151
+ // encode issuer now that it's all set up
152
+ issuerName := ap.Issuer.(caddy.Module).CaddyModule().ID.Name()
153
+ ap.IssuerRaw = caddyconfig.JSONModuleObject(ap.Issuer, "module", issuerName, &warnings)
154
+
155
// first make sure this block is allowed to create an automation policy;
156
// doing so is forbidden if it has a key with no host (i.e. ":443")
157
// and if there is a different server block that also has a key with no
@@ -222,6 +265,11 @@ func (st ServerType) buildTLSApp(
265
266
// if there is a global/catch-all automation policy, ensure it goes last
267
if catchAllAP != nil {
268
+ // first, encode its issuer
269
+ issuerName := catchAllAP.Issuer.(caddy.Module).CaddyModule().ID.Name()
270
+ catchAllAP.IssuerRaw = caddyconfig.JSONModuleObject(catchAllAP.Issuer, "module", issuerName, &warnings)
271
+
272
+ // then append it to the end of the policies list
273
if tlsApp.Automation == nil {
274
tlsApp.Automation = new(caddytls.AutomationConfig)
275
}
@@ -290,7 +338,7 @@ func newBaseAutomationPolicy(options map[string]interface{}, warnings []caddycon
338
339
if localCerts != nil {
340
// internal issuer enabled trumps any ACME configurations; useful in testing
293
- ap.IssuerRaw = caddyconfig.JSONModuleObject(caddytls.InternalIssuer{}, "module", "internal", &warnings)
341
+ ap.Issuer = new(caddytls.InternalIssuer) // we'll encode it later
342
} else {
343
if acmeCA == nil {
344
acmeCA = ""
@@ -298,7 +346,7 @@ func newBaseAutomationPolicy(options map[string]interface{}, warnings []caddycon
346
if email == nil {
347
email = ""
348
}
301
- mgr := caddytls.ACMEIssuer{
349
+ mgr := &caddytls.ACMEIssuer{
350
CA: acmeCA.(string),
351
Email: email.(string),
352
}
@@ -315,7 +363,7 @@ func newBaseAutomationPolicy(options map[string]interface{}, warnings []caddycon
363
if acmeCARoot != nil {
364
mgr.TrustedRootsPEMFiles = []string{acmeCARoot.(string)}
365
}
318
- ap.IssuerRaw = caddyconfig.JSONModuleObject(mgr, "module", "acme", &warnings)
366
+ ap.Issuer = mgr // we'll encode it later
367
}
368
369
return ap, nil