http: Enable TLS for servers listening only on HTTPS port

It seems silly to have to add a single, empty TLS connection policy to a server to enable TLS when it's only listening on the HTTPS port. We now do this for the user as part of automatic HTTPS (thus, it can be disabled / overridden). See https://caddy.community/t/v2-catch-all-server-with-automatic-tls/6692/2?u=matt

Matthew Holt committed Dec 28, 2019 at 23:56 UTC 2b33d9a5e5d1bd12d27bea2cfe8341fd1e5703b2

2 files changed +13

modules/caddyhttp/caddyhttp.go

+12

@@ -326,6 +326,18 @@ func (app *App) automaticHTTPS() error {

326 continue

327 }

328

329 + // if all listeners are on the HTTPS port, make sure

330 + // there is at least one TLS connection policy; it

331 + // should be obvious that they want to use TLS without

332 + // needing to specify one empty policy to enable it

333 + if !srv.listenersUseAnyPortOtherThan(app.httpsPort()) && len(srv.TLSConnPolicies) == 0 {

334 + app.logger.Info("server is only listening on the HTTPS port but has no TLS connection policies; adding one to enable TLS",

335 + zap.String("server_name", srvName),

336 + zap.Int("https_port", app.httpsPort()),

337 + )

338 + srv.TLSConnPolicies = append(srv.TLSConnPolicies, new(caddytls.ConnectionPolicy))

339 + }

340 +

341 // find all qualifying domain names, de-duplicated

342 domainSet := make(map[string]struct{})

343 for routeIdx, route := range srv.Routes {

modules/caddytls/connpolicy.go

@@ -106,6 +106,7 @@ func (cp ConnectionPolicies) TLSConfig(ctx caddy.Context) (*tls.Config, error) {

106 }

107

108 // ConnectionPolicy specifies the logic for handling a TLS handshake.

109 +// An empty policy is valid; safe and sensible defaults will be used.

110 type ConnectionPolicy struct {

111 // How to match this policy with a TLS ClientHello. If

112 // this policy is the first to match, it will be used.