httpcaddyfile: Map default_bind to BindHost in globalACMEDefaults (#7278)

* Implement BindHost fallback in ACME issuer * Fix indentation * Skip creating empty challenges stub in adapted json config * Skip setting BindHost for DNS Challenge * golangci-lint fix --------- Co-authored-by: Matt Holt <mholt@users.noreply.github.com>

Monviech committed Oct 7, 2025 at 00:48 UTC 2f1d270968e050105e3f6814b1ef7e7660ed41ba

1 file changed +15

caddyconfig/httpcaddyfile/tlsapp.go

+15

@@ -554,6 +554,7 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e

554 globalPreferredChains := options["preferred_chains"]

555 globalCertLifetime := options["cert_lifetime"]

556 globalHTTPPort, globalHTTPSPort := options["http_port"], options["https_port"]

557 + globalDefaultBind := options["default_bind"]

558

559 if globalEmail != nil && acmeIssuer.Email == "" {

560 acmeIssuer.Email = globalEmail.(string)

@@ -606,6 +607,20 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e

607 }

608 acmeIssuer.Challenges.TLSALPN.AlternatePort = globalHTTPSPort.(int)

609 }

610 + // If BindHost is still unset, fall back to the first default_bind address if set

611 + // This avoids binding the automation policy to the wildcard socket, which is unexpected behavior when a more selective socket is specified via default_bind

612 + // In BSD it is valid to bind to the wildcard socket even though a more selective socket is already open (still unexpected behavior by the caller though)

613 + // In Linux the same call will error with EADDRINUSE whenever the listener for the automation policy is opened

614 + if acmeIssuer.Challenges == nil || (acmeIssuer.Challenges.DNS == nil && acmeIssuer.Challenges.BindHost == "") {

615 + if defBinds, ok := globalDefaultBind.([]ConfigValue); ok && len(defBinds) > 0 {

616 + if abp, ok := defBinds[0].Value.(addressesWithProtocols); ok && len(abp.addresses) > 0 {

617 + if acmeIssuer.Challenges == nil {

618 + acmeIssuer.Challenges = new(caddytls.ChallengesConfig)

619 + }

620 + acmeIssuer.Challenges.BindHost = abp.addresses[0]

621 + }

622 + }

623 + }

624 if globalCertLifetime != nil && acmeIssuer.CertificateLifetime == 0 {

625 acmeIssuer.CertificateLifetime = globalCertLifetime.(caddy.Duration)

626 }