Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 08:00 UTC
caddytls: Add `dns_ttl` config, improve Caddyfile `tls` options (#5287)
Yannick Ihmels committed
Jan 6, 2023 at 20:44 UTC
55035d327a2dbd32887db0b1dcbc25dba590798f
3 files changed
+173
-9
caddyconfig/httpcaddyfile/builtins.go
+85
-9
@@ -24,6 +24,7 @@ import (
24
"reflect"
25
"strconv"
26
"strings"
27
+ "time"
28
29
"github.com/caddyserver/caddy/v2"
30
"github.com/caddyserver/caddy/v2/caddyconfig"
@@ -75,16 +76,22 @@ func parseBind(h Helper) ([]ConfigValue, error) {
76
// trusted_leaf_cert <base64_der>
77
// trusted_leaf_cert_file <filename>
78
// }
78
-// alpn <values...>
79
-// load <paths...>
80
-// ca <acme_ca_endpoint>
81
-// ca_root <pem_file>
82
-// dns <provider_name> [...]
79
+// alpn <values...>
80
+// load <paths...>
81
+// ca <acme_ca_endpoint>
82
+// ca_root <pem_file>
83
+// key_type [ed25519|p256|p384|rsa2048|rsa4096]
84
+// dns <provider_name> [...]
85
+// propagation_delay <duration>
86
+// propagation_timeout <duration>
87
+// resolvers <dns_servers...>
88
+// dns_ttl <duration>
89
+// dns_challenge_override_domain <domain>
90
// on_demand
84
-// eab <key_id> <mac_key>
85
-// issuer <module_name> [...]
86
-// get_certificate <module_name> [...]
87
-// insecure_secrets_log <log_file>
91
+// eab <key_id> <mac_key>
92
+// issuer <module_name> [...]
93
+// get_certificate <module_name> [...]
94
+// insecure_secrets_log <log_file>
95
// }
96
func parseTLS(h Helper) ([]ConfigValue, error) {
97
cp := new(caddytls.ConnectionPolicy)
@@ -363,6 +370,75 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
370
}
371
acmeIssuer.Challenges.DNS.Resolvers = args
372
373
+ case "propagation_delay":
374
+ arg := h.RemainingArgs()
375
+ if len(arg) != 1 {
376
+ return nil, h.ArgErr()
377
+ }
378
+ delayStr := arg[0]
379
+ delay, err := caddy.ParseDuration(delayStr)
380
+ if err != nil {
381
+ return nil, h.Errf("invalid propagation_delay duration %s: %v", delayStr, err)
382
+ }
383
+ if acmeIssuer == nil {
384
+ acmeIssuer = new(caddytls.ACMEIssuer)
385
+ }
386
+ if acmeIssuer.Challenges == nil {
387
+ acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
388
+ }
389
+ if acmeIssuer.Challenges.DNS == nil {
390
+ acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
391
+ }
392
+ acmeIssuer.Challenges.DNS.PropagationDelay = caddy.Duration(delay)
393
+
394
+ case "propagation_timeout":
395
+ arg := h.RemainingArgs()
396
+ if len(arg) != 1 {
397
+ return nil, h.ArgErr()
398
+ }
399
+ timeoutStr := arg[0]
400
+ var timeout time.Duration
401
+ if timeoutStr == "-1" {
402
+ timeout = time.Duration(-1)
403
+ } else {
404
+ var err error
405
+ timeout, err = caddy.ParseDuration(timeoutStr)
406
+ if err != nil {
407
+ return nil, h.Errf("invalid propagation_timeout duration %s: %v", timeoutStr, err)
408
+ }
409
+ }
410
+ if acmeIssuer == nil {
411
+ acmeIssuer = new(caddytls.ACMEIssuer)
412
+ }
413
+ if acmeIssuer.Challenges == nil {
414
+ acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
415
+ }
416
+ if acmeIssuer.Challenges.DNS == nil {
417
+ acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
418
+ }
419
+ acmeIssuer.Challenges.DNS.PropagationTimeout = caddy.Duration(timeout)
420
+
421
+ case "dns_ttl":
422
+ arg := h.RemainingArgs()
423
+ if len(arg) != 1 {
424
+ return nil, h.ArgErr()
425
+ }
426
+ ttlStr := arg[0]
427
+ ttl, err := caddy.ParseDuration(ttlStr)
428
+ if err != nil {
429
+ return nil, h.Errf("invalid dns_ttl duration %s: %v", ttlStr, err)
430
+ }
431
+ if acmeIssuer == nil {
432
+ acmeIssuer = new(caddytls.ACMEIssuer)
433
+ }
434
+ if acmeIssuer.Challenges == nil {
435
+ acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
436
+ }
437
+ if acmeIssuer.Challenges.DNS == nil {
438
+ acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
439
+ }
440
+ acmeIssuer.Challenges.DNS.TTL = caddy.Duration(ttl)
441
+
442
case "dns_challenge_override_domain":
443
arg := h.RemainingArgs()
444
if len(arg) != 1 {
caddytest/integration/caddyfile_adapt/tls_dns_ttl.txt
new
+70
@@ -0,0 +1,70 @@
1
+localhost
2
+
3
+respond "hello from localhost"
4
+tls {
5
+ issuer acme {
6
+ dns_ttl 5m10s
7
+ }
8
+}
9
+----------
10
+{
11
+ "apps": {
12
+ "http": {
13
+ "servers": {
14
+ "srv0": {
15
+ "listen": [
16
+ ":443"
17
+ ],
18
+ "routes": [
19
+ {
20
+ "match": [
21
+ {
22
+ "host": [
23
+ "localhost"
24
+ ]
25
+ }
26
+ ],
27
+ "handle": [
28
+ {
29
+ "handler": "subroute",
30
+ "routes": [
31
+ {
32
+ "handle": [
33
+ {
34
+ "body": "hello from localhost",
35
+ "handler": "static_response"
36
+ }
37
+ ]
38
+ }
39
+ ]
40
+ }
41
+ ],
42
+ "terminal": true
43
+ }
44
+ ]
45
+ }
46
+ }
47
+ },
48
+ "tls": {
49
+ "automation": {
50
+ "policies": [
51
+ {
52
+ "subjects": [
53
+ "localhost"
54
+ ],
55
+ "issuers": [
56
+ {
57
+ "challenges": {
58
+ "dns": {
59
+ "ttl": 310000000000
60
+ }
61
+ },
62
+ "module": "acme"
63
+ }
64
+ ]
65
+ }
66
+ ]
67
+ }
68
+ }
69
+ }
70
+}
\ No newline at end of file
modules/caddytls/acmeissuer.go
+18
@@ -266,6 +266,7 @@ func (iss *ACMEIssuer) GetACMEIssuer() *ACMEIssuer { return iss }
266
// propagation_delay <duration>
267
// propagation_timeout <duration>
268
// resolvers <dns_servers...>
269
+// dns_ttl <duration>
270
// dns_challenge_override_domain <domain>
271
// preferred_chains [smallest] {
272
// root_common_name <common_names...>
@@ -445,6 +446,23 @@ func (iss *ACMEIssuer) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
446
return d.ArgErr()
447
}
448
449
+ case "dns_ttl":
450
+ if !d.NextArg() {
451
+ return d.ArgErr()
452
+ }
453
+ ttlStr := d.Val()
454
+ ttl, err := caddy.ParseDuration(ttlStr)
455
+ if err != nil {
456
+ return d.Errf("invalid dns_ttl duration %s: %v", ttlStr, err)
457
+ }
458
+ if iss.Challenges == nil {
459
+ iss.Challenges = new(ChallengesConfig)
460
+ }
461
+ if iss.Challenges.DNS == nil {
462
+ iss.Challenges.DNS = new(DNSChallengeConfig)
463
+ }
464
+ iss.Challenges.DNS.TTL = caddy.Duration(ttl)
465
+
466
case "dns_challenge_override_domain":
467
arg := d.RemainingArgs()
468
if len(arg) != 1 {