Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 13:30 UTC
caddytls: Avoid default issuers for implicit tailscale policies (#7577)
Tao committed
Mar 21, 2026 at 01:36 UTC
5d189aff40dcfd6e8245310eb696e0de3775a690
2 files changed
+61
-1
modules/caddytls/automation.go
+24
-1
@@ -235,7 +235,7 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
235
}
236
237
issuers := ap.Issuers
238
- if len(issuers) == 0 {
238
+ if len(issuers) == 0 && !ap.implicitTailscaleManagersOnly() {
239
var err error
240
issuers, err = DefaultIssuersProvisioned(tlsApp.ctx)
241
if err != nil {
@@ -429,6 +429,29 @@ func (ap *AutomationPolicy) AllInternalSubjects() bool {
429
})
430
}
431
432
+// implicitTailscaleManagersOnly returns true if this policy is configured to
433
+// serve only Tailscale names from the Tailscale manager at handshake-time.
434
+func (ap *AutomationPolicy) implicitTailscaleManagersOnly() bool {
435
+ if len(ap.subjects) == 0 {
436
+ return false
437
+ }
438
+
439
+ for _, subject := range ap.subjects {
440
+ if !strings.HasSuffix(strings.ToLower(subject), tailscaleDomainAliasEnding) {
441
+ return false
442
+ }
443
+ }
444
+
445
+ for _, manager := range ap.Managers {
446
+ switch manager.(type) {
447
+ case Tailscale, *Tailscale:
448
+ return true
449
+ }
450
+ }
451
+
452
+ return false
453
+}
454
+
455
func (ap *AutomationPolicy) onlyInternalIssuer() bool {
456
if len(ap.Issuers) != 1 {
457
return false
modules/caddytls/automation_test.go
new
+37
@@ -0,0 +1,37 @@
1
+package caddytls
2
+
3
+import (
4
+ "testing"
5
+
6
+ "github.com/caddyserver/certmagic"
7
+ "go.uber.org/zap"
8
+)
9
+
10
+func TestAutomationPolicyMakeCertMagicConfigImplicitTailscaleManagersOnly(t *testing.T) {
11
+ ap := AutomationPolicy{
12
+ Managers: []certmagic.Manager{Tailscale{}},
13
+ subjects: []string{"test-node.example.ts.net"},
14
+ }
15
+
16
+ cfg, err := ap.makeCertMagicConfig(&TLS{
17
+ logger: zap.NewNop(),
18
+ }, nil, &certmagic.FileStorage{Path: t.TempDir()})
19
+ if err != nil {
20
+ t.Fatalf("making certmagic config: %v", err)
21
+ }
22
+ if cfg.OnDemand == nil {
23
+ t.Fatal("expected on-demand config to be set")
24
+ }
25
+ if len(cfg.Issuers) != 0 {
26
+ t.Fatalf("expected no issuers for tailscale-managed ts.net policy, got %d", len(cfg.Issuers))
27
+ }
28
+}
29
+
30
+func TestAutomationPolicyImplicitTailscaleManagersOnlyCatchAll(t *testing.T) {
31
+ ap := AutomationPolicy{
32
+ Managers: []certmagic.Manager{Tailscale{}},
33
+ }
34
+ if ap.implicitTailscaleManagersOnly() {
35
+ t.Fatal("expected catch-all manager policy to remain outside tailscale-only special case")
36
+ }
37
+}