Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
httpcaddyfile: Add `skip_install_trust` global option (#4153)
Fixes https://github.com/caddyserver/caddy/issues/4002
Francis Lavoie committed
Jun 7, 2021 at 14:18 UTC
658772ff24b9e1eabf6f254d039d91e8abfcb775
3 files changed
+77
caddyconfig/httpcaddyfile/options.go
+1
@@ -39,6 +39,7 @@ func init() {
39
RegisterGlobalOption("acme_dns", parseOptACMEDNS)
40
RegisterGlobalOption("acme_eab", parseOptACMEEAB)
41
RegisterGlobalOption("cert_issuer", parseOptCertIssuer)
42
+ RegisterGlobalOption("skip_install_trust", parseOptTrue)
43
RegisterGlobalOption("email", parseOptSingleString)
44
RegisterGlobalOption("admin", parseOptAdmin)
45
RegisterGlobalOption("on_demand_tls", parseOptOnDemand)
caddyconfig/httpcaddyfile/pkiapp.go
+20
@@ -27,15 +27,35 @@ func (st ServerType) buildPKIApp(
27
28
pkiApp := &caddypki.PKI{CAs: make(map[string]*caddypki.CA)}
29
30
+ skipInstallTrust := false
31
+ if _, ok := options["skip_install_trust"]; ok {
32
+ skipInstallTrust = true
33
+ }
34
+ falseBool := false
35
+
36
for _, p := range pairings {
37
for _, sblock := range p.serverBlocks {
38
// find all the CAs that were defined and add them to the app config
39
+ // i.e. from any "acme_server" directives
40
for _, caCfgValue := range sblock.pile["pki.ca"] {
41
ca := caCfgValue.Value.(*caddypki.CA)
42
+ if skipInstallTrust {
43
+ ca.InstallTrust = &falseBool
44
+ }
45
pkiApp.CAs[ca.ID] = ca
46
}
47
}
48
}
49
50
+ // if there was no CAs defined in any of the servers,
51
+ // and we were requested to not install trust, then
52
+ // add one for the default/local CA to do so
53
+ if len(pkiApp.CAs) == 0 && skipInstallTrust {
54
+ ca := new(caddypki.CA)
55
+ ca.ID = caddypki.DefaultCAID
56
+ ca.InstallTrust = &falseBool
57
+ pkiApp.CAs[ca.ID] = ca
58
+ }
59
+
60
return pkiApp, warnings, nil
61
}
caddytest/integration/caddyfile_adapt/global_options_skip_install_trust.txt
new
+56
@@ -0,0 +1,56 @@
1
+{
2
+ skip_install_trust
3
+}
4
+
5
+a.example.com {
6
+ tls internal
7
+}
8
+----------
9
+{
10
+ "apps": {
11
+ "http": {
12
+ "servers": {
13
+ "srv0": {
14
+ "listen": [
15
+ ":443"
16
+ ],
17
+ "routes": [
18
+ {
19
+ "match": [
20
+ {
21
+ "host": [
22
+ "a.example.com"
23
+ ]
24
+ }
25
+ ],
26
+ "terminal": true
27
+ }
28
+ ]
29
+ }
30
+ }
31
+ },
32
+ "pki": {
33
+ "certificate_authorities": {
34
+ "local": {
35
+ "install_trust": false
36
+ }
37
+ }
38
+ },
39
+ "tls": {
40
+ "automation": {
41
+ "policies": [
42
+ {
43
+ "subjects": [
44
+ "a.example.com"
45
+ ],
46
+ "issuers": [
47
+ {
48
+ "module": "internal"
49
+ }
50
+ ]
51
+ }
52
+ ]
53
+ }
54
+ }
55
+ }
56
+}
\ No newline at end of file