Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 16:00 UTC
caddytls: Finish removing prefer_wildcard
Finish what should have been done a year ago in #6959)
Matthew Holt committed
Feb 12, 2026 at 11:35 UTC
6718bd470f23367e49ae9a3642f2e1ef8feb12d7
2 files changed
+1
-53
caddyconfig/httpcaddyfile/options.go
+1
-2
@@ -457,9 +457,8 @@ func parseOptAutoHTTPS(d *caddyfile.Dispenser, _ any) (any, error) {
457
case "disable_redirects":
458
case "disable_certs":
459
case "ignore_loaded_certs":
460
- case "prefer_wildcard":
460
default:
462
- return "", d.Errf("auto_https must be one of 'off', 'disable_redirects', 'disable_certs', 'ignore_loaded_certs', or 'prefer_wildcard'")
461
+ return "", d.Errf("auto_https must be one of 'off', 'disable_redirects', 'disable_certs', or 'ignore_loaded_certs'")
462
}
463
}
464
return val, nil
caddyconfig/httpcaddyfile/tlsapp.go
-51
@@ -92,26 +92,8 @@ func (st ServerType) buildTLSApp(
92
tlsApp.Automation.Policies = append(tlsApp.Automation.Policies, catchAllAP)
93
}
94
95
- var wildcardHosts []string // collect all hosts that have a wildcard in them, and aren't HTTP
95
forcedAutomatedNames := make(map[string]struct{}) // explicitly configured to be automated, even if covered by a wildcard
96
98
- for _, p := range pairings {
99
- var addresses []string
100
- for _, addressWithProtocols := range p.addressesWithProtocols {
101
- addresses = append(addresses, addressWithProtocols.address)
102
- }
103
- if !listenersUseAnyPortOtherThan(addresses, httpPort) {
104
- continue
105
- }
106
- for _, sblock := range p.serverBlocks {
107
- for _, addr := range sblock.parsedKeys {
108
- if strings.HasPrefix(addr.Host, "*.") {
109
- wildcardHosts = append(wildcardHosts, addr.Host[2:])
110
- }
111
- }
112
- }
113
- }
114
-
97
for _, p := range pairings {
98
// avoid setting up TLS automation policies for a server that is HTTP-only
99
var addresses []string
@@ -135,12 +117,6 @@ func (st ServerType) buildTLSApp(
117
return nil, warnings, err
118
}
119
138
- // make a plain copy so we can compare whether we made any changes
139
- apCopy, err := newBaseAutomationPolicy(options, warnings, true)
140
- if err != nil {
141
- return nil, warnings, err
142
- }
143
-
120
sblockHosts := sblock.hostsFromKeys(false)
121
if len(sblockHosts) == 0 && catchAllAP != nil {
122
ap = catchAllAP
@@ -253,16 +229,6 @@ func (st ServerType) buildTLSApp(
229
hostsNotHTTP := sblock.hostsFromKeysNotHTTP(httpPort)
230
sort.Strings(hostsNotHTTP) // solely for deterministic test results
231
256
- // if the we prefer wildcards and the AP is unchanged,
257
- // then we can skip this AP because it should be covered
258
- // by an AP with a wildcard
259
- if slices.Contains(autoHTTPS, "prefer_wildcard") {
260
- if hostsCoveredByWildcard(hostsNotHTTP, wildcardHosts) &&
261
- reflect.DeepEqual(ap, apCopy) {
262
- continue
263
- }
264
- }
265
-
232
// associate our new automation policy with this server block's hosts
233
ap.SubjectsRaw = hostsNotHTTP
234
@@ -849,20 +815,3 @@ func automationPolicyHasAllPublicNames(ap *caddytls.AutomationPolicy) bool {
815
func isTailscaleDomain(name string) bool {
816
return strings.HasSuffix(strings.ToLower(name), ".ts.net")
817
}
852
-
853
-func hostsCoveredByWildcard(hosts []string, wildcards []string) bool {
854
- if len(hosts) == 0 || len(wildcards) == 0 {
855
- return false
856
- }
857
- for _, host := range hosts {
858
- for _, wildcard := range wildcards {
859
- if strings.HasPrefix(host, "*.") {
860
- continue
861
- }
862
- if certmagic.MatchWildcard(host, "*."+wildcard) {
863
- return true
864
- }
865
- }
866
- }
867
- return false
868
-}