Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 12, 13:15 UTC
caddytls: Add Caddyfile support for on-demand permission module (close #6260)
Matthew Holt committed
Apr 22, 2024 at 15:47 UTC
6a0299905479083f250c39d5780c305f82863273
3 files changed
+39
-8
caddyconfig/httpcaddyfile/options.go
+25
@@ -345,9 +345,34 @@ func parseOptOnDemand(d *caddyfile.Dispenser, _ any) (any, error) {
345
if ond == nil {
346
ond = new(caddytls.OnDemandConfig)
347
}
348
+ if ond.PermissionRaw != nil {
349
+ return nil, d.Err("on-demand TLS permission module (or 'ask') already specified")
350
+ }
351
perm := caddytls.PermissionByHTTP{Endpoint: d.Val()}
352
ond.PermissionRaw = caddyconfig.JSONModuleObject(perm, "module", "http", nil)
353
354
+ case "permission":
355
+ if !d.NextArg() {
356
+ return nil, d.ArgErr()
357
+ }
358
+ if ond == nil {
359
+ ond = new(caddytls.OnDemandConfig)
360
+ }
361
+ if ond.PermissionRaw != nil {
362
+ return nil, d.Err("on-demand TLS permission module (or 'ask') already specified")
363
+ }
364
+ modName := d.Val()
365
+ modID := "tls.permission." + modName
366
+ unm, err := caddyfile.UnmarshalModule(d, modID)
367
+ if err != nil {
368
+ return nil, err
369
+ }
370
+ perm, ok := unm.(caddytls.OnDemandPermission)
371
+ if !ok {
372
+ return nil, d.Errf("module %s (%T) is not an on-demand TLS permission module", modID, unm)
373
+ }
374
+ ond.PermissionRaw = caddyconfig.JSONModuleObject(perm, "module", modName, nil)
375
+
376
case "interval":
377
if !d.NextArg() {
378
return nil, d.ArgErr()
caddyconfig/httploader.go
+2
-8
@@ -181,19 +181,13 @@ func (hl HTTPLoader) makeClient(ctx caddy.Context) (*http.Client, error) {
181
if err != nil {
182
return nil, fmt.Errorf("getting server identity credentials: %v", err)
183
}
184
- if tlsConfig == nil {
185
- tlsConfig = new(tls.Config)
186
- }
187
- tlsConfig.Certificates = certs
184
+ tlsConfig = &tls.Config{Certificates: certs}
185
} else if hl.TLS.ClientCertificateFile != "" && hl.TLS.ClientCertificateKeyFile != "" {
186
cert, err := tls.LoadX509KeyPair(hl.TLS.ClientCertificateFile, hl.TLS.ClientCertificateKeyFile)
187
if err != nil {
188
return nil, err
189
}
193
- if tlsConfig == nil {
194
- tlsConfig = new(tls.Config)
195
- }
196
- tlsConfig.Certificates = []tls.Certificate{cert}
190
+ tlsConfig = &tls.Config{Certificates: []tls.Certificate{cert}}
191
}
192
193
// trusted server certs
modules/caddytls/ondemand.go
+12
@@ -28,6 +28,7 @@ import (
28
"go.uber.org/zap"
29
30
"github.com/caddyserver/caddy/v2"
31
+ "github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
32
)
33
34
func init() {
@@ -117,6 +118,17 @@ func (PermissionByHTTP) CaddyModule() caddy.ModuleInfo {
118
}
119
}
120
121
+// UnmarshalCaddyfile implements caddyfile.Unmarshaler.
122
+func (p *PermissionByHTTP) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
123
+ if !d.Next() {
124
+ return nil
125
+ }
126
+ if !d.AllArgs(&p.Endpoint) {
127
+ return d.ArgErr()
128
+ }
129
+ return nil
130
+}
131
+
132
func (p *PermissionByHTTP) Provision(ctx caddy.Context) error {
133
p.logger = ctx.Logger()
134
p.replacer = caddy.NewReplacer()