caddyhttp: Don't attempt to manage Tailscale certs

If .ts.net domains are explicitly added to config, don't try to manage a cert for them (it will fail, and our implicit Tailscale module will get those certs at run-time).

Matthew Holt committed Mar 2, 2022 at 13:42 UTC 6b385a36f9750b7a66300bbb2167ea5a4d26a61f

1 file changed +7 -1

modules/caddyhttp/autohttps.go

+7 -1

@@ -152,7 +152,9 @@ func (app *App) automaticHTTPSPhase1(ctx caddy.Context, repl *caddy.Replacer) er

152 return fmt.Errorf("%s: route %d, matcher set %d, matcher %d, host matcher %d: %v",

153 srvName, routeIdx, matcherSetIdx, matcherIdx, hostMatcherIdx, err)

154 }

155 - if !srv.AutoHTTPS.Skipped(d, srv.AutoHTTPS.Skip) {

155 + // only include domain if it's not explicitly skipped and it's not a Tailscale domain

156 + // (the implicit Tailscale manager module will get those certs at run-time)

157 + if !srv.AutoHTTPS.Skipped(d, srv.AutoHTTPS.Skip) && !isTailscaleDomain(d) {

158 serverDomainSet[d] = struct{}{}

159 }

160 }

@@ -688,4 +690,8 @@ func implicitTailscale(ctx caddy.Context) (caddytls.Tailscale, error) {

690 return ts, err

691 }

692

693 +func isTailscaleDomain(name string) bool {

694 + return strings.HasSuffix(strings.ToLower(name), ".ts.net")

695 +}

696 +

697 type acmeCapable interface{ GetACMEIssuer() *caddytls.ACMEIssuer }