Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
caddytls: Don't initialize default internal issuer unless necessary
Otherwise, a password prompt can occur unnecessarily.
Matthew Holt committed
Apr 9, 2020 at 13:09 UTC
85f5f47f31f09f8dda6f6ab77749edddb17551a1
3 files changed
+37
-29
modules/caddyhttp/autohttps.go
+1
-1
@@ -339,7 +339,7 @@ uniqueDomainsLoop:
339
}
340
redirTo += "{http.request.uri}"
341
routes = append(routes, Route{
342
- MatcherSets: []MatcherSet{MatcherSet{MatchProtocol("http")}},
342
+ MatcherSets: []MatcherSet{{MatchProtocol("http")}},
343
Handlers: []MiddlewareHandler{
344
StaticResponse{
345
StatusCode: WeakString(strconv.Itoa(http.StatusPermanentRedirect)),
modules/caddytls/automation.go
+1
-1
@@ -54,7 +54,7 @@ type AutomationConfig struct {
54
RenewCheckInterval caddy.Duration `json:"renew_interval,omitempty"`
55
56
defaultPublicAutomationPolicy *AutomationPolicy
57
- defaultInternalAutomationPolicy *AutomationPolicy
57
+ defaultInternalAutomationPolicy *AutomationPolicy // only initialized if necessary
58
}
59
60
// AutomationPolicy designates the policy for automating the
modules/caddytls/tls.go
+35
-27
@@ -89,29 +89,6 @@ func (t *TLS) Provision(ctx caddy.Context) error {
89
}
90
t.certCache = certmagic.NewCache(cacheOpts)
91
92
- // automation/management policies
93
- if t.Automation == nil {
94
- t.Automation = new(AutomationConfig)
95
- }
96
- t.Automation.defaultPublicAutomationPolicy = new(AutomationPolicy)
97
- err := t.Automation.defaultPublicAutomationPolicy.Provision(t)
98
- if err != nil {
99
- return fmt.Errorf("provisioning default public automation policy: %v", err)
100
- }
101
- t.Automation.defaultInternalAutomationPolicy = &AutomationPolicy{
102
- IssuerRaw: json.RawMessage(`{"module":"internal"}`),
103
- }
104
- err = t.Automation.defaultInternalAutomationPolicy.Provision(t)
105
- if err != nil {
106
- return fmt.Errorf("provisioning default internal automation policy: %v", err)
107
- }
108
- for i, ap := range t.Automation.Policies {
109
- err := ap.Provision(t)
110
- if err != nil {
111
- return fmt.Errorf("provisioning automation policy %d: %v", i, err)
112
- }
113
- }
114
-
92
// certificate loaders
93
val, err := ctx.LoadModule(t, "CertificatesRaw")
94
if err != nil {
@@ -119,9 +96,8 @@ func (t *TLS) Provision(ctx caddy.Context) error {
96
}
97
for modName, modIface := range val.(map[string]interface{}) {
98
if modName == "automate" {
122
- // special case; these will be loaded in later
123
- // using our automation facilities, which we
124
- // want to avoid during provisioning
99
+ // special case; these will be loaded in later using our automation facilities,
100
+ // which we want to avoid doing during provisioning
101
if automateNames, ok := modIface.(*AutomateLoader); ok && automateNames != nil {
102
t.automateNames = []string(*automateNames)
103
} else {
@@ -132,6 +108,38 @@ func (t *TLS) Provision(ctx caddy.Context) error {
108
t.certificateLoaders = append(t.certificateLoaders, modIface.(CertificateLoader))
109
}
110
111
+ // automation/management policies
112
+ if t.Automation == nil {
113
+ t.Automation = new(AutomationConfig)
114
+ }
115
+ t.Automation.defaultPublicAutomationPolicy = new(AutomationPolicy)
116
+ err = t.Automation.defaultPublicAutomationPolicy.Provision(t)
117
+ if err != nil {
118
+ return fmt.Errorf("provisioning default public automation policy: %v", err)
119
+ }
120
+ for _, n := range t.automateNames {
121
+ // if any names specified by the "automate" loader do not qualify for a public
122
+ // certificate, we should initialize a default internal automation policy
123
+ // (but we don't want to do this unnecessarily, since it may prompt for password!)
124
+ if certmagic.SubjectQualifiesForPublicCert(n) {
125
+ continue
126
+ }
127
+ t.Automation.defaultInternalAutomationPolicy = &AutomationPolicy{
128
+ IssuerRaw: json.RawMessage(`{"module":"internal"}`),
129
+ }
130
+ err = t.Automation.defaultInternalAutomationPolicy.Provision(t)
131
+ if err != nil {
132
+ return fmt.Errorf("provisioning default internal automation policy: %v", err)
133
+ }
134
+ break
135
+ }
136
+ for i, ap := range t.Automation.Policies {
137
+ err := ap.Provision(t)
138
+ if err != nil {
139
+ return fmt.Errorf("provisioning automation policy %d: %v", i, err)
140
+ }
141
+ }
142
+
143
// session ticket ephemeral keys (STEK) service and provider
144
if t.SessionTickets != nil {
145
err := t.SessionTickets.provision(ctx)
@@ -340,7 +348,7 @@ func (t *TLS) getAutomationPolicyForName(name string) *AutomationPolicy {
348
}
349
}
350
}
343
- if certmagic.SubjectQualifiesForPublicCert(name) {
351
+ if certmagic.SubjectQualifiesForPublicCert(name) || t.Automation.defaultInternalAutomationPolicy == nil {
352
return t.Automation.defaultPublicAutomationPolicy
353
}
354
return t.Automation.defaultInternalAutomationPolicy