Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 18:00 UTC
Fix #4822 and fix #4779
The fix for 4822 is the change at the top of the file, and 4779's fix is toward the bottom of the file.
Matthew Holt committed
Jun 1, 2022 at 15:12 UTC
886ba84baa4f7ed7502034893e084193dd12f9f7
2 files changed
+20
-9
caddyconfig/httpcaddyfile/tlsapp.go
-1
@@ -350,7 +350,6 @@ func (st ServerType) buildTLSApp(
350
globalPreferredChains := options["preferred_chains"]
351
hasGlobalACMEDefaults := globalEmail != nil || globalACMECA != nil || globalACMECARoot != nil || globalACMEDNS != nil || globalACMEEAB != nil || globalPreferredChains != nil
352
if hasGlobalACMEDefaults {
353
- // for _, ap := range tlsApp.Automation.Policies {
353
for i := 0; i < len(tlsApp.Automation.Policies); i++ {
354
ap := tlsApp.Automation.Policies[i]
355
if len(ap.Issuers) == 0 && automationPolicyHasAllPublicNames(ap) {
modules/caddyhttp/autohttps.go
+20
-8
@@ -152,9 +152,7 @@ func (app *App) automaticHTTPSPhase1(ctx caddy.Context, repl *caddy.Replacer) er
152
return fmt.Errorf("%s: route %d, matcher set %d, matcher %d, host matcher %d: %v",
153
srvName, routeIdx, matcherSetIdx, matcherIdx, hostMatcherIdx, err)
154
}
155
- // only include domain if it's not explicitly skipped and it's not a Tailscale domain
156
- // (the implicit Tailscale manager module will get those certs at run-time)
157
- if !srv.AutoHTTPS.Skipped(d, srv.AutoHTTPS.Skip) && !isTailscaleDomain(d) {
155
+ if !srv.AutoHTTPS.Skipped(d, srv.AutoHTTPS.Skip) {
156
serverDomainSet[d] = struct{}{}
157
}
158
}
@@ -181,6 +179,11 @@ func (app *App) automaticHTTPSPhase1(ctx caddy.Context, repl *caddy.Replacer) er
179
app.logger.Warn("skipping automated certificate management for server because it is disabled", zap.String("server_name", srvName))
180
} else {
181
for d := range serverDomainSet {
182
+ // the implicit Tailscale manager module will get its own certs at run-time
183
+ if isTailscaleDomain(d) {
184
+ continue
185
+ }
186
+
187
if certmagic.SubjectQualifiesForCert(d) &&
188
!srv.AutoHTTPS.Skipped(d, srv.AutoHTTPS.SkipCerts) {
189
// if a certificate for this name is already loaded,
@@ -436,7 +439,7 @@ func (app *App) makeRedirRoute(redirToPort uint, matcherSet MatcherSet) Route {
439
}
440
}
441
439
-// createAutomationPolicy ensures that automated certificates for this
442
+// createAutomationPolicies ensures that automated certificates for this
443
// app are managed properly. This adds up to two automation policies:
444
// one for the public names, and one for the internal names. If a catch-all
445
// automation policy exists, it will be shallow-copied and used as the
@@ -485,6 +488,12 @@ func (app *App) createAutomationPolicies(ctx caddy.Context, internalNames []stri
488
return err
489
}
490
ap.Managers = []certmagic.Manager{ts}
491
+
492
+ // must reprovision the automation policy so that the underlying
493
+ // CertMagic config knows about the updated Managers
494
+ if err := ap.Provision(app.tlsApp); err != nil {
495
+ return fmt.Errorf("re-provisioning automation policy: %v", err)
496
+ }
497
}
498
499
// while we're here, is this the catch-all/base policy?
@@ -495,14 +504,17 @@ func (app *App) createAutomationPolicies(ctx caddy.Context, internalNames []stri
504
}
505
506
if basePolicy == nil {
498
- // no base policy found, we will make one! (with implicit Tailscale integration)
507
+ // no base policy found; we will make one
508
+ basePolicy = new(caddytls.AutomationPolicy)
509
+ }
510
+
511
+ if basePolicy.Managers == nil {
512
+ // add implicit Tailscale integration, for harmless convenience
513
ts, err := implicitTailscale(ctx)
514
if err != nil {
515
return err
516
}
503
- basePolicy = &caddytls.AutomationPolicy{
504
- Managers: []certmagic.Manager{ts},
505
- }
517
+ basePolicy.Managers = []certmagic.Manager{ts}
518
}
519
520
// if the basePolicy has an existing ACMEIssuer (particularly to