Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
caddytls: Adjust DNS challenge structure; clarify some docs
Matthew Holt committed
Apr 30, 2020 at 16:15 UTC
a1796c2f147e6a3d395e015600b51b67136292eb
4 files changed
+41
-15
caddyconfig/httpcaddyfile/builtins.go
+2
-1
@@ -211,12 +211,13 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
211
provName := h.Val()
212
if acmeIssuer.Challenges == nil {
213
acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
214
+ acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
215
}
216
dnsProvModule, err := caddy.GetModule("tls.dns." + provName)
217
if err != nil {
218
return nil, h.Errf("getting DNS provider module named '%s': %v", provName, err)
219
}
219
- acmeIssuer.Challenges.DNSRaw = caddyconfig.JSONModuleObject(dnsProvModule.New(), "provider", provName, h.warnings)
220
+ acmeIssuer.Challenges.DNS.ProviderRaw = caddyconfig.JSONModuleObject(dnsProvModule.New(), "name", provName, h.warnings)
221
222
case "ca_root":
223
arg := h.RemainingArgs()
caddyconfig/httpcaddyfile/tlsapp.go
+3
-1
@@ -388,7 +388,9 @@ func newBaseAutomationPolicy(options map[string]interface{}, warnings []caddycon
388
return nil, fmt.Errorf("getting DNS provider module named '%s': %v", provName, err)
389
}
390
mgr.Challenges = &caddytls.ChallengesConfig{
391
- DNSRaw: caddyconfig.JSONModuleObject(dnsProvModule.New(), "provider", provName, &warnings),
391
+ DNS: &caddytls.DNSChallengeConfig{
392
+ ProviderRaw: caddyconfig.JSONModuleObject(dnsProvModule.New(), "name", provName, &warnings),
393
+ },
394
}
395
}
396
if acmeCARoot != nil {
modules/caddytls/acmeissuer.go
+6
-4
@@ -86,8 +86,8 @@ func (ACMEIssuer) CaddyModule() caddy.ModuleInfo {
86
// Provision sets up m.
87
func (m *ACMEIssuer) Provision(ctx caddy.Context) error {
88
// DNS providers
89
- if m.Challenges != nil && m.Challenges.DNSRaw != nil {
90
- val, err := ctx.LoadModule(m.Challenges, "DNSRaw")
89
+ if m.Challenges != nil && m.Challenges.DNS != nil && m.Challenges.DNS.ProviderRaw != nil {
90
+ val, err := ctx.LoadModule(m.Challenges.DNS, "ProviderRaw")
91
if err != nil {
92
return fmt.Errorf("loading DNS provider module: %v", err)
93
}
@@ -95,7 +95,7 @@ func (m *ACMEIssuer) Provision(ctx caddy.Context) error {
95
if err != nil {
96
return fmt.Errorf("making DNS provider: %v", err)
97
}
98
- m.Challenges.DNS = prov
98
+ m.Challenges.DNS.provider = prov
99
}
100
101
// add any custom CAs to trust store
@@ -152,7 +152,9 @@ func (m *ACMEIssuer) makeIssuerTemplate() (certmagic.ACMEManager, error) {
152
template.DisableTLSALPNChallenge = m.Challenges.TLSALPN.Disabled
153
template.AltTLSALPNPort = m.Challenges.TLSALPN.AlternatePort
154
}
155
- template.DNSProvider = m.Challenges.DNS
155
+ if m.Challenges.DNS != nil {
156
+ template.DNSProvider = m.Challenges.DNS.provider
157
+ }
158
template.ListenHost = m.Challenges.BindHost
159
}
160
modules/caddytls/automation.go
+30
-9
@@ -35,8 +35,15 @@ type AutomationConfig struct {
35
36
// On-Demand TLS defers certificate operations to the
37
// moment they are needed, e.g. during a TLS handshake.
38
- // Useful when you don't know all the hostnames up front.
39
- // Caddy was the first web server to deploy this technology.
38
+ // Useful when you don't know all the hostnames at
39
+ // config-time, or when you are not in control of the
40
+ // domain names you are managing certificates for.
41
+ // In 2015, Caddy became the first web server to
42
+ // implement this experimental technology.
43
+ //
44
+ // Note that this field does not enable on-demand TLS,
45
+ // it only configures it for when it is used. To enable
46
+ // it, create an automation policy with `on_demand`.
47
OnDemand *OnDemandConfig `json:"on_demand,omitempty"`
48
49
// Caddy staples OCSP (and caches the response) for all
@@ -239,13 +246,14 @@ type ChallengesConfig struct {
246
// not enabled by default. This is the only challenge
247
// type which does not require a direct connection
248
// to Caddy from an external server.
242
- DNSRaw json.RawMessage `json:"dns,omitempty" caddy:"namespace=tls.dns inline_key=provider"`
249
+ // NOTE: DNS providers are currently being upgraded,
250
+ // and this API is subject to change, but should be
251
+ // stabilized soon.
252
+ DNS *DNSChallengeConfig `json:"dns,omitempty"`
253
254
// Optionally customize the host to which a listener
255
// is bound if required for solving a challenge.
256
BindHost string `json:"bind_host,omitempty"`
247
-
248
- DNS challenge.Provider `json:"-"`
257
}
258
259
// HTTPChallengeConfig configures the ACME HTTP challenge.
@@ -274,12 +282,25 @@ type TLSALPNChallengeConfig struct {
282
AlternatePort int `json:"alternate_port,omitempty"`
283
}
284
285
+// DNSChallengeConfig configures the ACME DNS challenge.
286
+// NOTE: This API is still experimental and is subject to change.
287
+type DNSChallengeConfig struct {
288
+ // The DNS provider module to use which will manage
289
+ // the DNS records relevant to the ACME challenge.
290
+ ProviderRaw json.RawMessage `json:"provider,omitempty" caddy:"namespace=tls.dns inline_key=name"`
291
+
292
+ // The TTL of the TXT record used for the DNS challenge.
293
+ TTL caddy.Duration `json:"ttl,omitempty"`
294
+
295
+ provider challenge.Provider
296
+}
297
+
298
// OnDemandConfig configures on-demand TLS, for obtaining
299
// needed certificates at handshake-time. Because this
279
-// feature can easily be abused, you should set up rate
280
-// limits and/or an internal endpoint that Caddy can
281
-// "ask" if it should be allowed to manage certificates
282
-// for a given hostname.
300
+// feature can easily be abused, you should use this to
301
+// establish rate limits and/or an internal endpoint that
302
+// Caddy can "ask" if it should be allowed to manage
303
+// certificates for a given hostname.
304
type OnDemandConfig struct {
305
// An optional rate limit to throttle the
306
// issuance of certificates from handshakes.