Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 05:30 UTC
caddytls: Allow on-demand w/o ask for internal-only
Matthew Holt committed
Mar 14, 2023 at 10:29 UTC
a7af7c486e5240da974e02b7dfee9d265aaa654a
1 file changed
+42
-34
modules/caddytls/automation.go
+42
-34
@@ -165,40 +165,6 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
165
ap.storage = cmStorage
166
}
167
168
- // on-demand TLS
169
- var ond *certmagic.OnDemandConfig
170
- if ap.OnDemand {
171
- // ask endpoint is now required after a number of negligence cases causing abuse
172
- if tlsApp.Automation == nil || tlsApp.Automation.OnDemand == nil || tlsApp.Automation.OnDemand.Ask == "" {
173
- return fmt.Errorf("on-demand TLS cannot be enabled without an 'ask' endpoint to prevent abuse; please refer to documentation for details")
174
- }
175
- ond = &certmagic.OnDemandConfig{
176
- DecisionFunc: func(name string) error {
177
- if err := onDemandAskRequest(tlsApp.logger, tlsApp.Automation.OnDemand.Ask, name); err != nil {
178
- // distinguish true errors from denials, because it's important to elevate actual errors
179
- if errors.Is(err, errAskDenied) {
180
- tlsApp.logger.Debug("certificate issuance denied",
181
- zap.String("ask_endpoint", tlsApp.Automation.OnDemand.Ask),
182
- zap.String("domain", name),
183
- zap.Error(err))
184
- } else {
185
- tlsApp.logger.Error("request to 'ask' endpoint failed",
186
- zap.String("ask_endpoint", tlsApp.Automation.OnDemand.Ask),
187
- zap.String("domain", name),
188
- zap.Error(err))
189
- }
190
- return err
191
- }
192
- // check the rate limiter last because
193
- // doing so makes a reservation
194
- if !onDemandRateLimiter.Allow() {
195
- return fmt.Errorf("on-demand rate limit exceeded")
196
- }
197
- return nil
198
- },
199
- }
200
- }
201
-
168
// we don't store loaded modules directly in the certmagic config since
169
// policy provisioning may happen more than once (during auto-HTTPS) and
170
// loading a module clears its config bytes; thus, load the module and
@@ -255,6 +221,40 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
221
storage = tlsApp.ctx.Storage()
222
}
223
224
+ // on-demand TLS
225
+ var ond *certmagic.OnDemandConfig
226
+ if ap.OnDemand {
227
+ // ask endpoint is now required after a number of negligence cases causing abuse
228
+ if !ap.onlyInternalIssuer() && (tlsApp.Automation == nil || tlsApp.Automation.OnDemand == nil || tlsApp.Automation.OnDemand.Ask == "") {
229
+ return fmt.Errorf("on-demand TLS cannot be enabled without an 'ask' endpoint to prevent abuse; please refer to documentation for details")
230
+ }
231
+ ond = &certmagic.OnDemandConfig{
232
+ DecisionFunc: func(name string) error {
233
+ if err := onDemandAskRequest(tlsApp.logger, tlsApp.Automation.OnDemand.Ask, name); err != nil {
234
+ // distinguish true errors from denials, because it's important to elevate actual errors
235
+ if errors.Is(err, errAskDenied) {
236
+ tlsApp.logger.Debug("certificate issuance denied",
237
+ zap.String("ask_endpoint", tlsApp.Automation.OnDemand.Ask),
238
+ zap.String("domain", name),
239
+ zap.Error(err))
240
+ } else {
241
+ tlsApp.logger.Error("request to 'ask' endpoint failed",
242
+ zap.String("ask_endpoint", tlsApp.Automation.OnDemand.Ask),
243
+ zap.String("domain", name),
244
+ zap.Error(err))
245
+ }
246
+ return err
247
+ }
248
+ // check the rate limiter last because
249
+ // doing so makes a reservation
250
+ if !onDemandRateLimiter.Allow() {
251
+ return fmt.Errorf("on-demand rate limit exceeded")
252
+ }
253
+ return nil
254
+ },
255
+ }
256
+ }
257
+
258
template := certmagic.Config{
259
MustStaple: ap.MustStaple,
260
RenewalWindowRatio: ap.RenewalWindowRatio,
@@ -286,6 +286,14 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
286
return nil
287
}
288
289
+func (ap *AutomationPolicy) onlyInternalIssuer() bool {
290
+ if len(ap.Issuers) != 1 {
291
+ return false
292
+ }
293
+ _, ok := ap.Issuers[0].(*InternalIssuer)
294
+ return ok
295
+}
296
+
297
// DefaultIssuers returns empty Issuers (not provisioned) to be used as defaults.
298
// This function is experimental and has no compatibility promises.
299
func DefaultIssuers() []certmagic.Issuer {