Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 18:00 UTC
reverseproxy: Add --internal-certs CLI flag #3589 (#4817)
added flag --internal-certs when set, for non-local domains the internal CA will be used for cert generation
Alexander M committed
May 29, 2022 at 23:33 UTC
a9267791c4b34b06cfb71d7cf8bee203545a3677
1 file changed
+20
-4
modules/caddyhttp/reverseproxy/command.go
+20
-4
@@ -27,6 +27,7 @@ import (
27
caddycmd "github.com/caddyserver/caddy/v2/cmd"
28
"github.com/caddyserver/caddy/v2/modules/caddyhttp"
29
"github.com/caddyserver/caddy/v2/modules/caddyhttp/headers"
30
+ "github.com/caddyserver/caddy/v2/modules/caddytls"
31
)
32
33
func init() {
@@ -59,6 +60,7 @@ default, all incoming headers are passed through unmodified.)
60
fs.String("to", "", "Upstream address to which traffic should be sent")
61
fs.Bool("change-host-header", false, "Set upstream Host header to address of upstream")
62
fs.Bool("insecure", false, "Disable TLS verification (WARNING: DISABLES SECURITY BY NOT VERIFYING SSL CERTIFICATES!)")
63
+ fs.Bool("internal-certs", false, "Use internal CA for issuing certs")
64
return fs
65
}(),
66
})
@@ -71,6 +73,7 @@ func cmdReverseProxy(fs caddycmd.Flags) (int, error) {
73
to := fs.String("to")
74
changeHost := fs.Bool("change-host-header")
75
insecure := fs.Bool("insecure")
76
+ internalCerts := fs.Bool("internal-certs")
77
78
httpPort := strconv.Itoa(caddyhttp.DefaultHTTPPort)
79
httpsPort := strconv.Itoa(caddyhttp.DefaultHTTPSPort)
@@ -154,11 +157,24 @@ func cmdReverseProxy(fs caddycmd.Flags) (int, error) {
157
Servers: map[string]*caddyhttp.Server{"proxy": server},
158
}
159
160
+ appsRaw := caddy.ModuleMap{
161
+ "http": caddyconfig.JSON(httpApp, nil),
162
+ }
163
+ if internalCerts && fromAddr.Host != "" {
164
+ tlsApp := caddytls.TLS{
165
+ Automation: &caddytls.AutomationConfig{
166
+ Policies: []*caddytls.AutomationPolicy{{
167
+ Subjects: []string{fromAddr.Host},
168
+ IssuersRaw: []json.RawMessage{json.RawMessage(`{"module":"internal"}`)},
169
+ }},
170
+ },
171
+ }
172
+ appsRaw["tls"] = caddyconfig.JSON(tlsApp, nil)
173
+ }
174
+
175
cfg := &caddy.Config{
158
- Admin: &caddy.AdminConfig{Disabled: true},
159
- AppsRaw: caddy.ModuleMap{
160
- "http": caddyconfig.JSON(httpApp, nil),
161
- },
176
+ Admin: &caddy.AdminConfig{Disabled: true},
177
+ AppsRaw: appsRaw,
178
}
179
180
err = caddy.Run(cfg)