caddytls: fix regression in external certificate manager support (#7179)

revert changes to automation.go from e276994174983dbb190d4bb9acaab157ef14373b

avery committed Aug 13, 2025 at 16:30 UTC b898873b90b5cb804400888ec2f2994f6a2dd270

1 file changed +6 -4

modules/caddytls/automation.go

+6 -4

@@ -173,6 +173,9 @@ type AutomationPolicy struct {

173 subjects []string

174 magic *certmagic.Config

175 storage certmagic.Storage

176 +

177 + // Whether this policy had explicit managers configured directly on it.

178 + hadExplicitManagers bool

179 }

180

181 // Provision sets up ap and builds its underlying CertMagic config.

@@ -209,9 +212,8 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {

212 // store them on the policy before putting it on the config

213

214 // load and provision any cert manager modules

212 - var hadExplicitManagers bool

215 if ap.ManagersRaw != nil {

214 - hadExplicitManagers = true

216 + ap.hadExplicitManagers = true

217 vals, err := tlsApp.ctx.LoadModule(ap, "ManagersRaw")

218 if err != nil {

219 return fmt.Errorf("loading external certificate manager modules: %v", err)

@@ -271,9 +273,9 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {

273 // prevent issuance from Issuers (when Managers don't provide a certificate) if there's no

274 // permission module configured

275 noProtections := ap.isWildcardOrDefault() && !ap.onlyInternalIssuer() && (tlsApp.Automation == nil || tlsApp.Automation.OnDemand == nil || tlsApp.Automation.OnDemand.permission == nil)

274 - failClosed := noProtections && !hadExplicitManagers // don't allow on-demand issuance (other than implicit managers) if no managers have been explicitly configured

276 + failClosed := noProtections && !ap.hadExplicitManagers // don't allow on-demand issuance (other than implicit managers) if no managers have been explicitly configured

277 if noProtections {

276 - if !hadExplicitManagers {

278 + if !ap.hadExplicitManagers {

279 // no managers, no explicitly-configured permission module, this is a config error

280 return fmt.Errorf("on-demand TLS cannot be enabled without a permission module to prevent abuse; please refer to documentation for details")

281 }