Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
httpcaddyfile: New `acme_eab` option (#3492)
* Adds global options for external account bindings * Maybe other people use ctags too? * Use nested block to configure external account * go format files * Restore acme_ca directive in test file * Change Caddyfile config syntax for acme_eab * Update test Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
Chris Ortman committed
Jun 12, 2020 at 14:37 UTC
d84a5d84278686d7400b3754b0422f85f5541326
5 files changed
+125
-5
.gitignore
+1
-1
@@ -20,4 +20,4 @@ vendor
20
# goreleaser artifacts
21
dist
22
caddy-build
23
-caddy-dist
\ No newline at end of file
23
+caddy-dist
caddyconfig/httpcaddyfile/options.go
+30
-1
@@ -31,8 +31,9 @@ func init() {
31
RegisterGlobalOption("experimental_http3", parseOptTrue)
32
RegisterGlobalOption("storage", parseOptStorage)
33
RegisterGlobalOption("acme_ca", parseOptSingleString)
34
- RegisterGlobalOption("acme_dns", parseOptSingleString)
34
RegisterGlobalOption("acme_ca_root", parseOptSingleString)
35
+ RegisterGlobalOption("acme_dns", parseOptSingleString)
36
+ RegisterGlobalOption("acme_eab", parseOptACMEEAB)
37
RegisterGlobalOption("email", parseOptSingleString)
38
RegisterGlobalOption("admin", parseOptAdmin)
39
RegisterGlobalOption("on_demand_tls", parseOptOnDemand)
@@ -180,6 +181,34 @@ func parseOptStorage(d *caddyfile.Dispenser) (interface{}, error) {
181
return storage, nil
182
}
183
184
+func parseOptACMEEAB(d *caddyfile.Dispenser) (interface{}, error) {
185
+ eab := new(caddytls.ExternalAccountBinding)
186
+ for d.Next() {
187
+ if d.NextArg() {
188
+ return nil, d.ArgErr()
189
+ }
190
+ for nesting := d.Nesting(); d.NextBlock(nesting); {
191
+ switch d.Val() {
192
+ case "key_id":
193
+ if !d.NextArg() {
194
+ return nil, d.ArgErr()
195
+ }
196
+ eab.KeyID = d.Val()
197
+
198
+ case "hmac":
199
+ if !d.NextArg() {
200
+ return nil, d.ArgErr()
201
+ }
202
+ eab.HMAC = d.Val()
203
+
204
+ default:
205
+ return nil, d.Errf("unrecognized parameter '%s'", d.Val())
206
+ }
207
+ }
208
+ }
209
+ return eab, nil
210
+}
211
+
212
func parseOptSingleString(d *caddyfile.Dispenser) (interface{}, error) {
213
d.Next() // consume parameter name
214
if !d.Next() {
caddyconfig/httpcaddyfile/tlsapp.go
+7
-2
@@ -348,13 +348,15 @@ func (st ServerType) buildTLSApp(
348
// true, a non-nil value will always be returned (unless there is an error).
349
func newBaseAutomationPolicy(options map[string]interface{}, warnings []caddyconfig.Warning, always bool) (*caddytls.AutomationPolicy, error) {
350
acmeCA, hasACMECA := options["acme_ca"]
351
- acmeDNS, hasACMEDNS := options["acme_dns"]
351
acmeCARoot, hasACMECARoot := options["acme_ca_root"]
352
+ acmeDNS, hasACMEDNS := options["acme_dns"]
353
+ acmeEAB, hasACMEEAB := options["acme_eab"]
354
+
355
email, hasEmail := options["email"]
356
localCerts, hasLocalCerts := options["local_certs"]
357
keyType, hasKeyType := options["key_type"]
358
357
- hasGlobalAutomationOpts := hasACMECA || hasACMEDNS || hasACMECARoot || hasEmail || hasLocalCerts || hasKeyType
359
+ hasGlobalAutomationOpts := hasACMECA || hasACMECARoot || hasACMEDNS || hasACMEEAB || hasEmail || hasLocalCerts || hasKeyType
360
361
// if there are no global options related to automation policies
362
// set, then we can just return right away
@@ -396,6 +398,9 @@ func newBaseAutomationPolicy(options map[string]interface{}, warnings []caddycon
398
if acmeCARoot != nil {
399
mgr.TrustedRootsPEMFiles = []string{acmeCARoot.(string)}
400
}
401
+ if acmeEAB != nil {
402
+ mgr.ExternalAccount = acmeEAB.(*caddytls.ExternalAccountBinding)
403
+ }
404
if keyType != nil {
405
ap.KeyType = keyType.(string)
406
}
caddytest/integration/caddyfile_adapt/global_options.txt
+2
-1
@@ -9,6 +9,7 @@
9
}
10
acme_ca https://example.com
11
acme_ca_root /path/to/ca.crt
12
+
13
email test@example.com
14
admin off
15
on_demand_tls {
@@ -68,4 +69,4 @@
69
}
70
}
71
}
71
-}
\ No newline at end of file
72
+}
caddytest/integration/caddyfile_adapt/global_options_acme.txt
new
+85
@@ -0,0 +1,85 @@
1
+{
2
+ debug
3
+ http_port 8080
4
+ https_port 8443
5
+ default_sni localhost
6
+ order root first
7
+ storage file_system {
8
+ root /data
9
+ }
10
+ acme_ca https://example.com
11
+ acme_eab {
12
+ key_id 4K2scIVbBpNd-78scadB2g
13
+ hmac abcdefghijklmnopqrstuvwx-abcdefghijklnopqrstuvwxyz12ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh
14
+ }
15
+ acme_ca_root /path/to/ca.crt
16
+ email test@example.com
17
+ admin off
18
+ on_demand_tls {
19
+ ask https://example.com
20
+ interval 30s
21
+ burst 20
22
+ }
23
+
24
+ key_type ed25519
25
+}
26
+
27
+:80
28
+----------
29
+{
30
+ "admin": {
31
+ "disabled": true
32
+ },
33
+ "logging": {
34
+ "logs": {
35
+ "default": {
36
+ "level": "DEBUG"
37
+ }
38
+ }
39
+ },
40
+ "storage": {
41
+ "module": "file_system",
42
+ "root": "/data"
43
+ },
44
+ "apps": {
45
+ "http": {
46
+ "http_port": 8080,
47
+ "https_port": 8443,
48
+ "servers": {
49
+ "srv0": {
50
+ "listen": [
51
+ ":80"
52
+ ]
53
+ }
54
+ }
55
+ },
56
+ "tls": {
57
+ "automation": {
58
+ "policies": [
59
+ {
60
+ "issuer": {
61
+ "ca": "https://example.com",
62
+ "email": "test@example.com",
63
+ "external_account": {
64
+ "hmac": "abcdefghijklmnopqrstuvwx-abcdefghijklnopqrstuvwxyz12ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefgh",
65
+ "key_id": "4K2scIVbBpNd-78scadB2g"
66
+ },
67
+ "module": "acme",
68
+ "trusted_roots_pem_files": [
69
+ "/path/to/ca.crt"
70
+ ]
71
+ },
72
+ "key_type": "ed25519"
73
+ }
74
+ ],
75
+ "on_demand": {
76
+ "rate_limit": {
77
+ "interval": 30000000000,
78
+ "burst": 20
79
+ },
80
+ "ask": "https://example.com"
81
+ }
82
+ }
83
+ }
84
+ }
85
+}