Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 21:45 UTC
caddytls: dns_challenge_override_domain for challenge delegation (#4596)
* Add a override_domain option to allow DNS chanllenge delegation CNAME can be used to delegate answering the chanllenge to another DNS zone. One usage is to reduce the exposure of the DNS credential [1]. Based on the discussion in caddy/certmagic#160, we are adding an option to allow the user explicitly specify the domain to delegate, instead of following the CNAME chain. This needs caddy/certmagic#160. * rename override_domain to dns_challenge_override_domain * Update CertMagic; fix spelling Co-authored-by: Matthew Holt <mholt@users.noreply.github.com>
Ran Chen committed
Mar 9, 2022 at 03:03 UTC
d9b1d463259a6f8f520edd6659dac11218c82b4e
5 files changed
+38
-3
caddyconfig/httpcaddyfile/builtins.go
+16
@@ -362,6 +362,22 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
362
}
363
acmeIssuer.Challenges.DNS.Resolvers = args
364
365
+ case "dns_challenge_override_domain":
366
+ arg := h.RemainingArgs()
367
+ if len(arg) != 1 {
368
+ return nil, h.ArgErr()
369
+ }
370
+ if acmeIssuer == nil {
371
+ acmeIssuer = new(caddytls.ACMEIssuer)
372
+ }
373
+ if acmeIssuer.Challenges == nil {
374
+ acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
375
+ }
376
+ if acmeIssuer.Challenges.DNS == nil {
377
+ acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
378
+ }
379
+ acmeIssuer.Challenges.DNS.OverrideDomain = arg[0]
380
+
381
case "ca_root":
382
arg := h.RemainingArgs()
383
if len(arg) != 1 {
go.mod
+1
-1
@@ -8,7 +8,7 @@ require (
8
github.com/Masterminds/sprig/v3 v3.2.2
9
github.com/alecthomas/chroma v0.10.0
10
github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b
11
- github.com/caddyserver/certmagic v0.15.4-0.20220217213750-797d29bcf32f
11
+ github.com/caddyserver/certmagic v0.15.4
12
github.com/dustin/go-humanize v1.0.1-0.20200219035652-afde56e7acac
13
github.com/fsnotify/fsnotify v1.5.1 // indirect
14
github.com/go-chi/chi v4.1.2+incompatible
go.sum
+2
-2
@@ -189,8 +189,8 @@ github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl
189
github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
190
github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
191
github.com/caarlos0/ctrlc v1.0.0/go.mod h1:CdXpj4rmq0q/1Eb44M9zi2nKB0QraNKuRGYGrrHhcQw=
192
-github.com/caddyserver/certmagic v0.15.4-0.20220217213750-797d29bcf32f h1:sdjilRh0dxXpofiwDSFU7itmxuXetKB6xWd+lNRVq9s=
193
-github.com/caddyserver/certmagic v0.15.4-0.20220217213750-797d29bcf32f/go.mod h1:qhkAOthf72ufAcp3Y5jF2RaGE96oip3UbEQRIzwe3/8=
192
+github.com/caddyserver/certmagic v0.15.4 h1:kz//9+Z/xw197jtIBxxUDub8pQi9gcYvhXk5Ouw2EkM=
193
+github.com/caddyserver/certmagic v0.15.4/go.mod h1:qhkAOthf72ufAcp3Y5jF2RaGE96oip3UbEQRIzwe3/8=
194
github.com/campoy/unique v0.0.0-20180121183637-88950e537e7e/go.mod h1:9IOqJGCPMSc6E5ydlp5NIonxObaeu/Iub/X03EKPVYo=
195
github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
196
github.com/cavaliercoder/go-cpio v0.0.0-20180626203310-925f9528c45e/go.mod h1:oDpT4efm8tSYHXV5tHSdRvBet/b/QzxZ+XyyPehvm3A=
modules/caddytls/acmeissuer.go
+14
@@ -144,6 +144,7 @@ func (iss *ACMEIssuer) Provision(ctx caddy.Context) error {
144
TTL: time.Duration(iss.Challenges.DNS.TTL),
145
PropagationTimeout: time.Duration(iss.Challenges.DNS.PropagationTimeout),
146
Resolvers: iss.Challenges.DNS.Resolvers,
147
+ OverrideDomain: iss.Challenges.DNS.OverrideDomain,
148
}
149
}
150
}
@@ -417,6 +418,19 @@ func (iss *ACMEIssuer) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
418
return d.ArgErr()
419
}
420
421
+ case "dns_challenge_override_domain":
422
+ arg := d.RemainingArgs()
423
+ if len(arg) != 1 {
424
+ return d.ArgErr()
425
+ }
426
+ if iss.Challenges == nil {
427
+ iss.Challenges = new(ChallengesConfig)
428
+ }
429
+ if iss.Challenges.DNS == nil {
430
+ iss.Challenges.DNS = new(DNSChallengeConfig)
431
+ }
432
+ iss.Challenges.DNS.OverrideDomain = arg[0]
433
+
434
case "preferred_chains":
435
chainPref, err := ParseCaddyfilePreferredChainsOptions(d)
436
if err != nil {
modules/caddytls/automation.go
+5
@@ -370,6 +370,11 @@ type DNSChallengeConfig struct {
370
// Often necessary to configure when using split-horizon DNS.
371
Resolvers []string `json:"resolvers,omitempty"`
372
373
+ // Override the domain to use for the DNS challenge. This
374
+ // is to delegate the challenge to a different domain,
375
+ // e.g. one that updates faster or one with a provider API.
376
+ OverrideDomain string `json:"override_domain,omitempty"`
377
+
378
solver acmez.Solver
379
}
380