Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 12:15 UTC
caddytls: Expand ACME credentials (#7554)
* caddytls: Expand ACME credentials This allows using global placeholders such as {file./run/secrets/key_id} when setting up the tls configuration. * chore(formatting): gofmt on acmeissuer_test
Felix Eckhofer committed
May 2, 2026 at 23:13 UTC
ef496e58ef9e7844cf8f1831030713ee5e9b354b
2 files changed
+79
modules/caddytls/acmeissuer.go
+36
@@ -140,6 +140,42 @@ func (iss *ACMEIssuer) Provision(ctx caddy.Context) error {
140
iss.Email = email
141
}
142
143
+ // expand CA endpoint, if non-empty
144
+ if iss.CA != "" {
145
+ ca, err := repl.ReplaceOrErr(iss.CA, true, true)
146
+ if err != nil {
147
+ return fmt.Errorf("expanding CA endpoint '%s': %v", iss.CA, err)
148
+ }
149
+ iss.CA = ca
150
+ }
151
+
152
+ // expand TestCA endpoint, if non-empty
153
+ if iss.TestCA != "" {
154
+ testca, err := repl.ReplaceOrErr(iss.TestCA, true, true)
155
+ if err != nil {
156
+ return fmt.Errorf("expanding TestCA endpoint '%s': %v", iss.TestCA, err)
157
+ }
158
+ iss.TestCA = testca
159
+ }
160
+
161
+ // expand EAB credentials, if non-empty
162
+ if iss.ExternalAccount != nil {
163
+ if iss.ExternalAccount.KeyID != "" {
164
+ keyID, err := repl.ReplaceOrErr(iss.ExternalAccount.KeyID, true, true)
165
+ if err != nil {
166
+ return fmt.Errorf("expanding EAB key ID '%s': %v", iss.ExternalAccount.KeyID, err)
167
+ }
168
+ iss.ExternalAccount.KeyID = keyID
169
+ }
170
+ if iss.ExternalAccount.MACKey != "" {
171
+ macKey, err := repl.ReplaceOrErr(iss.ExternalAccount.MACKey, true, true)
172
+ if err != nil {
173
+ return fmt.Errorf("expanding EAB MAC key (redacted): %v", err)
174
+ }
175
+ iss.ExternalAccount.MACKey = macKey
176
+ }
177
+ }
178
+
179
// expand account key, if non-empty
180
if iss.AccountKey != "" {
181
accountKey, err := repl.ReplaceOrErr(iss.AccountKey, true, true)
modules/caddytls/acmeissuer_test.go
new
+43
@@ -0,0 +1,43 @@
1
+package caddytls
2
+
3
+import (
4
+ "github.com/caddyserver/caddy/v2"
5
+ "github.com/mholt/acmez/v3/acme"
6
+ "testing"
7
+)
8
+
9
+func TestACMEIssuerExpandPlaceholders(t *testing.T) {
10
+ t.Setenv("CADDY_TEST_CA_URL", "https://acme.example.com/directory")
11
+ t.Setenv("CADDY_TEST_TEST_CA_URL", "https://acme2.example.com/directory")
12
+ t.Setenv("CADDY_TEST_EAB_KEY_ID", "example-key-id")
13
+ t.Setenv("CADDY_TEST_EAB_MAC_KEY", "example-mac-key")
14
+
15
+ caddyCtx, cancel := caddy.NewContext(caddy.Context{Context: t.Context()})
16
+ defer cancel()
17
+
18
+ iss := &ACMEIssuer{
19
+ CA: "{env.CADDY_TEST_CA_URL}",
20
+ TestCA: "{env.CADDY_TEST_TEST_CA_URL}",
21
+ ExternalAccount: &acme.EAB{
22
+ KeyID: "{env.CADDY_TEST_EAB_KEY_ID}",
23
+ MACKey: "{env.CADDY_TEST_EAB_MAC_KEY}",
24
+ },
25
+ }
26
+
27
+ if err := iss.Provision(caddyCtx); err != nil {
28
+ t.Fatalf("Provision() returned unexpected error: %v", err)
29
+ }
30
+
31
+ if want := "https://acme.example.com/directory"; iss.CA != want {
32
+ t.Errorf("CA: got %q, want %q", iss.CA, want)
33
+ }
34
+ if want := "https://acme2.example.com/directory"; iss.TestCA != want {
35
+ t.Errorf("TestCA: got %q, want %q", iss.TestCA, want)
36
+ }
37
+ if want := "example-key-id"; iss.ExternalAccount.KeyID != want {
38
+ t.Errorf("ExternalAccount.KeyID: got %q, want %q", iss.ExternalAccount.KeyID, want)
39
+ }
40
+ if want := "example-mac-key"; iss.ExternalAccount.MACKey != want {
41
+ t.Errorf("ExternalAccount.MACKey: got %q, want %q", iss.ExternalAccount.MACKey, want)
42
+ }
43
+}