From b3d35a4995c98cfadeb0c3a356025dbd3984caef Mon Sep 17 00:00:00 2001
From: Matthew Holt <mholt@users.noreply.github.com>
Date: Fri, 25 Jun 2021 11:28:32 -0600
Subject: httpcaddyfile: Don't put localhost in public APs (fix #4220)

If an email is specified in global options, a site called 'localhost' shouldn't be bunched together with public DNS names in the automation policies, which get the default, public-CA issuers. Fix old test that did this.

I also noticed that these two:

    localhost {
    }
    example.com {
    }

and

    localhost, example.com {
    }

produce slightly different TLS automation policies. The former is what the new test case covers, and we have logic that removes the empty automation policy for localhost so that auto-HTTPS can implicitly create one. (We prefer that whenever possible.) But the latter case produces two automation policies, with the second one being for localhost, with an explicit internal issuer. It's not wrong, just more explicit than it needs to be.

I'd really like to completely rewrite the code from scratch that generates automation policies, hopefully there is a simpler, more correct algorithm.
---
 .../global_options_preferred_chains.txt            |  6 +-
 ..._automation_policies_global_email_localhost.txt | 66 ++++++++++++++++++++++
 2 files changed, 69 insertions(+), 3 deletions(-)
 create mode 100644 caddytest/integration/caddyfile_adapt/tls_automation_policies_global_email_localhost.txt

(limited to 'caddytest/integration')

diff --git a/caddytest/integration/caddyfile_adapt/global_options_preferred_chains.txt b/caddytest/integration/caddyfile_adapt/global_options_preferred_chains.txt
index 893b34b..9173b26 100644
--- a/caddytest/integration/caddyfile_adapt/global_options_preferred_chains.txt
+++ b/caddytest/integration/caddyfile_adapt/global_options_preferred_chains.txt
@@ -2,7 +2,7 @@
 	preferred_chains smallest
 }
 
-localhost
+example.com
 ----------
 {
 	"apps": {
@@ -17,7 +17,7 @@ localhost
 							"match": [
 								{
 									"host": [
-										"localhost"
+										"example.com"
 									]
 								}
 							],
@@ -32,7 +32,7 @@ localhost
 				"policies": [
 					{
 						"subjects": [
-							"localhost"
+							"example.com"
 						],
 						"issuers": [
 							{
diff --git a/caddytest/integration/caddyfile_adapt/tls_automation_policies_global_email_localhost.txt b/caddytest/integration/caddyfile_adapt/tls_automation_policies_global_email_localhost.txt
new file mode 100644
index 0000000..e8ef3a7
--- /dev/null
+++ b/caddytest/integration/caddyfile_adapt/tls_automation_policies_global_email_localhost.txt
@@ -0,0 +1,66 @@
+{
+	email foo@bar
+}
+
+localhost {
+}
+
+example.com {
+}
+----------
+{
+	"apps": {
+		"http": {
+			"servers": {
+				"srv0": {
+					"listen": [
+						":443"
+					],
+					"routes": [
+						{
+							"match": [
+								{
+									"host": [
+										"example.com"
+									]
+								}
+							],
+							"terminal": true
+						},
+						{
+							"match": [
+								{
+									"host": [
+										"localhost"
+									]
+								}
+							],
+							"terminal": true
+						}
+					]
+				}
+			}
+		},
+		"tls": {
+			"automation": {
+				"policies": [
+					{
+						"subjects": [
+							"example.com"
+						],
+						"issuers": [
+							{
+								"email": "foo@bar",
+								"module": "acme"
+							},
+							{
+								"email": "foo@bar",
+								"module": "zerossl"
+							}
+						]
+					}
+				]
+			}
+		}
+	}
+}
\ No newline at end of file
-- 
cgit v1.2.3