From 2b33d9a5e5d1bd12d27bea2cfe8341fd1e5703b2 Mon Sep 17 00:00:00 2001 From: Matthew Holt Date: Sat, 28 Dec 2019 23:56:08 -0700 Subject: http: Enable TLS for servers listening only on HTTPS port It seems silly to have to add a single, empty TLS connection policy to a server to enable TLS when it's only listening on the HTTPS port. We now do this for the user as part of automatic HTTPS (thus, it can be disabled / overridden). See https://caddy.community/t/v2-catch-all-server-with-automatic-tls/6692/2?u=matt --- modules/caddyhttp/caddyhttp.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'modules/caddyhttp/caddyhttp.go') diff --git a/modules/caddyhttp/caddyhttp.go b/modules/caddyhttp/caddyhttp.go index 756a6c3..d3be288 100644 --- a/modules/caddyhttp/caddyhttp.go +++ b/modules/caddyhttp/caddyhttp.go @@ -326,6 +326,18 @@ func (app *App) automaticHTTPS() error { continue } + // if all listeners are on the HTTPS port, make sure + // there is at least one TLS connection policy; it + // should be obvious that they want to use TLS without + // needing to specify one empty policy to enable it + if !srv.listenersUseAnyPortOtherThan(app.httpsPort()) && len(srv.TLSConnPolicies) == 0 { + app.logger.Info("server is only listening on the HTTPS port but has no TLS connection policies; adding one to enable TLS", + zap.String("server_name", srvName), + zap.Int("https_port", app.httpsPort()), + ) + srv.TLSConnPolicies = append(srv.TLSConnPolicies, new(caddytls.ConnectionPolicy)) + } + // find all qualifying domain names, de-duplicated domainSet := make(map[string]struct{}) for routeIdx, route := range srv.Routes { -- cgit v1.2.3