From 886ba84baa4f7ed7502034893e084193dd12f9f7 Mon Sep 17 00:00:00 2001
From: Matthew Holt <mholt@users.noreply.github.com>
Date: Wed, 1 Jun 2022 15:12:57 -0600
Subject: Fix #4822 and fix #4779
The fix for 4822 is the change at the top of the file, and
4779's fix is toward the bottom of the file.
---
modules/caddyhttp/autohttps.go | 28 ++++++++++++++++++++--------
1 file changed, 20 insertions(+), 8 deletions(-)
(limited to 'modules/caddyhttp')
diff --git a/modules/caddyhttp/autohttps.go b/modules/caddyhttp/autohttps.go
index 91611f9..4cc5d2f 100644
--- a/modules/caddyhttp/autohttps.go
+++ b/modules/caddyhttp/autohttps.go
@@ -152,9 +152,7 @@ func (app *App) automaticHTTPSPhase1(ctx caddy.Context, repl *caddy.Replacer) er
return fmt.Errorf("%s: route %d, matcher set %d, matcher %d, host matcher %d: %v",
srvName, routeIdx, matcherSetIdx, matcherIdx, hostMatcherIdx, err)
}
- // only include domain if it's not explicitly skipped and it's not a Tailscale domain
- // (the implicit Tailscale manager module will get those certs at run-time)
- if !srv.AutoHTTPS.Skipped(d, srv.AutoHTTPS.Skip) && !isTailscaleDomain(d) {
+ if !srv.AutoHTTPS.Skipped(d, srv.AutoHTTPS.Skip) {
serverDomainSet[d] = struct{}{}
}
}
@@ -181,6 +179,11 @@ func (app *App) automaticHTTPSPhase1(ctx caddy.Context, repl *caddy.Replacer) er
app.logger.Warn("skipping automated certificate management for server because it is disabled", zap.String("server_name", srvName))
} else {
for d := range serverDomainSet {
+ // the implicit Tailscale manager module will get its own certs at run-time
+ if isTailscaleDomain(d) {
+ continue
+ }
+
if certmagic.SubjectQualifiesForCert(d) &&
!srv.AutoHTTPS.Skipped(d, srv.AutoHTTPS.SkipCerts) {
// if a certificate for this name is already loaded,
@@ -436,7 +439,7 @@ func (app *App) makeRedirRoute(redirToPort uint, matcherSet MatcherSet) Route {
}
}
-// createAutomationPolicy ensures that automated certificates for this
+// createAutomationPolicies ensures that automated certificates for this
// app are managed properly. This adds up to two automation policies:
// one for the public names, and one for the internal names. If a catch-all
// automation policy exists, it will be shallow-copied and used as the
@@ -485,6 +488,12 @@ func (app *App) createAutomationPolicies(ctx caddy.Context, internalNames []stri
return err
}
ap.Managers = []certmagic.Manager{ts}
+
+ // must reprovision the automation policy so that the underlying
+ // CertMagic config knows about the updated Managers
+ if err := ap.Provision(app.tlsApp); err != nil {
+ return fmt.Errorf("re-provisioning automation policy: %v", err)
+ }
}
// while we're here, is this the catch-all/base policy?
@@ -495,14 +504,17 @@ func (app *App) createAutomationPolicies(ctx caddy.Context, internalNames []stri
}
if basePolicy == nil {
- // no base policy found, we will make one! (with implicit Tailscale integration)
+ // no base policy found; we will make one
+ basePolicy = new(caddytls.AutomationPolicy)
+ }
+
+ if basePolicy.Managers == nil {
+ // add implicit Tailscale integration, for harmless convenience
ts, err := implicitTailscale(ctx)
if err != nil {
return err
}
- basePolicy = &caddytls.AutomationPolicy{
- Managers: []certmagic.Manager{ts},
- }
+ basePolicy.Managers = []certmagic.Manager{ts}
}
// if the basePolicy has an existing ACMEIssuer (particularly to
--
cgit v1.2.3