mirror of
				https://github.com/caddyserver/caddy.git
				synced 2025-11-04 03:27:23 -05:00 
			
		
		
		
	httpcaddyfile: Enable TLS for catch-all site if tls directive is specified (#5808)
				
					
				
			This commit is contained in:
		
							parent
							
								
									e0aaefab80
								
							
						
					
					
						commit
						df99502977
					
				@ -716,10 +716,20 @@ func (st *ServerType) serversFromPairings(
 | 
				
			|||||||
					}
 | 
										}
 | 
				
			||||||
				}
 | 
									}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
									// If TLS is specified as directive, it will also result in 1 or more connection policy being created
 | 
				
			||||||
 | 
									// Thus, catch-all address with non-standard port, e.g. :8443, can have TLS enabled without
 | 
				
			||||||
 | 
									// specifying prefix "https://"
 | 
				
			||||||
 | 
									// Second part of the condition is to allow creating TLS conn policy even though `auto_https` has been disabled
 | 
				
			||||||
 | 
									// ensuring compatibility with behavior described in below link
 | 
				
			||||||
 | 
									// https://caddy.community/t/making-sense-of-auto-https-and-why-disabling-it-still-serves-https-instead-of-http/9761
 | 
				
			||||||
 | 
									createdTLSConnPolicies, ok := sblock.pile["tls.connection_policy"]
 | 
				
			||||||
 | 
									hasTLSEnabled := (ok && len(createdTLSConnPolicies) > 0) ||
 | 
				
			||||||
 | 
										(addr.Host != "" && srv.AutoHTTPS != nil && !sliceContains(srv.AutoHTTPS.Skip, addr.Host))
 | 
				
			||||||
 | 
					
 | 
				
			||||||
				// we'll need to remember if the address qualifies for auto-HTTPS, so we
 | 
									// we'll need to remember if the address qualifies for auto-HTTPS, so we
 | 
				
			||||||
				// can add a TLS conn policy if necessary
 | 
									// can add a TLS conn policy if necessary
 | 
				
			||||||
				if addr.Scheme == "https" ||
 | 
									if addr.Scheme == "https" ||
 | 
				
			||||||
					(addr.Scheme != "http" && addr.Host != "" && addr.Port != httpPort) {
 | 
										(addr.Scheme != "http" && addr.Port != httpPort && hasTLSEnabled) {
 | 
				
			||||||
					addressQualifiesForTLS = true
 | 
										addressQualifiesForTLS = true
 | 
				
			||||||
				}
 | 
									}
 | 
				
			||||||
				// predict whether auto-HTTPS will add the conn policy for us; if so, we
 | 
									// predict whether auto-HTTPS will add the conn policy for us; if so, we
 | 
				
			||||||
 | 
				
			|||||||
@ -0,0 +1,37 @@
 | 
				
			|||||||
 | 
					:8443 {
 | 
				
			||||||
 | 
						tls internal {
 | 
				
			||||||
 | 
							on_demand
 | 
				
			||||||
 | 
						}
 | 
				
			||||||
 | 
					}
 | 
				
			||||||
 | 
					----------
 | 
				
			||||||
 | 
					{
 | 
				
			||||||
 | 
						"apps": {
 | 
				
			||||||
 | 
							"http": {
 | 
				
			||||||
 | 
								"servers": {
 | 
				
			||||||
 | 
									"srv0": {
 | 
				
			||||||
 | 
										"listen": [
 | 
				
			||||||
 | 
											":8443"
 | 
				
			||||||
 | 
										],
 | 
				
			||||||
 | 
										"tls_connection_policies": [
 | 
				
			||||||
 | 
											{}
 | 
				
			||||||
 | 
										]
 | 
				
			||||||
 | 
									}
 | 
				
			||||||
 | 
								}
 | 
				
			||||||
 | 
							},
 | 
				
			||||||
 | 
							"tls": {
 | 
				
			||||||
 | 
								"automation": {
 | 
				
			||||||
 | 
									"policies": [
 | 
				
			||||||
 | 
										{
 | 
				
			||||||
 | 
											"issuers": [
 | 
				
			||||||
 | 
												{
 | 
				
			||||||
 | 
													"module": "internal"
 | 
				
			||||||
 | 
												}
 | 
				
			||||||
 | 
											],
 | 
				
			||||||
 | 
											"on_demand": true
 | 
				
			||||||
 | 
										}
 | 
				
			||||||
 | 
									]
 | 
				
			||||||
 | 
								}
 | 
				
			||||||
 | 
							}
 | 
				
			||||||
 | 
						}
 | 
				
			||||||
 | 
					}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
		Loading…
	
	
			
			x
			
			
		
	
		Reference in New Issue
	
	Block a user