mirror of
https://github.com/caddyserver/caddy.git
synced 2026-02-11 22:14:21 -05:00
55601d3ec2
Before, Caddy couldn't support graceful (zero-downtime) restarts when the reloaded Caddyfile had a host in it that was elligible for a LE certificate because the port was already in use. This commit makes it possible to do zero-downtime reloads and issue certificates for new hosts that need it. Supports only http-01 challenge at this time. OCSP stapling is improved in that it updates before the expiration time when the validity window has shifted forward. See 30c949085cad82d07562ca3403a22513b8fcd440. Before it only used to update when the status changed. This commit also sets the user agent for Let's Encrypt requests with a string containing "Caddy".
49 lines
1.2 KiB
Go
49 lines
1.2 KiB
Go
package letsencrypt
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"log"
|
|
"net"
|
|
"net/http"
|
|
"net/http/httputil"
|
|
"net/url"
|
|
"strings"
|
|
)
|
|
|
|
const challengeBasePath = "/.well-known/acme-challenge"
|
|
|
|
// RequestCallback proxies challenge requests to ACME client if the
|
|
// request path starts with challengeBasePath. It returns true if it
|
|
// handled the request and no more needs to be done; it returns false
|
|
// if this call was a no-op and the request still needs handling.
|
|
func RequestCallback(w http.ResponseWriter, r *http.Request) bool {
|
|
if strings.HasPrefix(r.URL.Path, challengeBasePath) {
|
|
scheme := "http"
|
|
if r.TLS != nil {
|
|
scheme = "https"
|
|
}
|
|
|
|
hostname, _, err := net.SplitHostPort(r.URL.Host)
|
|
if err != nil {
|
|
hostname = r.URL.Host
|
|
}
|
|
|
|
upstream, err := url.Parse(scheme + "://" + hostname + ":" + AlternatePort)
|
|
if err != nil {
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
log.Printf("[ERROR] letsencrypt handler: %v", err)
|
|
return true
|
|
}
|
|
|
|
proxy := httputil.NewSingleHostReverseProxy(upstream)
|
|
proxy.Transport = &http.Transport{
|
|
TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // client would use self-signed cert
|
|
}
|
|
proxy.ServeHTTP(w, r)
|
|
|
|
return true
|
|
}
|
|
|
|
return false
|
|
}
|