mirror of
https://github.com/netbirdio/plugins.git
synced 2026-05-22 18:44:07 -07:00
www/caddy: Prevent sudo on startup via skip_install_trust (#5015)
This can happen when an internal domain has been added, e.g. example.internal. Caddy will then generate a self signed certificate via smallstep CA, and on startup it tries to install a root certificate for it into the FreeBSD trust store. If running as www user, this causes sudo to appear at boot, because that is baked into smallstep CA. https://github.com/smallstep/truststore/blob/master/truststore_freebsd.go Via skip_install_trust, we prevent caddy from trying this.
This commit is contained in:
@@ -228,6 +228,7 @@
|
||||
# Default of Caddy is to wait for all connections to close before allowing reload, meaning the higher the value, the longer applies take.
|
||||
#}
|
||||
grace_period {{ generalSettings.GracePeriod }}s
|
||||
skip_install_trust
|
||||
import /usr/local/etc/caddy/caddy.d/*.global
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user