From 01521808650dac35f86f99aebea3d23dd82b0bcf Mon Sep 17 00:00:00 2001
From: Monviech <79600909+Monviech@users.noreply.github.com>
Date: Mon, 10 Nov 2025 17:01:03 +0100
Subject: [PATCH] www/caddy: Prevent sudo on startup via skip_install_trust
 (#5015)

This can happen when an internal domain has been added, e.g. example.internal. Caddy will then generate a self signed certificate via smallstep CA, and on startup it tries to install a root certificate for it into the FreeBSD trust store.

If running as www user, this causes sudo to appear at boot, because that is baked into smallstep CA.

https://github.com/smallstep/truststore/blob/master/truststore_freebsd.go

Via skip_install_trust, we prevent caddy from trying this.
---
 .../src/opnsense/service/templates/OPNsense/Caddy/Caddyfile      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
index c3f5a3862..d0b58323c 100644
--- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
+++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
@@ -228,6 +228,7 @@
     # Default of Caddy is to wait for all connections to close before allowing reload, meaning the higher the value, the longer applies take.
     #}
     grace_period {{ generalSettings.GracePeriod }}s
+    skip_install_trust
     import /usr/local/etc/caddy/caddy.d/*.global
 }