netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

www/caddy: HTTP-01 challenge redirection subdomain fix (#3977)

Browse Source
This commit is contained in:
Monviech
2024-05-14 10:14:58 +02:00
committed by GitHub
parent a9bcbe748f
commit 08aae0dfbd
5 changed files with 32 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml
+1 -2
View File
@@ -53,8 +53,7 @@ ll be automatically updated with your DNS Provider.]]></help>
<id>reverse.AcmePassthrough</id>
<label>HTTP-01 challenge redirection</label>
<type>text</type>
<help><![CDATA[Enter a domain name or IP address. The HTTP-01 challenge will be redirected to that destination. This enables a server behind Caddy to serve "/.well-known/acme-challenge/". Caddy will issue a certificate for the same domain using the TLS-ALPN-01 challenge or DNS-01 challenge instead.]]></help>
<advanced>true</advanced>
<help><![CDATA[Enter a domain name or IP address. The HTTP-01 challenge will be redirected to that destination. This enables a server behind Caddy to serve "/.well-known/acme-challenge/". Caddy will issue a certificate for the same domain using the TLS-ALPN-01 challenge or DNS-01 challenge instead. Setting this option on a wildcard domain will pass the challenge of all subdomains to a single server behind Caddy. For finer control, use this option in subdomains instead of their wildcard domain.]]></help>
</field>
<field>
<id>reverse.CustomCertificate</id>
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml
+11
View File
@@ -43,6 +43,17 @@
<type>checkbox</type>
<help><![CDATA[Enable Dynamic DNS, please configure DNS Provider and API Key in General Settings. The DNS Records of this subdomain will be automatically updated with your DNS Provider.]]></help>
</field>
<field>
<type>header</type>
<label>Trust</label>
<collapse>true</collapse>
</field>
<field>
<id>subdomain.AcmePassthrough</id>
<label>HTTP-01 challenge redirection</label>
<type>text</type>
<help><![CDATA[Enter a domain name or IP address. The HTTP-01 challenge will be redirected to that destination. This enables a server behind Caddy to serve "/.well-known/acme-challenge/".]]></help>
</field>
<field>
<type>header</type>
<label>Access</label>
www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
+4
View File
@@ -219,6 +219,10 @@
<Required>Y</Required>
</description>
<DynDns type="BooleanField"/>
<AcmePassthrough type="HostnameField">
<ValidationMessage>Please enter a valid 'to' domain or IP address.</ValidationMessage>
<IpAllowed>Y</IpAllowed>
</AcmePassthrough>
</subdomain>
<handle type="ArrayField">
<enabled type="BooleanField">
www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt
+2 -1
View File
@@ -257,7 +257,7 @@
<th data-column-id="FromPort" data-type="string">Port</th>
<th data-column-id="accesslist" data-type="string" data-visible="false">Access List</th>
<th data-column-id="basicauth" data-type="string" data-visible="false">Basic Auth</th>
<th data-column-id="DnsChallenge" data-type="boolean" data-formatter="boolean" data-visible="false">DNS-01</th>
<th data-column-id="DnsChallenge" data-type="boolean" data-formatter="boolean" data-visible="false">DNS-01 challenge</th>
<th data-column-id="DynDns" data-type="boolean" data-formatter="boolean" data-visible="false">Dynamic DNS</th>
<th data-column-id="AccessLog" data-type="boolean" data-formatter="boolean" data-visible="false">HTTP Access Log</th>
<th data-column-id="CustomCertificate" data-type="string" data-visible="false">Custom Certificate</th>
@@ -295,6 +295,7 @@
<th data-column-id="accesslist" data-type="string" data-visible="false">Access List</th>
<th data-column-id="basicauth" data-type="string" data-visible="false">Basic Auth</th>
<th data-column-id="DynDns" data-type="boolean" data-formatter="boolean" data-visible="false">Dynamic DNS</th>
<th data-column-id="AcmePassthrough" data-type="string" data-visible="false">HTTP-01 redirection</th>
<th data-column-id="description" data-type="string">Description</th>
<th data-column-id="commands" data-width="7em" data-formatter="commands" data-sortable="false">Commands</th>
</tr>
www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
+14
View File
@@ -308,6 +308,20 @@
}
{% endif %}
{% endfor %}
{# Process redirection for subdomains afterwards, since a redirection of a wildcard domain has to match before them. #}
{% for subdomain in helpers.toList('Pischem.caddy.reverseproxy.subdomain') %}
{% if subdomain.enabled|default("0") == "1" and subdomain.AcmePassthrough %}
# HTTP-01 challenge redirection for subdomain: "{{ subdomain['@uuid'] }}"
http://{{ subdomain.FromDomain|default("") }} {
handle /.well-known/acme-challenge/* {
reverse_proxy {{ subdomain.AcmePassthrough }}
}
handle {
redir https://{host}{uri} 308
}
}
{% endif %}
{% endfor %}
{#
# Macro: tls_configuration