From 08aae0dfbd0e7f57a6c37268c2dd8d07f05bd8af Mon Sep 17 00:00:00 2001
From: Monviech <79600909+Monviech@users.noreply.github.com>
Date: Tue, 14 May 2024 10:14:58 +0200
Subject: [PATCH] www/caddy: HTTP-01 challenge redirection subdomain fix
(#3977)
---
.../OPNsense/Caddy/forms/dialogReverseProxy.xml | 3 +--
.../OPNsense/Caddy/forms/dialogSubdomain.xml | 11 +++++++++++
.../mvc/app/models/OPNsense/Caddy/Caddy.xml | 4 ++++
.../app/views/OPNsense/Caddy/reverse_proxy.volt | 3 ++-
.../service/templates/OPNsense/Caddy/Caddyfile | 14 ++++++++++++++
5 files changed, 32 insertions(+), 3 deletions(-)
diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml
index a849f3593..f84c18c97 100644
--- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml
+++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml
@@ -53,8 +53,7 @@ ll be automatically updated with your DNS Provider.]]>
reverse.AcmePassthrough
text
-
- true
+
reverse.CustomCertificate
diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml
index 4aeace28a..9a790162a 100644
--- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml
+++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml
@@ -43,6 +43,17 @@
checkbox
+
+ header
+
+ true
+
+
+ subdomain.AcmePassthrough
+
+ text
+
+
header
diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
index d482aa4ba..4177a5dc5 100644
--- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
+++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
@@ -219,6 +219,10 @@
Y
+
+ Please enter a valid 'to' domain or IP address.
+ Y
+
diff --git a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt
index 7cfd98bc8..ec5e4b7dc 100644
--- a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt
+++ b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt
@@ -257,7 +257,7 @@
| Port |
Access List |
Basic Auth |
- DNS-01 |
+ DNS-01 challenge |
Dynamic DNS |
HTTP Access Log |
Custom Certificate |
@@ -295,6 +295,7 @@
Access List |
Basic Auth |
Dynamic DNS |
+ HTTP-01 redirection |
Description |
Commands |
diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
index 7aa75d1dc..7c9f7ed9d 100644
--- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
+++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
@@ -308,6 +308,20 @@
}
{% endif %}
{% endfor %}
+{# Process redirection for subdomains afterwards, since a redirection of a wildcard domain has to match before them. #}
+{% for subdomain in helpers.toList('Pischem.caddy.reverseproxy.subdomain') %}
+ {% if subdomain.enabled|default("0") == "1" and subdomain.AcmePassthrough %}
+ # HTTP-01 challenge redirection for subdomain: "{{ subdomain['@uuid'] }}"
+ http://{{ subdomain.FromDomain|default("") }} {
+ handle /.well-known/acme-challenge/* {
+ reverse_proxy {{ subdomain.AcmePassthrough }}
+ }
+ handle {
+ redir https://{host}{uri} 308
+ }
+ }
+ {% endif %}
+{% endfor %}
{#
# Macro: tls_configuration