netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

www/caddy: v1.5.3 (#3865)

Browse Source
This commit is contained in:
Monviech
2024-04-02 12:36:18 +02:00
committed by GitHub
parent a2ccdcc65e
commit 354782cf9b
17 changed files with 269 additions and 297 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/caddy/Makefile
+2 -2
View File
@@ -1,7 +1,7 @@
PLUGIN_NAME= caddy
PLUGIN_VERSION= 1.5.2
PLUGIN_VERSION= 1.5.3
PLUGIN_DEPENDS= caddy-custom
PLUGIN_COMMENT= Easy to configure Reverse Proxy based on Caddy with Automatic HTTPS and Dynamic DNS
PLUGIN_COMMENT= Easy to configure Reverse Proxy with Automatic HTTPS and Dynamic DNS
PLUGIN_MAINTAINER= cedrik@pischem.com
.include "../../Mk/plugins.mk"
www/caddy/pkg-descr
+13
View File
@@ -19,9 +19,22 @@ Main features of this plugin:
* Syslog-ng integration and HTTP Access Log
* NTLM Transport
DOC: https://docs.opnsense.org/manual/how-tos/caddy.html
Plugin Changelog
================
1.5.3
* Change from "Phalcon Messages" to "OPNsense Messages" in Caddy.php.
* Change default storage location from /usr/local/etc/caddy to /var/db/caddy/data/caddy/.
* Change description from "TextField" to "DescriptionField" in Caddy.xml model.
* Add tls_insecure_skip_verify to handlers.
* Add possibility to restart Caddy with the ACME Client by using "Automations - Run Command - System or Plugin Command".
* Add option to redirect the ACME HTTP-01 challenge to an upstream destination as advanced option in domains.
* Remove unmaintained DNS Providers: dnspod, hetzner, namesilo, vercel, alidns, metaname, openstack-designate.
* Cleanup dialogs and UI to present all options better.
1.5.2
* Increased timeout of message area in reverse_proxy.volt and general.volt to 15 seconds.
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/Api/ReverseProxyController.php
+2 -2
View File
@@ -43,7 +43,7 @@ class ReverseProxyController extends ApiMutableModelControllerBase
public function searchReverseProxyAction()
{
return $this->searchBase("reverseproxy.reverse", ['enabled', 'FromDomain', 'FromPort', 'accesslist', 'basicauth', 'DnsChallenge', 'CustomCertificate', 'AccessLog', 'DynDns', 'description']);
return $this->searchBase("reverseproxy.reverse", ['enabled', 'FromDomain', 'FromPort', 'accesslist', 'basicauth', 'DnsChallenge', 'CustomCertificate', 'AccessLog', 'DynDns', 'AcmePassthrough', 'description']);
}
public function setReverseProxyAction($uuid)
@@ -109,7 +109,7 @@ class ReverseProxyController extends ApiMutableModelControllerBase
public function searchHandleAction()
{
return $this->searchBase("reverseproxy.handle", ['enabled', 'reverse', 'subdomain', 'HandleType', 'HandlePath', 'ToDomain', 'ToPort', 'ToPath', 'HttpTls', 'HttpTlsTrustedCaCerts', 'HttpTlsServerName', 'HttpNtlm', 'description']);
return $this->searchBase("reverseproxy.handle", ['enabled', 'reverse', 'subdomain', 'HandleType', 'HandlePath', 'ToDomain', 'ToPort', 'ToPath', 'HttpTls', 'HttpTlsTrustedCaCerts', 'HttpTlsServerName', 'HttpNtlm', 'HttpTlsInsecureSkipVerify', 'description']);
}
public function setHandleAction($uuid)
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml
+44 -34
View File
@@ -7,73 +7,70 @@
</field>
<field>
<id>handle.reverse</id>
<label>Reverse Proxy Domain</label>
<label>Domain</label>
<type>dropdown</type>
<help><![CDATA[Select a reverse proxy domain to which this handler should be added.]]></help>
</field>
<field>
<id>handle.subdomain</id>
<label>Reverse Proxy Subdomain</label>
<label>Subdomain</label>
<type>dropdown</type>
<help><![CDATA[Optionally, select a reverse proxy subdomain to which this handler should be added. In most cases, leaving this as "None" will be the best choice.]]></help>
<advanced>true</advanced>
<help><![CDATA[Optionally, select a reverse proxy subdomain to which this handler should be added. If not using subdomains, leaving this as "None" will be the best choice.]]></help>
</field>
<field>
<id>handle.HandleType</id>
<label>Handle Type</label>
<type>dropdown</type>
<help><![CDATA[Select the handler type. In most cases, leaving this as "handle" will be the best choice.]]></help>
<help><![CDATA[In most cases, leaving this as "handle" will be the best choice.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>handle.HandlePath</id>
<label>Handle Path</label>
<type>text</type>
<help><![CDATA[Enter a handler like '/*' or '/example/*', or leave blank for a catch-all handler (recommended). You can define multiple handlers per domain/subdomain by creating additional entries. Save more specific handlers first, as the first matching handler is prioritized. Blank handlers are processed last automatically. To reorder, clone handlers in the desired sequence and delete old ones.]]></help>
<advanced>true</advanced>
<help><![CDATA[Enter a handler like '/*' or '/example/*', or leave blank for a catch-all handler (recommended). Any request matching this handler will be reverse proxied to the upstream destination.]]></help>
</field>
<field>
<id>handle.description</id>
<label>Description</label>
<type>text</type>
<help><![CDATA[Enter a description for this handler.]]></help>
</field>
<field>
<type>header</type>
<label>Upstream</label>
</field>
<field>
<id>handle.ToDomain</id>
<label>Backend Server Domain</label>
<label>Upstream Domain</label>
<type>text</type>
<hint>192.168.1.1</hint>
<help><![CDATA[Enter the internal domain name or IP address of the backend server destination for this handler.]]></help>
<help><![CDATA[Enter the internal domain name or IP address of the upstream destination for this handler.]]></help>
</field>
<field>
<id>handle.ToPort</id>
<label>Backend Server Port</label>
<label>Upstream Port</label>
<type>text</type>
<hint>443</hint>
<help><![CDATA[Enter the port number of the backend server. Leave this empty for bind to port 80. For HTTPS, use 443.]]></help>
<advanced>true</advanced>
<hint>80</hint>
<help><![CDATA[Enter the port number of the upstream destination. Leave this empty to use port 80.]]></help>
</field>
<field>
<id>handle.ToPath</id>
<label>Backend Path</label>
<label>Upstream Path</label>
<type>text</type>
<help><![CDATA[Enter a path prefix like '/guacamole' that should be prepended to the backend request because the application demands it.]]></help>
<help><![CDATA[Enter a path prefix like '/guacamole' that should be prepended to the upstream request because the application demands it.]]></help>
<advanced>true</advanced>
</field>
<field>
<type>header</type>
<label>Trust</label>
<collapse>true</collapse>
</field>
<field>
<id>handle.HttpTls</id>
<label>TLS</label>
<type>checkbox</type>
<help><![CDATA[Use HTTP over TLS (HTTPS) to communicate with the Backend Server. In most cases, leaving this unchecked will be the best choice. Caddy uses HTTP for communication with the Backend Server by default.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>handle.HttpTlsTrustedCaCerts</id>
<label>TLS Trusted CA Certificate</label>
<type>dropdown</type>
<help><![CDATA[If TLS is enabled, and you are not using a globally trusted server certificate on your Backend Server, you can choose a CA certificate or self-signed certificate to trust from "System - Trust - Authorities".]]></help>
<advanced>true</advanced>
</field>
<field>
<id>handle.HttpTlsServerName</id>
<label>TLS Server Name</label>
<type>text</type>
<help><![CDATA[Optionally, specify a hostname or IP address that matches the SAN of the "TLS Trusted CA Certificate". Please note that only SAN certificates are supported; CN will not work.]]></help>
<advanced>true</advanced>
<help><![CDATA[Use HTTP over TLS (HTTPS) to communicate with the upstream destination. In most cases, leaving this unchecked will be the best choice. Caddy uses HTTP for communication with the upstream destination by default.]]></help>
</field>
<field>
<id>handle.HttpNtlm</id>
@@ -83,9 +80,22 @@
<advanced>true</advanced>
</field>
<field>
<id>handle.description</id>
<label>Description</label>
<id>handle.HttpTlsInsecureSkipVerify</id>
<label>TLS Insecure Skip Verify</label>
<type>checkbox</type>
<help><![CDATA[Turns off TLS handshake verification, making the connection insecure and vulnerable to man-in-the-middle attacks. Do not use in production.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>handle.HttpTlsTrustedCaCerts</id>
<label>TLS Trusted CA Certificate</label>
<type>dropdown</type>
<help><![CDATA[Optionally, if TLS is enabled, choose a CA certificate or self-signed certificate to trust from "System - Trust - Authorities".]]></help>
</field>
<field>
<id>handle.HttpTlsServerName</id>
<label>TLS Server Name</label>
<type>text</type>
<help><![CDATA[Enter a description for this handler.]]></help>
<help><![CDATA[Optionally, specify a hostname or IP address that matches the SAN of the "TLS Trusted CA Certificate". Please note that only SAN certificates are supported; CN will not work.]]></help>
</field>
</form>
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml
+62 -44
View File
@@ -7,59 +7,17 @@
</field>
<field>
<id>reverse.FromDomain</id>
<label>Reverse Proxy Domain</label>
<label>Domain</label>
<type>text</type>
<hint>example.com</hint>
<help><![CDATA[Enter a domain name or IP address. For a wildcard domain, use *.example.com. Only use wildcard domains with a wildcard certificate. Don't forget to create a firewall rule that allows port 80 and 443 to "This Firewall".]]></help>
</field>
<field>
<id>reverse.FromPort</id>
<label>Reverse Proxy Port</label>
<label>Port</label>
<type>text</type>
<hint>443</hint>
<help><![CDATA[Enter the port number. Leave this empty to bind to port 80 and 443 with automatic redirection. Don't forget to create a firewall rule that allows this port to "This Firewall".]]></help>
<advanced>true</advanced>
</field>
<field>
<id>reverse.accesslist</id>
<label>Access List</label>
<type>dropdown</type>
<help><![CDATA[Optionally, select an Access List to restrict access to this domain. If left as "None", any local or remote client is allowed access. In most cases, leaving this as "None" will be the best choice.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>reverse.basicauth</id>
<label>Basic Auth</label>
<type>select_multiple</type>
<size>5</size>
<help><![CDATA[Optionally, select Users to restrict access to this domain. Basic Auth matches after Access Lists. If left as "None", any client is allowed access. In most cases, leaving this as "None" will be the best choice.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>reverse.DnsChallenge</id>
<label>DNS-01 challenge</label>
<type>checkbox</type>
<help><![CDATA[Enable DNS-01 challenge for ACME, please configure DNS Provider and API Key in General Settings. In most cases, leaving this option unchecked will be the best choice. The automatic Let's Encrypt HTTP challenge will be used if this option is unchecked, which needs no further configuration.]]></help>
</field>
<field>
<id>reverse.DynDns</id>
<label>Dynamic DNS</label>
<type>checkbox</type>
<help><![CDATA[Enable Dynamic DNS, please configure DNS Provider and API Key in General Settings. The DNS Records of this domain will be automatically updated with your DNS Provider.]]></help>
</field>
<field>
<id>reverse.CustomCertificate</id>
<label>Custom Certificate</label>
<type>dropdown</type>
<help><![CDATA[Choose your own certificate from System Trust Certificates. Make sure you have imported the full chain. In most cases, leaving this as "None" will be the best choice.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>reverse.AccessLog</id>
<label>HTTP Access Log</label>
<type>checkbox</type>
<help><![CDATA[Enable the HTTP request logging for this domain and its subdomains. This option is mostly for troubleshooting since it will log every single request.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>reverse.description</id>
@@ -68,4 +26,64 @@
<hint>example.com.443</hint>
<help><![CDATA[Enter a description for this reverse proxy domain.]]></help>
</field>
<field>
<type>header</type>
<label>DNS</label>
<collapse>true</collapse>
</field>
<field>
<id>reverse.DynDns</id>
<label>Dynamic DNS</label>
<type>checkbox</type>
<help><![CDATA[Enable Dynamic DNS, please configure DNS Provider and API Key in General Settings. The DNS Records of this domain wi
ll be automatically updated with your DNS Provider.]]></help>
</field>
<field>
<type>header</type>
<label>Trust</label>
<collapse>true</collapse>
</field>
<field>
<id>reverse.DnsChallenge</id>
<label>DNS-01 challenge</label>
<type>checkbox</type>
<help><![CDATA[Enable DNS-01 challenge for ACME, please configure DNS Provider and API Key in General Settings. In most cases, leaving this option unchecked will be the best choice. The automatic Let's Encrypt HTTP challenge will be used if this option is unchecked, which needs no further configuration.]]></help>
</field>
<field>
<id>reverse.AcmePassthrough</id>
<label>HTTP-01 challenge redirection</label>
<type>text</type>
<help><![CDATA[Enter a domain name or IP address. The HTTP-01 challenge will be redirected to that destination. This enables a server behind Caddy to serve "/.well-known/acme-challenge/". Caddy will issue a certificate for the same domain using the TLS-ALPN-01 challenge or DNS-01 challenge instead.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>reverse.CustomCertificate</id>
<label>Custom Certificate</label>
<type>dropdown</type>
<help><![CDATA[Choose your own certificate from System Trust Certificates. Make sure you have imported the full chain. In most cases, leaving this as "None" will be the best choice.]]></help>
</field>
<field>
<type>header</type>
<label>Access</label>
<collapse>true</collapse>
</field>
<field>
<id>reverse.accesslist</id>
<label>Access List</label>
<type>dropdown</type>
<help><![CDATA[Optionally, select an Access List to restrict access to this domain. If left as "None", any local or remote client is allowed access. In most cases, leaving this as "None" will be the best choice.]]></help>
</field>
<field>
<id>reverse.basicauth</id>
<label>Basic Auth</label>
<type>select_multiple</type>
<size>5</size>
<help><![CDATA[Optionally, select Users to restrict access to this domain. Basic Auth matches after Access Lists. If left as "None", any client is allowed access. In most cases, leaving this as "None" will be the best choice.]]></help>
</field>
<field>
<id>reverse.AccessLog</id>
<label>HTTP Access Log</label>
<type>checkbox</type>
<help><![CDATA[Enable the HTTP request logging for this domain and its subdomains. This option is mostly for troubleshooting since it will log every single request.]]></help>
</field>
</form>
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml
+32 -25
View File
@@ -7,45 +7,23 @@
</field>
<field>
<id>subdomain.reverse</id>
<label>Reverse Proxy Domain</label>
<label>Domain</label>
<type>dropdown</type>
<help><![CDATA[Select a domain, to which this subdomain should be added.]]></help>
</field>
<field>
<id>subdomain.FromDomain</id>
<label>Reverse Proxy Subdomain</label>
<label>Subdomain</label>
<type>text</type>
<hint>opn.example.com</hint>
<help><![CDATA[Enter the subdomain name (e.g., 'opn.example.com' if your wildcard domain is '*.example.com').]]></help>
</field>
<field>
<id>subdomain.FromPort</id>
<label>Reverse Proxy Port</label>
<label>Port</label>
<type>text</type>
<hint>443</hint>
<help><![CDATA[Enter the port number. Leave this empty to bind to port 80 and 443 with automatic redirection. Don't forget to create a firewall rule that allows this destination port to "This Firewall".]]></help>
<advanced>true</advanced>
</field>
<field>
<id>subdomain.accesslist</id>
<label>Access List</label>
<type>dropdown</type>
<help><![CDATA[Optionally, select an Access List to restrict access to this subdomain. If left as "None", any local or remote client is allowed access. In most cases, leaving this as "None" will be the best choice.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>subdomain.basicauth</id>
<label>Basic Auth</label>
<type>select_multiple</type>
<size>5</size>
<help><![CDATA[Optionally, select Users to restrict access to this subdomain. Basic Auth matches after Access Lists. If left as "None", any client is allowed access. In most cases, leaving this as "None" will be the best choice.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>subdomain.DynDns</id>
<label>Dynamic DNS</label>
<type>checkbox</type>
<help><![CDATA[Enable Dynamic DNS, please configure DNS Provider and API Key in General Settings. The DNS Records of this subdomain will be automatically updated with your DNS Provider.]]></help>
</field>
<field>
<id>subdomain.description</id>
@@ -54,4 +32,33 @@
<hint>opn.example.com.443</hint>
<help><![CDATA[Enter a description for this reverse proxy subdomain.]]></help>
</field>
<field>
<type>header</type>
<label>DNS</label>
<collapse>true</collapse>
</field>
<field>
<id>subdomain.DynDns</id>
<label>Dynamic DNS</label>
<type>checkbox</type>
<help><![CDATA[Enable Dynamic DNS, please configure DNS Provider and API Key in General Settings. The DNS Records of this subdomain will be automatically updated with your DNS Provider.]]></help>
</field>
<field>
<type>header</type>
<label>Access</label>
<collapse>true</collapse>
</field>
<field>
<id>subdomain.accesslist</id>
<label>Access List</label>
<type>dropdown</type>
<help><![CDATA[Optionally, select an Access List to restrict access to this subdomain. If left as "None", any local or remote client is allowed access. In most cases, leaving this as "None" will be the best choice.]]></help>
</field>
<field>
<id>subdomain.basicauth</id>
<label>Basic Auth</label>
<type>select_multiple</type>
<size>5</size>
<help><![CDATA[Optionally, select Users to restrict access to this subdomain. Basic Auth matches after Access Lists. If left as "None", any client is allowed access. In most cases, leaving this as "None" will be the best choice.]]></help>
</field>
</form>
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dnsprovider.xml
+11 -25
View File
@@ -9,55 +9,41 @@
<id>caddy.general.TlsDnsApiKey</id>
<label>DNS API Standard Field</label>
<type>text</type>
<help><![CDATA[This is the standard field for the API Key. Field can be left empty if optional: Cloudflare "api_token", Duckdns "api_token", DigitalOcean "auth_token", DNSPod "auth_token", Hetzner "api_token", Godaddy "api_token", Gandi "bearer_token", IONOS "api_token", deSEC "token", Route53 "access_key_id", Porkbun "api_key", ACME-DNS "username", Netlify "personal_access_token", Namesilo "api_token", Njalla "api_token", Vercel "api_token", Google Cloud DNS "gcp_project", Alidns "access_key_id", Azure "tenant_id", OpenStack Designate "region_name", OVH "endpoint", Namecheap "api_key", PowerDNS "server_url", DDNSS "api_token", Metaname "api_key", Linode "api_token", Tencent Cloud "secret_id", Dinahosting "username", Hexonet "username", Mail-in-a-Box "api_url".]]></help>
<help><![CDATA[This is the standard field for the API Key. Field can be left empty if optional: Cloudflare "api_token", Duckdns "api_token", DigitalOcean "auth_token", Godaddy "api_token", Gandi "bearer_token", IONOS "api_token", deSEC "token", Route53 "access_key_id", Porkbun "api_key", ACME-DNS "username", Netlify "personal_access_token", Njalla "api_token", Google Cloud DNS "gcp_project", Azure "tenant_id", OVH "endpoint", Namecheap "api_key", PowerDNS "server_url", DDNSS "api_token", Linode "api_token", Tencent Cloud "secret_id", Dinahosting "username", Hexonet "username", Mail-in-a-Box "api_url".]]></help>
</field>
<field>
<type>header</type>
<label>Additional Fields</label>
<collapse>true</collapse>
</field>
<field>
<id>caddy.general.TlsDnsSecretApiKey</id>
<label>DNS API Additional Field 1</label>
<type>text</type>
<help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: Duckdns "override_domain", Route53 "secret_access_key", Porkbun "api_secret_key", ACME-DNS "password", Alidns "access_key_secret", Azure "client_id", OpenStack Designate "tenant_id", OVH "application_key", Namecheap "user", PowerDNS "api_token", DDNSS "username", Metaname "account_reference", Linode "api_url", Tencent Cloud "secret_key", Dinahosting "password", Hexonet "password", Mail-in-a-Box "email_address".]]></help>
<advanced>true</advanced>
<help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: Duckdns "override_domain", Route53 "secret_access_key", Porkbun "api_secret_key", ACME-DNS "password", Azure "client_id", OVH "application_key", Namecheap "user", PowerDNS "api_token", DDNSS "username", Linode "api_url", Tencent Cloud "secret_key", Dinahosting "password", Hexonet "password", Mail-in-a-Box "email_address".]]></help>
</field>
<field>
<id>caddy.general.TlsDnsOptionalField1</id>
<label>DNS API Additional Field 2</label>
<type>text</type>
<help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: Route53 "max_retries", ACME-DNS "subdomain", Azure "client_secret", OpenStack Designate "identity_api_version", OVH "application_secret", Namecheap "api_endpoint", DDNSS "password", Linode "api_version", Mail-in-a-Box "password".]]></help>
<advanced>true</advanced>
<help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: Route53 "max_retries", ACME-DNS "subdomain", Azure "client_secret", OVH "application_secret", Namecheap "api_endpoint", DDNSS "password", Linode "api_version", Mail-in-a-Box "password".]]></help>
</field>
<field>
<id>caddy.general.TlsDnsOptionalField2</id>
<label>DNS API Additional Field 3</label>
<type>text</type>
<help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: Route53 "aws_profile", ACME-DNS "server_url", Azure "subscription_id", OpenStack Designate "password", OVH "consumer_key", Namecheap "client_ip", DDNS "password".]]></help>
<advanced>true</advanced>
<help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: Route53 "aws_profile", ACME-DNS "server_url", Azure "subscription_id", OVH "consumer_key", Namecheap "client_ip", DDNS "password".]]></help>
</field>
<field>
<id>caddy.general.TlsDnsOptionalField3</id>
<label>DNS API Additional Field 4</label>
<type>text</type>
<help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: Route53 "region", Azure "resource_group_name", OpenStack Designate "username".]]></help>
<advanced>true</advanced>
<help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: Route53 "region", Azure "resource_group_name".]]></help>
</field>
<field>
<id>caddy.general.TlsDnsOptionalField4</id>
<label>DNS API Additional Field 5</label>
<type>text</type>
<help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: Route53 "token", OpenStack Designate "tenant_name".]]></help>
<advanced>true</advanced>
</field>
<field>
<id>caddy.general.TlsDnsOptionalField5</id>
<label>DNS API Additional Field 6</label>
<type>text</type>
<help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: OpenStack Designate "auth_url".]]></help>
<advanced>true</advanced>
</field>
<field>
<id>caddy.general.TlsDnsOptionalField6</id>
<label>DNS API Additional Field 7</label>
<type>text</type>
<help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: OpenStack Designate "endpoint_type".]]></help>
<advanced>true</advanced>
<help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: Route53 "token".]]></help>
</field>
</form>
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dynamicdns.xml
+20 -17
View File
@@ -1,17 +1,9 @@
<form>
<field>
<id>caddy.general.DynDnsSimpleHttp</id>
<label>DynDns Check Http</label>
<type>text</type>
<help><![CDATA[Optionally, enter a URL to test the current IP address of the firewall via HTTP protocol. Generally, this is not needed. Caddy uses default providers to test the current IP addresses. If you'd rather use your own, enter the https:// link to an IP address testing website.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>caddy.general.DynDnsInterface</id>
<label>DynDns Check Interface</label>
<id>caddy.general.DynDnsIpVersions</id>
<label>DynDns IP Version</label>
<type>dropdown</type>
<help><![CDATA[Optionally, select an interface to extract the current IP addresses of the firewall. At most, one IPv6 Global Unicast Address and one IPv4 non-RFC1918 Address will be extracted. This depends on the DynDns IP Version that's specified.]]></help>
<advanced>true</advanced>
<help><![CDATA[Leave on None to set IPv4 A-Records and IPv6 AAAA-Records. Select "IPv4 only" for setting A-Records. Select "IPv6 only" for setting AAAA-Records.]]></help>
</field>
<field>
<id>caddy.general.DynDnsCheckInterval</id>
@@ -19,16 +11,27 @@
<type>text</type>
<help><![CDATA[Interval to poll for changes of the IP address. The default is 5 minutes. Can be a number between 1 to 1440 minutes.]]></help>
</field>
<field>
<id>caddy.general.DynDnsIpVersions</id>
<label>DynDns IP Version</label>
<type>dropdown</type>
<help><![CDATA[Leave on None to set IPv4 A-Records and IPv6 AAAA-Records. Select "IPv4 only" for setting A-Records. Select "IPv6 only" for setting AAAA-Records.]]></help>
</field>
<field>
<id>caddy.general.DynDnsTTL</id>
<label>DynDns TTL</label>
<type>text</type>
<help><![CDATA[Set the TTL (time to live) for DNS Records. The default is 1 hour. Can be a number between 1 to 24 hours.]]></help>
</field>
<field>
<type>header</type>
<label>Additional Checks</label>
<collapse>true</collapse>
</field>
<field>
<id>caddy.general.DynDnsSimpleHttp</id>
<label>DynDns Check Http</label>
<type>text</type>
<help><![CDATA[Optionally, enter a URL to test the current IP address of the firewall via HTTP protocol. Generally, this is not needed. Caddy uses default providers to test the current IP addresses. If you'd rather use your own, enter the https:// link to an IP address testing website.]]></help>
</field>
<field>
<id>caddy.general.DynDnsInterface</id>
<label>DynDns Check Interface</label>
<type>dropdown</type>
<help><![CDATA[Optionally, select an interface to extract the current IP addresses of the firewall. At most, one IPv6 Global Unicast Address and one IPv4 non-RFC1918 Address will be extracted. This depends on the DynDns IP Version that's specified.]]></help>
</field>
</form>
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml
+6 -6
View File
@@ -18,16 +18,16 @@
<type>dropdown</type>
<help><![CDATA[Select the auto HTTPS option. "On" (default) creates automatic certificates using Let's Encrypt or ZeroSSL without needing any configuration.]]></help>
</field>
<field>
<id>caddy.general.abort</id>
<label>Abort Connections</label>
<type>checkbox</type>
<help><![CDATA[Abort all connections that don't have a matching handle or access list. This option doesn't conflict with Let's Encrypt. Disable it for troubleshooting purposes, e.g., testing if the Reverse Proxy Domain works and the Certificate has been installed. For production use, enabling this option is recommended.]]></help>
</field>
<field>
<id>caddy.general.accesslist</id>
<label>Trusted Proxies</label>
<type>dropdown</type>
<help><![CDATA[Select an Access List of Trusted Proxies. If Caddy is not the first server being connected to by your clients (for example when a CDN is in front of Caddy), you may configure trusted_proxies with a list of IP ranges (CIDRs) from which incoming requests are trusted to have sent good values for these headers. Additionally, set the same Access List to the Domains your Trusted Proxy connects to.]]></help>
</field>
<field>
<id>caddy.general.abort</id>
<label>Abort Connections</label>
<type>checkbox</type>
<help><![CDATA[Abort all connections that don't have a matching handle or access list. This option doesn't conflict with Let's Encrypt. Disable it for troubleshooting purposes, e.g., testing if the Reverse Proxy Domain works and the Certificate has been installed. For production use, enabling this option is recommended.]]></help>
</field>
</form>
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/logsettings.xml
-2
View File
@@ -10,7 +10,6 @@
<label>Log HTTP Access in JSON Format</label>
<type>checkbox</type>
<help><![CDATA[Log HTTP access in a standard JSON logfile per domain, e.g for processing by CrowdSec. Use combined with HTTP Access Log in the Reverse Proxy Domain. Enabling this will make the HTTP Access Log dissappear from the standard "Log File" in the GUI. They can be found in the filesystem "/var/log/caddy/access/"]]></help>
<advanced>true</advanced>
</field>
<field>
<id>caddy.general.LogAccessPlainKeep</id>
@@ -18,6 +17,5 @@
<hint>10</hint>
<type>text</type>
<help><![CDATA[How many days to keep the JSON access logs.]]></help>
<advanced>true</advanced>
</field>
</form>
www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php
+1 -1
View File
@@ -31,7 +31,7 @@
namespace OPNsense\Caddy;
use OPNsense\Base\BaseModel;
use Phalcon\Messages\Message;
use OPNsense\Base\Messages\Message;
class Caddy extends BaseModel
{
www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
+11 -28
View File
@@ -1,7 +1,7 @@
<model>
<mount>//Pischem/caddy</mount>
<description>A GUI model for configuring a reverse proxy in the Caddy web server.</description>
<version>1.1.4</version>
<version>1.1.5</version>
<items>
<general>
<enabled type="BooleanField">
@@ -26,8 +26,6 @@
<cloudflare>Cloudflare</cloudflare>
<duckdns>Duck DNS</duckdns>
<digitalocean>DigitalOcean</digitalocean>
<dnspod>DNSPod</dnspod>
<hetzner>Hetzner</hetzner>
<godaddy>GoDaddy</godaddy>
<gandi>Gandi</gandi>
<ionos>IONOS</ionos>
@@ -35,19 +33,14 @@
<porkbun>Porkbun</porkbun>
<route53>Route53</route53>
<acmedns>ACME-DNS</acmedns>
<alidns>Alidns</alidns>
<googleclouddns>Google Cloud DNS</googleclouddns>
<azure>Azure</azure>
<openstack-designate>OpenStack Designate</openstack-designate>
<ovh>OVH</ovh>
<namecheap>Namecheap</namecheap>
<netlify>Netlify</netlify>
<namesilo>Namesilo</namesilo>
<powerdns>PowerDNS</powerdns>
<vercel>Vercel</vercel>
<ddnss>DDNSS</ddnss>
<njalla>Njalla</njalla>
<metaname>Metaname</metaname>
<linode>Linode</linode>
<tencentcloud>Tencent Cloud</tencentcloud>
<dinahosting>Dinahosting</dinahosting>
@@ -61,8 +54,6 @@
<TlsDnsOptionalField2 type="TextField"/>
<TlsDnsOptionalField3 type="TextField"/>
<TlsDnsOptionalField4 type="TextField"/>
<TlsDnsOptionalField5 type="TextField"/>
<TlsDnsOptionalField6 type="TextField"/>
<accesslist type="ModelRelationField">
<Model>
<reverseproxy>
@@ -146,15 +137,17 @@
</Model>
<Multiple>Y</Multiple>
</basicauth>
<description type="TextField">
<description type="DescriptionField">
<Required>Y</Required>
<Mask>/^([\t\n\v\f\r 0-9a-zA-Z.,_*-\x{00A0}-\x{FFFF}]){1,255}$/u</Mask>
<ValidationMessage>Please provide a valid description.</ValidationMessage>
</description>
<DnsChallenge type="BooleanField"/>
<CustomCertificate type="CertificateField"/>
<AccessLog type="BooleanField"/>
<DynDns type="BooleanField"/>
<AcmePassthrough type="HostnameField">
<ValidationMessage>Please enter a valid 'to' domain or IP address.</ValidationMessage>
<IpAllowed>Y</IpAllowed>
</AcmePassthrough>
</reverse>
<subdomain type="ArrayField">
<enabled type="BooleanField">
@@ -200,10 +193,8 @@
</Model>
<Multiple>Y</Multiple>
</basicauth>
<description type="TextField">
<description type="DescriptionField">
<Required>Y</Required>
<Mask>/^([\t\n\v\f\r 0-9a-zA-Z.,_-\x{00A0}-\x{FFFF}]){1,255}$/u</Mask>
<ValidationMessage>Please provide a valid description.</ValidationMessage>
</description>
<DynDns type="BooleanField"/>
</subdomain>
@@ -259,6 +250,7 @@
</ToPath>
<HttpTls type="BooleanField"/>
<HttpNtlm type="BooleanField"/>
<HttpTlsInsecureSkipVerify type="BooleanField"/>
<HttpTlsTrustedCaCerts type="CertificateField">
<Type>ca</Type>
</HttpTlsTrustedCaCerts>
@@ -269,10 +261,7 @@
<FqdnWildcardAllowed>Y</FqdnWildcardAllowed>
<ZoneRootAllowed>N</ZoneRootAllowed>
</HttpTlsServerName>
<description type="TextField">
<Mask>/^([\t\n\v\f\r 0-9a-zA-Z.,_-\x{00A0}-\x{FFFF}]){1,255}$/u</Mask>
<ValidationMessage>Please provide a valid description.</ValidationMessage>
</description>
<description type="DescriptionField"/>
</handle>
<accesslist type="ArrayField">
<accesslistName type="TextField">
@@ -289,10 +278,7 @@
<ValidationMessage>Please enter valid IP address(es) or network(s), separated by commas.</ValidationMessage>
</clientIps>
<accesslistInvert type="BooleanField"/>
<description type="TextField">
<Mask>/^([\t\n\v\f\r 0-9a-zA-Z.,_*-\x{00A0}-\x{FFFF}]){1,255}$/u</Mask>
<ValidationMessage>Please provide a valid description.</ValidationMessage>
</description>
<description type="DescriptionField"/>
</accesslist>
<basicauth type="ArrayField">
<basicauthuser type="TextField">
@@ -303,10 +289,7 @@
<basicauthpass type="UpdateOnlyTextField">
<Required>Y</Required>
</basicauthpass>
<description type="TextField">
<Mask>/^([\t\n\v\f\r 0-9a-zA-Z.,_-\x{00A0}-\x{FFFF}]){1,255}$/u</Mask>
<ValidationMessage>Please provide a valid description.</ValidationMessage>
</description>
<description type="DescriptionField"/>
</basicauth>
</reverseproxy>
</items>
www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt
+6 -4
View File
@@ -166,6 +166,7 @@
<th data-column-id="DynDns" data-type="boolean" data-formatter="boolean" data-visible="false">Dynamic DNS</th>
<th data-column-id="AccessLog" data-type="boolean" data-formatter="boolean" data-visible="false">HTTP Access Log</th>
<th data-column-id="CustomCertificate" data-type="string" data-visible="false">Custom Certificate</th>
<th data-column-id="AcmePassthrough" data-type="string" data-visible="false">HTTP-01 redirection</th>
<th data-column-id="description" data-type="string">Description</th>
<th data-column-id="commands" data-width="7em" data-formatter="commands" data-sortable="false">Commands</th>
</tr>
@@ -232,14 +233,15 @@
<th data-column-id="reverse" data-type="string">Domain</th>
<th data-column-id="subdomain" data-type="string">Subdomain</th>
<th data-column-id="HandleType" data-type="string" data-visible="false">Handle Type</th>
<th data-column-id="HandlePath" data-type="string">Handle Path</th>
<th data-column-id="ToDomain" data-type="string">Backend Domain</th>
<th data-column-id="ToPort" data-type="string">Backend Port</th>
<th data-column-id="ToPath" data-type="string" data-visible="false">Backend Path</th>
<th data-column-id="HandlePath" data-type="string" data-visible="false">Handle Path</th>
<th data-column-id="ToDomain" data-type="string">Upstream Domain</th>
<th data-column-id="ToPort" data-type="string">Upstream Port</th>
<th data-column-id="ToPath" data-type="string" data-visible="false">Upstream Path</th>
<th data-column-id="HttpTls" data-type="boolean" data-formatter="boolean" data-visible="false">TLS</th>
<th data-column-id="HttpTlsTrustedCaCerts" data-type="string" data-visible="false">TLS CA</th>
<th data-column-id="HttpTlsServerName" data-type="string" data-visible="false">TLS Server Name</th>
<th data-column-id="HttpNtlm" data-type="boolean" data-formatter="boolean" data-visible="false">NTLM</th>
<th data-column-id="HttpTlsInsecureSkipVerify" data-type="boolean" data-formatter="boolean" data-visible="false">TLS Insecure Skip Verify</th>
<th data-column-id="description" data-type="string">Description</th>
<th data-column-id="commands" data-width="7em" data-formatter="commands" data-sortable="false">Commands</th>
</tr>
www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php
+1 -6
View File
@@ -29,13 +29,11 @@
*/
require_once("config.inc");
require_once("certs.inc");
require_once("legacy_bindings.inc");
use OPNsense\Core\Config;
$configObj = Config::getInstance()->object();
$temp_dir = '/usr/local/etc/caddy/certificates/temp/';
$temp_dir = '/var/db/caddy/data/caddy/certificates/temp/';
function extract_and_save_certificates($configObj, $temp_dir)
{
@@ -68,9 +66,7 @@ function extract_and_save_certificates($configObj, $temp_dir)
// Save the certificate chain and private key
file_put_contents($temp_dir . $cert_refid . '.pem', $cert_chain);
chmod($temp_dir . $cert_refid . '.pem', 0600);
file_put_contents($temp_dir . $cert_refid . '.key', $key_content);
chmod($temp_dir . $cert_refid . '.key', 0600);
}
// Traverse through CA certificates and save them
@@ -80,7 +76,6 @@ function extract_and_save_certificates($configObj, $temp_dir)
// Save the CA certificate
file_put_contents($temp_dir . $ca_refid . '.pem', $ca_content);
chmod($temp_dir . $ca_refid . '.pem', 0600);
}
}
www/caddy/src/opnsense/scripts/OPNsense/Caddy/setup.sh
+8 -20
View File
@@ -2,37 +2,25 @@
# Define directories
CADDY_DIR="/usr/local/etc/caddy"
CADDY_ACME_DIR="${CADDY_DIR}/acme"
CADDY_CERTS_DIR="${CADDY_DIR}/certificates/temp"
CADDY_OCSP_DIR="${CADDY_DIR}/ocsp"
CADDY_LOCKS_DIR="${CADDY_DIR}/locks"
CADDY_CERTS_DIR="/var/db/caddy/data/caddy/certificates/temp"
CADDY_LOG_DIR="/var/log/caddy/access"
CADDY_CONF_DIR="${CADDY_DIR}/caddy.d"
# Create Caddy configuration directories with appropriate permissions
mkdir -p "${CADDY_DIR}"
mkdir -p "${CADDY_ACME_DIR}"
# Create custom directories with appropriate permissions
mkdir -p "${CADDY_CERTS_DIR}"
mkdir -p "${CADDY_OCSP_DIR}"
mkdir -p "${CADDY_LOCKS_DIR}"
mkdir -p "${CADDY_CONF_DIR}"
chown -R root:wheel "${CADDY_CERTS_DIR}"
chmod -R 600 "${CADDY_CERTS_DIR}"
# Set permissions for Caddy configuration directories
chown -R root:wheel "${CADDY_DIR}"
chmod -R 750 "${CADDY_DIR}"
# Create Caddy log directory
mkdir -p "${CADDY_LOG_DIR}"
# Set permissions for Caddy log directory
chown -R root:wheel "${CADDY_LOG_DIR}"
chmod -R 750 "${CADDY_LOG_DIR}"
mkdir -p "${CADDY_CONF_DIR}"
chown -R root:wheel "${CADDY_CONF_DIR}"
chmod -R 750 "${CADDY_CONF_DIR}"
# Format and overwrite the Caddyfile
(cd "${CADDY_DIR}" && /usr/local/bin/caddy fmt --overwrite)
# Write custom certs from the OPNsense Trust Store into a directory where Caddy can read them
/usr/local/opnsense/scripts/OPNsense/Caddy/caddy_certs.php
# Optional Debug message
# echo "Caddy installation completed. All caddy directories and files created successfully."
www/caddy/src/opnsense/service/conf/actions.d/actions_caddy.conf
+1
View File
@@ -15,6 +15,7 @@ command:/usr/local/opnsense/scripts/OPNsense/Caddy/caddy_control.py restart
parameters:
type:script
message:Reloading Caddy configuration
description:Restart Caddy service
[validate]
command:/usr/local/opnsense/scripts/OPNsense/Caddy/caddy_control.py validate
www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
+49 -81
View File
@@ -4,9 +4,6 @@
# Global Options
{
storage file_system {
root /usr/local/etc/caddy
}
log {
{% if generalSettings.LogAccessPlain|default("0") == "0" %}
{% for reverse in helpers.toList('Pischem.caddy.reverseproxy.reverse') %}
@@ -57,8 +54,6 @@
{% set dnsOptionalField2 = generalSettings.TlsDnsOptionalField2 %}
{% set dnsOptionalField3 = generalSettings.TlsDnsOptionalField3 %}
{% set dnsOptionalField4 = generalSettings.TlsDnsOptionalField4 %}
{% set dnsOptionalField5 = generalSettings.TlsDnsOptionalField5 %}
{% set dnsOptionalField6 = generalSettings.TlsDnsOptionalField6 %}
{% set dynDnsSimpleHttp = generalSettings.DynDnsSimpleHttp %}
{% set dynDnsInterface = generalSettings.DynDnsInterface %}
{% set dynDnsCheckInterval = generalSettings.DynDnsCheckInterval %}
@@ -85,7 +80,7 @@
{% if dnsProvider and dnsProvider != "none" and dnsProvider != "acmedns" and dynDnsDomains|length > 0 %}
dynamic_dns {
{% if dnsProvider in ['porkbun', 'desec', 'route53', 'alidns', 'googleclouddns', 'azure', 'openstack-designate', 'ovh', 'namecheap', 'powerdns', 'ddnss', 'linode', 'tencentcloud', 'dinahosting', 'hexonet', 'mailinabox'] %}
{% if dnsProvider in ['porkbun', 'desec', 'route53', 'googleclouddns', 'azure', 'ovh', 'namecheap', 'powerdns', 'ddnss', 'linode', 'tencentcloud', 'dinahosting', 'hexonet', 'mailinabox'] %}
provider {{ dnsProvider }} {
{% if dnsProvider == 'porkbun' %}
{% if dnsApiKey %}api_key {{ dnsApiKey }}
@@ -108,11 +103,6 @@
{% endif %}
{% if dnsOptionalField4 %}token {{ dnsOptionalField4 }}
{% endif %}
{% elif dnsProvider == 'alidns' %}
{% if dnsApiKey %}access_key_id {{ dnsApiKey }}
{% endif %}
{% if dnsSecretApiKey %}access_key_secret {{ dnsSecretApiKey }}
{% endif %}
{% elif dnsProvider == 'googleclouddns' %}
{% if dnsApiKey %}gcp_project {{ dnsApiKey }}
{% endif %}
@@ -127,23 +117,6 @@
{% endif %}
{% if dnsOptionalField3 %}resource_group_name {{ dnsOptionalField3 }}
{% endif %}
{% elif dnsProvider == 'openstack-designate' %}
{% if dnsApiKey %}region_name {{ dnsApiKey }}
{% endif %}
{% if dnsSecretApiKey %}tenant_id {{ dnsSecretApiKey }}
{% endif %}
{% if dnsOptionalField1 %}identity_api_version {{ dnsOptionalField1 }}
{% endif %}
{% if dnsOptionalField2 %}password {{ dnsOptionalField2 }}
{% endif %}
{% if dnsOptionalField3 %}username {{ dnsOptionalField3 }}
{% endif %}
{% if dnsOptionalField4 %}tenant_name {{ dnsOptionalField4 }}
{% endif %}
{% if dnsOptionalField5 %}auth_url {{ dnsOptionalField5 }}
{% endif %}
{% if dnsOptionalField6 %}endpoint_type {{ dnsOptionalField6 }}
{% endif %}
{% elif dnsProvider == 'ovh' %}
{% if dnsApiKey %}endpoint {{ dnsApiKey }}
{% endif %}
@@ -204,8 +177,6 @@
{% endif %}
{% endif %}
}
{% elif dnsProvider in ['metaname'] %}
provider {{ dnsProvider }} {{ dnsApiKey }} {{ dnsSecretApiKey }}
{% else %}
provider {{ dnsProvider }} {{ dnsApiKey }}
{% endif %}
@@ -248,9 +219,24 @@
}
# Reverse Proxy Configuration
{% macro tls_configuration(dnsProvider, dnsApiKey, customCert, dnsChallenge, dnsSecretApiKey, TlsDnsOptionalField1, TlsDnsOptionalField2, TlsDnsOptionalField3, TlsDnsOptionalField4, TlsDnsOptionalField5, TlsDnsOptionalField6) %}
{% for reverse in helpers.toList('Pischem.caddy.reverseproxy.reverse') %}
{% if reverse.enabled|default("0") == "1" and reverse.AcmePassthrough %}
# HTTP-01 challenge redirection for domain: "{{ reverse['@uuid'] }}"
http://{{ reverse.FromDomain|default("") }} {
handle /.well-known/acme-challenge/* {
reverse_proxy {{ reverse.AcmePassthrough }}
}
handle {
redir https://{host}{uri} 308
}
}
{% endif %}
{% endfor %}
{% macro tls_configuration(dnsProvider, dnsApiKey, customCert, dnsChallenge, dnsSecretApiKey, TlsDnsOptionalField1, TlsDnsOptionalField2, TlsDnsOptionalField3, TlsDnsOptionalField4) %}
{% if dnsChallenge == "1" and dnsProvider and dnsProvider != "none" %}
{% if dnsProvider in ['duckdns', 'porkbun', 'desec', 'route53', 'acmedns', 'alidns', 'googleclouddns', 'azure', 'openstack-designate', 'ovh', 'namecheap', 'powerdns', 'ddnss', 'linode', 'tencentcloud', 'dinahosting', 'hexonet', 'mailinabox'] %}
{% if dnsProvider in ['duckdns', 'porkbun', 'desec', 'route53', 'acmedns', 'googleclouddns', 'azure', 'ovh', 'namecheap', 'powerdns', 'ddnss', 'linode', 'tencentcloud', 'dinahosting', 'hexonet', 'mailinabox'] %}
tls {
dns {{ dnsProvider }} {
{% if dnsProvider == 'duckdns' %}
@@ -288,11 +274,6 @@
{% endif %}
{% if dnsOptionalField2 %}server_url {{ dnsOptionalField2 }}
{% endif %}
{% elif dnsProvider == 'alidns' %}
{% if dnsApiKey %}access_key_id {{ dnsApiKey }}
{% endif %}
{% if dnsSecretApiKey %}access_key_secret {{ dnsSecretApiKey }}
{% endif %}
{% elif dnsProvider == 'googleclouddns' %}
{% if dnsApiKey %}gcp_project {{ dnsApiKey }}
{% endif %}
@@ -307,23 +288,6 @@
{% endif %}
{% if dnsOptionalField3 %}resource_group_name {{ dnsOptionalField3 }}
{% endif %}
{% elif dnsProvider == 'openstack-designate' %}
{% if dnsApiKey %}region_name {{ dnsApiKey }}
{% endif %}
{% if dnsSecretApiKey %}tenant_id {{ dnsSecretApiKey }}
{% endif %}
{% if dnsOptionalField1 %}identity_api_version {{ dnsOptionalField1 }}
{% endif %}
{% if dnsOptionalField2 %}password {{ dnsOptionalField2 }}
{% endif %}
{% if dnsOptionalField3 %}username {{ dnsOptionalField3 }}
{% endif %}
{% if dnsOptionalField4 %}tenant_name {{ dnsOptionalField4 }}
{% endif %}
{% if dnsOptionalField5 %}auth_url {{ dnsOptionalField5 }}
{% endif %}
{% if dnsOptionalField6 %}endpoint_type {{ dnsOptionalField6 }}
{% endif %}
{% elif dnsProvider == 'ovh' %}
{% if dnsApiKey %}endpoint {{ dnsApiKey }}
{% endif %}
@@ -385,10 +349,6 @@
{% endif %}
}
}
{% elif dnsProvider in ['metaname'] %}
tls {
dns {{ dnsProvider }} {{ dnsApiKey }} {{ dnsSecretApiKey }}
}
{% else %}
tls {
dns {{ dnsProvider }} {{ dnsApiKey }}
@@ -396,7 +356,7 @@
{% endif %}
{% endif %}
{% if customCert %}
tls /usr/local/etc/caddy/certificates/temp/{{ customCert }}.pem /usr/local/etc/caddy/certificates/temp/{{ customCert }}.key
tls /var/db/caddy/data/caddy/certificates/temp/{{ customCert }}.pem /var/db/caddy/data/caddy/certificates/temp/{{ customCert }}.key
{% endif %}
{% endmacro %}
@@ -406,28 +366,36 @@
rewrite * {{ handle.ToPath }}{uri}
{% endif %}
reverse_proxy {{ handle.ToDomain }}{% if handle.ToPort %}:{{ handle.ToPort }}{% endif %} {
{% if handle.HttpTls|default("0") == "1" %}
{% if handle.HttpNtlm|default("0") == "1" %}
transport http_ntlm {
tls
{% if handle.HttpTlsTrustedCaCerts %}
tls_trusted_ca_certs /usr/local/etc/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem
{% if handle.HttpTls|default("0") == "1" or handle.HttpTlsInsecureSkipVerify|default("0") == "1" %}
{% if handle.HttpNtlm|default("0") == "1" %}
transport http_ntlm {
{% if handle.HttpTlsInsecureSkipVerify|default("0") == "1" %}
tls_insecure_skip_verify
{% else %}
tls
{% if handle.HttpTlsTrustedCaCerts %}
tls_trusted_ca_certs /var/db/caddy/data/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem
{% endif %}
{% if handle.HttpTlsServerName %}
tls_server_name {{ handle.HttpTlsServerName }}
{% endif %}
{% endif %}
}
{% else %}
transport http {
{% if handle.HttpTlsInsecureSkipVerify|default("0") == "1" %}
tls_insecure_skip_verify
{% else %}
tls
{% if handle.HttpTlsTrustedCaCerts %}
tls_trusted_ca_certs /var/db/caddy/data/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem
{% endif %}
{% if handle.HttpTlsServerName %}
tls_server_name {{ handle.HttpTlsServerName }}
{% endif %}
{% endif %}
}
{% endif %}
{% if handle.HttpTlsServerName %}
tls_server_name {{ handle.HttpTlsServerName }}
{% endif %}
}
{% else %}
transport http {
tls
{% if handle.HttpTlsTrustedCaCerts %}
tls_trusted_ca_certs /usr/local/etc/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem
{% endif %}
{% if handle.HttpTlsServerName %}
tls_server_name {{ handle.HttpTlsServerName }}
{% endif %}
}
{% endif %}
{% endif %}
}
}
@@ -471,7 +439,7 @@
{% endif %}
{% set customCert = reverse.CustomCertificate|default("") %}
{% set dnsChallenge = reverse.DnsChallenge|default("0") %}
{{ tls_configuration(dnsProvider, dnsApiKey, customCert, dnsChallenge, dnsSecretApiKey, TlsDnsOptionalField1, TlsDnsOptionalField2, TlsDnsOptionalField3, TlsDnsOptionalField4, TlsDnsOptionalField5, TlsDnsOptionalField6) }}
{{ tls_configuration(dnsProvider, dnsApiKey, customCert, dnsChallenge, dnsSecretApiKey, TlsDnsOptionalField1, TlsDnsOptionalField2, TlsDnsOptionalField3, TlsDnsOptionalField4) }}
{% if not reverse.accesslist %}
{% set basicauth_uuids = reverse.basicauth %}