diff --git a/www/caddy/Makefile b/www/caddy/Makefile index 95dd8078a..138ee9fee 100644 --- a/www/caddy/Makefile +++ b/www/caddy/Makefile @@ -1,7 +1,7 @@ PLUGIN_NAME= caddy -PLUGIN_VERSION= 1.5.2 +PLUGIN_VERSION= 1.5.3 PLUGIN_DEPENDS= caddy-custom -PLUGIN_COMMENT= Easy to configure Reverse Proxy based on Caddy with Automatic HTTPS and Dynamic DNS +PLUGIN_COMMENT= Easy to configure Reverse Proxy with Automatic HTTPS and Dynamic DNS PLUGIN_MAINTAINER= cedrik@pischem.com .include "../../Mk/plugins.mk" diff --git a/www/caddy/pkg-descr b/www/caddy/pkg-descr index 483ce846c..72f60a2da 100644 --- a/www/caddy/pkg-descr +++ b/www/caddy/pkg-descr @@ -19,9 +19,22 @@ Main features of this plugin: * Syslog-ng integration and HTTP Access Log * NTLM Transport +DOC: https://docs.opnsense.org/manual/how-tos/caddy.html + Plugin Changelog ================ +1.5.3 + +* Change from "Phalcon Messages" to "OPNsense Messages" in Caddy.php. +* Change default storage location from /usr/local/etc/caddy to /var/db/caddy/data/caddy/. +* Change description from "TextField" to "DescriptionField" in Caddy.xml model. +* Add tls_insecure_skip_verify to handlers. +* Add possibility to restart Caddy with the ACME Client by using "Automations - Run Command - System or Plugin Command". +* Add option to redirect the ACME HTTP-01 challenge to an upstream destination as advanced option in domains. +* Remove unmaintained DNS Providers: dnspod, hetzner, namesilo, vercel, alidns, metaname, openstack-designate. +* Cleanup dialogs and UI to present all options better. + 1.5.2 * Increased timeout of message area in reverse_proxy.volt and general.volt to 15 seconds. diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/Api/ReverseProxyController.php b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/Api/ReverseProxyController.php index a1d71c831..5236dfba9 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/Api/ReverseProxyController.php +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/Api/ReverseProxyController.php @@ -43,7 +43,7 @@ class ReverseProxyController extends ApiMutableModelControllerBase public function searchReverseProxyAction() { - return $this->searchBase("reverseproxy.reverse", ['enabled', 'FromDomain', 'FromPort', 'accesslist', 'basicauth', 'DnsChallenge', 'CustomCertificate', 'AccessLog', 'DynDns', 'description']); + return $this->searchBase("reverseproxy.reverse", ['enabled', 'FromDomain', 'FromPort', 'accesslist', 'basicauth', 'DnsChallenge', 'CustomCertificate', 'AccessLog', 'DynDns', 'AcmePassthrough', 'description']); } public function setReverseProxyAction($uuid) @@ -109,7 +109,7 @@ class ReverseProxyController extends ApiMutableModelControllerBase public function searchHandleAction() { - return $this->searchBase("reverseproxy.handle", ['enabled', 'reverse', 'subdomain', 'HandleType', 'HandlePath', 'ToDomain', 'ToPort', 'ToPath', 'HttpTls', 'HttpTlsTrustedCaCerts', 'HttpTlsServerName', 'HttpNtlm', 'description']); + return $this->searchBase("reverseproxy.handle", ['enabled', 'reverse', 'subdomain', 'HandleType', 'HandlePath', 'ToDomain', 'ToPort', 'ToPath', 'HttpTls', 'HttpTlsTrustedCaCerts', 'HttpTlsServerName', 'HttpNtlm', 'HttpTlsInsecureSkipVerify', 'description']); } public function setHandleAction($uuid) diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml index 26bb9cacb..68ac76a59 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml @@ -7,73 +7,70 @@ handle.reverse - + dropdown handle.subdomain - + dropdown - - true + handle.HandleType dropdown - + true handle.HandlePath text - - true + + + + handle.description + + text + + + + header + handle.ToDomain - + text 192.168.1.1 - + handle.ToPort - + text - 443 - - true + 80 + handle.ToPath - + text - + true + + header + + true + handle.HttpTls checkbox - - true - - - handle.HttpTlsTrustedCaCerts - - dropdown - - true - - - handle.HttpTlsServerName - - text - - true + handle.HttpNtlm @@ -83,9 +80,22 @@ true - handle.description - + handle.HttpTlsInsecureSkipVerify + + checkbox + + true + + + handle.HttpTlsTrustedCaCerts + + dropdown + + + + handle.HttpTlsServerName + text - + diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml index 16699cf3a..a849f3593 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml @@ -7,59 +7,17 @@ reverse.FromDomain - + text example.com reverse.FromPort - + text 443 - true - - - reverse.accesslist - - dropdown - - true - - - reverse.basicauth - - select_multiple - 5 - - true - - - reverse.DnsChallenge - - checkbox - - - - reverse.DynDns - - checkbox - - - - reverse.CustomCertificate - - dropdown - - true - - - reverse.AccessLog - - checkbox - - true reverse.description @@ -68,4 +26,64 @@ example.com.443 + + header + + true + + + reverse.DynDns + + checkbox + + + + header + + true + + + reverse.DnsChallenge + + checkbox + + + + reverse.AcmePassthrough + + text + + true + + + reverse.CustomCertificate + + dropdown + + + + header + + true + + + reverse.accesslist + + dropdown + + + + reverse.basicauth + + select_multiple + 5 + + + + reverse.AccessLog + + checkbox + + diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml index a43e961ee..4aeace28a 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogSubdomain.xml @@ -7,45 +7,23 @@ subdomain.reverse - + dropdown subdomain.FromDomain - + text opn.example.com subdomain.FromPort - + text 443 - true - - - subdomain.accesslist - - dropdown - - true - - - subdomain.basicauth - - select_multiple - 5 - - true - - - subdomain.DynDns - - checkbox - subdomain.description @@ -54,4 +32,33 @@ opn.example.com.443 + + header + + true + + + subdomain.DynDns + + checkbox + + + + header + + true + + + subdomain.accesslist + + dropdown + + + + subdomain.basicauth + + select_multiple + 5 + + diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dnsprovider.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dnsprovider.xml index ad963b984..cd6f75bf7 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dnsprovider.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dnsprovider.xml @@ -9,55 +9,41 @@ caddy.general.TlsDnsApiKey text - + + + + header + + true caddy.general.TlsDnsSecretApiKey text - - true + caddy.general.TlsDnsOptionalField1 text - - true + caddy.general.TlsDnsOptionalField2 text - - true + caddy.general.TlsDnsOptionalField3 text - - true + caddy.general.TlsDnsOptionalField4 text - - true - - - caddy.general.TlsDnsOptionalField5 - - text - - true - - - caddy.general.TlsDnsOptionalField6 - - text - - true + diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dynamicdns.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dynamicdns.xml index d57c17e57..d7fa66ef1 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dynamicdns.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dynamicdns.xml @@ -1,17 +1,9 @@
- caddy.general.DynDnsSimpleHttp - - text - - true - - - caddy.general.DynDnsInterface - + caddy.general.DynDnsIpVersions + dropdown - - true + caddy.general.DynDnsCheckInterval @@ -19,16 +11,27 @@ text - - caddy.general.DynDnsIpVersions - - dropdown - - caddy.general.DynDnsTTL text + + header + + true + + + caddy.general.DynDnsSimpleHttp + + text + + + + caddy.general.DynDnsInterface + + dropdown + +
diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml index b00d7085e..e17e87026 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml @@ -18,16 +18,16 @@ dropdown - - caddy.general.abort - - checkbox - - caddy.general.accesslist dropdown + + caddy.general.abort + + checkbox + + diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/logsettings.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/logsettings.xml index 5af8a9a14..022ce6ca0 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/logsettings.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/logsettings.xml @@ -10,7 +10,6 @@ checkbox - true caddy.general.LogAccessPlainKeep @@ -18,6 +17,5 @@ 10 text - true diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php index e9bbb97df..953f284fb 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php @@ -31,7 +31,7 @@ namespace OPNsense\Caddy; use OPNsense\Base\BaseModel; -use Phalcon\Messages\Message; +use OPNsense\Base\Messages\Message; class Caddy extends BaseModel { diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml index 89bc764fb..3d8497fd3 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml @@ -1,7 +1,7 @@ //Pischem/caddy A GUI model for configuring a reverse proxy in the Caddy web server. - 1.1.4 + 1.1.5 @@ -26,8 +26,6 @@ Cloudflare Duck DNS DigitalOcean - DNSPod - Hetzner GoDaddy Gandi IONOS @@ -35,19 +33,14 @@ Porkbun Route53 ACME-DNS - Alidns Google Cloud DNS Azure - OpenStack Designate OVH Namecheap Netlify - Namesilo PowerDNS - Vercel DDNSS Njalla - Metaname Linode Tencent Cloud Dinahosting @@ -61,8 +54,6 @@ - - @@ -146,15 +137,17 @@ Y - + Y - /^([\t\n\v\f\r 0-9a-zA-Z.,_*-\x{00A0}-\x{FFFF}]){1,255}$/u - Please provide a valid description. + + Please enter a valid 'to' domain or IP address. + Y + @@ -200,10 +193,8 @@ Y - + Y - /^([\t\n\v\f\r 0-9a-zA-Z.,_-\x{00A0}-\x{FFFF}]){1,255}$/u - Please provide a valid description. @@ -259,6 +250,7 @@ + ca @@ -269,10 +261,7 @@ Y N - - /^([\t\n\v\f\r 0-9a-zA-Z.,_-\x{00A0}-\x{FFFF}]){1,255}$/u - Please provide a valid description. - + @@ -289,10 +278,7 @@ Please enter valid IP address(es) or network(s), separated by commas. - - /^([\t\n\v\f\r 0-9a-zA-Z.,_*-\x{00A0}-\x{FFFF}]){1,255}$/u - Please provide a valid description. - + @@ -303,10 +289,7 @@ Y - - /^([\t\n\v\f\r 0-9a-zA-Z.,_-\x{00A0}-\x{FFFF}]){1,255}$/u - Please provide a valid description. - + diff --git a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt index 1ba868a24..92aaac25d 100644 --- a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt +++ b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt @@ -166,6 +166,7 @@ Dynamic DNS HTTP Access Log Custom Certificate + HTTP-01 redirection Description Commands @@ -232,14 +233,15 @@ Domain Subdomain Handle Type - Handle Path - Backend Domain - Backend Port - Backend Path + Handle Path + Upstream Domain + Upstream Port + Upstream Path TLS TLS CA TLS Server Name NTLM + TLS Insecure Skip Verify Description Commands diff --git a/www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php b/www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php index f4f0f6bf6..0f6078b46 100755 --- a/www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php +++ b/www/caddy/src/opnsense/scripts/OPNsense/Caddy/caddy_certs.php @@ -29,13 +29,11 @@ */ require_once("config.inc"); -require_once("certs.inc"); -require_once("legacy_bindings.inc"); use OPNsense\Core\Config; $configObj = Config::getInstance()->object(); -$temp_dir = '/usr/local/etc/caddy/certificates/temp/'; +$temp_dir = '/var/db/caddy/data/caddy/certificates/temp/'; function extract_and_save_certificates($configObj, $temp_dir) { @@ -68,9 +66,7 @@ function extract_and_save_certificates($configObj, $temp_dir) // Save the certificate chain and private key file_put_contents($temp_dir . $cert_refid . '.pem', $cert_chain); - chmod($temp_dir . $cert_refid . '.pem', 0600); file_put_contents($temp_dir . $cert_refid . '.key', $key_content); - chmod($temp_dir . $cert_refid . '.key', 0600); } // Traverse through CA certificates and save them @@ -80,7 +76,6 @@ function extract_and_save_certificates($configObj, $temp_dir) // Save the CA certificate file_put_contents($temp_dir . $ca_refid . '.pem', $ca_content); - chmod($temp_dir . $ca_refid . '.pem', 0600); } } diff --git a/www/caddy/src/opnsense/scripts/OPNsense/Caddy/setup.sh b/www/caddy/src/opnsense/scripts/OPNsense/Caddy/setup.sh index 6ee35ebb7..334bd5672 100755 --- a/www/caddy/src/opnsense/scripts/OPNsense/Caddy/setup.sh +++ b/www/caddy/src/opnsense/scripts/OPNsense/Caddy/setup.sh @@ -2,37 +2,25 @@ # Define directories CADDY_DIR="/usr/local/etc/caddy" -CADDY_ACME_DIR="${CADDY_DIR}/acme" -CADDY_CERTS_DIR="${CADDY_DIR}/certificates/temp" -CADDY_OCSP_DIR="${CADDY_DIR}/ocsp" -CADDY_LOCKS_DIR="${CADDY_DIR}/locks" +CADDY_CERTS_DIR="/var/db/caddy/data/caddy/certificates/temp" CADDY_LOG_DIR="/var/log/caddy/access" CADDY_CONF_DIR="${CADDY_DIR}/caddy.d" -# Create Caddy configuration directories with appropriate permissions -mkdir -p "${CADDY_DIR}" -mkdir -p "${CADDY_ACME_DIR}" +# Create custom directories with appropriate permissions mkdir -p "${CADDY_CERTS_DIR}" -mkdir -p "${CADDY_OCSP_DIR}" -mkdir -p "${CADDY_LOCKS_DIR}" -mkdir -p "${CADDY_CONF_DIR}" +chown -R root:wheel "${CADDY_CERTS_DIR}" +chmod -R 600 "${CADDY_CERTS_DIR}" -# Set permissions for Caddy configuration directories -chown -R root:wheel "${CADDY_DIR}" -chmod -R 750 "${CADDY_DIR}" - -# Create Caddy log directory mkdir -p "${CADDY_LOG_DIR}" - -# Set permissions for Caddy log directory chown -R root:wheel "${CADDY_LOG_DIR}" chmod -R 750 "${CADDY_LOG_DIR}" +mkdir -p "${CADDY_CONF_DIR}" +chown -R root:wheel "${CADDY_CONF_DIR}" +chmod -R 750 "${CADDY_CONF_DIR}" + # Format and overwrite the Caddyfile (cd "${CADDY_DIR}" && /usr/local/bin/caddy fmt --overwrite) # Write custom certs from the OPNsense Trust Store into a directory where Caddy can read them /usr/local/opnsense/scripts/OPNsense/Caddy/caddy_certs.php - -# Optional Debug message -# echo "Caddy installation completed. All caddy directories and files created successfully." diff --git a/www/caddy/src/opnsense/service/conf/actions.d/actions_caddy.conf b/www/caddy/src/opnsense/service/conf/actions.d/actions_caddy.conf index 764809f8e..28b10be8d 100644 --- a/www/caddy/src/opnsense/service/conf/actions.d/actions_caddy.conf +++ b/www/caddy/src/opnsense/service/conf/actions.d/actions_caddy.conf @@ -15,6 +15,7 @@ command:/usr/local/opnsense/scripts/OPNsense/Caddy/caddy_control.py restart parameters: type:script message:Reloading Caddy configuration +description:Restart Caddy service [validate] command:/usr/local/opnsense/scripts/OPNsense/Caddy/caddy_control.py validate diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile index 079d3a19e..e0e84bc72 100644 --- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile @@ -4,9 +4,6 @@ # Global Options { - storage file_system { - root /usr/local/etc/caddy - } log { {% if generalSettings.LogAccessPlain|default("0") == "0" %} {% for reverse in helpers.toList('Pischem.caddy.reverseproxy.reverse') %} @@ -57,8 +54,6 @@ {% set dnsOptionalField2 = generalSettings.TlsDnsOptionalField2 %} {% set dnsOptionalField3 = generalSettings.TlsDnsOptionalField3 %} {% set dnsOptionalField4 = generalSettings.TlsDnsOptionalField4 %} - {% set dnsOptionalField5 = generalSettings.TlsDnsOptionalField5 %} - {% set dnsOptionalField6 = generalSettings.TlsDnsOptionalField6 %} {% set dynDnsSimpleHttp = generalSettings.DynDnsSimpleHttp %} {% set dynDnsInterface = generalSettings.DynDnsInterface %} {% set dynDnsCheckInterval = generalSettings.DynDnsCheckInterval %} @@ -85,7 +80,7 @@ {% if dnsProvider and dnsProvider != "none" and dnsProvider != "acmedns" and dynDnsDomains|length > 0 %} dynamic_dns { - {% if dnsProvider in ['porkbun', 'desec', 'route53', 'alidns', 'googleclouddns', 'azure', 'openstack-designate', 'ovh', 'namecheap', 'powerdns', 'ddnss', 'linode', 'tencentcloud', 'dinahosting', 'hexonet', 'mailinabox'] %} + {% if dnsProvider in ['porkbun', 'desec', 'route53', 'googleclouddns', 'azure', 'ovh', 'namecheap', 'powerdns', 'ddnss', 'linode', 'tencentcloud', 'dinahosting', 'hexonet', 'mailinabox'] %} provider {{ dnsProvider }} { {% if dnsProvider == 'porkbun' %} {% if dnsApiKey %}api_key {{ dnsApiKey }} @@ -108,11 +103,6 @@ {% endif %} {% if dnsOptionalField4 %}token {{ dnsOptionalField4 }} {% endif %} - {% elif dnsProvider == 'alidns' %} - {% if dnsApiKey %}access_key_id {{ dnsApiKey }} - {% endif %} - {% if dnsSecretApiKey %}access_key_secret {{ dnsSecretApiKey }} - {% endif %} {% elif dnsProvider == 'googleclouddns' %} {% if dnsApiKey %}gcp_project {{ dnsApiKey }} {% endif %} @@ -127,23 +117,6 @@ {% endif %} {% if dnsOptionalField3 %}resource_group_name {{ dnsOptionalField3 }} {% endif %} - {% elif dnsProvider == 'openstack-designate' %} - {% if dnsApiKey %}region_name {{ dnsApiKey }} - {% endif %} - {% if dnsSecretApiKey %}tenant_id {{ dnsSecretApiKey }} - {% endif %} - {% if dnsOptionalField1 %}identity_api_version {{ dnsOptionalField1 }} - {% endif %} - {% if dnsOptionalField2 %}password {{ dnsOptionalField2 }} - {% endif %} - {% if dnsOptionalField3 %}username {{ dnsOptionalField3 }} - {% endif %} - {% if dnsOptionalField4 %}tenant_name {{ dnsOptionalField4 }} - {% endif %} - {% if dnsOptionalField5 %}auth_url {{ dnsOptionalField5 }} - {% endif %} - {% if dnsOptionalField6 %}endpoint_type {{ dnsOptionalField6 }} - {% endif %} {% elif dnsProvider == 'ovh' %} {% if dnsApiKey %}endpoint {{ dnsApiKey }} {% endif %} @@ -204,8 +177,6 @@ {% endif %} {% endif %} } - {% elif dnsProvider in ['metaname'] %} - provider {{ dnsProvider }} {{ dnsApiKey }} {{ dnsSecretApiKey }} {% else %} provider {{ dnsProvider }} {{ dnsApiKey }} {% endif %} @@ -248,9 +219,24 @@ } # Reverse Proxy Configuration -{% macro tls_configuration(dnsProvider, dnsApiKey, customCert, dnsChallenge, dnsSecretApiKey, TlsDnsOptionalField1, TlsDnsOptionalField2, TlsDnsOptionalField3, TlsDnsOptionalField4, TlsDnsOptionalField5, TlsDnsOptionalField6) %} + +{% for reverse in helpers.toList('Pischem.caddy.reverseproxy.reverse') %} + {% if reverse.enabled|default("0") == "1" and reverse.AcmePassthrough %} + # HTTP-01 challenge redirection for domain: "{{ reverse['@uuid'] }}" + http://{{ reverse.FromDomain|default("") }} { + handle /.well-known/acme-challenge/* { + reverse_proxy {{ reverse.AcmePassthrough }} + } + handle { + redir https://{host}{uri} 308 + } + } + {% endif %} +{% endfor %} + +{% macro tls_configuration(dnsProvider, dnsApiKey, customCert, dnsChallenge, dnsSecretApiKey, TlsDnsOptionalField1, TlsDnsOptionalField2, TlsDnsOptionalField3, TlsDnsOptionalField4) %} {% if dnsChallenge == "1" and dnsProvider and dnsProvider != "none" %} - {% if dnsProvider in ['duckdns', 'porkbun', 'desec', 'route53', 'acmedns', 'alidns', 'googleclouddns', 'azure', 'openstack-designate', 'ovh', 'namecheap', 'powerdns', 'ddnss', 'linode', 'tencentcloud', 'dinahosting', 'hexonet', 'mailinabox'] %} + {% if dnsProvider in ['duckdns', 'porkbun', 'desec', 'route53', 'acmedns', 'googleclouddns', 'azure', 'ovh', 'namecheap', 'powerdns', 'ddnss', 'linode', 'tencentcloud', 'dinahosting', 'hexonet', 'mailinabox'] %} tls { dns {{ dnsProvider }} { {% if dnsProvider == 'duckdns' %} @@ -288,11 +274,6 @@ {% endif %} {% if dnsOptionalField2 %}server_url {{ dnsOptionalField2 }} {% endif %} - {% elif dnsProvider == 'alidns' %} - {% if dnsApiKey %}access_key_id {{ dnsApiKey }} - {% endif %} - {% if dnsSecretApiKey %}access_key_secret {{ dnsSecretApiKey }} - {% endif %} {% elif dnsProvider == 'googleclouddns' %} {% if dnsApiKey %}gcp_project {{ dnsApiKey }} {% endif %} @@ -307,23 +288,6 @@ {% endif %} {% if dnsOptionalField3 %}resource_group_name {{ dnsOptionalField3 }} {% endif %} - {% elif dnsProvider == 'openstack-designate' %} - {% if dnsApiKey %}region_name {{ dnsApiKey }} - {% endif %} - {% if dnsSecretApiKey %}tenant_id {{ dnsSecretApiKey }} - {% endif %} - {% if dnsOptionalField1 %}identity_api_version {{ dnsOptionalField1 }} - {% endif %} - {% if dnsOptionalField2 %}password {{ dnsOptionalField2 }} - {% endif %} - {% if dnsOptionalField3 %}username {{ dnsOptionalField3 }} - {% endif %} - {% if dnsOptionalField4 %}tenant_name {{ dnsOptionalField4 }} - {% endif %} - {% if dnsOptionalField5 %}auth_url {{ dnsOptionalField5 }} - {% endif %} - {% if dnsOptionalField6 %}endpoint_type {{ dnsOptionalField6 }} - {% endif %} {% elif dnsProvider == 'ovh' %} {% if dnsApiKey %}endpoint {{ dnsApiKey }} {% endif %} @@ -385,10 +349,6 @@ {% endif %} } } - {% elif dnsProvider in ['metaname'] %} - tls { - dns {{ dnsProvider }} {{ dnsApiKey }} {{ dnsSecretApiKey }} - } {% else %} tls { dns {{ dnsProvider }} {{ dnsApiKey }} @@ -396,7 +356,7 @@ {% endif %} {% endif %} {% if customCert %} - tls /usr/local/etc/caddy/certificates/temp/{{ customCert }}.pem /usr/local/etc/caddy/certificates/temp/{{ customCert }}.key + tls /var/db/caddy/data/caddy/certificates/temp/{{ customCert }}.pem /var/db/caddy/data/caddy/certificates/temp/{{ customCert }}.key {% endif %} {% endmacro %} @@ -406,28 +366,36 @@ rewrite * {{ handle.ToPath }}{uri} {% endif %} reverse_proxy {{ handle.ToDomain }}{% if handle.ToPort %}:{{ handle.ToPort }}{% endif %} { - {% if handle.HttpTls|default("0") == "1" %} - {% if handle.HttpNtlm|default("0") == "1" %} - transport http_ntlm { - tls - {% if handle.HttpTlsTrustedCaCerts %} - tls_trusted_ca_certs /usr/local/etc/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem + {% if handle.HttpTls|default("0") == "1" or handle.HttpTlsInsecureSkipVerify|default("0") == "1" %} + {% if handle.HttpNtlm|default("0") == "1" %} + transport http_ntlm { + {% if handle.HttpTlsInsecureSkipVerify|default("0") == "1" %} + tls_insecure_skip_verify + {% else %} + tls + {% if handle.HttpTlsTrustedCaCerts %} + tls_trusted_ca_certs /var/db/caddy/data/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem + {% endif %} + {% if handle.HttpTlsServerName %} + tls_server_name {{ handle.HttpTlsServerName }} + {% endif %} + {% endif %} + } + {% else %} + transport http { + {% if handle.HttpTlsInsecureSkipVerify|default("0") == "1" %} + tls_insecure_skip_verify + {% else %} + tls + {% if handle.HttpTlsTrustedCaCerts %} + tls_trusted_ca_certs /var/db/caddy/data/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem + {% endif %} + {% if handle.HttpTlsServerName %} + tls_server_name {{ handle.HttpTlsServerName }} + {% endif %} + {% endif %} + } {% endif %} - {% if handle.HttpTlsServerName %} - tls_server_name {{ handle.HttpTlsServerName }} - {% endif %} - } - {% else %} - transport http { - tls - {% if handle.HttpTlsTrustedCaCerts %} - tls_trusted_ca_certs /usr/local/etc/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem - {% endif %} - {% if handle.HttpTlsServerName %} - tls_server_name {{ handle.HttpTlsServerName }} - {% endif %} - } - {% endif %} {% endif %} } } @@ -471,7 +439,7 @@ {% endif %} {% set customCert = reverse.CustomCertificate|default("") %} {% set dnsChallenge = reverse.DnsChallenge|default("0") %} - {{ tls_configuration(dnsProvider, dnsApiKey, customCert, dnsChallenge, dnsSecretApiKey, TlsDnsOptionalField1, TlsDnsOptionalField2, TlsDnsOptionalField3, TlsDnsOptionalField4, TlsDnsOptionalField5, TlsDnsOptionalField6) }} + {{ tls_configuration(dnsProvider, dnsApiKey, customCert, dnsChallenge, dnsSecretApiKey, TlsDnsOptionalField1, TlsDnsOptionalField2, TlsDnsOptionalField3, TlsDnsOptionalField4) }} {% if not reverse.accesslist %} {% set basicauth_uuids = reverse.basicauth %}