From 64a38846959331313ac3b13a8484d267bf177c16 Mon Sep 17 00:00:00 2001
From: Monviech <79600909+Monviech@users.noreply.github.com>
Date: Sat, 10 Aug 2024 12:11:16 +0200
Subject: [PATCH] www/caddy: Add Disable Propagation Timeout in DNS Provider
 Tab. (#4170)

---
 www/caddy/Makefile                            |  2 +-
 www/caddy/pkg-descr                           |  4 +++
 .../OPNsense/Caddy/forms/dnsprovider.xml      | 11 ++++++++
 .../mvc/app/models/OPNsense/Caddy/Caddy.xml   |  1 +
 .../templates/OPNsense/Caddy/Caddyfile        | 26 ++++++++++++++-----
 5 files changed, 37 insertions(+), 7 deletions(-)

diff --git a/www/caddy/Makefile b/www/caddy/Makefile
index 1c2aedae1..8a8b2898e 100644
--- a/www/caddy/Makefile
+++ b/www/caddy/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		caddy
-PLUGIN_VERSION=		1.6.2
+PLUGIN_VERSION=		1.6.3
 PLUGIN_DEPENDS=		caddy-custom
 PLUGIN_COMMENT=		Easy to configure Reverse Proxy with Automatic HTTPS and Dynamic DNS
 PLUGIN_MAINTAINER=	cedrik@pischem.com
diff --git a/www/caddy/pkg-descr b/www/caddy/pkg-descr
index df004fa8c..570748fa5 100644
--- a/www/caddy/pkg-descr
+++ b/www/caddy/pkg-descr
@@ -28,6 +28,10 @@ DOC: https://docs.opnsense.org/manual/how-tos/caddy.html
 Plugin Changelog
 ================
 
+1.6.3
+
+* Add: Disable Propagation Timeout in DNS Provider Tab. This can help if the DNS Challenge fails due to DNS Propagation being too slow.
+
 1.6.2
 
 * Add: Authentik as authentication provider (contributed by Tim-Sc)
diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dnsprovider.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dnsprovider.xml
index 87fedb3ca..738419d5c 100644
--- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dnsprovider.xml
+++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dnsprovider.xml
@@ -46,4 +46,15 @@
         <type>text</type>
         <help><![CDATA[Leave empty if your DNS Provider isn't specified here. Field can be left empty if optional: Route53 "session_token".]]></help>
     </field>
+    <field>
+        <type>header</type>
+        <label>DNS Propagation</label>
+        <collapse>true</collapse>
+    </field>
+    <field>
+        <id>caddy.general.TlsDnsPropagationTimeout</id>
+        <label>Disable Propagation Timeout</label>
+        <type>checkbox</type>
+        <help><![CDATA[Propagation Timeout is a duration value that sets the maximum time to wait for the DNS TXT records to appear when using the DNS challenge. The default is 2 minutes. Disabling this will set propagation_timeout to -1 (checking propagation infinitely) and additionally set a propagation_delay of 30s (wait time before starting propagation checks). This can help when the DNS Challenge continues to fail because the local DNS Server does not know the new DNS TXT records yet in the default timeframe of 2 minutes.]]></help>
+    </field>
 </form>
diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
index d3c0d2ed2..f61d5c937 100644
--- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
+++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
@@ -69,6 +69,7 @@
             <TlsDnsOptionalField2 type="TextField"/>
             <TlsDnsOptionalField3 type="TextField"/>
             <TlsDnsOptionalField4 type="TextField"/>
+            <TlsDnsPropagationTimeout type="BooleanField"/>
             <accesslist type="ModelRelationField">
                 <Model>
                     <reverseproxy>
diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
index 2ee50d271..32d33f062 100644
--- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
+++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
@@ -318,19 +318,32 @@
 #   - @param dnsChallenge (boolean): Indicates if a DNS challenge is used for certificate authentication.
 #   - @param dnsSecretApiKey (string, optional): A secret API key or token for additional security, depending on the provider.
 #   - @param TlsDnsOptionalField1 to 4 (string, optional): Additional fields for specific DNS provider configurations.
+#   - @param TlsDnsPropagationTimeout (boolean, optional): Disables Propagation Timeout for DNS Challenge.
 #}
-{% macro tls_configuration(dnsProvider, dnsApiKey, customCert, dnsChallenge, dnsSecretApiKey, TlsDnsOptionalField1, TlsDnsOptionalField2, TlsDnsOptionalField3, TlsDnsOptionalField4) %}
+{% macro tls_configuration(dnsProvider, dnsApiKey, customCert, dnsChallenge, dnsSecretApiKey, TlsDnsOptionalField1, TlsDnsOptionalField2, TlsDnsOptionalField3, TlsDnsOptionalField4, TlsDnsPropagationTimeout) %}
     {% if dnsChallenge == "1" and dnsProvider %}
         {% if dnsProvider in dnsProviderSpecialConfig %}
             tls {
-                dns {{ dnsProvider }} {
-                    {% include "OPNsense/Caddy/includeDnsProvider" %}
+                issuer acme {
+                    dns {{ dnsProvider }} {
+                        {% include "OPNsense/Caddy/includeDnsProvider" %}
+                    }
+                    {% if TlsDnsPropagationTimeout|default("0") == "1" %}
+                        propagation_delay 30s
+                        propagation_timeout -1
+                    {% endif %}
                 }
             }
         {% else %}
             tls {
-                {# Other DNS Providers fall under this default #}
-                dns {{ dnsProvider }} {{ dnsApiKey }}
+                issuer acme {
+                    {# Other DNS Providers fall under this default #}
+                    dns {{ dnsProvider }} {{ dnsApiKey }}
+                    {% if TlsDnsPropagationTimeout|default("0") == "1" %}
+                        propagation_delay 30s
+                        propagation_timeout -1
+                    {% endif %}
+                }
             }
         {% endif %}
     {% endif %}
@@ -545,7 +558,8 @@
             {% endif %}
             {% set customCert = reverse.CustomCertificate|default("") %}
             {% set dnsChallenge = reverse.DnsChallenge|default("0") %}
-            {{ tls_configuration(dnsProvider, dnsApiKey, customCert, dnsChallenge, dnsSecretApiKey, TlsDnsOptionalField1, TlsDnsOptionalField2, TlsDnsOptionalField3, TlsDnsOptionalField4) }}
+            {% set TlsDnsPropagationTimeout = generalSettings.TlsDnsPropagationTimeout %}
+            {{ tls_configuration(dnsProvider, dnsApiKey, customCert, dnsChallenge, dnsSecretApiKey, TlsDnsOptionalField1, TlsDnsOptionalField2, TlsDnsOptionalField3, TlsDnsOptionalField4, TlsDnsPropagationTimeout) }}
 
             {% if not reverse.accesslist %}
                 {% set basicauth_uuids = reverse.basicauth %}