www/caddy: Add option to disable TLS in domain (#4077)

* www/caddy: Add option to disable TLS for a domain. Add new validation to ensure conflicting TLS options can not be selected.

* www/caddy: Add changelog.

* www/caddy: Invert the logic, make TLS activation a checkbox that is enabled by default. Standard migration will take care of this. This makes the TLS checkbox in domains behave the same as in handlers, improving consistency.

* www/caddy: Change logic again, going back to the original plan to use DisableTls for a domain. This way, the default can be empty.

* www/caddy: Only validate if field DisableTLS has changed.

* www/caddy: Remove sprintf since it does nothing here.

www/caddy/pkg-descr

@@ -34,6 +34,7 @@ Plugin Changelog
 * Add: Introduce HTTP version to handler. HTTP/1.1, HTTP/2 and HTTP/3 can be chosen.
 * Add: HTTP Keepalive can be set in a handler.
 * Change: Option "tls_trusted_ca_certs" is now "tls_trust_pool".
+* Add: TLS can be deactivated in a domain.
 
 1.5.7
 

www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml

@@ -42,6 +42,12 @@
         <label>Trust</label>
         <collapse>true</collapse>
     </field>
+    <field>
+        <id>reverse.DisableTls</id>
+        <label>Disable TLS</label>
+        <type>checkbox</type>
+        <help><![CDATA[Disable HTTP over TLS (HTTPS) for this domain. When disabling TLS, automatic certificate management will be disabled and all traffic to and from this domain will be unencrypted.]]></help>
+    </field>
     <field>
         <id>reverse.DnsChallenge</id>
         <label>DNS-01 Challenge</label>

www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php

@@ -160,6 +160,35 @@ class Caddy extends BaseModel
         }
     }
 
+    // 5. Prevent the usage of conflicting options when TLS is deactivated for a Domain
+    private function checkDisableTlsConflicts($messages)
+    {
+        foreach ($this->reverseproxy->reverse->iterateItems() as $item) {
+            // First check if the DisableTls field has been changed
+            if ($item->isFieldChanged('DisableTls')) {
+                if ((string) $item->DisableTls === '1') {
+                    $conflictChecks = [
+                        'DnsChallenge' => (string) $item->DnsChallenge === '1',
+                        'AcmePassthrough' => !empty((string) $item->AcmePassthrough),
+                        'CustomCertificate' => !empty((string) $item->CustomCertificate)
+                    ];
+
+                    $conflictFields = array_keys(array_filter($conflictChecks));
+
+                    if (!empty($conflictFields)) {
+                        $messages->appendMessage(new Message(
+                            gettext(
+                                'TLS cannot be disabled if one of the following options are used: ' .
+                                '"DNS-01 Challenge", "HTTP-01 Challenge Redirection" and "Custom Certificate"'
+                            ),
+                            $item->__reference . ".DisableTls"
+                        ));
+                    }
+                }
+            }
+        }
+    }
+
     // Perform the actual validation
     public function performValidation($validateFullModel = false)
     {
@@ -172,6 +201,8 @@ class Caddy extends BaseModel
         $this->checkWebGuiSettings($messages);
         // 4. Check for ACME Email requirement
         $this->checkAcmeEmailAutoHttps($messages);
+        // 5. Check for TLS conflicts in Domain
+        $this->checkDisableTlsConflicts($messages);
 
         return $messages;
     }

www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml

@@ -193,6 +193,7 @@
                     <ValidationMessage>Please enter a valid 'to' domain or IP address.</ValidationMessage>
                     <IpAllowed>Y</IpAllowed>
                 </AcmePassthrough>
+                <DisableTls type="BooleanField"/>
             </reverse>
             <subdomain type="ArrayField">
                 <enabled type="BooleanField">

www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt

@@ -262,6 +262,7 @@
                             <th data-column-id="AccessLog" data-type="boolean" data-formatter="boolean" data-visible="false">{{ lang._('HTTP Access Log') }}</th>
                             <th data-column-id="CustomCertificate" data-type="string" data-visible="false">{{ lang._('Custom Certificate') }}</th>
                             <th data-column-id="AcmePassthrough" data-type="string" data-visible="false">{{ lang._('HTTP-01 redirection') }}</th>
+                            <th data-column-id="DisableTls" data-type="boolean" data-formatter="boolean" data-visible="false">{{ lang._('Disable TLS') }}</th>
                             <th data-column-id="description" data-type="string">{{ lang._('Description') }}</th>
                             <th data-column-id="commands" data-width="7em" data-formatter="commands" data-sortable="false">{{ lang._('Commands') }}</th>
                         </tr>

www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile

@@ -484,7 +484,8 @@
 {% for reverse in helpers.toList('Pischem.caddy.reverseproxy.reverse') %}
 {% if reverse.enabled|default("0") == "1" %}
 # Reverse Proxy Domain: "{{ reverse['@uuid'] }}"
-{{ reverse.FromDomain|default("") }}{% if reverse.FromPort %}:{{ reverse.FromPort }}{% endif %} {
+{# The default are encrypted connections, uncencrypted connections have to render http:// #}
+{% if reverse.DisableTls|default("0") == "1" %}http://{% endif %}{{ reverse.FromDomain|default("") }}{% if reverse.FromPort %}:{{ reverse.FromPort }}{% endif %} {
     {% if reverse.AccessLog|default("0") == "1" %}
     {% if generalSettings.LogAccessPlain|default("0") == "0" %}
     log {{ reverse['@uuid'] }}