From b3a6eca348be70ebd6fa61cee859c5f05b74ad82 Mon Sep 17 00:00:00 2001
From: Monviech <79600909+Monviech@users.noreply.github.com>
Date: Mon, 6 May 2024 16:05:10 +0200
Subject: [PATCH] www/caddy: template fix tls_server_name option (#3948)

* Update Caddyfile

It is allowed for these TLS Options to appear more freely inside the transport_http blocks without producing an invalid configuration.

For example, "tls_server_name" is not required to appear together with "tls"

* Update Caddy.xml

Ensure that when "NTLM" is chosen, TLS has to be enabled at the same time.
---
 .../mvc/app/models/OPNsense/Caddy/Caddy.xml   | 20 +++++++++++++++++--
 .../templates/OPNsense/Caddy/Caddyfile        | 16 ++++++++-------
 2 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
index f544f3c9b..d482aa4ba 100644
--- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
+++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
@@ -290,8 +290,24 @@
                     <MaximumValue>100</MaximumValue>
                     <ValidationMessage>Please enter a value between 1 to 100.</ValidationMessage>
                 </PassiveHealthFailDuration>
-                <HttpTls type="BooleanField"/>
-                <HttpNtlm type="BooleanField"/>
+                <HttpTls type="BooleanField">
+                    <Constraints>
+                        <check001>
+                            <ValidationMessage>TLS and NTLM must be enabled at the same time.</ValidationMessage>
+                            <type>DependConstraint</type>
+                            <addFields>
+                                <field1>HttpNtlm</field1>
+                            </addFields>
+                        </check001>
+                    </Constraints>
+                </HttpTls>
+                <HttpNtlm type="BooleanField">
+                    <Constraints>
+                        <check001>
+                            <reference>HttpNtlm.check001</reference>
+                        </check001>
+                    </Constraints>
+                </HttpNtlm>
                 <HttpTlsInsecureSkipVerify type="BooleanField"/>
                 <HttpTlsTrustedCaCerts type="CertificateField">
                     <Type>ca</Type>
diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
index c162a0bfd..7aa75d1dc 100644
--- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
+++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
@@ -523,34 +523,36 @@
             {% if handle.PassiveHealthFailDuration|default("") %}
             fail_duration {{ handle.PassiveHealthFailDuration }}s
             {% endif %}
-            {% if handle.HttpTls|default("0") == "1" or handle.HttpTlsInsecureSkipVerify|default("0") == "1" %}
+            {% if handle.HttpTls|default("0") == "1" or handle.HttpTlsInsecureSkipVerify|default("0") == "1" or handle.HttpTlsTrustedCaCerts|default("") != "" or handle.HttpTlsServerName|default("") != "" %}
                 {% if handle.HttpNtlm|default("0") == "1" %}
                 transport http_ntlm {
+                    {% if handle.HttpTls|default("0") == "1" %}
+                    tls
+                    {% endif %}
                     {% if handle.HttpTlsInsecureSkipVerify|default("0") == "1" %}
                     tls_insecure_skip_verify
-                    {% else %}
-                    tls
+                    {% endif %}
                     {% if handle.HttpTlsTrustedCaCerts %}
                     tls_trusted_ca_certs /var/db/caddy/data/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem
                     {% endif %}
                     {% if handle.HttpTlsServerName %}
                     tls_server_name {{ handle.HttpTlsServerName }}
                     {% endif %}
-                    {% endif %}
                 }
                 {% else %}
                 transport http {
+                    {% if handle.HttpTls|default("0") == "1" %}
+                    tls
+                    {% endif %}
                     {% if handle.HttpTlsInsecureSkipVerify|default("0") == "1" %}
                     tls_insecure_skip_verify
-                    {% else %}
-                    tls
+                    {% endif %}
                     {% if handle.HttpTlsTrustedCaCerts %}
                     tls_trusted_ca_certs /var/db/caddy/data/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem
                     {% endif %}
                     {% if handle.HttpTlsServerName %}
                     tls_server_name {{ handle.HttpTlsServerName }}
                     {% endif %}
-                    {% endif %}
                 }
                 {% endif %}
             {% endif %}