From ec4b328027e6e87ebab618834073fcd8f9b7bf06 Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Fri, 29 Nov 2024 17:31:30 +0100 Subject: [PATCH] www/caddy: Add h2c protocol to handler (#4369) * www/caddy: Add h2c protocol to handler * www/caddy: Hide tls options when http or h2c is selected * www/caddy: elif is better, reduce diff * www/caddy: Add comments for clarity --- .../mvc/app/models/OPNsense/Caddy/Caddy.xml | 1 + .../views/OPNsense/Caddy/reverse_proxy.volt | 4 +- .../templates/OPNsense/Caddy/Caddyfile | 58 +++++++++---------- 3 files changed, 33 insertions(+), 30 deletions(-) diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml index f1ef8c65d..04897e2f8 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml @@ -356,6 +356,7 @@ http:// https:// + h2c:// diff --git a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt index e98e921a0..2840c9b83 100644 --- a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt +++ b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt @@ -248,8 +248,9 @@ } }); + // Hide TLS specific options when http or h2c is selected $("#handle\\.HttpTls").change(function() { - if ($(this).val() === "0") { + if ($(this).val() != "1") { $(".style_tls").closest('tr').hide(); } else { $(".style_tls").closest('tr').show(); @@ -266,6 +267,7 @@ } }); + // Hide TLS specific options when http is selected $("#reverse\\.DisableTls").change(function() { if ($(this).val() === "1") { $(".style_tls").closest('tr').hide(); diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile index c25a36e04..ba29d7e26 100644 --- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile @@ -399,18 +399,28 @@ http://{{ domain }} { {% if handle.HandleDirective == "reverse_proxy" and handle.ToPath|default("") != "" %} rewrite * {{ handle.ToPath }}{uri} {% endif %} + {# http:// is the empty default #} + {% set protocol = 'https://' if handle.HttpTls == "1" else 'h2c://' if handle.HttpTls == "2" else '' -%} + {% set formatted_domains = [] -%} + {% for domain in handle.ToDomain.split(',') -%} + {% set is_ipv6 = (':' in domain and domain.count(':') >= 2) -%} + {% set formatted_domain = + ( '[' ~ domain ~ ']' if is_ipv6 else domain ) ~ + ( ':' ~ handle.ToPort if handle.ToPort else '' ) -%} + {% set _ = formatted_domains.append(protocol ~ formatted_domain) -%} + {% endfor -%} {% if handle.HandleDirective == "reverse_proxy" %} - {{ handle.HandleDirective }} {% for domain in handle.ToDomain.split(',') %} - {# Check if the domain is IPv6 and wrap in square brackets if necessary #} - {% set is_ipv6 = (':' in domain and domain.count(':') >= 2) %} - {# For each domain/IP, append the port if it's specified, followed by a space #} - {{- '[' if is_ipv6 else '' -}}{{ domain }}{{ ']' if is_ipv6 else '' -}}{% if handle.ToPort %}:{{ handle.ToPort }}{% endif %}{% if not loop.last %} {% endif %} - {% endfor %} { + {{ handle.HandleDirective }} {{ formatted_domains | join(' ') }} { {{ header_manipulation(handle) }} {% if handle.PassiveHealthFailDuration|default("") %} fail_duration {{ handle.PassiveHealthFailDuration }}s {% endif %} - {% set has_transport_options = handle.HttpVersion or handle.HttpKeepalive or handle.HttpTls|default("0") == "1" or handle.HttpTlsInsecureSkipVerify|default("0") == "1" or handle.HttpTlsTrustedCaCerts or handle.HttpTlsServerName %} + {% set has_transport_options = + handle.HttpVersion or + handle.HttpKeepalive or + handle.HttpTlsInsecureSkipVerify|default("0") == "1" or + handle.HttpTlsTrustedCaCerts or + handle.HttpTlsServerName -%} {% if has_transport_options %} {% if handle.HttpNtlm|default("0") == "1" %} transport http_ntlm { @@ -428,32 +438,22 @@ http://{{ domain }} { keepalive {{ handle.HttpKeepalive }}s {% endif %} {% endif %} - {% if handle.HttpTls|default("0") == "1" %} - tls - {% endif %} - {% if handle.HttpTlsInsecureSkipVerify|default("0") == "1" %} - tls_insecure_skip_verify - {% endif %} - {% if handle.HttpTlsTrustedCaCerts %} - tls_trust_pool file /var/db/caddy/data/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem - {% endif %} - {% if handle.HttpTlsServerName %} - tls_server_name {{ handle.HttpTlsServerName }} + {% if handle.HttpTls == "1" %} + {% if handle.HttpTlsInsecureSkipVerify|default("0") == "1" %} + tls_insecure_skip_verify + {% endif %} + {% if handle.HttpTlsTrustedCaCerts %} + tls_trust_pool file /var/db/caddy/data/caddy/certificates/temp/{{ handle.HttpTlsTrustedCaCerts }}.pem + {% endif %} + {% if handle.HttpTlsServerName %} + tls_server_name {{ handle.HttpTlsServerName }} + {% endif %} {% endif %} } {% endif %} } - {% else %} - {% set protocol = 'https://' if handle.HttpTls == "1" else 'http://' %} - {% set domain = handle.ToDomain.split(',')[0] %} - {% set is_ipv6 = (':' in domain and domain.count(':') >= 2) %} - {% set formatted_domain = ('[' ~ domain ~ ']') if is_ipv6 else domain %} - {% if handle.ToPort %} - {% set domain_with_port = formatted_domain ~ ':' ~ handle.ToPort %} - {% else %} - {% set domain_with_port = formatted_domain %} - {% endif %} - {{ handle.HandleDirective }} {{ protocol }}{{ domain_with_port }}{{ handle.ToPath|default("{uri}") }} + {% elif handle.HandleDirective == "redir" %} + {{ handle.HandleDirective }} {{ formatted_domains[0] }}{{ handle.ToPath|default("{uri}") }} {% endif %} } {% endmacro %}