Commit Graph

92 Commits

Author SHA1 Message Date
Gavin Chappell 7c0c385c94 opnsense/plugins#4402: configure custom permissions on caddy.sock (#4403) 2024-12-13 11:00:00 +01:00
Monviech b4e133bb39 www/caddy: Fix redirect regression (#4390)
www/caddy: Fix redirect regression, always attach http to redir instead of empty default
2024-12-10 08:47:27 +01:00
Franco Fichtner bb2ec32b0e www/caddy: remove sessionClose() 2024-12-10 08:18:10 +01:00
Monviech 6d79d32ea8 www/caddy: Fix wildcard certificate extraction for widget (#4385)
* www/caddy: Fix wildcard certificate extraction for widget

Co-authored-by: Franco Fichtner <franco@lastsummer.de>

---------

Co-authored-by: Franco Fichtner <franco@lastsummer.de>
2024-12-05 08:11:11 +01:00
Monviech 6bde751bc9 www/caddy: Add Load Balancing options to Reverse Proxy and Layer4 Proxy (#4379)
* www/caddy: Add Load Balancing options to Reverse Proxy and Layer4 Proxy

* www/caddy: Add Load Balancing options to Reverse Proxy and Layer4 Proxy

* Update www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml

Co-authored-by: Franco Fichtner <franco@lastsummer.de>

* www/caddy: Add changelog

---------

Co-authored-by: Franco Fichtner <franco@lastsummer.de>
2024-12-02 16:15:58 +01:00
Monviech 3913456755 www/caddy: widgets, hide unused certs, improve error handling (#4372)
* www/caddy: CaddyCertificate widget, compare certs on disk with configured hostnames and only display relevant ones

* www/caddy: Caddy Domain widget improve error handling
2024-12-02 14:40:35 +01:00
Monviech 088ab968c7 www/caddy: Add TLS termination to Layer4 Proxy (#4364)
* www/caddy: Add TLS termination to Layer4 Proxy

* www/caddy: Unhide important options from advanced and change position of new TerminateTls

* www/caddy: default in template is better, reduce diff

* www/caddy: Add changelog

* www/caddy: Improve UX of layer4 dialog, since it is unclear what happens when routing type is not exposed

* www/caddy: Make style
2024-11-29 17:49:44 +01:00
Monviech ec4b328027 www/caddy: Add h2c protocol to handler (#4369)
* www/caddy: Add h2c protocol to handler

* www/caddy: Hide tls options when http or h2c is selected

* www/caddy: elif is better, reduce diff

* www/caddy: Add comments for clarity
2024-11-29 17:31:30 +01:00
Monviech 5925be8c33 www/caddy: Refactor certificate extraction to Trust model (#4365)
* www/caddy: Refactor certificate extraction script to use model

* www/caddy: caddy_certs remove namespace, use load_phalcon, use getCaChain to get full chain
2024-11-29 10:45:45 +01:00
Monviech 50f261d4e5 www/caddy: Fix access list handle being the same duplicate string when appended to both wildcard and subdomain. (#4334) 2024-11-04 17:26:41 +01:00
Monviech 72e09d54d1 www/caddy: Add Layer4 openvpn, winbox and quic matcher (#4325)
* www/caddy: Add CRUD for Layer4 OpenVPN matcher with mode and static key support.

* www/caddy: Export static keys to the filesystem as uuid.key

* www/caddy: Remove validation that checks for multiple keys, help text is enough.

* www/caddy: Expand layer4 template for all supported OpenVPN modes.

* www/caddy: Prevent multiple static keys for modes other than crypt2_client. Fix helptexts.

* www/caddy: Add unique constraint to description of openvpn static key

* www/caddy: Changelog and version bump

* www/caddy: Make static key optional when choosing the tls mode in openvpn matcher

* www/caddy: Prepare new Layer7 Matcher Tab for more customizable matchers in the future.

* www/caddy: Add Layer4 QUIC matcher.

* www/caddy: Rename matcherTab

* www/caddy: Revert a4ea0cb3 since its non operational and will not be needed for a while anyway

* www/caddy: Changelog
2024-11-04 17:26:24 +01:00
Monviech e806ea3fd6 www/caddy: Remove default route from layer4 since its obsolete (#4323) 2024-11-04 17:25:09 +01:00
Monviech 72dfcfa12b www/caddy: Fix WebGUI ports validation (by removing it) (#4311)
* www/caddy: Remove WebGUI validation
2024-10-21 20:54:40 +02:00
Monviech 75702c050d www/caddy: Put Layer4 Proxy into own menu, cleanup reverse_proxy.volt (#4312)
* www/caddy: Move Layer4 tab to own Menu entry to make it less convoluted.

* www/caddy: Remove stray data-column-id

* www/caddy: Fix ACL for Layer4 menu

* www/caddy: Cleanup terminology of previous

* www/caddy: Rename Layer4 to Layer4 Proxy

* www/caddy: Cleanup reverse_proxy.volt. Remove Subdomain tab and add it to the Domains tab. Remove some of the hide logic for subdomains for brevity. Add clear all button for filter by domain selectpicker.

* www/caddy: Adjust helptext and remove style that is no longer needed due to change where subdomains are displayed

* www/caddy: Changelog and version bump

* www/caddy: Remove stray data-column-id in handle bootgrid, again
2024-10-21 17:02:36 +02:00
Franco Fichtner 4f9801f9de www/caddy: style fix 2024-10-16 08:31:10 +02:00
Monviech 30a1d4796e www/caddy: Complete Layer4 routing feature (#4281)
* www/caddy: Improve Layer 4 Routes to allow configurations outside the context of listener_wrappers, streaming and loadbalancing any TCP/UDP traffic on custom ports.

* www/caddy: Add validations for Layer 4 Routes.

* www/caddy: Control visibility of FromDomain in Layer4 based on Matcher. Remove need to always select * even when matcher does not support domains. Remove requirement for FromDomain, it is now validated based on selected Matcher.

* www/caddy: Cleanup validations, add isFieldChanged where applicable, removed weird old subdomain validation.

* www/caddy: Introduce InvertMatchers to invert any matchers, replacing the not tls sni matcher. Add HTTP and TLS without domain requirement as additional matchers. Add validations to ensure these matchers can not be chosen for listener_wrappers. Improve validations to ensure domain is empty when not using HTTP Host Header or TLS SNI Client Hello matchers.

* www/caddy: Bump model version. Add changelog.

* www/caddy: Since the prior validation demanded * and required FromDomain to be filled out, the new validation has to allow this too to avoid migration issues.

* www/caddy: Implement sequence number so rules can be sorted and be processed in custom order.
2024-10-08 13:00:43 +02:00
Monviech 07fae7ecf9 www/caddy: Add redir directive to HTTP Handler (#4263)
* www/caddy: Directive can be chosen in HTTP Handler, redir added to create HTTP redirects.

* www/caddy: Disable reverse_proxy specific fields when redir is chosen, these fields do not generate anything in the config even when they have been filled out. The disable property makes that clearer to the user. Unhide directive from advanced mode so its easier to create basic redirects. Clean up style names for consistency.

* www/caddy: HandleDirective does not need default in template
2024-09-29 09:11:58 +02:00
Monviech bd009e41c3 www/caddy: Force caddy to restart if a reload takes too long (#4261)
* www/caddy: Patch behavior of caddy hanging during a reload or restart in some circumstances. This will avoid caddy waiting indefinitely when the NTLM module is active. After the Grace Period is over, there is a hard kill and restart. Since the template already regenerated the configuration, the new one will be used when Caddy starts.

* www/caddy: Bump revision and add changelog
2024-09-27 19:48:51 +02:00
Monviech b8699cde8c www/caddy: Allow access lists in handlers (#4245)
* www/caddy: Allow access lists in handlers. The new unique_suffix constructs the named matcher so that it is always unique. Also small bug that the invert did not render was fixed.

* www/caddy: Create inline access list logic that matches in the scope of a handler before the reverse_proxy directive, effectively blocking connections on matched IPs before they process further.

* www/caddy: Rework access list feature to use a single macro and work the same in domains, subdomains and handlers. Remove abort statement from general settings since the new logic makes it mandatory.

* www/caddy: Actually add the new template to the commit

* www/caddy: Hide Access List Response Code in advanced mode, since abort is now the standard action. Add changelog.

* www/caddy: Remove default values from Access List Response, since abort is the default. Add it as hint to dialogAccessList. Fix two small bugs: Layer4 ports do not render since the generalSettings was missing, Subdomains do not have ports, so replace with description.
2024-09-22 09:53:55 +02:00
Monviech 7faded335d www/caddy: Handler and other dialogue form cleanup (#4242)
* www/caddy: Cleanup Handle, Domain and Layer4 dialogue. Convert all TLS checkboxes to dropdowns for consistency.

* www/caddy: Remove all hints from forms that do not imply a default value. Change the position of some options. Improve some help texts.

* www/caddy: Refactor dialogHandler to hide options based on selections or inside advanced mode.

* www/caddy: Remove boldness from tabs since it renders strange in some browsers. Change spot of HttpTls in handler.

* www/caddy: Add Access header with advanced mode.

* www/caddy: Final touches on the improved dialogHandle.

* www/caddy: Changelog

* www/caddy: Access is inside handler

* www/caddy: Caddy Domains widget opens links to domains in new tab.

* www/caddy: Improve Domain and Subdomain dialogue, rename Bootgrid options for consistency.

* www/caddy: Mark ACME as default.

* www/caddy: Last tweaks to dialogDomain.
2024-09-20 15:09:49 +02:00
Monviech d7569fda0f www/caddy: Add option to disable QUIC protocol (#4238)
* www/caddy: Add option to disable QUIC protocol

* Resolve all -Enable to Disable something- options into clear selectpickers. Simplify template that generates server options.

* www/caddy: Make new option fields totally backwards compatible to prior checkboxes. Shift two options around in the ReverseProxy form for clarity.
2024-09-14 20:20:05 +02:00
Monviech ea150f2e90 www/caddy: Fix api endpoints in widgets via lint-acl (#4234)
* www/caddy: Fix api endpoints in widgets via lint-acl.

* www/caddy: Add links to Metadata too.

* www/caddy: Use wildcards for api endpoints.

* Revert "www/caddy: Use wildcards for api endpoints."

This reverts commit 85d2027634c8e08ac18e723432d9b74c5d7facce.
2024-09-14 11:03:34 +02:00
Monviech bf45298f0c www/caddy: Typo in TlsInsecureSkipVerify condition prevents it from appearing if it is the only transport_http option. (#4237) 2024-09-13 20:55:20 +02:00
Monviech 61db9e7146 www/caddy: Remove old custom migration scripts (#4213)
* www/caddy: Remove old custom migration scripts

* www/caddy: Remove email validation since it made default migration fail due to an impossible condition at initial config creation
2024-09-03 17:09:58 +02:00
Monviech 0e03ffbd6f www/caddy: Refactor Caddyfile template to make it more dry (#4211)
* www/caddy: Refactor Caddyfile to make it more dry. All prior functionality remains the same.

* www/caddy: Fix typo in TlsInsecureSkipVerify
2024-09-03 07:08:28 +02:00