Stowage/caddy
2
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2025-10-19 15:53:17 +00:00
Code Issues Projects Releases Packages Wiki Activity

caddytls: fix regression in external certificate manager support (#7179)

Browse source 
revert changes to automation.go from e276994174
This commit is contained in:
avery 2025-08-13 16:30:26 +01:00 • committed by GitHub
parent 09b53a753c
commit b898873b90
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
modules/caddytls/automation.go
View file

@ -173,6 +173,9 @@ type AutomationPolicy struct {
subjects []string subjects []string
magic *certmagic.Config magic *certmagic.Config
storage certmagic.Storage storage certmagic.Storage
// Whether this policy had explicit managers configured directly on it.
hadExplicitManagers bool
} }
// Provision sets up ap and builds its underlying CertMagic config. // Provision sets up ap and builds its underlying CertMagic config.
@ -209,9 +212,8 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
// store them on the policy before putting it on the config // store them on the policy before putting it on the config
// load and provision any cert manager modules // load and provision any cert manager modules
var hadExplicitManagers bool
if ap.ManagersRaw != nil { if ap.ManagersRaw != nil {
hadExplicitManagers = true ap.hadExplicitManagers = true
vals, err := tlsApp.ctx.LoadModule(ap, "ManagersRaw") vals, err := tlsApp.ctx.LoadModule(ap, "ManagersRaw")
if err != nil { if err != nil {
return fmt.Errorf("loading external certificate manager modules: %v", err) return fmt.Errorf("loading external certificate manager modules: %v", err)
@ -271,9 +273,9 @@ func (ap *AutomationPolicy) Provision(tlsApp *TLS) error {
// prevent issuance from Issuers (when Managers don't provide a certificate) if there's no // prevent issuance from Issuers (when Managers don't provide a certificate) if there's no
// permission module configured // permission module configured
noProtections := ap.isWildcardOrDefault() && !ap.onlyInternalIssuer() && (tlsApp.Automation == nil || tlsApp.Automation.OnDemand == nil || tlsApp.Automation.OnDemand.permission == nil) noProtections := ap.isWildcardOrDefault() && !ap.onlyInternalIssuer() && (tlsApp.Automation == nil || tlsApp.Automation.OnDemand == nil || tlsApp.Automation.OnDemand.permission == nil)
failClosed := noProtections && !hadExplicitManagers // don't allow on-demand issuance (other than implicit managers) if no managers have been explicitly configured failClosed := noProtections && !ap.hadExplicitManagers // don't allow on-demand issuance (other than implicit managers) if no managers have been explicitly configured
if noProtections { if noProtections {
if !hadExplicitManagers { if !ap.hadExplicitManagers {
// no managers, no explicitly-configured permission module, this is a config error // no managers, no explicitly-configured permission module, this is a config error
return fmt.Errorf("on-demand TLS cannot be enabled without a permission module to prevent abuse; please refer to documentation for details") return fmt.Errorf("on-demand TLS cannot be enabled without a permission module to prevent abuse; please refer to documentation for details")
} }