infrastructure/mox
1
0
Fork 0
mirror of https://github.com/mjl-/mox.git synced 2025-07-10 07:14:40 +03:00
Code Issues Packages Projects Releases Wiki Activity

also configure acme validation with http-01, and fix a bug that caused tls cert refresh at startup to not always run

Browse Source 
we already do acme tls-alpn-01 validation, and still require it (we could relax
this at some point). http-01 is easy to add.

the bug was that the list of acme managers and hosts to refresh was overwritten
by another listener. the listeners are a map, and we range over it, so the
order we handle them is random. if the public listener was handled first, and
an internal handler later, the list was reset again.
This commit is contained in:
Mechiel Lukkien
2023-03-10 17:55:37 +01:00
parent f60ad1452f
commit bddc8e4062
3 changed files with 28 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
http/web.go
View File

@ -189,7 +189,7 @@ type pathHandler struct {
Handle http.HandlerFunc
}
type serve struct {
Kinds []string // Type of handler and protocol (http/https).
Kinds []string // Type of handler and protocol (e.g. acme-tls-alpn-01, account-http, admin-https).
TLSConfig *tls.Config
PathHandlers []pathHandler // Sorted, longest first.
Webserver bool // Whether serving WebHandler. PathHandlers are always evaluated before WebHandlers.
@ -319,7 +319,7 @@ func Listen() {
if l.TLS != nil && l.TLS.ACME != "" && (l.SMTP.Enabled && !l.SMTP.NoSTARTTLS || l.Submissions.Enabled || l.IMAPS.Enabled) {
port := config.Port(mox.Conf.Static.ACME[l.TLS.ACME].Port, 443)
ensureServe(true, port, "acme-tls-alpn01")
ensureServe(true, port, "acme-tls-alpn-01")
}
if l.AccountHTTP.Enabled {
@ -405,16 +405,16 @@ func Listen() {
srv.Webserver = true
}
// We'll explicitly ensure these TLS certs exist (e.g. are created with ACME)
// immediately after startup. We only do so for our explicit listener hostnames,
// not for mta-sts DNS records, it can be requested on demand (perhaps never). We
// do request autoconfig, otherwise clients may run into their timeouts waiting for
// the certificate to be given during the first https connection.
ensureManagerHosts = map[*autotls.Manager]map[dns.Domain]struct{}{}
if l.TLS != nil && l.TLS.ACME != "" {
m := mox.Conf.Static.ACME[l.TLS.ACME].Manager
// If we are listening on port 80 for plain http, also register acme http-01
// validation handler.
if srv, ok := portServe[80]; ok && srv.TLSConfig == nil {
srv.Kinds = append(srv.Kinds, "acme-http-01")
srv.HandleFunc("acme-http-01", nil, "/.well-known/acme-challenge/", m.Manager.HTTPHandler(nil).ServeHTTP)
}
hosts := map[dns.Domain]struct{}{
mox.Conf.Static.HostnameDomain: {},
}
@ -467,7 +467,13 @@ func adminIndex(w http.ResponseWriter, r *http.Request) {
// functions to be launched in goroutine that will serve on a listener.
var servers []func()
var ensureManagerHosts map[*autotls.Manager]map[dns.Domain]struct{}
// We'll explicitly ensure these TLS certs exist (e.g. are created with ACME)
// immediately after startup. We only do so for our explicit listener hostnames,
// not for mta-sts DNS records, it can be requested on demand (perhaps never). We
// do request autoconfig, otherwise clients may run into their timeouts waiting for
// the certificate to be given during the first https connection.
var ensureManagerHosts = map[*autotls.Manager]map[dns.Domain]struct{}{}
// listen prepares a listener, and adds it to "servers", to be launched (if not running as root) through Serve.
func listen1(ip string, port int, tlsConfig *tls.Config, name string, kinds []string, handler http.Handler) {