diff options
Diffstat (limited to 'internal/server/tls.go')
| -rw-r--r-- | internal/server/tls.go | 86 |
1 files changed, 52 insertions, 34 deletions
diff --git a/internal/server/tls.go b/internal/server/tls.go index fa9e69a..9481b6a 100644 --- a/internal/server/tls.go +++ b/internal/server/tls.go @@ -6,14 +6,14 @@ import ( "net" "net/http" "strconv" - "website/internal/listenfd" - "website/internal/log" + + "go.alanpearce.eu/x/listenfd" "github.com/ardanlabs/conf/v3" "github.com/caddyserver/caddy/v2" "github.com/caddyserver/certmagic" certmagic_redis "github.com/pberkel/caddy-storage-redis" - "github.com/pkg/errors" + "gitlab.com/tozd/go/errors" ) type redisConfig struct { @@ -25,37 +25,17 @@ type redisConfig struct { } func (s *Server) serveTLS() (err error) { - var issuer *certmagic.ACMEIssuer + log := s.log.Named("tls") + // setting cfg.Logger is too late somehow + certmagic.Default.Logger = log.GetLogger().Named("certmagic") cfg := certmagic.NewDefault() cfg.DefaultServerName = s.config.Domains[0] - issuer = &certmagic.DefaultACME + issuer := &certmagic.DefaultACME certmagic.DefaultACME.Agreed = true certmagic.DefaultACME.Email = s.config.Email - - ln, err := listenfd.GetListener( - 1, - net.JoinHostPort(s.runtimeConfig.ListenAddress, strconv.Itoa(s.runtimeConfig.Port)), - ) - if err != nil { - return errors.Wrap(err, "could not bind plain socket") - } - - go func(ln net.Listener) { - redirecter := http.NewServeMux() - redirecter.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { - if certmagic.LooksLikeHTTPChallenge(r) { - issuer.HandleHTTPChallenge(w, r) - } else { - s.redirectHandler(w, r) - } - }) - err := http.Serve(ln, redirecter) - if err != nil && !errors.Is(err, http.ErrServerClosed) { - log.Error("error in http handler", "error", err) - } - }(ln) + certmagic.DefaultACME.Logger = certmagic.Default.Logger if s.runtimeConfig.Development { ca := s.runtimeConfig.ACMECA @@ -76,16 +56,11 @@ func (s *Server) serveTLS() (err error) { // caddy's ACME server (step-ca) doesn't specify an OCSP server cfg.OCSP.DisableStapling = true - listenAddress := s.runtimeConfig.ListenAddress - if listenAddress[0] == '[' { - listenAddress = listenAddress[1 : len(listenAddress)-1] - } - issuer = certmagic.NewACMEIssuer(cfg, certmagic.ACMEIssuer{ CA: s.runtimeConfig.ACMECA, TrustedRoots: cp, DisableTLSALPNChallenge: true, - ListenHost: listenAddress, + ListenHost: s.runtimeConfig.ListenAddress, AltHTTPPort: s.runtimeConfig.Port, AltTLSALPNPort: s.runtimeConfig.TLSPort, }) @@ -113,6 +88,48 @@ func (s *Server) serveTLS() (err error) { } } + ln, err := listenfd.GetListener( + 1, + net.JoinHostPort(s.runtimeConfig.ListenAddress, strconv.Itoa(s.runtimeConfig.Port)), + log.Named("listenfd"), + ) + if err != nil { + return errors.Wrap(err, "could not bind plain socket") + } + + go func(ln net.Listener, srv *http.Server) { + httpMux := http.NewServeMux() + httpMux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { + if certmagic.LooksLikeHTTPChallenge(r) && issuer.HandleHTTPChallenge(w, r) { + return + } + url := r.URL + url.Scheme = "https" + port := s.config.BaseURL.Port() + if port == "" { + url.Host = r.Host + } else { + host, _, err := net.SplitHostPort(r.Host) + if err != nil { + log.Warn("error splitting host and port", "error", err) + host = r.Host + } + url.Host = net.JoinHostPort(host, s.config.BaseURL.Port()) + } + http.Redirect(w, r, url.String(), http.StatusMovedPermanently) + }) + srv.Handler = httpMux + + if err := srv.Serve(ln); err != nil && !errors.Is(err, http.ErrServerClosed) { + log.Error("error in http handler", "error", err) + } + }(ln, &http.Server{ + ReadHeaderTimeout: s.ReadHeaderTimeout, + ReadTimeout: s.ReadTimeout, + WriteTimeout: s.WriteTimeout, + IdleTimeout: s.IdleTimeout, + }) + log.Debug( "starting certmagic", "http_port", @@ -131,6 +148,7 @@ func (s *Server) serveTLS() (err error) { 0, net.JoinHostPort(s.runtimeConfig.ListenAddress, strconv.Itoa(s.runtimeConfig.TLSPort)), tlsConfig, + log.Named("listenfd"), ) if err != nil { return errors.Wrap(err, "could not bind tls socket") |