Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

www/caddy: Allow bind to non standard ports #4069

Merged
merged 4 commits into from
Jul 3, 2024
Merged

www/caddy: Allow bind to non standard ports #4069

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6d4617a
www/caddy: Allow bind to default loopback interface and bind to non s…
Monviech Jun 30, 2024
0a7db08
www/caddy: Improve validation to include new custom ports. Remove wro…
Monviech Jun 30, 2024
af61c5d
Remove keys that are already defaults.
Monviech Jul 1, 2024
c4d7dae
Allowing WellKnown is wrong in this context.
Monviech Jul 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,22 @@
<type>checkbox</type>
<help><![CDATA[Enable or disable the Caddy web server.]]></help>
</field>
<field>
<id>caddy.general.HttpPort</id>
<label>HTTP Port</label>
<type>text</type>
<hint>80</hint>
<help><![CDATA[If the default HTTP port is changed to e.g. 8080, then a port forward from port 80 to 8080 is necessary to issue automatic certificates with the HTTP-01 challenge and serve clients the reverse proxied resources.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>caddy.general.HttpsPort</id>
<label>HTTPS Port</label>
<type>text</type>
<hint>443</hint>
<help><![CDATA[If the default HTTPS port is changed to e.g. 8443, then a port forward from port 443 to 8443 is necessary to issue automatic certificates with the TLS-ALPN-01 challenge and serve clients the reverse proxied resources.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>caddy.general.TlsEmail</id>
<label>ACME Email</label>
Expand Down
9 changes: 7 additions & 2 deletions www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,13 +129,18 @@ private function getWebGuiPorts()

private function checkWebGuiSettings($messages)
{
$overlap = array_intersect($this->getWebGuiPorts(), ['80', '443']);
// Get custom caddy ports if set. If empty, default to 80 and 443.
$httpPort = !empty((string)$this->general->HttpPort) ? (string)$this->general->HttpPort : '80';
$httpsPort = !empty((string)$this->general->HttpsPort) ? (string)$this->general->HttpsPort : '443';
$tlsAutoHttpsSetting = (string)$this->general->TlsAutoHttps;

// Check for conflicts
$overlap = array_intersect($this->getWebGuiPorts(), [$httpPort, $httpsPort]);

if (!empty($overlap) && $tlsAutoHttpsSetting !== 'off') {
$portOverlap = implode(', ', $overlap);
$messages->appendMessage(new Message(
sprintf(gettext('To use "Auto HTTPS", resolve these conflicting ports (%s) that are currently configured for the OPNsense WebGUI. Go to "System - Settings - Administration". To release port 80, enable "Disable web GUI redirect rule". To release port 443, change "TCP port" to a non-standard port, e.g., 8443.'), $portOverlap),
sprintf(gettext('To use "Auto HTTPS", resolve these conflicting ports (%s) that are currently configured for the OPNsense WebGUI. Go to "System - Settings - Administration". To release port 80, enable "Disable web GUI redirect rule". To release port %s, change "TCP port" to a non-standard port, e.g., 8443.'), $portOverlap, $httpsPort),
"general.TlsAutoHttps"
));
}
Expand Down
2 changes: 2 additions & 0 deletions www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@
<Default>0</Default>
<Required>Y</Required>
</enabled>
<HttpPort type="PortField"/>
<HttpsPort type="PortField"/>
<TlsEmail type="EmailField">
<ValidationMessage>Please enter a valid email address.</ValidationMessage>
</TlsEmail>
Expand Down
11 changes: 11 additions & 0 deletions www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,17 @@
{% endif %}
}

{# Change default ports on demand #}
{% set httpPort = generalSettings.HttpPort %}
{% set httpsPort = generalSettings.HttpsPort %}

{% if httpPort %}
http_port {{ httpPort }}
{% endif %}
{% if httpsPort %}
https_port {{ httpsPort }}
{% endif %}

{#
# Section: Global Trusted Proxy and Credential Logging
# Purpose: The trusted proxy section is important when using CDNs so that headers are trusted.
Expand Down