Only the first visited https domain resolves correctly.

[thenbe]

https://foo.tailf123a.ts.net {
	bind tailscale/foo
	reverse_proxy localhost:3000
}

https://bar.tailf123a.ts.net {
	bind tailscale/bar
	reverse_proxy localhost:5000
}

Two domains are declared in the previous caddyfile. After starting caddy, only the first domain I visit will resolve correctly. The second one will never resolve. For example:

1. Start caddy.
2. Go to https://foo.tailf123a.ts.net
3. Caddy does its tls thing and I'm able to connect.
4. Now go to https://bar.tailf123a.ts.net.
5. Caddy this time tries to do a http-01 challenge. This always fails. We are unable to connect https://bar.tailf123a.ts.net.

If we restart caddy, and visit https://bar.tailf123a.ts.net first, then it works. But then we can never conenct to https://foo.tailf123a.ts.net because that will do a http-01 challenge which fails.

If we declare 3 tailscale https domains in the caddyfile, the first one we visit will resolve correctly and the other 2 always fail.

[willnorris]

I'll work on testing and reproducing, but I'm curious what happens if you manually specify the tailscale cert manager for each site:

https://foo.tailf123a.ts.net {
	bind tailscale/foo
	tls {
		get_certificate tailscale
	}
	reverse_proxy localhost:3000
}

https://bar.tailf123a.ts.net {
	bind tailscale/bar
	tls {
		get_certificate tailscale
	}
	reverse_proxy localhost:5000
}

Since you have the full hostname you shouldn't actually need that, but given that it's falling back to an http-01 challenge, it seems like the tailscale cert manager isn't getting used.

[willnorris]

Okay, I can definitely reproduce and I see the same http-01 challenge for the second site. It doesn't appear that manually setting the cert manager helps, which is weird. The simplest complete config I've got to reproduce the error:

{
  debug
  tailscale {
    ephemeral # create all nodes as ephemeral
  }
}

:443 {
  bind tailscale/caddytest
  tls {
    get_certificate tailscale
  }
  respond "Hello from caddytest"
}

:443 {
  bind tailscale/caddytest2
  tls {
    get_certificate tailscale
  }
  respond "Hello from caddytest2"
}

Debug output shows caddy trying to do http-01 then tls-apln-01 challenges. This looks like a caddy bug, but I'm still digging into it.

/cc @mholt @mohammed90 as fyi

[thenbe]

Yup I get the same results you did when I specify the tailscale cert manager for each site.

Meanwhile, if anyone else encounters this issue they can use this workaround for now:

{
  auto_https off
}

:80 {
	bind tailscale/foo
	reverse_proxy localhost:3000
}

:443 {
	bind tailscale+tls/foo
	reverse_proxy localhost:3000
}

:80 {
	bind tailscale/bar
	reverse_proxy localhost:5000
}

:443 {
	bind tailscale+tls/bar
	reverse_proxy localhost:5000
}

[willnorris]

okay, I've found the problem. While the localAPIDialer I added does correctly find the right tsnet server to connect to, it's only ever dialed on first connection (tscert only builds a single client).

We could possibly have localAPIDialer return a net.Conn that muxes reads and writes to the correct backend, but there's no context to mux on at that point. So I'm not immediately sure how I'll fix this 😕

Edit: instead of having a muxing net.Conn, I went the other way and added support to tscert to allow overriding the http.Transport.

[willnorris]

I think we can mark this as fixed by #67