Turn on TLS automation

Author: liujed

app.go

@@ -9,6 +9,7 @@ import (
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
 	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
+	"github.com/caddyserver/caddy/v2/modules/caddytls"
 )
 
 func init() {
@@ -19,6 +20,9 @@ func init() {
 type App struct {
 	Handler
 
+	// The server's hostnames. Used for obtaining TLS certificates.
+	Hostnames []string `json:"hostnames"`
+
 	// The sockets on which to listen.
 	Listen []string `json:"listen"`
 
@@ -53,8 +57,19 @@ func (app *App) Provision(ctx caddy.Context) error {
 						Routes:            app.makeRoutes(),
 						TrustedProxiesRaw: app.TrustedProxiesRaw,
 
+						// Turn off HTTP-to-HTTPS redirection. It masks insecure client
+						// configurations.
+						AutoHTTPS: &caddyhttp.AutoHTTPSConfig{
+							DisableRedir: true,
+						},
+
 						// Turns on logging.
 						Logs: &caddyhttp.ServerLogConfig{},
+
+						// Turns on TLS.
+						TLSConnPolicies: caddytls.ConnectionPolicies{
+							&caddytls.ConnectionPolicy{},
+						},
 					},
 				},
 			},
@@ -80,6 +95,14 @@ func (app *App) Stop() error {
 func (app *App) makeRoutes() caddyhttp.RouteList {
 	return caddyhttp.RouteList{
 		{
+			MatcherSetsRaw: caddyhttp.RawMatcherSets{
+				{
+					"host": caddyconfig.JSON(
+						app.Hostnames,
+						nil,
+					),
+				},
+			},
 			HandlersRaw: []json.RawMessage{
 				caddyconfig.JSONModuleObject(
 					app.Handler,
@@ -101,3 +124,31 @@ func (app *App) makeRoutes() caddyhttp.RouteList {
 		},
 	}
 }
+
+// Returns a TLS app configuration that uses the user-specified DNS provider for
+// ACME challenges during TLS automation.
+func (app *App) MakeTLSConfig() caddytls.TLS {
+	return caddytls.TLS{
+		Automation: &caddytls.AutomationConfig{
+			Policies: []*caddytls.AutomationPolicy{
+				{
+					IssuersRaw: []json.RawMessage{
+						caddyconfig.JSONModuleObject(
+							caddytls.ACMEIssuer{
+								Challenges: &caddytls.ChallengesConfig{
+									DNS: &caddytls.DNSChallengeConfig{
+										ProviderRaw: app.DNS.ProviderRaw,
+										Resolvers:   app.DNS.Resolvers,
+									},
+								},
+							},
+							"module",
+							"acme",
+							nil,
+						),
+					},
+				},
+			},
+		},
+	}
+}

caddy_config.go

@@ -25,15 +25,20 @@ func caddyConfigFromConfigFile(path string) (*caddy.Config, error) {
 		config.Listen = []string{defaultListen}
 	}
 
+	appsRaw := caddy.ModuleMap{
+		"dns01proxy": caddyconfig.JSON(config, nil),
+
+		// Configure TLS automation to use the DNS provider.
+		"tls": caddyconfig.JSON(config.MakeTLSConfig(), nil),
+	}
+
 	return &caddy.Config{
 		Admin: &caddy.AdminConfig{
 			Disabled: true,
 			Config: &caddy.ConfigSettings{
 				Persist: ptr.Of(false),
 			},
 		},
-		AppsRaw: caddy.ModuleMap{
-			"dns01proxy": caddyconfig.JSON(config, nil),
-		},
+		AppsRaw: appsRaw,
 	}, nil
 }