2021-01-25 08:37:35 +09:00
|
|
|
// Copyright 2020 The Gitea Authors. All rights reserved.
|
|
|
|
// Use of this source code is governed by a MIT-style
|
|
|
|
// license that can be found in the LICENSE file.
|
|
|
|
|
|
|
|
package cmd
|
|
|
|
|
|
|
|
import (
|
|
|
|
"net/http"
|
2021-05-13 04:58:55 +09:00
|
|
|
"strconv"
|
2021-01-25 08:37:35 +09:00
|
|
|
"strings"
|
|
|
|
|
2022-01-01 18:43:28 +09:00
|
|
|
"code.gitea.io/gitea/modules/graceful"
|
2021-01-25 08:37:35 +09:00
|
|
|
"code.gitea.io/gitea/modules/log"
|
|
|
|
"code.gitea.io/gitea/modules/setting"
|
|
|
|
|
|
|
|
"github.com/caddyserver/certmagic"
|
|
|
|
)
|
|
|
|
|
|
|
|
func runLetsEncrypt(listenAddr, domain, directory, email string, m http.Handler) error {
|
|
|
|
// If HTTP Challenge enabled, needs to be serving on port 80. For TLSALPN needs 443.
|
2021-07-08 20:38:13 +09:00
|
|
|
// Due to docker port mapping this can't be checked programmatically
|
2021-01-25 08:37:35 +09:00
|
|
|
// TODO: these are placeholders until we add options for each in settings with appropriate warning
|
|
|
|
enableHTTPChallenge := true
|
|
|
|
enableTLSALPNChallenge := true
|
2021-05-13 04:58:55 +09:00
|
|
|
altHTTPPort := 0
|
2021-05-14 23:39:10 +09:00
|
|
|
altTLSALPNPort := 0
|
2021-05-13 04:58:55 +09:00
|
|
|
|
|
|
|
if p, err := strconv.Atoi(setting.PortToRedirect); err == nil {
|
|
|
|
altHTTPPort = p
|
|
|
|
}
|
2021-05-14 23:39:10 +09:00
|
|
|
if p, err := strconv.Atoi(setting.HTTPPort); err == nil {
|
|
|
|
altTLSALPNPort = p
|
|
|
|
}
|
2021-01-25 08:37:35 +09:00
|
|
|
|
|
|
|
magic := certmagic.NewDefault()
|
|
|
|
magic.Storage = &certmagic.FileStorage{Path: directory}
|
|
|
|
myACME := certmagic.NewACMEManager(magic, certmagic.ACMEManager{
|
|
|
|
Email: email,
|
|
|
|
Agreed: setting.LetsEncryptTOS,
|
|
|
|
DisableHTTPChallenge: !enableHTTPChallenge,
|
|
|
|
DisableTLSALPNChallenge: !enableTLSALPNChallenge,
|
2021-05-14 23:39:10 +09:00
|
|
|
ListenHost: setting.HTTPAddr,
|
|
|
|
AltTLSALPNPort: altTLSALPNPort,
|
2021-05-13 04:58:55 +09:00
|
|
|
AltHTTPPort: altHTTPPort,
|
2021-01-25 08:37:35 +09:00
|
|
|
})
|
|
|
|
|
2021-04-23 05:42:33 +09:00
|
|
|
magic.Issuers = []certmagic.Issuer{myACME}
|
2021-01-25 08:37:35 +09:00
|
|
|
|
|
|
|
// this obtains certificates or renews them if necessary
|
2022-01-01 18:43:28 +09:00
|
|
|
err := magic.ManageSync(graceful.GetManager().HammerContext(), []string{domain})
|
2021-01-25 08:37:35 +09:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
tlsConfig := magic.TLSConfig()
|
2021-07-14 02:17:46 +09:00
|
|
|
tlsConfig.NextProtos = append(tlsConfig.NextProtos, "h2")
|
2021-01-25 08:37:35 +09:00
|
|
|
|
2021-11-20 15:12:43 +09:00
|
|
|
if version := toTLSVersion(setting.SSLMinimumVersion); version != 0 {
|
|
|
|
tlsConfig.MinVersion = version
|
|
|
|
}
|
|
|
|
if version := toTLSVersion(setting.SSLMaximumVersion); version != 0 {
|
|
|
|
tlsConfig.MaxVersion = version
|
|
|
|
}
|
|
|
|
|
|
|
|
// Set curve preferences
|
|
|
|
if curves := toCurvePreferences(setting.SSLCurvePreferences); len(curves) > 0 {
|
|
|
|
tlsConfig.CurvePreferences = curves
|
|
|
|
}
|
|
|
|
|
|
|
|
// Set cipher suites
|
|
|
|
if ciphers := toTLSCiphers(setting.SSLCipherSuites); len(ciphers) > 0 {
|
|
|
|
tlsConfig.CipherSuites = ciphers
|
|
|
|
}
|
|
|
|
|
2021-01-25 08:37:35 +09:00
|
|
|
if enableHTTPChallenge {
|
|
|
|
go func() {
|
|
|
|
log.Info("Running Let's Encrypt handler on %s", setting.HTTPAddr+":"+setting.PortToRedirect)
|
|
|
|
// all traffic coming into HTTP will be redirect to HTTPS automatically (LE HTTP-01 validation happens here)
|
2022-01-21 02:46:10 +09:00
|
|
|
err := runHTTP("tcp", setting.HTTPAddr+":"+setting.PortToRedirect, "Let's Encrypt HTTP Challenge", myACME.HTTPChallengeHandler(http.HandlerFunc(runLetsEncryptFallbackHandler)))
|
2021-01-25 08:37:35 +09:00
|
|
|
if err != nil {
|
|
|
|
log.Fatal("Failed to start the Let's Encrypt handler on port %s: %v", setting.PortToRedirect, err)
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
}
|
|
|
|
|
2021-11-03 09:33:54 +09:00
|
|
|
return runHTTPSWithTLSConfig("tcp", listenAddr, "Web", tlsConfig, m)
|
2021-01-25 08:37:35 +09:00
|
|
|
}
|
|
|
|
|
|
|
|
func runLetsEncryptFallbackHandler(w http.ResponseWriter, r *http.Request) {
|
|
|
|
if r.Method != "GET" && r.Method != "HEAD" {
|
|
|
|
http.Error(w, "Use HTTPS", http.StatusBadRequest)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
// Remove the trailing slash at the end of setting.AppURL, the request
|
|
|
|
// URI always contains a leading slash, which would result in a double
|
|
|
|
// slash
|
|
|
|
target := strings.TrimSuffix(setting.AppURL, "/") + r.URL.RequestURI()
|
|
|
|
http.Redirect(w, r, target, http.StatusFound)
|
|
|
|
}
|