Deuxfleurs/garage

Fork 73

Website /check endpoint for Caddy/others #468

New issue

Closed

opened 2023-01-05 13:37:50 +00:00 by jpds · 5 comments

jpds commented

2023-01-05 13:37:50 +00:00

Contributor

Was reading the Caddy documentation when I came across the "On-Demand TLS" feature:

https://caddyserver.com/docs/automatic-https#using-on-demand-tls

They recommend that the backend that serves these dynamic FQDNs implement a small /check endpoint that verifies that the site is a valid one to be served:

https://caddy.community/t/serving-tens-of-thousands-of-domains-over-https-with-caddy/11179

Whilst a niche usecase (most people would just configure static domains) - could still be good to have the endpoint.

Was reading the Caddy documentation when I came across the "On-Demand TLS" feature: - https://caddyserver.com/docs/automatic-https#using-on-demand-tls They recommend that the backend that serves these dynamic FQDNs implement a small `/check` endpoint that verifies that the site is a valid one to be served: - https://caddy.community/t/serving-tens-of-thousands-of-domains-over-https-with-caddy/11179 Whilst a niche usecase (most people would just configure static domains) - could still be good to have the endpoint.

❤️ 1

jpds commented

2023-01-05 15:41:37 +00:00

Author

Contributor

Hmm, just found the authority_to_host() function already seems to listen on :3902's root, testing this out now.

Hmm, just found the `authority_to_host()` function already seems to listen on `:3902`'s root, testing this out now.

lx commented

2023-01-06 07:50:56 +00:00

Owner

We have /health on the admin API endpoint that is meant exactly for this, does it not work with Caddy ?

We have `/health` on the admin API endpoint that is meant exactly for this, does it not work with Caddy ?

jpds commented

2023-01-09 17:06:30 +00:00

Author

Contributor

Looking at the code in

fn handle_health(&self) -> Result<Response<Body>, Error> {

The /health endpoint seems better suited for an active health check in Caddy: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#active-health-checks

Whilst the /check endpoint Caddy purposes is more for "is this a valid domain for you to be serving before I request a TLS certificate for it?"

Looking at the code in https://git.deuxfleurs.fr/Deuxfleurs/garage/src/commit/02e8eb167efa1f08d69fe7f8e6192cde726c45aa/src/api/admin/api_server.rs#L80 The `/health` endpoint seems better suited for an active health check in Caddy: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#active-health-checks Whilst the `/check` endpoint Caddy purposes is more for "is this a valid domain for you to be serving before I request a TLS certificate for it?"

lx commented

2023-01-09 17:20:17 +00:00

Owner

It's not clear to me how Caddy transmits the domain name it wants to check to the /check endpoint, does it send the Host header as if it tried to actually access the website?

Also: is it OK for this endpoint to be implemented in the admin API endpoint, or does it have to be on the website endpiont? And can we use a path different than /check?

Thanks, I understand the difference now. This is definitely a valid feature request, we also do ondemand TLS with our custom reverse proxy (Tricot) and are vulnerable to the kind of attack described in the community thread. It's not clear to me how Caddy transmits the domain name it wants to check to the `/check` endpoint, does it send the `Host` header as if it tried to actually access the website? Also: is it OK for this endpoint to be implemented in the admin API endpoint, or does it have to be on the website endpiont? And can we use a path different than `/check`?

lx added the

labels 2023-01-09 17:20:30 +00:00

jpds commented

2023-01-09 17:29:54 +00:00

Author

Contributor

The PR that added this is at https://github.com/caddyserver/caddy/pull/1939 - it seems to send a domain field at the /check and looks for a 2XX response.

I think the admin API should be used - as a user might create a file called check in their bucket?

The PR that added this is at https://github.com/caddyserver/caddy/pull/1939 - it seems to send a `domain` field at the `/check` and looks for a `2XX` response. I think the admin API should be used - as a user might create a file called `check` in their bucket?

👍 1