Deuxfleurs
/
garage
41
37
Fork 55
Code Issues 70 Pull Requests 6 Releases 29 Wiki Activity

Support {s3,web}.root_domains for the Caddy on-demand TLS endpoint (<admin>/check?domain=xx) #610

Merged
lx merged 1 commits from bug/support-root-domains-on-demand-tls into main 2023-08-28 09:18:14 +00:00
Conversation 1 Commits 1 Files Changed 5 +156 -35
quentin commented 2023-08-08 09:17:05 +00:00
Owner
Copy Link

Context

Tricot does not support DNS01 challenge, hence it does not support wildcard certificate,
hence we must provision simple certificates for vhost-style URL on S3 AND for people having no dedicated domain name and using our root domain (web.deuxfleurs.fr).

Furthermore, the S3 specification allows dots in bucket name, but not wildcard certificates. Amazon decided to not support domains with dots for websites and s3 vhost-style access but we are currently supporting it on our production deployment.

Conclusion: the on-demand TLS endpoint must not only support FQDN bucket on the web endpoint, but also buckets expanded with a root domain on the S3+Web endpoints.

Content of this PR

Extend the <admin>/check?domain=xx API endpoint to support domains built with the bucket name expanded with either the S3 or Web root_domain.
See the associated reference documentation for more detailed explanations.

Limitations

Buckets that are not in the global namespace are not supported.

## Context [Tricot](https://git.deuxfleurs.fr/Deuxfleurs/tricot) does not support DNS01 challenge, hence it does not support wildcard certificate, hence we must provision simple certificates for vhost-style URL on S3 AND for people having no dedicated domain name and using our root domain (`web.deuxfleurs.fr`). Furthermore, the S3 specification allows dots in bucket name, but not wildcard certificates. Amazon decided to not support domains with dots for websites and s3 vhost-style access but we are currently supporting it on our production deployment. **Conclusion:** the on-demand TLS endpoint must not only support FQDN bucket on the web endpoint, but also buckets expanded with a root domain on the S3+Web endpoints. ## Content of this PR Extend the `<admin>/check?domain=xx` API endpoint to support domains built with the bucket name expanded with either the S3 or Web `root_domain`. See the associated reference documentation for more detailed explanations. ## Limitations Buckets that are not in the global namespace are not supported.
quentin added the
Improvement
 label 2023-08-08 09:17:05 +00:00
quentin added 1 commit 2023-08-08 09:17:06 +00:00
continuous-integration/drone/push Build is passing Details
continuous-integration/drone/pr Build is passing Details
24e533f262
support {s3,web}.root_domains in /check endpoint
jpds reviewed 2023-08-16 10:15:56 +00:00
doc/book/reference-manual/admin-api.md
@ -47,0 +95,4 @@
- Otherwise, returns 404 Not Found, 400 Bad Request or 5xx requests.
*Note 1: because in the path-style URL mode, there is only one domain that is not known by Garage, hence it is not supported by this API endpoint.
You must manually declare the domain in your reverse-proxy. Idem for K2V.*
jpds commented 2023-08-16 10:15:56 +00:00
Contributor
Copy Link

This is not an English word - suggest replacing with "Similarly".

This is not an English word - suggest replacing with "Similarly".
lx commented 2023-08-28 09:18:08 +00:00
Owner
Copy Link

Thanks, great work, could be slightly refactored but the current version is fine.

Thanks, great work, could be slightly refactored but the current version is fine.
lx merged commit d539a56d3a into main 2023-08-28 09:18:14 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
AdminAPI

Issues concerning the administration API

  
Bug

   
Check AWS

The behaviour should be checked against AWS S3

  
CI

Issues with Nix, Drone, Rust Compiler, etc.

  
Correctness

Issues of theoretical correctness that may impact edge-case scenarios

  
Critical

   
Documentation

   
Ideas

For abstract ideas/proposal to make Garage better, to better communicate our not yet achieved aims

  
Improvement

   
Low priority

For issues that we don't want to spend time on until made absolutely necessary

  
Newcomer

A bug that should be newcomer friendly.

  
Performance

   
S3 Compatibility

   
Testing

   
Usability

Propositions to make Garage easier to operate, by improving error reporting, CLI, etc.

No Label
AdminAPI
Bug
Check AWS
CI
Correctness
Critical
Documentation
Ideas
Improvement
Low priority
Newcomer
Performance
S3 Compatibility
Testing
Usability
Milestone
Clear milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
3 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: Deuxfleurs/garage#610
No description provided.
Delete Branch "bug/support-root-domains-on-demand-tls"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?