Skip to content

Commit 11f0ef8

Browse files
LecrisUTLecrisUT
committed
Refactor setting.go https settings, renamed options and variables, and documented app.example.ini
Signed-off-by: Cristian Le <[email protected]>
1 parent eb2dc85 commit 11f0ef8

File tree

4 files changed

+84
-37
lines changed

4 files changed

+84
-37
lines changed

‎cmd/web.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -222,8 +222,8 @@ func listen(m http.Handler, handleRedirector bool) error {
222222
}
223223
err = runHTTP("tcp", listenAddr, "Web", m)
224224
case setting.HTTPS:
225-
if setting.EnableLetsEncrypt {
226-
err = runLetsEncrypt(listenAddr, setting.Domain, setting.LetsEncryptDirectory, setting.LetsEncryptEmail, m)
225+
if setting.EnableAcme {
226+
err = runLetsEncrypt(listenAddr, setting.Domain, setting.AcmeLiveDirectory, setting.AcmeEmail, m)
227227
break
228228
}
229229
if handleRedirector {

‎cmd/web_letsencrypt.go renamed to ‎cmd/web_acme.go

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -38,25 +38,25 @@ func runLetsEncrypt(listenAddr, domain, directory, email string, m http.Handler)
3838
magic := certmagic.NewDefault()
3939
magic.Storage = &certmagic.FileStorage{Path: directory}
4040
// Try to use private CA root if provided, otherwise defaults to system's trust
41-
var CertPool *x509.CertPool = nil
42-
if setting.ACMECARoot != "" {
43-
r, err := ioutil.ReadFile(setting.ACMECARoot)
41+
var certPool *x509.CertPool
42+
if setting.AcmeCARoot != "" {
43+
r, err := ioutil.ReadFile(setting.AcmeCARoot)
4444
if err != nil {
45-
log.Warn("Failed to read CARoot certificate, using default CA trust: %v", err)
45+
log.Warn("Failed to read CA Root certificate, using default CA trust: %v", err)
4646
} else {
4747
block, _ := pem.Decode(r)
48-
CARoot, err := x509.ParseCertificate(block.Bytes)
48+
caRoot, err := x509.ParseCertificate(block.Bytes)
4949
if err != nil {
50-
log.Warn("Failed to parse CARoot certificate, using default CA trust: %v", err)
50+
log.Warn("Failed to parse CA Root certificate, using default CA trust: %v", err)
5151
} else {
52-
CertPool = x509.NewCertPool()
53-
CertPool.AddCert(CARoot)
52+
certPool = x509.NewCertPool()
53+
certPool.AddCert(caRoot)
5454
}
5555
}
5656
}
5757
myACME := certmagic.NewACMEManager(magic, certmagic.ACMEManager{
58-
CA: setting.ACMECAURL,
59-
TrustedRoots: CertPool,
58+
CA: setting.AcmeURL,
59+
TrustedRoots: certPool,
6060
Email: email,
6161
Agreed: setting.LetsEncryptTOS,
6262
DisableHTTPChallenge: !enableHTTPChallenge,

‎custom/conf/app.example.ini

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,32 @@ RUN_MODE = ; prod
175175
;OFFLINE_MODE = false
176176
;DISABLE_ROUTER_LOG = false
177177
;;
178+
;; TLS Settings: Either ACME or manual
179+
;; (Other common TLS configuration are found before)
180+
;ENABLE_ACME = false
181+
;;
182+
;; ACME automatic TLS settings:
183+
;;
184+
;; ACME directory URL (e.g. LetsEncrypt's staging/testing URL: https://acme-staging-v02.api.letsencrypt.org/directory)
185+
;; Leave empty to default to LetsEncrypt's (production) URL
186+
;ACME_URL =
187+
;;
188+
;; If using LetsEncrypt please read their TOS and manually change this setting to true
189+
;LETSENCRYPT_ACCEPTTOS = false
190+
;;
191+
;; If the ACME CA is not in your system's CA trust chain, it can be manually added here
192+
;ACME_CA_ROOT =
193+
;;
194+
;; Email used for the ACME registration service
195+
;; Can be left blank to initialize at first run and use the cached value
196+
;ACME_EMAIL =
197+
;;
198+
;; ACME live directory (not to be confused with ACME directory URL: ACME_URL)
199+
;; (Refer to caddy's ACME manager https://github.com/caddyserver/certmagic)
200+
;ACME_DIRECTORY = https
201+
;;
202+
;;
203+
;; Manual TLS settings: (Only applicable if ENABLE_ACME=false)
178204
;; Generate steps:
179205
;; $ ./gitea cert -ca=true -duration=8760h0m0s -host=myhost.example.com
180206
;;

‎modules/setting/setting.go

Lines changed: 46 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -109,12 +109,12 @@ var (
109109
UnixSocketPermission uint32
110110
EnablePprof bool
111111
PprofDataPath string
112-
EnableLetsEncrypt bool
112+
EnableAcme bool
113113
LetsEncryptTOS bool
114-
LetsEncryptDirectory string
115-
LetsEncryptEmail string
116-
ACMECAURL string
117-
ACMECARoot string
114+
AcmeLiveDirectory string
115+
AcmeEmail string
116+
AcmeURL string
117+
AcmeCARoot string
118118
SSLMinimumVersion string
119119
SSLMaximumVersion string
120120
SSLCurvePreferences []string
@@ -624,14 +624,49 @@ func loadFromConf(allowEmpty bool, extraConfig string) {
624624
switch protocolCfg {
625625
case "https":
626626
Protocol = HTTPS
627-
CertFile = sec.Key("CERT_FILE").String()
628-
KeyFile = sec.Key("KEY_FILE").String()
629-
if !filepath.IsAbs(CertFile) && len(CertFile) > 0 {
630-
CertFile = filepath.Join(CustomPath, CertFile)
627+
// FIXME: DEPRECATED to be removed in v1.18.0
628+
if sec.HasKey("ENABLE_ACME") {
629+
EnableAcme = sec.Key("ENABLE_ACME").MustBool(false)
630+
} else {
631+
deprecatedSetting("server", "ENABLE_LETSENCRYPT", "server", "ENABLE_ACME")
632+
EnableAcme = sec.Key("ENABLE_LETSENCRYPT").MustBool(false)
631633
}
632-
if !filepath.IsAbs(KeyFile) && len(KeyFile) > 0 {
633-
KeyFile = filepath.Join(CustomPath, KeyFile)
634+
if EnableAcme {
635+
AcmeURL = sec.Key("ACME_URL").MustString("")
636+
AcmeCARoot = sec.Key("ACME_CA_ROOT").MustString("")
637+
LetsEncryptTOS = sec.Key("LETSENCRYPT_ACCEPTTOS").MustBool(false)
638+
// The TOS is only required when using LetsEncrypt
639+
if AcmeURL == "" && !LetsEncryptTOS {
640+
log.Fatal("Let's Encrypt TOS (LETSENCRYPT_ACCEPTTOS) is not accepted. Either accept it or configure a different ACME provider (ACME_URL)")
641+
}
642+
// FIXME: DEPRECATED to be removed in v1.18.0
643+
if sec.HasKey("ACME_DIRECTORY") {
644+
AcmeLiveDirectory = sec.Key("ACME_DIRECTORY").MustString("https")
645+
} else {
646+
deprecatedSetting("server", "LETSENCRYPT_DIRECTORY", "server", "ACME_DIRECTORY")
647+
AcmeLiveDirectory = sec.Key("LETSENCRYPT_DIRECTORY").MustString("https")
648+
}
649+
// FIXME: DEPRECATED to be removed in v1.18.0
650+
if sec.HasKey("ACME_EMAIL") {
651+
AcmeEmail = sec.Key("ACME_EMAIL").MustString("")
652+
} else {
653+
deprecatedSetting("server", "LETSENCRYPT_EMAIL", "server", "ACME_EMAIL")
654+
AcmeEmail = sec.Key("LETSENCRYPT_EMAIL").MustString("")
655+
}
656+
} else {
657+
CertFile = sec.Key("CERT_FILE").String()
658+
KeyFile = sec.Key("KEY_FILE").String()
659+
if !filepath.IsAbs(CertFile) && len(CertFile) > 0 {
660+
CertFile = filepath.Join(CustomPath, CertFile)
661+
}
662+
if !filepath.IsAbs(KeyFile) && len(KeyFile) > 0 {
663+
KeyFile = filepath.Join(CustomPath, KeyFile)
664+
}
634665
}
666+
SSLMinimumVersion = sec.Key("SSL_MIN_VERSION").MustString("")
667+
SSLMaximumVersion = sec.Key("SSL_MAX_VERSION").MustString("")
668+
SSLCurvePreferences = sec.Key("SSL_CURVE_PREFERENCES").Strings(",")
669+
SSLCipherSuites = sec.Key("SSL_CIPHER_SUITES").Strings(",")
635670
case "fcgi":
636671
Protocol = FCGI
637672
case "fcgi+unix", "unix", "http+unix":
@@ -655,20 +690,6 @@ func loadFromConf(allowEmpty bool, extraConfig string) {
655690
HTTPAddr = filepath.Join(AppWorkPath, HTTPAddr)
656691
}
657692
}
658-
EnableLetsEncrypt = sec.Key("ENABLE_LETSENCRYPT").MustBool(false)
659-
ACMECAURL = sec.Key("ACME_CAURL").MustString("")
660-
ACMECARoot = sec.Key("ACME_CARoot").MustString("")
661-
LetsEncryptTOS = sec.Key("LETSENCRYPT_ACCEPTTOS").MustBool(false)
662-
if !LetsEncryptTOS && EnableLetsEncrypt {
663-
log.Warn("Failed to enable Let's Encrypt due to Let's Encrypt TOS not being accepted")
664-
EnableLetsEncrypt = false
665-
}
666-
LetsEncryptDirectory = sec.Key("LETSENCRYPT_DIRECTORY").MustString("https")
667-
LetsEncryptEmail = sec.Key("LETSENCRYPT_EMAIL").MustString("")
668-
SSLMinimumVersion = sec.Key("SSL_MIN_VERSION").MustString("")
669-
SSLMaximumVersion = sec.Key("SSL_MAX_VERSION").MustString("")
670-
SSLCurvePreferences = sec.Key("SSL_CURVE_PREFERENCES").Strings(",")
671-
SSLCipherSuites = sec.Key("SSL_CIPHER_SUITES").Strings(",")
672693
GracefulRestartable = sec.Key("ALLOW_GRACEFUL_RESTARTS").MustBool(true)
673694
GracefulHammerTime = sec.Key("GRACEFUL_HAMMER_TIME").MustDuration(60 * time.Second)
674695
StartupTimeout = sec.Key("STARTUP_TIMEOUT").MustDuration(0 * time.Second)

0 commit comments

Comments
 (0)