Auto-HTTPS edgecase

[francislavoie]

Reproduce case:

http://foo:8447, http://127.0.0.1:8447 {
    reverse_proxy 127.0.0.1:8080
}

This produces JSON with automation policies, it shouldn't though.

As a workaround, splitting the two site addresses into separate site blocks fixes the issue.

[emilylange]

I made a dumb little bash script which fetches all available linux tags from https://hub.docker.com/_/caddy and runs caddy adapt with the specified Caddyfile in them.
This bug seems to have been introduced in caddy:2.3.0-rc.1:

// 💁 Running in caddy:2.3.0-rc.1 (`caddy adapt`)
{
  "apps": {
    "http": {
      "servers": {
        "srv0": {
          "listen": [
            ":8447"
          ],
          "routes": [
            {
              "match": [
                {
                  "host": [
                    "foo",
                    "127.0.0.1"
                  ]
                }
              ],
              "handle": [
                {
                  "handler": "subroute",
                  "routes": [
                    {
                      "handle": [
                        {
                          "handler": "reverse_proxy",
                          "upstreams": [
                            {
                              "dial": "127.0.0.1:8080"
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ],
              "terminal": true
            }
          ],
          "automatic_https": {
            "skip": [
              "foo",
              "127.0.0.1"
            ]
          }
        }
      }
    },
    "tls": {
      "automation": {
        "policies": [
          {
            "subjects": [
              "127.0.0.1"
            ],
            "issuers": [
              {
                "module": "internal"
              }
            ]
          }
        ]
      }
    }
  }
}

// 💁 Running in caddy:2.2.1 (`caddy adapt`)
{
  "apps": {
    "http": {
      "servers": {
        "srv0": {
          "listen": [
            ":8447"
          ],
          "routes": [
            {
              "match": [
                {
                  "host": [
                    "foo",
                    "127.0.0.1"
                  ]
                }
              ],
              "handle": [
                {
                  "handler": "subroute",
                  "routes": [
                    {
                      "handle": [
                        {
                          "handler": "reverse_proxy",
                          "upstreams": [
                            {
                              "dial": "127.0.0.1:8080"
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ],
              "terminal": true
            }
          ],
          "automatic_https": {
            "skip": [
              "foo",
              "127.0.0.1"
            ]
          }
        }
      }
    }
  }
}

[francislavoie]

Yeah... the auto-https and Caddyfile server collecting loops are total whack-a-mole/radio buttons. Fix one thing, breaks the other. I'm not surprised in the slightest every time we have an issue here. But we have a reproduce case that we can use to write a test against, once someone gets around to digging into it.