+5 -2

conf/config.example.toml

··· 16 16 index-repos = ["<user>.codeberg.page", "pages"] 17 17 index-repo-branch = "main" 18 18 authorization = "forgejo" 19 19 - fallback-proxy-to = "https://codeberg.page" 19 19 + 20 20 + [fallback] # non-default section 21 21 + proxy-to = "https://codeberg.page" 22 22 + insecure = false 20 23 21 24 [storage] 22 25 type = "fs" ··· 24 27 [storage.fs] 25 28 root = "./data" 26 29 27 27 - [storage.s3] # non-default bucket configuration 30 30 + [storage.s3] # non-default section 28 31 endpoint = "play.min.io" 29 32 access-key-id = "Q3AM3UQ867SPQQA43P2F" 30 33 secret-access-key = "zuf+tfteSlswRu7BJ86wekitnifILbZam1KYY3TG"

+33 -25

src/caddy.go

··· 1 1 package git_pages 2 2 3 3 import ( 4 4 + "context" 4 5 "crypto/tls" 5 6 "fmt" 6 7 "net" ··· 34 35 // Pages v2, which would under some circumstances return certificates with subjectAltName 35 36 // not valid for the SNI. Go's TLS stack makes `tls.Dial` return an error for these, 36 37 // thankfully making it unnecessary to examine X.509 certificates manually here.) 37 37 - for _, wildcardConfig := range config.Wildcard { 38 38 - if wildcardConfig.FallbackProxyTo == "" { 39 39 - continue 40 40 - } 41 41 - fallbackURL, err := url.Parse(wildcardConfig.FallbackProxyTo) 42 42 - if err != nil { 43 43 - continue 44 44 - } 45 45 - if fallbackURL.Scheme != "https" { 46 46 - continue 47 47 - } 48 48 - connectHost := fallbackURL.Host 49 49 - if fallbackURL.Port() != "" { 50 50 - connectHost += ":" + fallbackURL.Port() 51 51 - } else { 52 52 - connectHost += ":443" 53 53 - } 54 54 - logc.Printf(r.Context(), "caddy: check TLS %s", fallbackURL) 55 55 - connection, err := tls.Dial("tcp", connectHost, &tls.Config{ServerName: domain}) 56 56 - if err != nil { 57 57 - continue 58 58 - } 59 59 - connection.Close() 60 60 - found = true 61 61 - break 38 38 + found, err = tryDialWithSNI(r.Context(), domain) 39 39 + if err != nil { 40 40 + logc.Printf(r.Context(), "caddy err: check SNI: %s\n", err) 62 41 } 63 42 } 64 43 ··· 74 53 fmt.Fprintln(w, err) 75 54 } 76 55 } 56 56 + 57 57 + func tryDialWithSNI(ctx context.Context, domain string) (bool, error) { 58 58 + if config.Fallback.ProxyTo == "" { 59 59 + return false, nil 60 60 + } 61 61 + 62 62 + fallbackURL, err := url.Parse(config.Fallback.ProxyTo) 63 63 + if err != nil { 64 64 + return false, err 65 65 + } 66 66 + if fallbackURL.Scheme != "https" { 67 67 + return false, nil 68 68 + } 69 69 + 70 70 + connectHost := fallbackURL.Host 71 71 + if fallbackURL.Port() != "" { 72 72 + connectHost += ":" + fallbackURL.Port() 73 73 + } else { 74 74 + connectHost += ":443" 75 75 + } 76 76 + 77 77 + logc.Printf(ctx, "caddy: check TLS %s", fallbackURL) 78 78 + connection, err := tls.Dial("tcp", connectHost, &tls.Config{ServerName: domain}) 79 79 + if err != nil { 80 80 + return false, err 81 81 + } 82 82 + connection.Close() 83 83 + return true, nil 84 84 + }

+11 -7

src/config.go

··· 41 41 LogLevel string `toml:"log-level" default:"info"` 42 42 Server ServerConfig `toml:"server"` 43 43 Wildcard []WildcardConfig `toml:"wildcard"` 44 44 + Fallback FallbackConfig `toml:"fallback"` 44 45 Storage StorageConfig `toml:"storage"` 45 46 Limits LimitsConfig `toml:"limits"` 46 47 Observability ObservabilityConfig `toml:"observability"` ··· 53 54 } 54 55 55 56 type WildcardConfig struct { 56 56 - Domain string `toml:"domain"` 57 57 - CloneURL string `toml:"clone-url"` 58 58 - IndexRepos []string `toml:"index-repos" default:"[]"` 59 59 - IndexRepoBranch string `toml:"index-repo-branch" default:"pages"` 60 60 - Authorization string `toml:"authorization"` 61 61 - FallbackProxyTo string `toml:"fallback-proxy-to"` 62 62 - FallbackInsecure bool `toml:"fallback-insecure"` 57 57 + Domain string `toml:"domain"` 58 58 + CloneURL string `toml:"clone-url"` 59 59 + IndexRepos []string `toml:"index-repos" default:"[]"` 60 60 + IndexRepoBranch string `toml:"index-repo-branch" default:"pages"` 61 61 + Authorization string `toml:"authorization"` 62 62 + } 63 63 + 64 64 + type FallbackConfig struct { 65 65 + ProxyTo string `toml:"proxy-to"` 66 66 + Insecure bool `toml:"insecure"` 63 67 } 64 68 65 69 type CacheConfig struct {

+30

src/main.go

··· 2 2 3 3 import ( 4 4 "context" 5 5 + "crypto/tls" 5 6 "errors" 6 7 "flag" 7 8 "fmt" ··· 10 11 "log/slog" 11 12 "net" 12 13 "net/http" 14 14 + "net/http/httputil" 13 15 "net/url" 14 16 "os" 15 17 "runtime/debug" ··· 22 24 23 25 var config *Config 24 26 var wildcards []*WildcardPattern 27 27 + var fallback http.Handler 25 28 var backend Backend 26 29 27 30 func configureFeatures() (err error) { ··· 63 66 } 64 67 } 65 68 69 69 + func configureFallback() (err error) { 70 70 + if config.Fallback.ProxyTo != "" { 71 71 + var fallbackURL *url.URL 72 72 + fallbackURL, err = url.Parse(config.Fallback.ProxyTo) 73 73 + if err != nil { 74 74 + err = fmt.Errorf("fallback: %w", err) 75 75 + return 76 76 + } 77 77 + 78 78 + fallback = &httputil.ReverseProxy{ 79 79 + Rewrite: func(r *httputil.ProxyRequest) { 80 80 + r.SetURL(fallbackURL) 81 81 + r.Out.Host = r.In.Host 82 82 + r.Out.Header["X-Forwarded-For"] = r.In.Header["X-Forwarded-For"] 83 83 + }, 84 84 + Transport: &http.Transport{ 85 85 + TLSClientConfig: &tls.Config{ 86 86 + InsecureSkipVerify: config.Fallback.Insecure, 87 87 + }, 88 88 + }, 89 89 + } 90 90 + } 91 91 + return 92 92 + } 93 93 + 66 94 func listen(name string, listen string) net.Listener { 67 95 if listen == "-" { 68 96 return nil ··· 230 258 configureFeatures(), 231 259 configureMemLimit(), 232 260 configureWildcards(), 261 261 + configureFallback(), 233 262 ); err != nil { 234 263 log.Fatalln(err) 235 264 } ··· 392 421 configureFeatures(), 393 422 configureMemLimit(), 394 423 configureWildcards(), 424 424 + configureFallback(), 395 425 ); err != nil { 396 426 // At this point the configuration is in an in-between, corrupted state, so 397 427 // the only reasonable choice is to crash.

+4 -2

src/pages.go

··· 136 136 result := <-indexManifestCh 137 137 manifest, manifestMtime, err = result.manifest, result.manifestMtime, result.err 138 138 if manifest == nil && errors.Is(err, ErrObjectNotFound) { 139 139 - if found, fallbackErr := HandleWildcardFallback(w, r); found { 140 140 - return fallbackErr 139 139 + if fallback != nil { 140 140 + logc.Printf(r.Context(), "fallback: %s via %s", host, config.Fallback.ProxyTo) 141 141 + fallback.ServeHTTP(w, r) 142 142 + return nil 141 143 } else { 142 144 w.WriteHeader(http.StatusNotFound) 143 145 fmt.Fprintf(w, "site not found\n")

-54

src/wildcard.go

··· 1 1 package git_pages 2 2 3 3 import ( 4 4 - "crypto/tls" 5 4 "fmt" 6 6 - "net/http" 7 7 - "net/http/httputil" 8 8 - "net/url" 9 5 "slices" 10 6 "strings" 11 7 ··· 18 14 IndexRepos []*fasttemplate.Template 19 15 IndexBranch string 20 16 Authorization bool 21 21 - FallbackURL *url.URL 22 22 - Fallback http.Handler 23 17 } 24 18 25 19 func (pattern *WildcardPattern) GetHost() string { ··· 78 72 return repoURLs, branch 79 73 } 80 74 81 81 - func (pattern *WildcardPattern) IsFallbackFor(host string) bool { 82 82 - if pattern.Fallback == nil { 83 83 - return false 84 84 - } 85 85 - _, found := pattern.Matches(host) 86 86 - return found 87 87 - } 88 88 - 89 89 - func HandleWildcardFallback(w http.ResponseWriter, r *http.Request) (bool, error) { 90 90 - host, err := GetHost(r) 91 91 - if err != nil { 92 92 - return false, err 93 93 - } 94 94 - 95 95 - for _, pattern := range wildcards { 96 96 - if pattern.IsFallbackFor(host) { 97 97 - logc.Printf(r.Context(), "proxy: %s via %s", pattern.GetHost(), pattern.FallbackURL) 98 98 - pattern.Fallback.ServeHTTP(w, r) 99 99 - return true, nil 100 100 - } 101 101 - } 102 102 - return false, nil 103 103 - } 104 104 - 105 75 func TranslateWildcards(configs []WildcardConfig) ([]*WildcardPattern, error) { 106 76 var wildcardPatterns []*WildcardPattern 107 77 for _, config := range configs { ··· 134 104 } 135 105 } 136 106 137 137 - var fallbackURL *url.URL 138 138 - var fallback http.Handler 139 139 - if config.FallbackProxyTo != "" { 140 140 - fallbackURL, err = url.Parse(config.FallbackProxyTo) 141 141 - if err != nil { 142 142 - return nil, fmt.Errorf("wildcard pattern: fallback URL: %w", err) 143 143 - } 144 144 - 145 145 - fallback = &httputil.ReverseProxy{ 146 146 - Rewrite: func(r *httputil.ProxyRequest) { 147 147 - r.SetURL(fallbackURL) 148 148 - r.Out.Host = r.In.Host 149 149 - r.Out.Header["X-Forwarded-For"] = r.In.Header["X-Forwarded-For"] 150 150 - }, 151 151 - Transport: &http.Transport{ 152 152 - TLSClientConfig: &tls.Config{ 153 153 - InsecureSkipVerify: config.FallbackInsecure, 154 154 - }, 155 155 - }, 156 156 - } 157 157 - } 158 158 - 159 107 wildcardPatterns = append(wildcardPatterns, &WildcardPattern{ 160 108 Domain: strings.Split(config.Domain, "."), 161 109 CloneURL: cloneURLTemplate, 162 110 IndexRepos: indexRepoTemplates, 163 111 IndexBranch: indexRepoBranch, 164 112 Authorization: authorization, 165 165 - FallbackURL: fallbackURL, 166 166 - Fallback: fallback, 167 113 }) 168 114 } 169 115 return wildcardPatterns, nil