detached 3bc07cb

refactor: Improve certificate handling and logging in proxy

- Remove default Echo logger middleware from router.
- Update comments in certificate handling to clarify the purpose of checks.
- Enhance logging for valid certificates found in the filesystem, specifying naming patterns.
- Implement glob search for certificate files, adding detailed logging for candidates and errors.
- Introduce a method to add certificates to the autocert cache with appropriate logging.
commit
3bc07cb93829e4e856053619cb126330621022aa
author
bamen · · 2025-03-25 06:21 UTC
parent
95052de
signature
unsigned
2 files · +190 -8
Unified
UnifiedSplit
M internal/httpserve/router.go +1 -2
@@ -12,8 +12,7 @@ import (
1212
1313 // RegisterRoutes registers all routes and middlewares
1414 func RegisterRoutes(e *echo.Echo, a *server.App) *echo.Echo {
15- // Add default Echo logger middleware
16- e.Use(echomid.Logger())
15+
1716 e.Use(echomid.Recover())
1817 // Initiate the session middleware
1918 e.Use(middleware.InitSessionMiddleware(a))
@@ -12,8 +12,7 @@ import (
12 12
13 // RegisterRoutes registers all routes and middlewares13 // RegisterRoutes registers all routes and middlewares
14 func RegisterRoutes(e *echo.Echo, a *server.App) *echo.Echo {14 func RegisterRoutes(e *echo.Echo, a *server.App) *echo.Echo {
15- // Add default Echo logger middleware15+
16- e.Use(echomid.Logger())
17 e.Use(echomid.Recover())16 e.Use(echomid.Recover())
18 // Initiate the session middleware17 // Initiate the session middleware
19 e.Use(middleware.InitSessionMiddleware(a))18 e.Use(middleware.InitSessionMiddleware(a))
M internal/proxy/certificates.go +189 -6
@@ -294,7 +294,7 @@ func (p *Proxy) checkCertificateInFilesystem(domain string) (bool, string) {
294294 certDir = p.app.GetConfig().General.StorageDir + "/certs"
295295 }
296296
297- // Check for certificates using different naming patterns
297+ // First check for known certificate patterns
298298 certFiles := []string{
299299 // Standard autocert naming
300300 domain,
@@ -304,7 +304,7 @@ func (p *Proxy) checkCertificateInFilesystem(domain string) (bool, string) {
304304 getCertificateFileName(domain, "production"),
305305 }
306306
307- // Check each possible certificate file
307+ // Check each possible certificate file using known patterns
308308 for _, baseName := range certFiles {
309309 certFile := filepath.Join(certDir, baseName)
310310 keyFile := filepath.Join(certDir, baseName+"+rsa")
@@ -334,12 +334,12 @@ func (p *Proxy) checkCertificateInFilesystem(domain string) (bool, string) {
334334 continue
335335 }
336336
337- logger.Info("Valid certificate found in filesystem",
337+ logger.Info("Valid certificate found in filesystem with standard naming pattern",
338338 "domain", domain,
339339 "expires_in", expiresInDays,
340340 "days",
341341 "type", certType,
342- "not_in_cache", true)
342+ "cert_file", certFile)
343343
344344 // Check if certificate matches current mode
345345 if p.config.LetsEncryptMode == "production" && certType == "staging" {
@@ -369,12 +369,125 @@ func (p *Proxy) checkCertificateInFilesystem(domain string) (bool, string) {
369369 "key_size", keyFileInfo.Size(),
370370 "key_modified", keyFileInfo.ModTime())
371371
372+ // Attempt to add to autocert cache if it's not already there
373+ if certType == "production" || (certType == "staging" && p.config.LetsEncryptMode == "staging") {
374+ // Add to autocert cache for future use
375+ p.addCertificateToCache(domain, certFile, keyFile)
376+ }
377+
372378 return true, certType
373379 }
374380
375- logger.Debug("No valid certificate files found in filesystem",
381+ // If no matches with standard patterns, try a glob search for any files starting with the domain name
382+ // This will catch files with any suffix like domain_letsencrypt-production
383+ // and domain_letsencrypt-staging
384+ logger.Debug("No standard certificate files found, searching for any matching certificates",
385+ "domain", domain)
386+
387+ files, err := filepath.Glob(filepath.Join(certDir, domain+"*"))
388+ if err != nil {
389+ logger.Warn("Error searching for certificate files",
390+ "domain", domain,
391+ "error", err)
392+ return false, ""
393+ }
394+
395+ // Extract base names without the path
396+ var candidates []string
397+ for _, file := range files {
398+ // Skip key files ending with +rsa since we'll process them together with certs
399+ if strings.HasSuffix(file, "+rsa") {
400+ continue
401+ }
402+
403+ baseFile := filepath.Base(file)
404+ // Check if the corresponding key file exists
405+ keyFile := file + "+rsa"
406+ if _, err := os.Stat(keyFile); os.IsNotExist(err) {
407+ continue
408+ }
409+
410+ // Add this candidate
411+ candidates = append(candidates, baseFile)
412+ }
413+
414+ // No certificate files found
415+ if len(candidates) == 0 {
416+ logger.Debug("No certificate files found in filesystem glob search",
417+ "domain", domain)
418+ return false, ""
419+ }
420+
421+ logger.Debug("Found certificate candidates in glob search",
376422 "domain", domain,
377- "searched_patterns", certFiles)
423+ "candidates", candidates)
424+
425+ // Process each candidate (if there are multiple matches)
426+ for _, baseName := range candidates {
427+ certFile := filepath.Join(certDir, baseName)
428+ keyFile := filepath.Join(certDir, baseName+"+rsa")
429+
430+ // Read and validate the certificate
431+ certData, err := os.ReadFile(certFile)
432+ if err != nil {
433+ logger.Warn("Failed to read certificate file from glob search",
434+ "domain", domain,
435+ "file", certFile,
436+ "error", err)
437+ continue
438+ }
439+
440+ // Validate the certificate data
441+ validCert, expiresInDays, certType, _ := isCertificateValid(certData, domain)
442+ if !validCert {
443+ continue
444+ }
445+
446+ logger.Info("Valid certificate found in filesystem with non-standard naming",
447+ "domain", domain,
448+ "expires_in", expiresInDays,
449+ "days",
450+ "type", certType,
451+ "cert_file", certFile)
452+
453+ // If we're in production mode and this is a production certificate, use it
454+ if p.config.LetsEncryptMode == "production" && certType == "production" {
455+ // Attempt to add to autocert cache
456+ p.addCertificateToCache(domain, certFile, keyFile)
457+ return true, certType
458+ }
459+
460+ // If we're in staging mode, prefer production certificates if available
461+ if p.config.LetsEncryptMode == "staging" {
462+ if certType == "production" {
463+ // Attempt to add to autocert cache
464+ p.addCertificateToCache(domain, certFile, keyFile)
465+ return true, certType
466+ } else if certType == "staging" {
467+ // If this is a staging certificate and we're in staging mode, use it
468+ // Attempt to add to autocert cache
469+ p.addCertificateToCache(domain, certFile, keyFile)
470+ return true, certType
471+ }
472+ }
473+
474+ // If this is a staging certificate but we're in production mode, ignore it
475+ // and continue checking other candidates
476+ if p.config.LetsEncryptMode == "production" && certType == "staging" {
477+ logger.Info("Ignoring staging certificate in production mode",
478+ "domain", domain,
479+ "cert_file", certFile)
480+ continue
481+ }
482+
483+ // Fallback: use the certificate if it's valid
484+ // Attempt to add to autocert cache
485+ p.addCertificateToCache(domain, certFile, keyFile)
486+ return true, certType
487+ }
488+
489+ logger.Debug("No valid certificate files found in filesystem",
490+ "domain", domain)
378491 return false, ""
379492 }
380493
@@ -402,6 +515,76 @@ func deleteCertificateFiles(certDir string, baseName string) {
402515 }
403516 }
404517
518+// addCertificateToCache adds a certificate found in the filesystem to the autocert cache
519+// This ensures certificates found on disk are also available for the autocert manager
520+func (p *Proxy) addCertificateToCache(domain string, certFile, keyFile string) {
521+ // Skip if we don't have a certificate manager
522+ if p.certManager == nil || p.certManager.Cache == nil {
523+ logger.Warn("Cannot add certificate to cache: certificate manager not initialized",
524+ "domain", domain)
525+ return
526+ }
527+
528+ // Create context for cache operations
529+ ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
530+ defer cancel()
531+
532+ // Read the certificate and key files
533+ certData, err := os.ReadFile(certFile)
534+ if err != nil {
535+ logger.Warn("Failed to read certificate file for cache addition",
536+ "domain", domain,
537+ "file", certFile,
538+ "error", err)
539+ return
540+ }
541+
542+ keyData, err := os.ReadFile(keyFile)
543+ if err != nil {
544+ logger.Warn("Failed to read certificate key file for cache addition",
545+ "domain", domain,
546+ "file", keyFile,
547+ "error", err)
548+ return
549+ }
550+
551+ // Format of cache key used by autocert is "cert-" + domain
552+ cacheKey := "cert-" + domain
553+
554+ // Check if certificate is already in the cache
555+ _, getCacheErr := p.certManager.Cache.Get(ctx, cacheKey)
556+ if getCacheErr == nil {
557+ // Certificate already exists in cache, no need to add
558+ logger.Debug("Certificate already exists in autocert cache, skipping addition",
559+ "domain", domain)
560+ return
561+ }
562+
563+ // Add certificate to cache
564+ err = p.certManager.Cache.Put(ctx, cacheKey, certData)
565+ if err != nil {
566+ logger.Warn("Failed to add certificate to autocert cache",
567+ "domain", domain,
568+ "error", err)
569+ return
570+ }
571+
572+ // Add key to cache with proper key format
573+ keyKey := "key-" + domain
574+ err = p.certManager.Cache.Put(ctx, keyKey, keyData)
575+ if err != nil {
576+ logger.Warn("Failed to add certificate key to autocert cache",
577+ "domain", domain,
578+ "error", err)
579+ return
580+ }
581+
582+ logger.Info("Successfully added certificate to autocert cache",
583+ "domain", domain,
584+ "from_cert_file", certFile,
585+ "from_key_file", keyFile)
586+}
587+
405588 // testCertificateWithTLSConnection attempts to establish a TLS connection to verify the certificate
406589 // This is an optional verification step for certificates we find on the filesystem
407590 func testCertificateWithTLSConnection(domain string, port string) bool {
@@ -294,7 +294,7 @@ func (p *Proxy) checkCertificateInFilesystem(domain string) (bool, string) {
294 certDir = p.app.GetConfig().General.StorageDir + "/certs"294 certDir = p.app.GetConfig().General.StorageDir + "/certs"
295 }295 }
296 296
297- // Check for certificates using different naming patterns297+ // First check for known certificate patterns
298 certFiles := []string{298 certFiles := []string{
299 // Standard autocert naming299 // Standard autocert naming
300 domain,300 domain,
@@ -304,7 +304,7 @@ func (p *Proxy) checkCertificateInFilesystem(domain string) (bool, string) {
304 getCertificateFileName(domain, "production"),304 getCertificateFileName(domain, "production"),
305 }305 }
306 306
307- // Check each possible certificate file307+ // Check each possible certificate file using known patterns
308 for _, baseName := range certFiles {308 for _, baseName := range certFiles {
309 certFile := filepath.Join(certDir, baseName)309 certFile := filepath.Join(certDir, baseName)
310 keyFile := filepath.Join(certDir, baseName+"+rsa")310 keyFile := filepath.Join(certDir, baseName+"+rsa")
@@ -334,12 +334,12 @@ func (p *Proxy) checkCertificateInFilesystem(domain string) (bool, string) {
334 continue334 continue
335 }335 }
336 336
337- logger.Info("Valid certificate found in filesystem",337+ logger.Info("Valid certificate found in filesystem with standard naming pattern",
338 "domain", domain,338 "domain", domain,
339 "expires_in", expiresInDays,339 "expires_in", expiresInDays,
340 "days",340 "days",
341 "type", certType,341 "type", certType,
342- "not_in_cache", true)342+ "cert_file", certFile)
343 343
344 // Check if certificate matches current mode344 // Check if certificate matches current mode
345 if p.config.LetsEncryptMode == "production" && certType == "staging" {345 if p.config.LetsEncryptMode == "production" && certType == "staging" {
@@ -369,12 +369,125 @@ func (p *Proxy) checkCertificateInFilesystem(domain string) (bool, string) {
369 "key_size", keyFileInfo.Size(),369 "key_size", keyFileInfo.Size(),
370 "key_modified", keyFileInfo.ModTime())370 "key_modified", keyFileInfo.ModTime())
371 371
372+ // Attempt to add to autocert cache if it's not already there
373+ if certType == "production" || (certType == "staging" && p.config.LetsEncryptMode == "staging") {
374+ // Add to autocert cache for future use
375+ p.addCertificateToCache(domain, certFile, keyFile)
376+ }
377+
372 return true, certType378 return true, certType
373 }379 }
374 380
375- logger.Debug("No valid certificate files found in filesystem",381+ // If no matches with standard patterns, try a glob search for any files starting with the domain name
382+ // This will catch files with any suffix like domain_letsencrypt-production
383+ // and domain_letsencrypt-staging
384+ logger.Debug("No standard certificate files found, searching for any matching certificates",
385+ "domain", domain)
386+
387+ files, err := filepath.Glob(filepath.Join(certDir, domain+"*"))
388+ if err != nil {
389+ logger.Warn("Error searching for certificate files",
390+ "domain", domain,
391+ "error", err)
392+ return false, ""
393+ }
394+
395+ // Extract base names without the path
396+ var candidates []string
397+ for _, file := range files {
398+ // Skip key files ending with +rsa since we'll process them together with certs
399+ if strings.HasSuffix(file, "+rsa") {
400+ continue
401+ }
402+
403+ baseFile := filepath.Base(file)
404+ // Check if the corresponding key file exists
405+ keyFile := file + "+rsa"
406+ if _, err := os.Stat(keyFile); os.IsNotExist(err) {
407+ continue
408+ }
409+
410+ // Add this candidate
411+ candidates = append(candidates, baseFile)
412+ }
413+
414+ // No certificate files found
415+ if len(candidates) == 0 {
416+ logger.Debug("No certificate files found in filesystem glob search",
417+ "domain", domain)
418+ return false, ""
419+ }
420+
421+ logger.Debug("Found certificate candidates in glob search",
376 "domain", domain,422 "domain", domain,
377- "searched_patterns", certFiles)423+ "candidates", candidates)
424+
425+ // Process each candidate (if there are multiple matches)
426+ for _, baseName := range candidates {
427+ certFile := filepath.Join(certDir, baseName)
428+ keyFile := filepath.Join(certDir, baseName+"+rsa")
429+
430+ // Read and validate the certificate
431+ certData, err := os.ReadFile(certFile)
432+ if err != nil {
433+ logger.Warn("Failed to read certificate file from glob search",
434+ "domain", domain,
435+ "file", certFile,
436+ "error", err)
437+ continue
438+ }
439+
440+ // Validate the certificate data
441+ validCert, expiresInDays, certType, _ := isCertificateValid(certData, domain)
442+ if !validCert {
443+ continue
444+ }
445+
446+ logger.Info("Valid certificate found in filesystem with non-standard naming",
447+ "domain", domain,
448+ "expires_in", expiresInDays,
449+ "days",
450+ "type", certType,
451+ "cert_file", certFile)
452+
453+ // If we're in production mode and this is a production certificate, use it
454+ if p.config.LetsEncryptMode == "production" && certType == "production" {
455+ // Attempt to add to autocert cache
456+ p.addCertificateToCache(domain, certFile, keyFile)
457+ return true, certType
458+ }
459+
460+ // If we're in staging mode, prefer production certificates if available
461+ if p.config.LetsEncryptMode == "staging" {
462+ if certType == "production" {
463+ // Attempt to add to autocert cache
464+ p.addCertificateToCache(domain, certFile, keyFile)
465+ return true, certType
466+ } else if certType == "staging" {
467+ // If this is a staging certificate and we're in staging mode, use it
468+ // Attempt to add to autocert cache
469+ p.addCertificateToCache(domain, certFile, keyFile)
470+ return true, certType
471+ }
472+ }
473+
474+ // If this is a staging certificate but we're in production mode, ignore it
475+ // and continue checking other candidates
476+ if p.config.LetsEncryptMode == "production" && certType == "staging" {
477+ logger.Info("Ignoring staging certificate in production mode",
478+ "domain", domain,
479+ "cert_file", certFile)
480+ continue
481+ }
482+
483+ // Fallback: use the certificate if it's valid
484+ // Attempt to add to autocert cache
485+ p.addCertificateToCache(domain, certFile, keyFile)
486+ return true, certType
487+ }
488+
489+ logger.Debug("No valid certificate files found in filesystem",
490+ "domain", domain)
378 return false, ""491 return false, ""
379 }492 }
380 493
@@ -402,6 +515,76 @@ func deleteCertificateFiles(certDir string, baseName string) {
402 }515 }
403 }516 }
404 517
518+// addCertificateToCache adds a certificate found in the filesystem to the autocert cache
519+// This ensures certificates found on disk are also available for the autocert manager
520+func (p *Proxy) addCertificateToCache(domain string, certFile, keyFile string) {
521+ // Skip if we don't have a certificate manager
522+ if p.certManager == nil || p.certManager.Cache == nil {
523+ logger.Warn("Cannot add certificate to cache: certificate manager not initialized",
524+ "domain", domain)
525+ return
526+ }
527+
528+ // Create context for cache operations
529+ ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
530+ defer cancel()
531+
532+ // Read the certificate and key files
533+ certData, err := os.ReadFile(certFile)
534+ if err != nil {
535+ logger.Warn("Failed to read certificate file for cache addition",
536+ "domain", domain,
537+ "file", certFile,
538+ "error", err)
539+ return
540+ }
541+
542+ keyData, err := os.ReadFile(keyFile)
543+ if err != nil {
544+ logger.Warn("Failed to read certificate key file for cache addition",
545+ "domain", domain,
546+ "file", keyFile,
547+ "error", err)
548+ return
549+ }
550+
551+ // Format of cache key used by autocert is "cert-" + domain
552+ cacheKey := "cert-" + domain
553+
554+ // Check if certificate is already in the cache
555+ _, getCacheErr := p.certManager.Cache.Get(ctx, cacheKey)
556+ if getCacheErr == nil {
557+ // Certificate already exists in cache, no need to add
558+ logger.Debug("Certificate already exists in autocert cache, skipping addition",
559+ "domain", domain)
560+ return
561+ }
562+
563+ // Add certificate to cache
564+ err = p.certManager.Cache.Put(ctx, cacheKey, certData)
565+ if err != nil {
566+ logger.Warn("Failed to add certificate to autocert cache",
567+ "domain", domain,
568+ "error", err)
569+ return
570+ }
571+
572+ // Add key to cache with proper key format
573+ keyKey := "key-" + domain
574+ err = p.certManager.Cache.Put(ctx, keyKey, keyData)
575+ if err != nil {
576+ logger.Warn("Failed to add certificate key to autocert cache",
577+ "domain", domain,
578+ "error", err)
579+ return
580+ }
581+
582+ logger.Info("Successfully added certificate to autocert cache",
583+ "domain", domain,
584+ "from_cert_file", certFile,
585+ "from_key_file", keyFile)
586+}
587+
405 // testCertificateWithTLSConnection attempts to establish a TLS connection to verify the certificate588 // testCertificateWithTLSConnection attempts to establish a TLS connection to verify the certificate
406 // This is an optional verification step for certificates we find on the filesystem589 // This is an optional verification step for certificates we find on the filesystem
407 func testCertificateWithTLSConnection(domain string, port string) bool {590 func testCertificateWithTLSConnection(domain string, port string) bool {

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 7

Tags 106

↑↓ moveenter openesc close