Add TLS feature with Caddy

2026-10-21 09:13:59 +01:00
parent 1462067e72
commit ed4a6f3ec8
109 changed files with 6374 additions and 156 deletions
@@ -0,0 +1,105 @@
+import { describe, expect, test } from "bun:test";
+import type {
+    BUN_SQLITE_WGUI_CLIENT_ROUTES,
+    BUN_SQLITE_WGUI_TLS_CERTIFICATES,
+} from "@/db/types/db";
+import buildCaddyfile from "./build-caddyfile";
+
+const base = {
+    https_port: 8443,
+    http_port: 8081,
+    admin_socket: `/run/wgui-caddy/admin.sock`,
+    storage_dir: `/var/lib/wgui/caddy/data`,
+};
+
+const certificate = {
+    hostname: "media.example.com",
+    cert_path: "/var/lib/wgui/tls/media.example.com/fullchain.pem",
+    key_path: "/var/lib/wgui/tls/media.example.com/privkey.pem",
+    status: "active",
+} as BUN_SQLITE_WGUI_TLS_CERTIFICATES;
+
+function route(
+    values: Partial<BUN_SQLITE_WGUI_CLIENT_ROUTES>,
+): BUN_SQLITE_WGUI_CLIENT_ROUTES {
+    return {
+        hostname: "media.example.com",
+        path_prefix: "/",
+        upstream_url: "http://10.5.0.20:8080",
+        enabled: 1,
+        ...values,
+    };
+}
+
+describe("buildCaddyfile", () => {
+    test("uses a high port and never 80/443", () => {
+        const res = buildCaddyfile({ ...base, routes: [], certificates: [] });
+
+        expect(res.config).toContain("https_port 8443");
+        expect(res.config).toContain("http_port 8081");
+        expect(res.config).toContain("auto_https disable_redirects");
+        expect(res.config).not.toContain("https_port 443");
+        expect(res.config).not.toContain("http_port 80\n");
+    });
+
+    test("orders longer prefixes before the catch-all", () => {
+        const res = buildCaddyfile({
+            ...base,
+            certificates: [certificate],
+            routes: [
+                route({ name: "root", path_prefix: "/" }),
+                route({
+                    name: "app",
+                    path_prefix: "/app",
+                    strip_prefix: 1,
+                    upstream_url: "http://10.5.0.30:9000",
+                }),
+            ],
+        });
+
+        const app_index = res.config?.indexOf("@route_1 {") || 0;
+        const root_index = res.config?.indexOf("handle {") || 0;
+
+        expect(app_index).toBeGreaterThan(0);
+        expect(root_index).toBeGreaterThan(app_index);
+        expect(res.config).toContain("path /app /app/*");
+        expect(res.config).toContain("uri strip_prefix /app");
+    });
+
+    test("skips routes without an active certificate", () => {
+        const res = buildCaddyfile({
+            ...base,
+            certificates: [],
+            routes: [route({ name: "media" })],
+        });
+
+        expect(res.config).not.toContain("media.example.com {");
+        expect(res.warnings[0]).toContain("certificate");
+    });
+
+    test("scopes a route to its host's WireGuard subnet", () => {
+        const res = buildCaddyfile({
+            ...base,
+            certificates: [certificate],
+            hosts: [{ id: 0, wg_ip_address: "10.5.0.1" }],
+            routes: [route({ host_id: 0, path_prefix: "/app" })],
+        });
+
+        expect(res.config).toContain("remote_ip 10.5.0.0/24");
+    });
+
+    test("maps insecure upstream TLS to Caddy", () => {
+        const res = buildCaddyfile({
+            ...base,
+            certificates: [certificate],
+            routes: [
+                route({
+                    upstream_url: "https://10.5.0.20:8443",
+                    upstream_tls_verify: 0,
+                }),
+            ],
+        });
+
+        expect(res.config).toContain("tls_insecure_skip_verify");
+    });
+});