Commit `399d2f300e`

399d2f300efc8573bf4799caedb52f4b2f1d63a7

parent: dce6f1b389

Verified · cmc

cmc <hello@cleberg.net> · 2026-08-24 00:30 UTC

tls: acme mode via autocert

- http.tls = "acme": certificates from Let's Encrypt (or any RFC 8555
  CA autocert supports) via TLS-ALPN-01 on the HTTPS port; cache under
  server.root/acme; HostWhitelist pinned to the site_url host
- optional acme_http_addr listener (default :80, "off" to disable)
  answers HTTP-01 challenges and 301-redirects everything to the
  canonical https host; failure to bind it is a warning, not fatal
- acme_email for the CA account; check-config rejects acme with an
  http:// site_url, localhost, or an IP literal
- e2e (offline-safe): redirect listener verified exactly, failed
  issuance handshakes leave the daemon and listener alive, cache dir
  created, non-whitelisted SNI refused before any issuance attempt

Layout: unified · split

cmd/gitbayd/main.go +26 −3

	@@ -8,11 +8,12 @@ import (
8	"net"	8	"net"
9	"net/http"	9	"net/http"
10	"os"	10	"os"
11	"strings"
12	"path/filepath"	11	"path/filepath"
13	"strconv"	12	"strconv"
		13	"strings"
14		14
15	"github.com/spf13/cobra"	15	"github.com/spf13/cobra"
		16	"golang.org/x/crypto/acme/autocert"
16	"golang.org/x/crypto/ssh"	17	"golang.org/x/crypto/ssh"
17		18
18	"gitbay.org/gitbay/internal/config"	19	"gitbay.org/gitbay/internal/config"
	@@ -146,8 +147,30 @@ func serveCmd() *cobra.Command {
146	errCh <- hs.ListenAndServe()	147	errCh <- hs.ListenAndServe()
147	case "files":	148	case "files":
148	errCh <- hs.ListenAndServeTLS(cfg.HTTP.CertFile, cfg.HTTP.KeyFile)	149	errCh <- hs.ListenAndServeTLS(cfg.HTTP.CertFile, cfg.HTTP.KeyFile)
149	default:	150	case "acme":
150	errCh <- fmt.Errorf("http.tls = %q not implemented yet; use \"files\" or \"off\"", cfg.HTTP.TLS)	151	host := cfg.SiteHost()
		152	m := &autocert.Manager{
		153	Prompt: autocert.AcceptTOS,
		154	Cache: autocert.DirCache(filepath.Join(cfg.Server.Root, "acme")),
		155	HostPolicy: autocert.HostWhitelist(host),
		156	Email: cfg.HTTP.ACMEEmail,
		157	}
		158	// TLS-ALPN-01 rides the HTTPS port itself. The optional
		159	// plain-HTTP listener adds HTTP-01 and a redirect; losing
		160	// it (port 80 taken, no privileges) is not fatal.
		161	if addr := cfg.HTTP.ACMEHTTPAddr; addr != "" && addr != "off" {
		162	redirect := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		163	http.Redirect(w, r, "https://"+host+r.URL.RequestURI(), http.StatusMovedPermanently)
		164	})
		165	go func() {
		166	slog.Info("acme http listening", "addr", addr)
		167	if err := http.ListenAndServe(addr, m.HTTPHandler(redirect)); err != nil {
		168	slog.Warn("acme http listener failed; continuing with TLS-ALPN only", "err", err)
		169	}
		170	}()
		171	}
		172	hs.TLSConfig = m.TLSConfig()
		173	errCh <- hs.ListenAndServeTLS("", "")
151	}	174	}
152	}()	175	}()
153		176

e2e/acme_test.go added +105

@@ -0,0 +1,105 @@
	1	package e2e
	2
	3	import (
	4	"crypto/tls"
	5	"fmt"
	6	"net"
	7	"net/http"
	8	"os"
	9	"os/exec"
	10	"path/filepath"
	11	"testing"
	12	"time"
	13	)
	14
	15	// TestACMEServe verifies the acme wiring offline: the HTTPS listener is up
	16	// with autocert answering handshakes, and the port-80-style helper listener
	17	// serves redirects. Actual issuance needs a reachable CA and a public DNS
	18	// name, which a test cannot have; what matters here is that the plumbing is
	19	// correct and failure to issue does not kill the daemon.
	20	func TestACMEServe(t *testing.T) {
	21	inst := startInstanceWith(t, "") // helper for binary + keys; killed below
	22	inst.proc.Process.Kill()
	23	inst.proc.Wait()
	24
	25	httpsPort := freePort(t)
	26	acmeHTTPPort := freePort(t)
	27	cfg := fmt.Sprintf(`
	28	[server]
	29	root = %q
	30	site_url = "https://gitbay.example"
	31	[ssh]
	32	port = %d
	33	[http]
	34	addr = "127.0.0.1:%d"
	35	tls = "acme"
	36	acme_email = "noreply@gitbay.example"
	37	acme_http_addr = "127.0.0.1:%d"
	38	`, inst.root, inst.port, httpsPort, acmeHTTPPort)
	39	if err := os.WriteFile(inst.config, []byte(cfg), 0o600); err != nil {
	40	t.Fatal(err)
	41	}
	42	inst.proc = exec.Command(inst.gitbayd, "--config", inst.config, "serve")
	43	inst.proc.Stderr = os.Stderr
	44	if err := inst.proc.Start(); err != nil {
	45	t.Fatal(err)
	46	}
	47	t.Cleanup(func() { inst.proc.Process.Kill(); inst.proc.Wait() })
	48
	49	wait := func(port int) {
	50	t.Helper()
	51	deadline := time.Now().Add(10 * time.Second)
	52	for {
	53	conn, err := net.DialTimeout("tcp", fmt.Sprintf("127.0.0.1:%d", port), 200*time.Millisecond)
	54	if err == nil {
	55	conn.Close()
	56	return
	57	}
	58	if time.Now().After(deadline) {
	59	t.Fatalf("port %d never came up", port)
	60	}
	61	time.Sleep(50 * time.Millisecond)
	62	}
	63	}
	64	wait(httpsPort)
	65	wait(acmeHTTPPort)
	66
	67	// The helper listener redirects everything to the canonical HTTPS host.
	68	client := &http.Client{CheckRedirect: func(http.Request, []http.Request) error {
	69	return http.ErrUseLastResponse
	70	}}
	71	resp, err := client.Get(fmt.Sprintf("http://127.0.0.1:%d/alice/repo/log?x=1", acmeHTTPPort))
	72	if err != nil {
	73	t.Fatal(err)
	74	}
	75	resp.Body.Close()
	76	if resp.StatusCode != http.StatusMovedPermanently \|\|
	77	resp.Header.Get("Location") != "https://gitbay.example/alice/repo/log?x=1" {
	78	t.Fatalf("redirect: %d %q", resp.StatusCode, resp.Header.Get("Location"))
	79	}
	80
	81	// A TLS handshake reaches autocert, which tries (and fails) to issue —
	82	// the handshake errors, the daemon survives, the listener stays up.
	83	conn, err := tls.DialWithDialer(&net.Dialer{Timeout: 3 * time.Second}, "tcp",
	84	fmt.Sprintf("127.0.0.1:%d", httpsPort),
	85	&tls.Config{ServerName: "gitbay.example", InsecureSkipVerify: true})
	86	if err == nil {
	87	conn.Close()
	88	t.Fatal("handshake unexpectedly succeeded with no CA reachable")
	89	}
	90	wait(httpsPort) // still listening after the failed handshake
	91
	92	// Certificates cache under the server root.
	93	if _, err := os.Stat(filepath.Join(inst.root, "acme")); err != nil {
	94	t.Fatalf("acme cache dir: %v", err)
	95	}
	96
	97	// A host outside the whitelist is refused before any issuance attempt.
	98	conn2, err := tls.DialWithDialer(&net.Dialer{Timeout: 3 * time.Second}, "tcp",
	99	fmt.Sprintf("127.0.0.1:%d", httpsPort),
	100	&tls.Config{ServerName: "evil.example", InsecureSkipVerify: true})
	101	if err == nil {
	102	conn2.Close()
	103	t.Fatal("handshake for non-whitelisted host succeeded")
	104	}
	105	}

go.mod +2

 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	modernc.org/libc v1.74.4 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

go.sum +10 −6

 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
 golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 modernc.org/cc/v4 v4.29.1 h1:MKgdCV3WykTSPqpVrnxdEDS0HEd2FHpKZDzxzU5LyeI=

internal/config/config.go +30 −1

 	"net"
 	"os"
 	"strconv"
+	"strings"
 	"github.com/BurntSushi/toml"
 )
 	TLS      string `toml:"tls"` // acme | files | off
 	CertFile string `toml:"cert_file"`
 	KeyFile  string `toml:"key_file"`
+	// ACME (Let's Encrypt by default). Certificates are cached under
+	// server.root/acme. acme_http_addr serves HTTP-01 challenges and
+	// redirects to HTTPS; "off" disables it (TLS-ALPN-01 on the HTTPS
+	// port still works).
+	ACMEEmail    string `toml:"acme_email"`
+	ACMEHTTPAddr string `toml:"acme_http_addr"`
 }
 type GitDaemon struct {
 	return Config{
 		Server: Server{Root: "/var/lib/gitbay"},
 		SSH:    SSH{Mode: "embedded", Port: 22},
-		HTTP:   HTTP{Addr: ":443", TLS: "acme"},
+		HTTP:   HTTP{Addr: ":443", TLS: "acme", ACMEHTTPAddr: ":80"},
 		Web:    Web{Mode: "view_only"},
 		Registration: Registration{
 			Mode: "closed",
 	if c.HTTP.TLS == "files" && (c.HTTP.CertFile == "" || c.HTTP.KeyFile == "") {
 		errs = append(errs, errors.New("http.tls = \"files\" requires cert_file and key_file"))
 	}
+	if c.HTTP.TLS == "acme" {
+		host := c.SiteHost()
+		switch {
+		case !strings.HasPrefix(c.Server.SiteURL, "https://"):
+			errs = append(errs, errors.New("http.tls = \"acme\" requires an https:// site_url: certificates are issued for that host"))
+		case host == "" || host == "localhost" || net.ParseIP(host) != nil:
+			errs = append(errs, fmt.Errorf("http.tls = \"acme\" cannot issue a certificate for %q: use a public DNS name in site_url", host))
+		}
+	}
 	if err := oneOf("web.mode", c.Web.Mode, "view_only", "accounts"); err != nil {
 		errs = append(errs, err)
 	}
 	return errors.Join(errs...)
 }
+// SiteHost returns the bare hostname from site_url (no scheme, port, path).
+func (c Config) SiteHost() string {
+	h := strings.TrimPrefix(strings.TrimPrefix(c.Server.SiteURL, "https://"), "http://")
+	h = strings.TrimSuffix(h, "/")
+	if i := strings.IndexByte(h, '/'); i >= 0 {
+		h = h[:i]
+	}
+	if host, _, err := net.SplitHostPort(h); err == nil {
+		return host
+	}
+	return h
+}
 // CheckHost performs environment probes that only make sense on the target
 // machine: port availability for the embedded listener and root existence.
 func (c Config) CheckHost() error {

internal/config/config_test.go +4

 			"closed registration, no smtp at all",
 			minimal,
 		},
+		{
+			"acme with public https host",
+			"[server]\nroot = \"/var/lib/gitbay\"\nsite_url = \"https://gitbay.org\"\n[http]\ntls = \"acme\"\nacme_email = \"noreply@gitbay.org\"\n",
+		},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {

Commit 399d2f300e

Commit `399d2f300e`