Method buildPKIApp

caddyconfig/httpcaddyfile/pkiapp.go:197–264

(
	pairings []sbAddrAssociation,
	options map[string]any,
	warnings []caddyconfig.Warning,
)

}

func (st ServerType) buildPKIApp(
	pairings []sbAddrAssociation,
	options map[string]any,
	warnings []caddyconfig.Warning,
) (*caddypki.PKI, []caddyconfig.Warning, error) {
	skipInstallTrust := false
	if _, ok := options["skip_install_trust"]; ok {
		skipInstallTrust = true
	}

	// check if auto_https is off - in that case we should not create
	// any PKI infrastructure even with skip_install_trust directive
	autoHTTPS := []string{}
	if ah, ok := options["auto_https"].([]string); ok {
		autoHTTPS = ah
	}
	autoHTTPSOff := slices.Contains(autoHTTPS, "off")

	falseBool := false

	// Load the PKI app configured via global options
	var pkiApp *caddypki.PKI
	unwrappedPki, ok := options["pki"].(*caddypki.PKI)
	if ok {
		pkiApp = unwrappedPki
	} else {
		pkiApp = &caddypki.PKI{CAs: make(map[string]*caddypki.CA)}
	}
	for _, ca := range pkiApp.CAs {
		if skipInstallTrust {
			ca.InstallTrust = &falseBool
		}
		pkiApp.CAs[ca.ID] = ca
	}

	// Add in the CAs configured via directives
	for _, p := range pairings {
		for _, sblock := range p.serverBlocks {
			// find all the CAs that were defined and add them to the app config
			// i.e. from any "acme_server" directives
			for _, caCfgValue := range sblock.pile["pki.ca"] {
				ca := caCfgValue.Value.(*caddypki.CA)
				if skipInstallTrust {
					ca.InstallTrust = &falseBool
				}

				// the CA might already exist from global options, so
				// don't overwrite it in that case
				if _, ok := pkiApp.CAs[ca.ID]; !ok {
					pkiApp.CAs[ca.ID] = ca
				}
			}
		}
	}

	// if there was no CAs defined in any of the servers,
	// and we were requested to not install trust, then
	// add one for the default/local CA to do so