Method Start

modules/caddytls/tls.go:401–463

Start activates the TLS module.

()

// Start activates the TLS module.
func (t *TLS) Start() error {
	// warn if on-demand TLS is enabled but no restrictions are in place
	if t.Automation.OnDemand == nil || (t.Automation.OnDemand.Ask == "" && t.Automation.OnDemand.permission == nil) {
		for _, ap := range t.Automation.Policies {
			if ap.OnDemand && ap.isWildcardOrDefault() {
				if c := t.logger.Check(zapcore.WarnLevel, "YOUR SERVER MAY BE VULNERABLE TO ABUSE: on-demand TLS is enabled, but no protections are in place"); c != nil {
					c.Write(zap.String("docs", "https://caddyserver.com/docs/automatic-https#on-demand-tls"))
				}
				break
			}
		}
	}

	// now that we are running, and all manual certificates have
	// been loaded, time to load the automated/managed certificates
	err := t.Manage(t.automateNames)
	if err != nil {
		return fmt.Errorf("automate: managing %v: %v", t.automateNames, err)
	}

	if t.EncryptedClientHello != nil {
		echLogger := t.logger.Named("ech")

		// publish ECH configs in the background; does not need to block
		// server startup, as it could take a while; then keep keys rotated
		go func() {
			// publish immediately first
			if err := t.publishECHConfigs(echLogger); err != nil {
				echLogger.Error("publication(s) failed", zap.Error(err))
			}

			// then every so often, rotate and publish if needed
			// (both of these functions only do something if needed)
			for {
				select {
				case <-time.After(1 * time.Hour):
					// ensure old keys are rotated out
					t.EncryptedClientHello.configsMu.Lock()
					err = t.EncryptedClientHello.rotateECHKeys(t.ctx, echLogger, false)
					t.EncryptedClientHello.configsMu.Unlock()
					if err != nil {
						echLogger.Error("rotating ECH configs failed", zap.Error(err))
						continue
					}
					err := t.publishECHConfigs(echLogger)
					if err != nil {
						echLogger.Error("publication(s) failed", zap.Error(err))
					}
				case <-t.ctx.Done():
					return
				}
			}
		}()
	}

	if !t.DisableStorageClean {
		// start the storage cleaner goroutine and ticker,
		// which cleans out expired certificates and more