Caddy: v2: on-demand TLS configuration in Caddyfile

[rgarrigue]

Hi there

I'm searching for the "on demand" configuration in Caddyfile V2. So far I only found this example through the API https://caddy.community/t/v2-http-to-https-redirects-fail-for-on-demand-ssl-certs/6742

I know it's work in progress, I'ld just like a confirmation it's still to be done, and an issue to track the feature.

Best regards,

[francislavoie]

Specifically, the request is to have an ask option in https://caddyserver.com/docs/caddyfile/directives/tls to match Caddy v1

[lpellegr]

I am also interested by the ask option for Caddy v2. So sad too see several features available with v1 that are not mentioned in v2 :(

[mholt]

@lpellegr Until I have time to add it, you are welcome to do so with a pull request any time!

[francislavoie]

@lpellegr to be clear, v2 does support the ask option, but it's only available via JSON config at this time. This issue is to track adding it to the Caddyfile config.

See here for the JSON config documentation https://caddyserver.com/docs/json/apps/tls/automation/

[mholt]

This is really hard, guys 😅

[mholt]

Done in fc7340e11aa9ca6326909aedfd36bb2c5b53d2a8

Docs to come soon. Basically (and this might change):

tls {
    on_demand
}

will enable on-demand TLS for that site. You can configure rate limits and the ask endpoint in a global option:

on_demand_tls {
    interval ...
    burst ...
    ask ...
}

Setting the global option does not enable it, you have to do that per-site.

Anyway, please try it out, and have fun! It was really complicated so I probably got something wrong!

[cmizzi]

Is there any way to configure an ask per-site ?

[mholt]

Is there any way to configure an ask per-site ?

No, because there's no concept of a "site" during a TLS handshake.

[francislavoie]

If you need to communicate with 2 different databases, then you should do that in your backend ask endpoint. That shouldn't be a concern of caddy.