- Currently if the canonical domain validations fails(either for legitimate reasons or for bug reasons like the request to Gitea/Forgejo failing) it will use main domain certificate, which in the case for custom domains will warrant a security error as the certificate isn't issued to the custom domain. - This patch handles this situation more gracefully and instead only disallow obtaining a certificate if the domain validation fails, so in the case that a certificate still exists it can still be used even if the canonical domain validation fails. There's a small side effect, legitimate users that remove domains from `.domain` will still be able to use the removed domain(as long as the DNS records exists) as long as the certificate currently hold by pages-server isn't expired. - Given the increased usage in custom domains that are resulting in errors, I think it ways more than the side effect. - In order to future-proof against future slowdowns of instances, add a retry mechanism to the domain validation function, such that it's more likely to succeed even if the instance is not responding. - Refactor the code a bit and add some comments. Co-authored-by: Gusted <postmaster@gusted.xyz> Co-authored-by: 6543 <6543@obermui.de> Reviewed-on: #160 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>
- Currently any error generated by requesting the `.domains` file of a repository would be logged under the info log level, which isn't the correct log level when we exclude the not found error. - Use warn log level if the error isn't the not found error. Co-authored-by: Gusted <postmaster@gusted.xyz> Reviewed-on: #162 Reviewed-by: Otto <otto@codeberg.org>
Added new TockenBucket named `acmeClientFailLimit` to avoid being banned because of the [Failed validation limit](https://letsencrypt.org/docs/failed-validation-limit/) of Let's Encrypt. The behaviour is similar to the other limiters blocking the `obtainCert` func ensuring rate under limit. Co-authored-by: fsologureng <sologuren@estudiohum.cl> Co-authored-by: 6543 <6543@obermui.de> Reviewed-on: #151 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Felipe Leopoldo Sologuren Gutiérrez <fsologureng@noreply.codeberg.org> Co-committed-by: Felipe Leopoldo Sologuren Gutiérrez <fsologureng@noreply.codeberg.org>
- It's not guaranteed that `tls.X509KeyPair` will set `c.Leaf`. - This patch fixes this by using a wrapper that parses the leaf certificate(in bytes) if `c.Leaf` wasn't set. - Resolves#149 Co-authored-by: Gusted <postmaster@gusted.xyz> Reviewed-on: #150 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>
If no repository is found the user expects a 404 status code instead of a dependency failed status code (as it was before). Signed-off-by: Jan Klippel <c0d3b3rg@kl1pp3l.de> Fixes: Codeberg/Community#809 Co-authored-by: Jan Klippel <c0d3b3rg@kl1pp3l.de> Co-authored-by: 6543 <6543@obermui.de> Reviewed-on: #141 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: jklippel <jklippel@noreply.codeberg.org> Co-committed-by: jklippel <jklippel@noreply.codeberg.org>
As per [the documentation](https://pkg.go.dev/net/http#Serve), it doesn't enable HTTP2 by-default, unless we enable it via the `NextProtos` option. Co-authored-by: Gusted <williamzijl7@hotmail.com> Reviewed-on: #137 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>
we have big functions that handle all stuff ... we should split this into smaler chuncks so we could test them seperate and make clear cuts in what happens where Reviewed-on: #135
- For production(*cough* Codeberg *cough*), it's important to not use mock certs. So fail right from the start if this is the case and not try to "handle it gracefully", as it would break production. - Resolves#131 CC @6543 Co-authored-by: Gusted <williamzijl7@hotmail.com> Reviewed-on: #133 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>
- Logs are currently indicating that it's returning `nil` in valid scenarios, therefor this patch adds extra logging in this code to better understand what it is doing in this function. Co-authored-by: Gusted <williamzijl7@hotmail.com> Reviewed-on: #130 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>
- It's likely that the tryBranch is returning false when it should be returning true, make these logs more verbose so they show up on production logs. Co-authored-by: Gusted <williamzijl7@hotmail.com> Reviewed-on: #127 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>
- Add the host to the Handler's logging fields, so you don't just see the path, but also which domain was being requested. Co-authored-by: Gusted <williamzijl7@hotmail.com> Reviewed-on: #123 Reviewed-by: 6543 <6543@noreply.codeberg.org> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>
- Actually log useful information at their respective log level. - Add logs in hot-paths to be able to deep-dive and debug specific requests (see server/handler.go) - Add more information to existing fields(e.g. the host that the user is visiting, this was noted by @fnetX). Co-authored-by: Gusted <williamzijl7@hotmail.com> Reviewed-on: #116 Reviewed-by: 6543 <6543@noreply.codeberg.org> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>
- Use a logger with `FASTHTTP` prefix as fasthttp's logger so it's easy to see what fasthttp is logging in console/journal. Co-authored-by: Gusted <williamzijl7@hotmail.com> Reviewed-on: #98 Reviewed-by: 6543 <6543@noreply.codeberg.org> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>
So we can access branch that contain slash like `branch/name` with `username.codeberg.page/repo/@branch~name/`. Branch name cannot contain `~` character but it can be in a HTTP URL, so replace the `~` from URL to `/` could be a valid solution to me. Resolve#101 Co-authored-by: Gary Wang <wzc782970009@gmail.com> Reviewed-on: #102 Reviewed-by: 6543 <6543@noreply.codeberg.org> Co-authored-by: Gary Wang <blumia@noreply.codeberg.org> Co-committed-by: Gary Wang <blumia@noreply.codeberg.org>
Use the default value of `256 * 1024` for the concurrency limit, this will mean that the server will be able to handle more connections. Co-authored-by: Gusted <williamzijl7@hotmail.com> Reviewed-on: #99 Reviewed-by: 6543 <6543@noreply.codeberg.org> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>
solves #56. - The expected filename is `404.html`, like GitHub Pages - Each repo/branch can have one `404.html` file at it's root - If a repo does not have a `pages` branch, the 404.html file from the `pages` repository is used - You get status code 404 (unless you request /404.html which returns 200) - The error page is cached --- close#56 Reviewed-on: #81 Reviewed-by: 6543 <6543@noreply.codeberg.org> Co-authored-by: crystal <crystal@noreply.codeberg.org> Co-committed-by: crystal <crystal@noreply.codeberg.org>
