Reviewed-on: #257 Reviewed-by: crapStone <codeberg@crapstone.dev> Co-authored-by: 6543 <6543@obermui.de> Co-committed-by: 6543 <6543@obermui.de>

closes #247 Reviewed-on: #254 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: crapStone <crapstone01@gmail.com> Co-committed-by: crapStone <crapstone01@gmail.com>

Reviewed-on: #251 Reviewed-by: crapStone <crapstone01@gmail.com> Co-authored-by: thepaperpilot <thepaperpilot@noreply.codeberg.org> Co-committed-by: thepaperpilot <thepaperpilot@noreply.codeberg.org>

Reviewed-on: #231 Reviewed-by: Gusted <gusted@noreply.codeberg.org>

- This specific message will [already be generated](974229681f/html/error.go (L44)) when `http.StatusMisdirectedRequest` is set as status with [an empty message](974229681f/html/error.go (L25-L28)). - Resolves #228 Co-authored-by: Gusted <postmaster@gusted.xyz> Reviewed-on: #230 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>

Adds basic support for `_redirects` files. It supports a subset of what IPFS supports: https://docs.ipfs.tech/how-to/websites-on-ipfs/redirects-and-custom-404s/ Example: ``` /redirect https://example.com/ 301 /another-redirect /page 301 /302 https://example.com/ 302 /app/* /index.html 200 /articles/* /posts/:splat 301 ``` 301 redirect: https://video-prize-ranch.localhost.mock.directory:4430/redirect SPA rewrite: https://video-prize-ranch.localhost.mock.directory:4430/app/path/path Catch-all with splat: https://video-prize-ranch.localhost.mock.directory:4430/articles/path/path Closes #46 Co-authored-by: video-prize-ranch <cb.8a3w5@simplelogin.co> Co-authored-by: 6543 <6543@obermui.de> Reviewed-on: #148 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: video-prize-ranch <video-prize-ranch@noreply.codeberg.org> Co-committed-by: video-prize-ranch <video-prize-ranch@noreply.codeberg.org>

A database bug in xorm.go prevents the pages-server from saving a renewed certificate for a domain that already has one in the database. Co-authored-by: crystal <crystal@noreply.codeberg.org> Co-authored-by: 6543 <6543@obermui.de> Reviewed-on: #209 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Crystal <crystal@noreply.codeberg.org> Co-committed-by: Crystal <crystal@noreply.codeberg.org>

I forgot to update the name of this function in the CI log so it looks like it's running the same test twice even though it's not. Co-authored-by: crystal <crystal@noreply.codeberg.org> Reviewed-on: #210 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Crystal <crystal@noreply.codeberg.org> Co-committed-by: Crystal <crystal@noreply.codeberg.org>

enhance #114 Reviewed-on: #205

This try to address #115 Co-authored-by: Simon Vieille <simon@deblan.fr> Co-authored-by: 6543 <6543@obermui.de> Reviewed-on: #125 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: deblan <deblan@noreply.codeberg.org> Co-committed-by: deblan <deblan@noreply.codeberg.org>

and more logging Reviewed-on: #184

close #181 Reviewed-on: #185

Reviewed-on: #183

fix #156 fix #157 Co-authored-by: 6543 <6543@obermui.de> Reviewed-on: #159 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: crystal <crystal@noreply.codeberg.org> Co-committed-by: crystal <crystal@noreply.codeberg.org>

get rid of gobal vars and make make functions with less args :) tldr: collect funcs and create a own ACME client to manage that stuff Reviewed-on: #179

followup of #173 close #95 Reviewed-on: #175

close #176 Reviewed-on: #177

error io.EOF is gracefully end of file read. so we don't need to cancel cache saving Reviewed-on: #178

Deprecate **pogreb**! close #169 Reviewed-on: #173

Solves Codeberg/Community#823 and #143 Co-authored-by: foehammer127 <foehammer127@gmail.com> Co-authored-by: 6543 <6543@obermui.de> Reviewed-on: #152 Reviewed-by: Otto <otto@codeberg.org> Reviewed-by: Gusted <gusted@noreply.codeberg.org> Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: foehammer <foehammer@noreply.codeberg.org> Co-committed-by: foehammer <foehammer@noreply.codeberg.org>

- Currently if the canonical domain validations fails(either for legitimate reasons or for bug reasons like the request to Gitea/Forgejo failing) it will use main domain certificate, which in the case for custom domains will warrant a security error as the certificate isn't issued to the custom domain. - This patch handles this situation more gracefully and instead only disallow obtaining a certificate if the domain validation fails, so in the case that a certificate still exists it can still be used even if the canonical domain validation fails. There's a small side effect, legitimate users that remove domains from `.domain` will still be able to use the removed domain(as long as the DNS records exists) as long as the certificate currently hold by pages-server isn't expired. - Given the increased usage in custom domains that are resulting in errors, I think it ways more than the side effect. - In order to future-proof against future slowdowns of instances, add a retry mechanism to the domain validation function, such that it's more likely to succeed even if the instance is not responding. - Refactor the code a bit and add some comments. Co-authored-by: Gusted <postmaster@gusted.xyz> Co-authored-by: 6543 <6543@obermui.de> Reviewed-on: #160 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>

address #155 Reviewed-on: #172

- Currently any error generated by requesting the `.domains` file of a repository would be logged under the info log level, which isn't the correct log level when we exclude the not found error. - Use warn log level if the error isn't the not found error. Co-authored-by: Gusted <postmaster@gusted.xyz> Reviewed-on: #162 Reviewed-by: Otto <otto@codeberg.org>

closes #153 Co-authored-by: crapStone <crapstone01@gmail.com> Co-authored-by: 6543 <6543@obermui.de> Reviewed-on: #154 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: crapStone <crapstone@noreply.codeberg.org> Co-committed-by: crapStone <crapstone@noreply.codeberg.org>

Added new TockenBucket named `acmeClientFailLimit` to avoid being banned because of the [Failed validation limit](https://letsencrypt.org/docs/failed-validation-limit/) of Let's Encrypt. The behaviour is similar to the other limiters blocking the `obtainCert` func ensuring rate under limit. Co-authored-by: fsologureng <sologuren@estudiohum.cl> Co-authored-by: 6543 <6543@obermui.de> Reviewed-on: #151 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Felipe Leopoldo Sologuren Gutiérrez <fsologureng@noreply.codeberg.org> Co-committed-by: Felipe Leopoldo Sologuren Gutiérrez <fsologureng@noreply.codeberg.org>

- It's not guaranteed that `tls.X509KeyPair` will set `c.Leaf`. - This patch fixes this by using a wrapper that parses the leaf certificate(in bytes) if `c.Leaf` wasn't set. - Resolves #149 Co-authored-by: Gusted <postmaster@gusted.xyz> Reviewed-on: #150 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>

Co-authored-by: crapStone <crapstone01@gmail.com> Reviewed-on: #145 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: crapStone <crapstone@noreply.codeberg.org> Co-committed-by: crapStone <crapstone@noreply.codeberg.org>

Co-authored-by: crapStone <crapstone01@gmail.com> Reviewed-on: #144 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: crapStone <crapstone@noreply.codeberg.org> Co-committed-by: crapStone <crapstone@noreply.codeberg.org>

If no repository is found the user expects a 404 status code instead of a dependency failed status code (as it was before). Signed-off-by: Jan Klippel <c0d3b3rg@kl1pp3l.de> Fixes: Codeberg/Community#809 Co-authored-by: Jan Klippel <c0d3b3rg@kl1pp3l.de> Co-authored-by: 6543 <6543@obermui.de> Reviewed-on: #141 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: jklippel <jklippel@noreply.codeberg.org> Co-committed-by: jklippel <jklippel@noreply.codeberg.org>

- Remove unnecessary type conversion. - Enforce via CI Co-authored-by: Gusted <williamzijl7@hotmail.com> Reviewed-on: #139 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>

As per [the documentation](https://pkg.go.dev/net/http#Serve), it doesn't enable HTTP2 by-default, unless we enable it via the `NextProtos` option. Co-authored-by: Gusted <williamzijl7@hotmail.com> Reviewed-on: #137 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>

we have big functions that handle all stuff ... we should split this into smaler chuncks so we could test them seperate and make clear cuts in what happens where Reviewed-on: #135

close #100 close #109 close #113 close #28 close #63 Reviewed-on: #106

- For production(*cough* Codeberg *cough*), it's important to not use mock certs. So fail right from the start if this is the case and not try to "handle it gracefully", as it would break production. - Resolves #131 CC @6543 Co-authored-by: Gusted <williamzijl7@hotmail.com> Reviewed-on: #133 Reviewed-by: 6543 <6543@obermui.de> Co-authored-by: Gusted <gusted@noreply.codeberg.org> Co-committed-by: Gusted <gusted@noreply.codeberg.org>

Signed-off-by: 6543 <6543@obermui.de>