Dev Tier: Enable wildcard certificates in Caddy#2740
Merged
Conversation
It works!
Since those certificates are fake, we don't need to worry about splitting rules to be per-domain like when we cannot do the DMS ACME challenge.
This way the if condition makes more sense and we don't need to repeat the condition expression multiple times.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## develop #2740 +/- ##
==========================================
- Coverage 2.27% 2.12% -0.16%
==========================================
Files 170 170
Lines 10378 10367 -11
==========================================
- Hits 236 220 -16
- Misses 10142 10147 +5
🚀 New features to boost your workflow:
|
Zokhoi
approved these changes
Mar 8, 2026
emmiegit
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This brings us closer to having our new dev (and prod) tiers by fixing some issues with Caddy as our front reverse proxy.
This PR is primarily concerned with enabling wildcard certificates, which requires a DNS-based ACME challenge. So there is a new option which allows passing in credential information to permit this type of challenge. If it's disabled, then the Caddyfile works to ensure there are no
*.domain.tldpatterns that Caddy would try to request wildcard certificates for. Forwjfilesthis means requesting each known subdomain separately, and for unknown domains means using only HTTP. (This would be for the "this site does not exist" error message - we'd like that to be HTTPS but it's much less crucial).I also switched CaddyService to use askama (jinja2) templates since making some of these changes using simple string buffer manipulation was getting annoying. I spent too long trying to get the newline spacing perfect but it's just not worth it, so there are a few spots where there are two newlines instead of one for some cases.