opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-10-16 14:48:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs(docs/tutorials/reverse-proxy-caddy.md): clarify the Caddy on-demand TLS ask endpoint (#29269)

Browse Source 
The Caddy reverse-proxy tutorial's `on_demand_tls` example told readers
to leave `ask http://example.com` unchanged, warning that changing it
could break cert issuance. That's backwards: Caddy calls the `ask` URL
with the requested hostname as a `domain` query parameter and treats any
`2xx` response as approval to issue a certificate. `example.com` returns
`200` for any request, so the documented config approved certificate
issuance for any hostname, letting an attacker exhaust the deployment's
Let's Encrypt rate limit for the whole domain.

Replaces the "DO NOT CHANGE" warning with guidance to point `ask` at a
real, self-hosted validation endpoint, and links to [the
discussion](https://github.com/coder/coder/discussions/29079#discussioncomment-18462842)
that reported this for a reference implementation.

Reported in https://github.com/coder/coder/discussions/29079

> This PR was created with AI assistance (Coder Agents).
This commit is contained in:
Ben Potter
2026-09-17 18:32:18 -05:00
committed by GitHub
parent d2a7454d79
commit dde8069ade
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tutorials/reverse-proxy-caddy.md
+8 -2
View File
@@ -106,6 +106,10 @@ certificates, you'll need a domain name that resolves to your Caddy server.
This is optional and can be removed.
- `email@example.com`: Email to request certificates from LetsEncrypt/ZeroSSL
(does not have to be Coder admin email)
- `ask http://example.com`: Change this to a URL you control that
validates the requested hostname before Caddy requests a certificate for
it. See [this discussion](https://github.com/coder/coder/discussions/29079#discussioncomment-18462842)
for a reference implementation.
4. Start Coder. Set `CODER_ACCESS_URL` and `CODER_WILDCARD_ACCESS_URL` to the
domain you're using in your Caddyfile.
@@ -147,8 +151,10 @@ certificates, you'll need a domain name that resolves to your Caddy server.
is optional and can be removed.
- `localhost:3000`: Address Coder is running on. Modify this if you changed
`CODER_HTTP_ADDRESS` in the Coder configuration.
- _DO NOT CHANGE the `ask http://example.com` line! Doing so will result in
your certs potentially not being generated._
- `ask http://example.com`: Change this to a URL you control that
validates the requested hostname before Caddy requests a certificate for
it. See [this discussion](https://github.com/coder/coder/discussions/29079#discussioncomment-18462842)
for a reference implementation.
4. [Configure Coder](../admin/setup/index.md) and change the following values: