ok yeah too many branches in this config · microcosm.blue/microcosm-rs@1108ca8

+54 -22

2 changed files

Expand all

slingshot

src

main.rs

server.rs

slingshot/src/main.rs

··· 80 80 /// you must also configure the relevant DNS records for this to work 81 81 #[arg(long, action, requires("tls_domain"), env = "SLINGSHOT_TLS_IPV6")] 82 82 tls_ipv6: bool, 83 + /// with tls configured on 443, say "please use https" on port 80 84 + /// 85 + /// note: configuring tls always binds port 80 as well, 443-only is TODO 86 + #[arg(long, action, requires("tls_domain"), env = "SLINGSHOT_WARN_INSECURE")] 87 + warn_insecure: bool, 83 88 /// redirect acme http-01 challenges to this url 84 89 /// 85 90 /// useful if you're setting up a second instance that synchronizes its ··· 201 206 args.tls_domain, 202 207 args.tls_certs, 203 208 args.tls_ipv6, 209 + args.warn_insecure, 204 210 args.acme_challenge_redirect, 205 211 args.acme_contact, 206 212 args.acme_staging,

+48 -22

slingshot/src/server.rs

··· 1304 1304 make_sync(move |_| doc.clone()) 1305 1305 } 1306 1306 1307 + #[poem::handler] 1308 + async fn https_plz() -> (poem::http::StatusCode, &'static str) { 1309 + ( 1310 + poem::http::StatusCode::MISDIRECTED_REQUEST, 1311 + "this service must be accessed with https (port 443).", 1312 + ) 1313 + } 1314 + 1307 1315 #[allow(clippy::too_many_arguments)] 1308 1316 pub async fn serve( 1309 1317 cache: HybridCache<String, CachedRecord>, ··· 1314 1322 tls_domain: Option<String>, 1315 1323 tls_certs: Option<PathBuf>, 1316 1324 tls_ipv6: bool, 1325 + warn_insecure: bool, 1317 1326 acme_challenge_redirect: Option<String>, 1318 1327 acme_contact: Option<String>, 1319 1328 acme_staging: bool, ··· 1369 1378 .with(cors); 1370 1379 1371 1380 if let Some(contact) = acme_contact { 1372 - let (listener, app) = acmify(app, domain, tls_certs, tls_ipv6, contact, acme_staging)?; 1381 + let (listener, app) = acmify( 1382 + app, 1383 + domain, 1384 + tls_certs, 1385 + tls_ipv6, 1386 + contact, 1387 + acme_staging, 1388 + warn_insecure, 1389 + )?; 1373 1390 run(listener, app, shutdown).await 1374 1391 } else { 1375 1392 let certs = tls_certs.expect("certs path must be set for non-acme tls"); 1376 - let (listener, app) = tlsify(app, domain, certs, tls_ipv6, acme_challenge_redirect)?; 1393 + let (listener, app) = tlsify( 1394 + app, 1395 + domain, 1396 + certs, 1397 + tls_ipv6, 1398 + acme_challenge_redirect, 1399 + warn_insecure, 1400 + )?; 1377 1401 run(listener, app, shutdown).await 1378 1402 } 1379 1403 } else { ··· 1388 1412 tls_ipv6: bool, 1389 1413 acme_contact: String, 1390 1414 acme_staging: bool, 1415 + warn_insecure: bool, 1391 1416 ) -> Result<(impl Listener + 'static, impl Endpoint + 'static), ServerError> { 1392 1417 let mut auto_cert = AutoCert::builder() 1393 1418 .contact(acme_contact) ··· 1409 1434 1410 1435 let auto_cert = auto_cert.build().map_err(ServerError::AcmeBuildError)?; 1411 1436 1412 - let app = RouteScheme::new() 1413 - .https(app) 1414 - .http(auto_cert.http_01_endpoint()); 1437 + let mut insecure_app = Route::new().at( 1438 + "/.well-known/acme-challenge/:token", 1439 + auto_cert.http_01_endpoint(), 1440 + ); 1441 + 1442 + if warn_insecure { 1443 + insecure_app = insecure_app.at("/*any", https_plz).at("/", https_plz); 1444 + } 1445 + 1446 + let app = RouteScheme::new().https(app).http(insecure_app); 1415 1447 1416 1448 let listener = TcpListener::bind(if tls_ipv6 { "[::]:443" } else { "0.0.0.0:443" }) 1417 1449 .acme(auto_cert) ··· 1430 1462 tls_certs: PathBuf, 1431 1463 tls_ipv6: bool, 1432 1464 acme_challenge_redirect: Option<String>, 1465 + warn_insecure: bool, 1433 1466 ) -> Result<(impl Listener + 'static, impl Endpoint + 'static), ServerError> { 1434 1467 use poem::listener::{RustlsCertificate, RustlsConfig}; 1435 1468 use std::path::Path; ··· 1466 1499 "0.0.0.0:80" 1467 1500 })); 1468 1501 1469 - #[poem::handler] 1470 - async fn https_plz() -> (poem::http::StatusCode, &'static str) { 1471 - ( 1472 - poem::http::StatusCode::MISDIRECTED_REQUEST, 1473 - "this service must be accessed with https (port 443).", 1474 - ) 1475 - } 1476 - 1477 1502 let app = if let Some(redir) = acme_challenge_redirect { 1478 1503 use poem::web; 1479 1504 ··· 1483 1508 web::Redirect::temporary(format!("{redir}{token}")) 1484 1509 }); 1485 1510 1486 - RouteScheme::new().https(app).http( 1487 - Route::new() 1488 - .at("/.well-known/acme-challenge/:token", redirect) 1489 - .at("/*any", https_plz) 1490 - .at("/", https_plz), 1491 - ) 1511 + let mut insecure_app = Route::new().at("/.well-known/acme-challenge/:token", redirect); 1512 + 1513 + if warn_insecure { 1514 + insecure_app = insecure_app.at("/*any", https_plz).at("/", https_plz); 1515 + } 1516 + 1517 + RouteScheme::new().https(app).http(insecure_app) 1518 + } else if warn_insecure { 1519 + RouteScheme::new().https(app).http(https_plz) 1492 1520 } else { 1493 - RouteScheme::new() 1494 - .https(app) 1495 - .http(Route::new().at("/*any", https_plz).at("/", https_plz)) 1521 + RouteScheme::new().https(app) 1496 1522 }; 1497 1523 1498 1524 Ok((listener, app))

Configure Feed

Configure Feed