From 30668be4a018b94920a2751fe52612f90c748297 Mon Sep 17 00:00:00 2001
From: Catherine <whitequark@whitequark.org>
Date: Sun, 26 Oct 2025 04:53:55 +0000
Subject: [PATCH] If an https fallback URL is configured, try TLS for Caddy
 domain check.

This is added pretty much exclusively for Codeberg Pages v2 migration,
but the implementation is generic enough to be useful for other similar
setups (if anyone ever has to deal with one...)
---
 src/caddy.go | 53 ++++++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 45 insertions(+), 8 deletions(-)

diff --git a/src/caddy.go b/src/caddy.go
index 2febad7..4252357 100644
--- a/src/caddy.go
+++ b/src/caddy.go
@@ -1,16 +1,18 @@
 package git_pages
 
 import (
+	"crypto/tls"
 	"fmt"
 	"log"
 	"net"
 	"net/http"
+	"net/url"
 	"strings"
 )
 
 func ServeCaddy(w http.ResponseWriter, r *http.Request) {
-	query := r.URL.Query().Get("domain")
-	if query == "" {
+	domain := r.URL.Query().Get("domain")
+	if domain == "" {
 		http.Error(w, "domain parameter required", http.StatusBadRequest)
 		return
 	}
@@ -19,21 +21,56 @@ func ServeCaddy(w http.ResponseWriter, r *http.Request) {
 	// While TLS certificates may be provisionsed for IP addresses under special circumstances[^1],
 	// this isn't really what git-pages is designed for, and object store accesses can cost money.
 	// [^1]: https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate
-	if ip := net.ParseIP(query); ip != nil {
-		log.Println("caddy:", query, 404, "(bare IP)")
+	if ip := net.ParseIP(domain); ip != nil {
+		log.Println("caddy:", domain, 404, "(bare IP)")
 		w.WriteHeader(http.StatusNotFound)
 		return
 	}
 
-	found, err := backend.CheckDomain(r.Context(), strings.ToLower(query))
+	found, err := backend.CheckDomain(r.Context(), strings.ToLower(domain))
+	if !found {
+		// If we don't serve the domain, but a fallback server does, then we should let our
+		// Caddy instance request a TLS certificate. Otherwise, we'll never have an opportunity
+		// to proxy the request further. (This functionality was originally added for Codeberg
+		// Pages v2, which would under some circumstances return certificates with subjectAltName
+		// not valid for the SNI. Go's TLS stack makes `tls.Dial` return an error for these,
+		// thankfully making it unnecessary to examine X.509 certificates manually here.)
+		for _, wildcardConfig := range config.Wildcard {
+			if wildcardConfig.FallbackProxyTo == "" {
+				continue
+			}
+			fallbackURL, err := url.Parse(wildcardConfig.FallbackProxyTo)
+			if err != nil {
+				continue
+			}
+			if fallbackURL.Scheme != "https" {
+				continue
+			}
+			connectHost := fallbackURL.Host
+			if fallbackURL.Port() != "" {
+				connectHost += ":" + fallbackURL.Port()
+			} else {
+				connectHost += ":443"
+			}
+			log.Printf("caddy: check TLS %s", fallbackURL)
+			connection, err := tls.Dial("tcp", connectHost, &tls.Config{ServerName: domain})
+			if err != nil {
+				continue
+			}
+			connection.Close()
+			found = true
+			break
+		}
+	}
+
 	if found {
-		log.Println("caddy:", query, 200)
+		log.Println("caddy:", domain, 200)
 		w.WriteHeader(http.StatusOK)
 	} else if err == nil {
-		log.Println("caddy:", query, 404)
+		log.Println("caddy:", domain, 404)
 		w.WriteHeader(http.StatusNotFound)
 	} else {
-		log.Println("caddy:", query, 500)
+		log.Println("caddy:", domain, 500)
 		w.WriteHeader(http.StatusInternalServerError)
 		fmt.Fprintln(w, err)
 	}