{"action":"created","issue":{"url":"https://api.github.com/repos/opnsense/plugins/issues/975","repository_url":"https://api.github.com/repos/opnsense/plugins","labels_url":"https://api.github.com/repos/opnsense/plugins/issues/975/labels{/name}","comments_url":"https://api.github.com/repos/opnsense/plugins/issues/975/comments","events_url":"https://api.github.com/repos/opnsense/plugins/issues/975/events","html_url":"https://github.com/opnsense/plugins/issues/975","id":379755049,"node_id":"MDU6SXNzdWUzNzk3NTUwNDk=","number":975,"title":"www/nginx: Add ACME proxy support","user":{"login":"jpawlowski","id":75446,"node_id":"MDQ6VXNlcjc1NDQ2","avatar_url":"https://avatars2.githubusercontent.com/u/75446?v=4","gravatar_id":"","url":"https://api.github.com/users/jpawlowski","html_url":"https://github.com/jpawlowski","followers_url":"https://api.github.com/users/jpawlowski/followers","following_url":"https://api.github.com/users/jpawlowski/following{/other_user}","gists_url":"https://api.github.com/users/jpawlowski/gists{/gist_id}","starred_url":"https://api.github.com/users/jpawlowski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jpawlowski/subscriptions","organizations_url":"https://api.github.com/users/jpawlowski/orgs","repos_url":"https://api.github.com/users/jpawlowski/repos","events_url":"https://api.github.com/users/jpawlowski/events{/privacy}","received_events_url":"https://api.github.com/users/jpawlowski/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2018-11-12T12:29:18Z","updated_at":"2018-11-13T17:58:51Z","closed_at":null,"author_association":"NONE","body":"It is kind of bothersome to configure ACME challenge forwarding to internal servers as to the NGINX configuration becomes quite crowded but such simple rules, especially as you cannot recycle a single location definition for multiple upstream servers.\r\n\r\nI suggest to extend the existing LetsEncrypt support with an additional local PHP routing script:\r\n\r\n1. If no local file for ACME challange was found in /var/etc/acme-client/challenges, forward HTTP request to a local PHP script.\r\n\r\n2. The PHP script should resolve the requested hostname from the HTTP header using the local resolver settings.\r\n\r\n3. It is assumed that the firewall would be able to resolve it to a network internal IP address (IPv4 or IPv6, both may also be public IPs).\r\n\r\n4. The firewall shall forward the ACME request to that internal server on port 80 and enforcing the correct URI path. Don't think the DNS lookup needs to be done explicitly, it may just be performed by the firewall. The only thing to consider is avoiding a loop, e.g. the script shall ensure it is not connecting back to the firewall on port 80.\r\n\r\nI imagine this would simplify the ADME challenge handling for internal servers a lot as it is quite normal that DNS validation cannot be used or is even not supported by some blackboxes (e.g. Proxmox VMM)."},"comment":{"url":"https://api.github.com/repos/opnsense/plugins/issues/comments/438373761","html_url":"https://github.com/opnsense/plugins/issues/975#issuecomment-438373761","issue_url":"https://api.github.com/repos/opnsense/plugins/issues/975","id":438373761,"node_id":"MDEyOklzc3VlQ29tbWVudDQzODM3Mzc2MQ==","user":{"login":"fabianfrz","id":3713914,"node_id":"MDQ6VXNlcjM3MTM5MTQ=","avatar_url":"https://avatars1.githubusercontent.com/u/3713914?v=4","gravatar_id":"","url":"https://api.github.com/users/fabianfrz","html_url":"https://github.com/fabianfrz","followers_url":"https://api.github.com/users/fabianfrz/followers","following_url":"https://api.github.com/users/fabianfrz/following{/other_user}","gists_url":"https://api.github.com/users/fabianfrz/gists{/gist_id}","starred_url":"https://api.github.com/users/fabianfrz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fabianfrz/subscriptions","organizations_url":"https://api.github.com/users/fabianfrz/orgs","repos_url":"https://api.github.com/users/fabianfrz/repos","events_url":"https://api.github.com/users/fabianfrz/events{/privacy}","received_events_url":"https://api.github.com/users/fabianfrz/received_events","type":"User","site_admin":false},"created_at":"2018-11-13T17:58:51Z","updated_at":"2018-11-13T17:58:51Z","author_association":"MEMBER","body":"@jpawlowski the listen thing is a bug in the validation and I'll look for fixing that. By the default the field should only allow numeric ports and some special ones (ssh, http) which will also cause some trouble in most plugins because they rely on a numeric input."}}
{"actor":{"display_login":"fabianfrz"}}