|  | @ -89,29 +89,6 @@ func (t *TLS) Provision(ctx caddy.Context) error { | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  | 	t.certCache = certmagic.NewCache(cacheOpts) |  |  | 	t.certCache = certmagic.NewCache(cacheOpts) | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | 	// automation/management policies
 |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	if t.Automation == nil { |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		t.Automation = new(AutomationConfig) |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	t.Automation.defaultPublicAutomationPolicy = new(AutomationPolicy) |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	err := t.Automation.defaultPublicAutomationPolicy.Provision(t) |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	if err != nil { |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		return fmt.Errorf("provisioning default public automation policy: %v", err) |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	t.Automation.defaultInternalAutomationPolicy = &AutomationPolicy{ |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		IssuerRaw: json.RawMessage(`{"module":"internal"}`), |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	err = t.Automation.defaultInternalAutomationPolicy.Provision(t) |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	if err != nil { |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		return fmt.Errorf("provisioning default internal automation policy: %v", err) |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	for i, ap := range t.Automation.Policies { |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		err := ap.Provision(t) |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		if err != nil { |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 			return fmt.Errorf("provisioning automation policy %d: %v", i, err) |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 		} |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  |  | 
			
		
	
		
		
			
				
					|  |  | 	// certificate loaders
 |  |  | 	// certificate loaders
 | 
			
		
	
		
		
			
				
					|  |  | 	val, err := ctx.LoadModule(t, "CertificatesRaw") |  |  | 	val, err := ctx.LoadModule(t, "CertificatesRaw") | 
			
		
	
		
		
			
				
					|  |  | 	if err != nil { |  |  | 	if err != nil { | 
			
		
	
	
		
		
			
				
					|  | @ -119,9 +96,8 @@ func (t *TLS) Provision(ctx caddy.Context) error { | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  | 	for modName, modIface := range val.(map[string]interface{}) { |  |  | 	for modName, modIface := range val.(map[string]interface{}) { | 
			
		
	
		
		
			
				
					|  |  | 		if modName == "automate" { |  |  | 		if modName == "automate" { | 
			
		
	
		
		
			
				
					
					|  |  | 			// special case; these will be loaded in later
 |  |  | 			// special case; these will be loaded in later using our automation facilities,
 | 
			
				
				
			
		
	
		
		
			
				
					
					|  |  | 			// using our automation facilities, which we
 |  |  | 			// which we want to avoid doing during provisioning
 | 
			
				
				
			
		
	
		
		
			
				
					|  |  | 			// want to avoid during provisioning
 |  |  |  | 
			
		
	
		
		
	
		
		
	
		
		
			
				
					|  |  | 			if automateNames, ok := modIface.(*AutomateLoader); ok && automateNames != nil { |  |  | 			if automateNames, ok := modIface.(*AutomateLoader); ok && automateNames != nil { | 
			
		
	
		
		
			
				
					|  |  | 				t.automateNames = []string(*automateNames) |  |  | 				t.automateNames = []string(*automateNames) | 
			
		
	
		
		
			
				
					|  |  | 			} else { |  |  | 			} else { | 
			
		
	
	
		
		
			
				
					|  | @ -132,6 +108,38 @@ func (t *TLS) Provision(ctx caddy.Context) error { | 
			
		
	
		
		
			
				
					|  |  | 		t.certificateLoaders = append(t.certificateLoaders, modIface.(CertificateLoader)) |  |  | 		t.certificateLoaders = append(t.certificateLoaders, modIface.(CertificateLoader)) | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  | 
 |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	// automation/management policies
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	if t.Automation == nil { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		t.Automation = new(AutomationConfig) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	t.Automation.defaultPublicAutomationPolicy = new(AutomationPolicy) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	err = t.Automation.defaultPublicAutomationPolicy.Provision(t) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	if err != nil { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		return fmt.Errorf("provisioning default public automation policy: %v", err) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	for _, n := range t.automateNames { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		// if any names specified by the "automate" loader do not qualify for a public
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		// certificate, we should initialize a default internal automation policy
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		// (but we don't want to do this unnecessarily, since it may prompt for password!)
 | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		if certmagic.SubjectQualifiesForPublicCert(n) { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			continue | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		t.Automation.defaultInternalAutomationPolicy = &AutomationPolicy{ | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			IssuerRaw: json.RawMessage(`{"module":"internal"}`), | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		err = t.Automation.defaultInternalAutomationPolicy.Provision(t) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		if err != nil { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			return fmt.Errorf("provisioning default internal automation policy: %v", err) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		break | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	for i, ap := range t.Automation.Policies { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		err := ap.Provision(t) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		if err != nil { | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 			return fmt.Errorf("provisioning automation policy %d: %v", i, err) | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 		} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  |  |  |  | 
 | 
			
		
	
		
		
			
				
					|  |  | 	// session ticket ephemeral keys (STEK) service and provider
 |  |  | 	// session ticket ephemeral keys (STEK) service and provider
 | 
			
		
	
		
		
			
				
					|  |  | 	if t.SessionTickets != nil { |  |  | 	if t.SessionTickets != nil { | 
			
		
	
		
		
			
				
					|  |  | 		err := t.SessionTickets.provision(ctx) |  |  | 		err := t.SessionTickets.provision(ctx) | 
			
		
	
	
		
		
			
				
					|  | @ -340,7 +348,7 @@ func (t *TLS) getAutomationPolicyForName(name string) *AutomationPolicy { | 
			
		
	
		
		
			
				
					|  |  | 			} |  |  | 			} | 
			
		
	
		
		
			
				
					|  |  | 		} |  |  | 		} | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  | 	} | 
			
		
	
		
		
			
				
					
					|  |  | 	if certmagic.SubjectQualifiesForPublicCert(name) { |  |  | 	if certmagic.SubjectQualifiesForPublicCert(name) || t.Automation.defaultInternalAutomationPolicy == nil { | 
			
				
				
			
		
	
		
		
	
		
		
			
				
					|  |  | 		return t.Automation.defaultPublicAutomationPolicy |  |  | 		return t.Automation.defaultPublicAutomationPolicy | 
			
		
	
		
		
			
				
					|  |  | 	} |  |  | 	} | 
			
		
	
		
		
			
				
					|  |  | 	return t.Automation.defaultInternalAutomationPolicy |  |  | 	return t.Automation.defaultInternalAutomationPolicy | 
			
		
	
	
		
		
			
				
					|  | 
 |