rlwj-lab/opsx-vpn
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add guarded IP certificate flow and renewal history

Browse Source
This commit is contained in:
Codex committed 2026-10-26 15:32:27 +08:00
1 parent dd94a4cc84
commit d3699abb18
14 files changed
+343 -56
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/internal/tlsservice/tlsservice.go
+33 -28
View File
@@ -40,29 +40,30 @@ var state struct {
}
type CertificateStatus struct {
Enabled bool `json:"enabled"`
Mode string `json:"mode"`
ConfiguredMode string `json:"configured_mode"`
Scheme string `json:"scheme"`
ConfiguredScheme string `json:"configured_scheme"`
Domain string `json:"domain"`
ConfiguredDomain string `json:"configured_domain"`
Port int `json:"port"`
ConfiguredPort int `json:"configured_port"`
PublicBase string `json:"public_base"`
ConfiguredPublicBase string `json:"configured_public_base"`
RestartRequired bool `json:"restart_required"`
DNS []string `json:"dns"`
HTTPAddr string `json:"http_address"`
HTTPSAddr string `json:"https_address"`
Cached bool `json:"certificate_cached"`
Valid bool `json:"certificate_valid"`
CertSource string `json:"cert_source,omitempty"`
Issuer string `json:"issuer,omitempty"`
NotBefore time.Time `json:"not_before,omitempty"`
NotAfter time.Time `json:"not_after,omitempty"`
Renewal string `json:"renewal_mode"`
DirectPortPublic bool `json:"management_direct_public"`
Enabled bool `json:"enabled"`
Mode string `json:"mode"`
ConfiguredMode string `json:"configured_mode"`
Scheme string `json:"scheme"`
ConfiguredScheme string `json:"configured_scheme"`
Domain string `json:"domain"`
ConfiguredDomain string `json:"configured_domain"`
Port int `json:"port"`
ConfiguredPort int `json:"configured_port"`
PublicBase string `json:"public_base"`
ConfiguredPublicBase string `json:"configured_public_base"`
RestartRequired bool `json:"restart_required"`
DNS []string `json:"dns"`
HTTPAddr string `json:"http_address"`
HTTPSAddr string `json:"https_address"`
Cached bool `json:"certificate_cached"`
Valid bool `json:"certificate_valid"`
CertSource string `json:"cert_source,omitempty"`
Issuer string `json:"issuer,omitempty"`
NotBefore time.Time `json:"not_before,omitempty"`
NotAfter time.Time `json:"not_after,omitempty"`
Renewal string `json:"renewal_mode"`
DirectPortPublic bool `json:"management_direct_public"`
RenewalEvents []RenewalEvent `json:"renewal_events"`
}
// DataDir returns the active TLS data directory (empty before Start).
@@ -82,11 +83,11 @@ func ValidPublicHost(scheme, host string) bool {
if !ValidScheme(scheme) {
return false
}
if scheme == "https" {
return ValidDomain(host)
}
if ip := net.ParseIP(host); ip != nil {
return ip.To4() != nil && !ip.IsUnspecified() && !ip.IsMulticast()
if ip.To4() == nil || ip.IsUnspecified() || ip.IsMulticast() {
return false
}
return scheme == "http" || (ip.IsGlobalUnicast() && !ip.IsPrivate() && !ip.IsLoopback() && !ip.IsLinkLocalUnicast())
}
return ValidDomain(host)
}
@@ -202,6 +203,9 @@ func configFromEnvironment(dataDir string) (configuration, error) {
if domain != "" && !ValidPublicHost(scheme, domain) {
return configuration{}, fmt.Errorf("VPN_TLS_DOMAIN 必须是有效域名，HTTP 模式也可使用 IPv4 地址")
}
if mode == "autocert" && domain != "" && !ValidDomain(domain) {
return configuration{}, fmt.Errorf("旧 Go 自动证书模式仅支持域名；IP 证书请使用 Nginx")
}
port := 0
if raw := strings.TrimSpace(os.Getenv("VPN_TLS_PORT")); raw != "" {
var err error
@@ -410,7 +414,8 @@ func Status() CertificateStatus {
Mode: config.mode,
DNS: []string{},
HTTPAddr: config.httpAddr, HTTPSAddr: config.httpsAddr,
Renewal: config.mode,
Renewal: config.mode,
RenewalEvents: ReadRenewalEvents(),
}
if config.mode == "nginx" {
listenAddress := os.Getenv("VPN_LISTEN_ADDR")