diff --git a/src/api/docs/content/specs/config.yaml b/src/api/docs/content/specs/config.yaml index c4de8b42..61dcf1ed 100644 --- a/src/api/docs/content/specs/config.yaml +++ b/src/api/docs/content/specs/config.yaml @@ -351,10 +351,15 @@ components: type: string port: type: string - tls_cert: - type: string sessionTimeout: type: integer + tls: + type: object + properties: + rev_proxy: + type: boolean + cert: + type: string paths: type: object properties: @@ -629,8 +634,10 @@ components: domain: pi.hole acl: "+0.0.0.0/0,::/0" port: 8080,[::]:8080 - tls_cert: "" sessionTimeout: 300 + tls: + rev_proxy: false + cert: "/etc/pihole/tls.pem" paths: webroot: "/var/www/html" webhome: "/admin/" diff --git a/src/config/config.c b/src/config/config.c index aff7e7f2..5780b5e8 100644 --- a/src/config/config.c +++ b/src/config/config.c @@ -826,12 +826,18 @@ void initConfig(struct config *conf) conf->webserver.port.t = CONF_STRING; conf->webserver.port.d.s = (char*)"8080,[::]:8080"; - conf->webserver.tls_cert.k = "webserver.tls_cert"; - conf->webserver.tls_cert.h = "Path to the TLS (SSL) certificate file. This option is only required when at least one of webserver.port is TLS. The file must be in PEM format, and it must have both, private key and certificate (the *.pem file created must contain a 'CERTIFICATE' section as well as a 'RSA PRIVATE KEY' section).\n The *.pem file can be created using\n cp server.crt server.pem\n cat server.key >> server.pem\n if you have these files instead"; - conf->webserver.tls_cert.a = cJSON_CreateStringReference(""); - conf->webserver.tls_cert.f = FLAG_ADVANCED_SETTING | FLAG_RESTART_DNSMASQ; - conf->webserver.tls_cert.t = CONF_STRING; - conf->webserver.tls_cert.d.s = (char*)"/etc/pihole/tls.pem"; + conf->webserver.tls.rev_proxy.k = "webserver.tls.rev_proxy"; + conf->webserver.tls.rev_proxy.h = "Is Pi-hole running behind a reverse proxy? If yes, Pi-hole will not consider HTTP-only connections being insecure. This is useful if you are running Pi-hole in a trusted environment, for example, in a local network, and you are using a reverse proxy to provide TLS encryption, e.g., by using Traefik (docker). If you are using a reverse proxy, you can alternatively set webserver.tls.cert to the path of the TLS certificate file and let Pi-hole handle true end-to-end encryption."; + conf->webserver.tls.rev_proxy.f = FLAG_ADVANCED_SETTING; + conf->webserver.tls.rev_proxy.t = CONF_BOOL; + conf->webserver.tls.rev_proxy.d.b = false; + + conf->webserver.tls.cert.k = "webserver.tls.cert"; + conf->webserver.tls.cert.h = "Path to the TLS (SSL) certificate file. This option is only required when at least one of webserver.port is TLS. The file must be in PEM format, and it must have both, private key and certificate (the *.pem file created must contain a 'CERTIFICATE' section as well as a 'RSA PRIVATE KEY' section).\n The *.pem file can be created using\n cp server.crt server.pem\n cat server.key >> server.pem\n if you have these files instead"; + conf->webserver.tls.cert.a = cJSON_CreateStringReference(""); + conf->webserver.tls.cert.f = FLAG_ADVANCED_SETTING | FLAG_RESTART_DNSMASQ; + conf->webserver.tls.cert.t = CONF_STRING; + conf->webserver.tls.cert.d.s = (char*)"/etc/pihole/tls.pem"; conf->webserver.sessionTimeout.k = "webserver.sessionTimeout"; conf->webserver.sessionTimeout.h = "Session timeout in seconds. If a session is inactive for more than this time, it will be terminated. Sessions are continuously refreshed by the web interface, preventing sessions from timing out while the web interface is open.\n This option may also be used to make logins persistent for long times, e.g. 86400 seconds (24 hours), 604800 seconds (7 days) or 2592000 seconds (30 days). Note that the total number of concurrent sessions is limited so setting this value too high may result in users being rejected and unable to log in if there are already too many sessions active."; diff --git a/src/config/config.h b/src/config/config.h index ed3b04cd..d5a5b4e0 100644 --- a/src/config/config.h +++ b/src/config/config.h @@ -204,7 +204,10 @@ struct config { struct conf_item acl; struct conf_item port; struct conf_item sessionTimeout; - struct conf_item tls_cert; + struct { + struct conf_item rev_proxy; + struct conf_item cert; + } tls; struct { struct conf_item webroot; struct conf_item webhome; diff --git a/src/lua/ftl_lua.c b/src/lua/ftl_lua.c index 0555d116..f8c556b6 100644 --- a/src/lua/ftl_lua.c +++ b/src/lua/ftl_lua.c @@ -228,6 +228,12 @@ static int pihole_needLogin(lua_State *L) { return 1; // number of results } +// pihole.rev_proxy() +static int pihole_rev_proxy(lua_State *L) { + lua_pushboolean(L, config.webserver.tls.rev_proxy.v.b); + return 1; // number of results +} + static const luaL_Reg piholelib[] = { {"ftl_version", pihole_ftl_version}, {"hostname", pihole_hostname}, @@ -237,6 +243,7 @@ static const luaL_Reg piholelib[] = { {"include", pihole_include}, {"boxedlayout", pihole_boxedlayout}, {"needLogin", pihole_needLogin}, + {"rev_proxy", pihole_rev_proxy}, {NULL, NULL} }; diff --git a/src/webserver/webserver.c b/src/webserver/webserver.c index 7f2228fb..b40712ab 100644 --- a/src/webserver/webserver.c +++ b/src/webserver/webserver.c @@ -232,26 +232,26 @@ void http_init(void) #ifdef HAVE_TLS // Add TLS options if configured - if(config.webserver.tls_cert.v.s != NULL && - strlen(config.webserver.tls_cert.v.s) > 0) + if(config.webserver.tls.cert.v.s != NULL && + strlen(config.webserver.tls.cert.v.s) > 0) { // Try to generate certificate if not present - if(!file_readable(config.webserver.tls_cert.v.s) && - !generate_certificate(config.webserver.tls_cert.v.s, false)) + if(!file_readable(config.webserver.tls.cert.v.s) && + !generate_certificate(config.webserver.tls.cert.v.s, false)) { log_err("Generation of SSL/TLS certificate %s failed!", - config.webserver.tls_cert.v.s); + config.webserver.tls.cert.v.s); } - if(file_readable(config.webserver.tls_cert.v.s)) + if(file_readable(config.webserver.tls.cert.v.s)) { options[++next_option] = "ssl_certificate"; - options[++next_option] = config.webserver.tls_cert.v.s; + options[++next_option] = config.webserver.tls.cert.v.s; } else { log_err("Webserver SSL/TLS certificate %s not found or not readable!", - config.webserver.tls_cert.v.s); + config.webserver.tls.cert.v.s); } } #endif diff --git a/test/pihole.toml b/test/pihole.toml index 7f3d5223..65b98b01 100644 --- a/test/pihole.toml +++ b/test/pihole.toml @@ -517,19 +517,6 @@ # comma-separated list of <[ip_address:]port> port = "8080,[::]:8080,443s" - # Path to the TLS (SSL) certificate file. This option is only required when at least - # one of webserver.port is TLS. The file must be in PEM format, and it must have both, - # private key and certificate (the *.pem file created must contain a 'CERTIFICATE' - # section as well as a 'RSA PRIVATE KEY' section). - # The *.pem file can be created using - # cp server.crt server.pem - # cat server.key >> server.pem - # if you have these files instead - # - # Possible values are: - # - tls_cert = "/etc/pihole/test.pem" ### CHANGED, default = "" - # Session timeout in seconds. If a session is inactive for more than this time, it will # be terminated. Sessions are continuously refreshed by the web interface, preventing # sessions from timing out while the web interface is open. @@ -540,6 +527,28 @@ # many sessions active. sessionTimeout = 300 + [webserver.tls] + # Is Pi-hole running behind a reverse proxy? If yes, Pi-hole will not consider + # HTTP-only connections being insecure. This is useful if you are running Pi-hole in a + # trusted environment, for example, in a local network, and you are using a reverse + # proxy to provide TLS encryption, e.g., by using Traefik (docker). If you are using a + # reverse proxy, you can alternatively set webserver.tls.cert to the path of the TLS + # certificate file and let Pi-hole handle true end-to-end encryption. + rev_proxy = false + + # Path to the TLS (SSL) certificate file. This option is only required when at least + # one of webserver.port is TLS. The file must be in PEM format, and it must have both, + # private key and certificate (the *.pem file created must contain a 'CERTIFICATE' + # section as well as a 'RSA PRIVATE KEY' section). + # The *.pem file can be created using + # cp server.crt server.pem + # cat server.key >> server.pem + # if you have these files instead + # + # Possible values are: + # + cert = "/etc/pihole/test.pem" + [webserver.paths] # Server root on the host #