summaryrefslogtreecommitdiff
path: root/interface-definitions/service_https.xml.in
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2024-01-06 10:55:42 +0100
committerMergify <37929162+mergify[bot]@users.noreply.github.com>2024-01-10 07:11:39 +0000
commit34eadcf2f74ae57342997bed77ce64bddd34219b (patch)
treed84308c16a8e892b047877cb4e20c702ee5574f5 /interface-definitions/service_https.xml.in
parenta9ed12de93425a9e9637a61e5b7f17ae01575242 (diff)
downloadvyos-1x-34eadcf2f74ae57342997bed77ce64bddd34219b.tar.gz
vyos-1x-34eadcf2f74ae57342997bed77ce64bddd34219b.zip
https: T5902: remove virtual-host configuration
We have not seen the adoption of the https virtual-host CLI option. What it did? * Create multiple webservers each listening on a different IP/port (but in the same VRF) * All webservers shared one common document root * All webservers shared the same SSL certificates * All webservers could have had individual allow-client configurations * API could be enabled for a particular virtual-host but was always enabled on the default host This configuration tried to provide a full webserver via the CLI but VyOS is a router and the Webserver is there for an API or to serve files for a local-ui. Changes Remove support for virtual-hosts as it's an incomplete and thus mostly useless "thing". Migrate all allow-client statements to one top-level allow statement. (cherry picked from commit d0d3071e99eb65edb888c26ef2fdc9e038438887)
Diffstat (limited to 'interface-definitions/service_https.xml.in')
-rw-r--r--interface-definitions/service_https.xml.in89
1 files changed, 32 insertions, 57 deletions
diff --git a/interface-definitions/service_https.xml.in b/interface-definitions/service_https.xml.in
index 57f36a982..b60c7ff2e 100644
--- a/interface-definitions/service_https.xml.in
+++ b/interface-definitions/service_https.xml.in
@@ -8,52 +8,6 @@
<priority>1001</priority>
</properties>
<children>
- <tagNode name="virtual-host">
- <properties>
- <help>Identifier for virtual host</help>
- <constraint>
- <regex>[a-zA-Z0-9-_.:]{1,255}</regex>
- </constraint>
- <constraintErrorMessage>illegal characters in identifier or identifier longer than 255 characters</constraintErrorMessage>
- </properties>
- <children>
- <leafNode name="listen-address">
- <properties>
- <help>Address to listen for HTTPS requests</help>
- <completionHelp>
- <script>${vyos_completion_dir}/list_local_ips.sh --both</script>
- </completionHelp>
- <valueHelp>
- <format>ipv4</format>
- <description>HTTPS IPv4 address</description>
- </valueHelp>
- <valueHelp>
- <format>ipv6</format>
- <description>HTTPS IPv6 address</description>
- </valueHelp>
- <valueHelp>
- <format>'*'</format>
- <description>any</description>
- </valueHelp>
- <constraint>
- <validator name="ip-address"/>
- <regex>\*</regex>
- </constraint>
- </properties>
- </leafNode>
- #include <include/port-number.xml.i>
- <leafNode name='port'>
- <defaultValue>443</defaultValue>
- </leafNode>
- <leafNode name="server-name">
- <properties>
- <help>Server names: exact, wildcard, or regex</help>
- <multi/>
- </properties>
- </leafNode>
- #include <include/allow-client.xml.i>
- </children>
- </tagNode>
<node name="api">
<properties>
<help>VyOS HTTP API configuration</help>
@@ -172,19 +126,18 @@
</node>
</children>
</node>
- <node name="api-restrict">
+ #include <include/allow-client.xml.i>
+ <leafNode name="enable-http-redirect">
<properties>
- <help>Restrict api proxy to subset of virtual hosts</help>
+ <help>Enable HTTP to HTTPS redirect</help>
+ <valueless/>
</properties>
- <children>
- <leafNode name="virtual-host">
- <properties>
- <help>Restrict proxy to virtual host(s)</help>
- <multi/>
- </properties>
- </leafNode>
- </children>
- </node>
+ </leafNode>
+ #include <include/listen-address.xml.i>
+ #include <include/port-number.xml.i>
+ <leafNode name='port'>
+ <defaultValue>443</defaultValue>
+ </leafNode>
<node name="certificates">
<properties>
<help>TLS certificates</help>
@@ -192,8 +145,30 @@
<children>
#include <include/pki/ca-certificate.xml.i>
#include <include/pki/certificate.xml.i>
+ #include <include/pki/dh-params.xml.i>
</children>
</node>
+ <leafNode name="tls-version">
+ <properties>
+ <help>Specify available TLS version(s)</help>
+ <completionHelp>
+ <list>1.2 1.3</list>
+ </completionHelp>
+ <valueHelp>
+ <format>1.2</format>
+ <description>TLSv1.2</description>
+ </valueHelp>
+ <valueHelp>
+ <format>1.3</format>
+ <description>TLSv1.3</description>
+ </valueHelp>
+ <constraint>
+ <regex>(1.2|1.3)</regex>
+ </constraint>
+ <multi/>
+ </properties>
+ <defaultValue>1.2 1.3</defaultValue>
+ </leafNode>
#include <include/interface/vrf.xml.i>
</children>
</node>