1. Caddy version (caddy version):
v2.5.1
2. How I run Caddy:
Command line (CLI)
a. System environment:
Windows Server 2016
b. Command:
caddy_windows_amd64.exe run --watch
c. Service/unit/compose file:
N/A
d. My complete Caddyfile or JSON config:
Server2016, localhost, 127.0.0.1, 10.10.7.10 {
log {
level INFO
format console
output file ./log/caddy.log
}
tls ./certs/server.pem ./certs/server.key {
client_auth {
mode require_and_verify
trusted_leaf_cert_file ./certs/clients/client01.cer
trusted_leaf_cert_file ./certs/clients/client02.cer
trusted_leaf_cert_file ./certs/server.pem
}
}
handle_path /fileserver1/* {
reverse_proxy * localhost:7777
}
handle_path /fileserver2/* {
expression {client_common_name}.startsWith("client01") {
rewrite * /client01{uri}
}
expression {client_common_name}.startsWith("client02") {
rewrite * /client02{uri}
}
reverse_proxy localhost:8888
}
route * {
respond "Main Page!!!"
}
}
3. The problem I’m having:
We would like to be able to filter a client certificate to a sub directory base upon the client_common_name on the header of client certificate presented.
This would be sub folders access/associated to a unique certificate, like how a home folder per user account would be structured.
Hopefully my explanation is clear enough, I am very new to Caddy so I might be missing something glaringly obvious or it might not even be a option but we’re trying to explore every avenue for help.
4. Error messages and/or full log output:
Log output from caddy.log output file command above.
1.6560244993440115e+09 info http.log.access.log0 handled request {“request”: {“remote_ip”: “fe80::a09c:786e:713:1a3%Ethernet0”, “remote_port”: “49758”, “proto”: “HTTP/2.0”, “method”: “HEAD”, “host”: “nsync”, “uri”: “/fileserver1/xxsgjuv2.4sb”, “headers”: {“User-Agent”: [“rclone/v1.57.0”]}, “tls”: {“resumed”: false, “version”: 772, “cipher_suite”: 4867, “proto”: “h2”, “server_name”: “Server2016”, “client_common_name”: “client01”, “client_serial”: “33652285”}}, “user_id”: “”, “duration”: 0.0010017, “size”: 0, “status”: 200, “resp_headers”: {“Content-Length”: [“4485120”], “Content-Type”: [“application/octet-stream”], “Last-Modified”: [“Sun, 29 May 2022 03:50:09 GMT”], “Date”: [“Thu, 23 Jun 2022 22:48:19 GMT”], “Server”: [“Caddy”, “rclone/v1.57.0”], “Accept-Ranges”: [“bytes”]}}
5. What I already tried:
I have tried using expression {client_common_name}.startsWith(“client01”) and expression {tls_client_subject}.startsWith(“CN=client01”) to validate the client trying to access then use the provided rewrite * /client01{uri}
Using this syntax in the config does not load the config in caddy.
expression {client_common_name}.startsWith(“client01”) {
rewrite * /client01{uri}
}
expression {client_common_name}.startsWith(“client02”) {
rewrite * /client02{uri}
}
reverse_proxy localhost:8888
6. Links to relevant resources:
Request matchers (Caddyfile) — Caddy Documentation (caddyserver.com)