From f1be90b74be064ece49b0a1c8bcfa8fa6c6c87f3 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Sun, 7 Sep 2025 22:01:17 -0400 Subject: [PATCH 1/7] fix: use https scheme for any tcp/443 EXPOSE directive --- plugins/builder-dockerfile/internal-functions | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/plugins/builder-dockerfile/internal-functions b/plugins/builder-dockerfile/internal-functions index 21e36208b..28438710f 100755 --- a/plugins/builder-dockerfile/internal-functions +++ b/plugins/builder-dockerfile/internal-functions @@ -124,8 +124,12 @@ fn-builder-dockerfile-get-detect-port-map() { p=${p//\/udp/} port_map+="udp:$p:$p " else + scheme="http" p=${p//\/tcp/} - port_map+="http:$p:$p " + if [[ "$p" == "443" ]]; then + scheme="https" + fi + port_map+="$scheme:$p:$p " fi done echo "$port_map" | xargs From 52e4e908197a855010b7671d161d5b14623b597b Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Sun, 7 Sep 2025 22:03:46 -0400 Subject: [PATCH 2/7] refactor: change SCHEME argument to DEFAULT_SCHEME to make it more apparent that it is a fallback --- plugins/domains/domains-urls | 10 +++++----- plugins/domains/internal-functions | 16 ++++++++-------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/plugins/domains/domains-urls b/plugins/domains/domains-urls index 3e45c80d5..6765d4d17 100755 --- a/plugins/domains/domains-urls +++ b/plugins/domains/domains-urls @@ -9,25 +9,25 @@ trigger-domains-domains-urls() { declare APP="$1" URL_TYPE="$2" local urls - local SCHEME="http" + local DEFAULT_SCHEME="http" local DEFAULT_LISTEN_PORT="80" if [[ "$(plugn trigger certs-exists "$APP")" == "true" ]]; then - SCHEME="https" + DEFAULT_SCHEME="https" DEFAULT_LISTEN_PORT="443" fi urls=$(plugn trigger app-urls "$APP" "$URL_TYPE") if [[ -n "$urls" ]]; then if [[ "$URL_TYPE" == "url" ]]; then - echo "$urls" | tr ' ' '\n' | grep "$SCHEME://" | head -n1 + echo "$urls" | tr ' ' '\n' | grep "$DEFAULT_SCHEME://" | head -n1 else echo "$urls" | tr ' ' '\n' | sort fi else if [[ "$URL_TYPE" == "url" ]]; then - fn-domains-generate-urls "$APP" "$SCHEME" "$DEFAULT_LISTEN_PORT" | tr ' ' '\n' | grep "$SCHEME://" | head -n1 + fn-domains-generate-urls "$APP" "$DEFAULT_SCHEME" "$DEFAULT_LISTEN_PORT" | tr ' ' '\n' | grep "$DEFAULT_SCHEME://" | head -n1 else - fn-domains-generate-urls "$APP" "$SCHEME" "$DEFAULT_LISTEN_PORT" | tr ' ' '\n' | sort + fn-domains-generate-urls "$APP" "$DEFAULT_SCHEME" "$DEFAULT_LISTEN_PORT" | tr ' ' '\n' | sort -u fi fi } diff --git a/plugins/domains/internal-functions b/plugins/domains/internal-functions index c4a870c40..aa9dd2048 100755 --- a/plugins/domains/internal-functions +++ b/plugins/domains/internal-functions @@ -116,26 +116,26 @@ fn-domains-global-vhosts() { } fn-domains-generate-urls() { - declare APP="$1" SCHEME="$2" DEFAULT_LISTEN_PORT="$3" + declare APP="$1" DEFAULT_SCHEME="$2" DEFAULT_LISTEN_PORT="$3" local app_vhosts="$(plugn trigger domains-list "$APP")" if [[ -n "$app_vhosts" ]]; then for app_vhost in $app_vhosts; do - fn-domains-generate-urls-from-config "$APP" "$SCHEME" "$app_vhost" "$DEFAULT_LISTEN_PORT" + fn-domains-generate-urls-from-config "$APP" "$DEFAULT_SCHEME" "$app_vhost" "$DEFAULT_LISTEN_PORT" done else if [[ -s "$DOKKU_ROOT/VHOST" ]]; then while read -r VHOST || [[ -n "$VHOST" ]]; do - fn-domains-generate-urls-from-config "$APP" "$SCHEME" "$VHOST" "$DEFAULT_LISTEN_PORT" + fn-domains-generate-urls-from-config "$APP" "$DEFAULT_SCHEME" "$VHOST" "$DEFAULT_LISTEN_PORT" done <"$DOKKU_ROOT/VHOST" else - fn-domains-generate-urls-from-config "$APP" "$SCHEME" "$(hostname -f)" "$DEFAULT_LISTEN_PORT" + fn-domains-generate-urls-from-config "$APP" "$DEFAULT_SCHEME" "$(hostname -f)" "$DEFAULT_LISTEN_PORT" fi fi } fn-domains-generate-urls-from-config() { - declare APP="$1" SCHEME="$2" VHOST="$3" DEFAULT_LISTEN_PORT="$4" + declare APP="$1" DEFAULT_SCHEME="$2" VHOST="$3" DEFAULT_LISTEN_PORT="$4" local APP_PORT_MAP="$(plugn trigger ports-get "$APP")" if [[ "$(plugn trigger proxy-is-enabled "$APP")" == "false" ]]; then @@ -143,7 +143,7 @@ fn-domains-generate-urls-from-config() { DOKKU_APP_WEB_LISTENERS="$(plugn trigger network-get-listeners "$APP" "web" | xargs)" for DOKKU_APP_WEB_LISTENER in $DOKKU_APP_WEB_LISTENERS; do listen_port="$(echo "$DOKKU_APP_WEB_LISTENER" | cut -d ':' -f2)" - fn-domains-generate-url "$SCHEME" "$VHOST" "$listen_port" + fn-domains-generate-url "$DEFAULT_SCHEME" "$VHOST" "$listen_port" done shopt -u nullglob elif [[ -n "$APP_PORT_MAP" ]]; then @@ -151,10 +151,10 @@ fn-domains-generate-urls-from-config() { while IFS= read -r port_map; do local scheme="$(awk -F ':' '{ print $1 }' <<<"$port_map")" local listen_port="$(awk -F ':' '{ print $2 }' <<<"$port_map")" - fn-domains-generate-url "$SCHEME" "$VHOST" "$listen_port" + fn-domains-generate-url "$DEFAULT_SCHEME" "$VHOST" "$listen_port" done <<<"$APP_PORT_MAP" else - fn-domains-generate-url "$SCHEME" "$VHOST" "$DEFAULT_LISTEN_PORT" + fn-domains-generate-url "$DEFAULT_SCHEME" "$VHOST" "$DEFAULT_LISTEN_PORT" fi } From aa5c365e93de8f482ba9b2ffd6da49676d24f4b3 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Sun, 7 Sep 2025 22:04:20 -0400 Subject: [PATCH 3/7] fix: prefer the scheme specified in the port map --- plugins/domains/internal-functions | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/domains/internal-functions b/plugins/domains/internal-functions index aa9dd2048..28cda472c 100755 --- a/plugins/domains/internal-functions +++ b/plugins/domains/internal-functions @@ -151,7 +151,7 @@ fn-domains-generate-urls-from-config() { while IFS= read -r port_map; do local scheme="$(awk -F ':' '{ print $1 }' <<<"$port_map")" local listen_port="$(awk -F ':' '{ print $2 }' <<<"$port_map")" - fn-domains-generate-url "$DEFAULT_SCHEME" "$VHOST" "$listen_port" + fn-domains-generate-url "$scheme" "$VHOST" "$listen_port" done <<<"$APP_PORT_MAP" else fn-domains-generate-url "$DEFAULT_SCHEME" "$VHOST" "$DEFAULT_LISTEN_PORT" From ca32172e1dd9bb6469ffa106a6b4b1e923adcca2 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Sun, 7 Sep 2025 22:04:57 -0400 Subject: [PATCH 4/7] fix: do not generate https urls when there is no certificate available --- plugins/domains/internal-functions | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/plugins/domains/internal-functions b/plugins/domains/internal-functions index 28cda472c..e839d2f27 100755 --- a/plugins/domains/internal-functions +++ b/plugins/domains/internal-functions @@ -147,10 +147,14 @@ fn-domains-generate-urls-from-config() { done shopt -u nullglob elif [[ -n "$APP_PORT_MAP" ]]; then + CERTS_EXIST="$(plugn trigger certs-exists "$APP")" local port_map while IFS= read -r port_map; do local scheme="$(awk -F ':' '{ print $1 }' <<<"$port_map")" local listen_port="$(awk -F ':' '{ print $2 }' <<<"$port_map")" + if [[ "$CERTS_EXIST" != "true" ]] && [[ "$scheme" == "https" ]]; then + continue + fi fn-domains-generate-url "$scheme" "$VHOST" "$listen_port" done <<<"$APP_PORT_MAP" else From 7345bda611772386583fdad487d0c438d249a552 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Sun, 7 Sep 2025 22:05:47 -0400 Subject: [PATCH 5/7] fix: properly generate urls for port 443 for non-https schemes --- plugins/domains/internal-functions | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/plugins/domains/internal-functions b/plugins/domains/internal-functions index e839d2f27..efc644d10 100755 --- a/plugins/domains/internal-functions +++ b/plugins/domains/internal-functions @@ -167,7 +167,11 @@ fn-domains-generate-url() { if [[ "$PORT" == "80" ]]; then echo "http://$VHOST" elif [[ "$PORT" == "443" ]]; then - echo "https://$VHOST" + if [[ "$SCHEME" == "https" ]]; then + echo "https://$VHOST" + else + echo "$SCHEME://$VHOST:$PORT" + fi else echo "$SCHEME://$VHOST:$PORT" fi From bf7e5a7312fdbdb15ddd59f1b628607717fe300b Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Sun, 7 Sep 2025 22:06:24 -0400 Subject: [PATCH 6/7] tests: add a test for apps that detect https:443:443 port mappings without an ssl cert --- tests/unit/domains.bats | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/tests/unit/domains.bats b/tests/unit/domains.bats index 362131020..33a88fa08 100644 --- a/tests/unit/domains.bats +++ b/tests/unit/domains.bats @@ -410,3 +410,25 @@ teardown() { assert_success assert_output_contains "Detected IPv4 domain name with nginx proxy enabled." 0 } + +@test "(domains) https:443" { + run /bin/bash -c "dokku domains:set $TEST_APP $TEST_APP.${DOKKU_DOMAIN}" + echo "output: $output" + echo "status: $status" + assert_success + + run /bin/bash -c "dokku git:from-image $TEST_APP cockpithq/cockpit:core-latest" + echo "output: $output" + echo "status: $status" + assert_success + assert_output_contains "http://$TEST_APP.${DOKKU_DOMAIN}" 2 + assert_output_contains "http://$TEST_APP.${DOKKU_DOMAIN}:2019" + assert_output_contains "udp://$TEST_APP.${DOKKU_DOMAIN}:443" + assert_output_contains "http://$TEST_APP.${DOKKU_DOMAIN}:443" 0 + + run /bin/bash -c "dokku ports:report $TEST_APP --ports-map-detected" + echo "output: $output" + echo "status: $status" + assert_success + assert_output "http:2019:2019 http:80:80 https:443:443 udp:443:443" +} From 345ad6e0d0a9a001a861766f1c362372d2e922e3 Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Sun, 7 Sep 2025 22:15:29 -0400 Subject: [PATCH 7/7] fix: correct lint issue --- plugins/openresty-vhosts/core-post-extract | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/openresty-vhosts/core-post-extract b/plugins/openresty-vhosts/core-post-extract index ed379a8cb..f2c1d7301 100755 --- a/plugins/openresty-vhosts/core-post-extract +++ b/plugins/openresty-vhosts/core-post-extract @@ -17,7 +17,7 @@ fn-openresty-vhosts-copy-from-image() { fi find "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/" -maxdepth 1 -name 'openresty-location-includes.*' -type d -exec rm -r {} + - copy_dir_from_image "$IMAGE_NAME" "$LOCATION_CONF_PATH" "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID" 2>/dev/null|| true + copy_dir_from_image "$IMAGE_NAME" "$LOCATION_CONF_PATH" "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID" 2>/dev/null || true if [[ ! -f "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID" ]]; then touch "${DOKKU_LIB_ROOT}/data/openresty-vhosts/app-$APP/openresty-location-includes.$DOKKU_PID.missing" fi