From 484981fd74fb3436e0e973213304a6e39aed2f4d Mon Sep 17 00:00:00 2001 From: Copilot <198982749+Copilot@users.noreply.github.com> Date: Thu, 24 Sep 2026 10:30:25 +0000 Subject: [PATCH] enhance(acme): add configurable ACME profile (#39375) Adds server-side ACME profile configuration so operators can select a non-default ACME profile. This covers issuers such as Let's Encrypt where raw-IP certificate issuance requires the `shortlived` profile. Fixes: #39374 Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: techknowlogick <164197+techknowlogick@users.noreply.github.com> Co-authored-by: techknowlogick Co-authored-by: silverwind --- cmd/web_acme.go | 1 + custom/conf/app.example.ini | 3 +++ modules/setting/server.go | 2 ++ 3 files changed, 6 insertions(+) diff --git a/cmd/web_acme.go b/cmd/web_acme.go index 6e40aef2924..857114ff902 100644 --- a/cmd/web_acme.go +++ b/cmd/web_acme.go @@ -83,6 +83,7 @@ func runACME(listenAddr string, m http.Handler) error { TrustedRoots: certPool, Email: setting.AcmeEmail, Agreed: setting.AcmeTOS, + Profile: setting.AcmeProfile, DisableHTTPChallenge: !enableHTTPChallenge, DisableTLSALPNChallenge: !enableTLSALPNChallenge, ListenHost: setting.HTTPAddr, diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini index ab5ddb6beff..3b3a17009cd 100644 --- a/custom/conf/app.example.ini +++ b/custom/conf/app.example.ini @@ -261,6 +261,9 @@ ;; Can be left blank to initialize at first run and use the cached value ;ACME_EMAIL = ;; +;; ACME profile to request from the CA (e.g. "shortlived" for raw-IP certificates) +;ACME_PROFILE = +;; ;; ACME live directory (not to be confused with ACME directory URL: ACME_URL) ;; (Refer to caddy's ACME manager https://github.com/caddyserver/certmagic) ;ACME_DIRECTORY = https diff --git a/modules/setting/server.go b/modules/setting/server.go index 6d0683655a2..289db6a044c 100644 --- a/modules/setting/server.go +++ b/modules/setting/server.go @@ -101,6 +101,7 @@ var ( AcmeLiveDirectory string AcmeEmail string AcmeURL string + AcmeProfile string AcmeCARoot string SSLMinimumVersion string SSLMaximumVersion string @@ -171,6 +172,7 @@ func loadServerFrom(rootCfg ConfigProvider) { Protocol = HTTPS if EnableAcme { AcmeURL = sec.Key("ACME_URL").MustString("") + AcmeProfile = sec.Key("ACME_PROFILE").MustString("") AcmeCARoot = sec.Key("ACME_CA_ROOT").MustString("") if sec.HasKey("ACME_ACCEPTTOS") {