kaffa/haproxy-mcp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Skip wildcard entry for subdomains of certificate domains

Browse Source 
_check_subdomain now also checks certificate domains from DB, not just
registered domains. This prevents adding useless wildcard map entries
like *.nocodb.inouter.com when inouter.com already has a wildcard cert
that only covers one level deep (*.inouter.com).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
kappa
2026-02-08 20:31:58 +09:00
parent c490ee8673
commit 81737bb256
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
haproxy_mcp/tools/domains.py
View File

@@ -33,14 +33,17 @@ from ..file_ops import (
remove_domain_from_map, remove_domain_from_map,
find_available_pool, find_available_pool,
) )
from ..db import db_load_certs
from ..utils import parse_servers_state, disable_server_slot from ..utils import parse_servers_state, disable_server_slot
def _check_subdomain(domain: str, registered_domains: set[str]) -> tuple[bool, Optional[str]]: def _check_subdomain(domain: str, registered_domains: set[str]) -> tuple[bool, Optional[str]]:
"""Check if a domain is a subdomain of an existing registered domain. """Check if a domain is a subdomain of an existing registered domain or certificate domain.
For example, vault.anvil.it.com is a subdomain if anvil.it.com exists. For example, vault.anvil.it.com is a subdomain if anvil.it.com exists.
Subdomains should not have wildcard entries added to avoid conflicts. nocodb.inouter.com is a subdomain if inouter.com has a certificate.
Subdomains should not have wildcard entries added to avoid conflicts,
because wildcard certs (*.example.com) only cover one level deep.
Args: Args:
domain: Domain name to check (e.g., "api.example.com"). domain: Domain name to check (e.g., "api.example.com").
@@ -49,10 +52,14 @@ def _check_subdomain(domain: str, registered_domains: set[str]) -> tuple[bool, O
Returns: Returns:
Tuple of (is_subdomain, parent_domain or None). Tuple of (is_subdomain, parent_domain or None).
""" """
# Combine registered domains and certificate domains as known base domains
cert_domains = set(db_load_certs())
known_domains = registered_domains | cert_domains
parts = domain.split(".") parts = domain.split(".")
for i in range(1, len(parts)): for i in range(1, len(parts)):
candidate = ".".join(parts[i:]) candidate = ".".join(parts[i:])
if candidate in registered_domains: if candidate in known_domains:
return True, candidate return True, candidate
return False, None return False, None