howard/caddy-and-cert-manager
1
0
Fork 0
mirror of https://github.com/hpware/caddy-and-cert-manager.git synced 2026-06-11 00:17:57 +08:00
Code Issues Projects Releases Packages Wiki Activity
Certificate manager https://git.yhw.tw/howard/caddy-and-cert-manager
96 commits 4 branches 0 tags 764 KiB
  • TypeScript 95.5%
  • CSS 2.7%
  • Shell 0.9%
  • Dockerfile 0.8%
Find a file
Exact
Howard 45fe5ec95a Fix redirect and docker-compose.
2026-03-25 11:32:13 +08:00
.github/workflows Fix CI workflow, auth responses, env validation, and misc issues 2026-03-18 23:55:00 +08:00
caddy submit current change. 2026-01-24 00:58:55 +08:00
certs Claude fixes stuff 2026-03-24 14:46:23 +08:00
db_migrations ok? 2026-03-16 00:04:27 +08:00
docs submit current change. 2026-01-24 00:58:55 +08:00
porca Claude fixes stuff 2026-03-24 14:46:23 +08:00
public ? 2026-01-17 21:04:14 +08:00
src Fix redirect and docker-compose. 2026-03-25 11:32:13 +08:00
yaak have the basics of the caddy system there and working!! 2026-01-22 15:29:33 +08:00
.env.docker.example Claude fixes stuff 2026-03-24 14:46:23 +08:00
.env.example Fix security, config, and correctness issues across the stack 2026-03-18 23:13:14 +08:00
.gitignore Fix security, config, and correctness issues across the stack 2026-03-18 23:13:14 +08:00
bun.lock Setup BA & fix the client side of the cert creation system. 2026-01-27 15:09:23 +08:00
Caddyfile.dev ? 2026-01-17 21:04:14 +08:00
components.json ? 2026-01-17 21:04:14 +08:00
docker-compose.yml Fix redirect and docker-compose. 2026-03-25 11:32:13 +08:00
Dockerfile I builds on my machine (i hope this works) 2026-03-16 10:27:43 +08:00
drizzle.config.ts ? 2026-01-17 21:04:14 +08:00
init.sh ok 2026-03-19 14:54:05 +08:00
LICENSE Update License and login screen to prevent default behavior. 2026-01-27 16:36:32 +08:00
next.config.ts ? 2026-01-17 21:04:14 +08:00
package.json Update some part of the login logic using BA, I'm going to sleep. 2026-01-27 23:52:02 +08:00
postcss.config.mjs ? 2026-01-17 21:04:14 +08:00
README.dev.md submit current change. 2026-01-24 00:58:55 +08:00
README.md Claude fixes stuff 2026-03-24 14:46:23 +08:00
tsconfig.json Fix tsconfig 2026-03-25 11:03:39 +08:00

README.md

Cert Manager

Caution

This project is still in development. There will be bugs.

My self-hosted Guest Resources is here: https://certs.default.tw, and the mirror of this repo is here: https://git.yhw.tw/howard/caddy-and-cert-manager

This platform is what I need for my home lab, a place I could get custom long-term certs for my internal services, without the hassle (and security issues) for exposing them to the internet in order to get SSL certs, now you get your own.

Quick setup!

curl -O https://raw.githubusercontent.com/hpware/caddy-and-cert-manager/refs/heads/master/docker-compose.yml
curl --output .env https://raw.githubusercontent.com/hpware/caddy-and-cert-manager/refs/heads/master/.env.docker.example
curl -O https://raw.githubusercontent.com/hpware/caddy-and-cert-manager/refs/heads/master/init.sh

then, change your env and init.sh to your liking

chmod +x init.sh
./init.sh
docker compose up -d

and you are done! You now can register an account (if you have SSO, login with that!), and you have your own CA, just make sure that you and your family all trust that master certificate!

Will your master CA private key get leaked if the next Next.js vuln happens?

The CA private key is held by porca, not Next.js, so a Next.js exploit cannot directly extract the key. However, unauthorized certificate issuance is a serious security incident — an attacker who can reach porca's signing endpoint can mint trusted certificates for any domain in your CA's scope.

If you suspect unauthorized issuance:

  1. Audit all issued certificates: review ./certs/ca_db/index.txt to enumerate every certificate signed by your CA.
  2. Immediately revoke any unauthorized certificates via the revoke endpoint and regenerate the CRL.
  3. If you cannot fully enumerate what was issued (e.g., logs are missing), rotate the CA: generate a new key pair, re-issue all legitimate certificates, and distribute the new root to your clients.
  4. Disable the issuance endpoint (take porca offline or block its port) until the vulnerability is patched.
  5. Notify stakeholders who trust your CA so they can take appropriate action.

Preventing future misuse: enable logging on porca requests so every signing operation is recorded. Monitor for unexpected certificate issuance. If you use the auto-update CA rotation script, verify your CA's integrity and audit the new CA before distributing it to clients.

Certificate Management

Note

This system is still not yet implemented!

This system partly follows RFC8555, but does not prove ownership of domains. This is designed for home lab users, who want custom certs for their internal services.