feat: support localhost apps running https

sreya · sreya · commit 3ebe5a422f92 · 2023-07-19T22:03:21.000Z
diff --git a/coderd/tailnet.go b/coderd/tailnet.go
@@ -3,6 +3,7 @@ package coderd
 import (
 	"bufio"
 	"context"
+	"crypto/tls"
 	"net"
 	"net/http"
 	"net/http/httputil"
@@ -214,7 +215,22 @@ type ServerTailnet struct {
 	transport *http.Transport
 }
 
+func insecureTLSConfig() *tls.Config {
+	return &tls.Config{
+		MinVersion:         tls.VersionTLS12,
+		InsecureSkipVerify: true,
+	}
+}
+
 func (s *ServerTailnet) ReverseProxy(targetURL, dashboardURL *url.URL, agentID uuid.UUID) (_ *httputil.ReverseProxy, release func(), _ error) {
+	transport := s.transport
+
+	// We don't verify certificates for localhost applications.
+	if targetURL.Scheme == "https" {
+		transport = transport.Clone()
+		transport.TLSClientConfig = insecureTLSConfig()
+	}
+
 	proxy := httputil.NewSingleHostReverseProxy(targetURL)
 	proxy.ErrorHandler = func(w http.ResponseWriter, r *http.Request, err error) {
 		site.RenderStaticErrorPage(w, r, site.ErrorPageData{
@@ -226,7 +242,7 @@ func (s *ServerTailnet) ReverseProxy(targetURL, dashboardURL *url.URL, agentID u
 		})
 	}
 	proxy.Director = s.director(agentID, proxy.Director)
-	proxy.Transport = s.transport
+	proxy.Transport = transport
 
 	return proxy, func() {}, nil
 }
diff --git a/coderd/wsconncache/wsconncache.go b/coderd/wsconncache/wsconncache.go
@@ -4,6 +4,7 @@ package wsconncache
 
 import (
 	"context"
+	"crypto/tls"
 	"net/http"
 	"net/http/httputil"
 	"net/url"
@@ -49,8 +50,15 @@ func (a *AgentProvider) ReverseProxy(targetURL *url.URL, dashboardURL *url.URL,
 		return nil, nil, xerrors.Errorf("acquire agent connection: %w", err)
 	}
 
-	proxy.Transport = conn.HTTPTransport()
+	transport := conn.HTTPTransport()
+	// We don't verify certificates for localhost applications.
+	if targetURL.Scheme == "https" {
+		trans := transport.Clone()
+		trans.TLSClientConfig = insecureTLSConfig()
 
+	}
+
+	proxy.Transport = transport
 	return proxy, release, nil
 }
 
@@ -211,3 +219,10 @@ func (c *Cache) Close() error {
 	c.closeGroup.Wait()
 	return nil
 }
+
+func insecureTLSConfig() *tls.Config {
+	return &tls.Config{
+		MinVersion:         tls.VersionTLS12,
+		InsecureSkipVerify: true,
+	}
+}
