Fix acme.json file automatic creation

provider/acme/local_store.go

@@ -16,7 +16,7 @@ var _ Store = (*LocalStore)(nil)
 type LocalStore struct {
 	filename     string
 	storedData   *StoredData
-	SaveDataChan chan *StoredData
+	SaveDataChan chan *StoredData `json:"-"`
 }
 
 // NewLocalStore initializes a new LocalStore with a file name
@@ -30,31 +30,38 @@ func (s *LocalStore) get() (*StoredData, error) {
 	if s.storedData == nil {
 		s.storedData = &StoredData{HTTPChallenges: make(map[string]map[string][]byte)}
 
-		f, err := os.Open(s.filename)
-		if err != nil {
-			return nil, err
-		}
-		defer f.Close()
-
-		file, err := ioutil.ReadAll(f)
+		hasData, err := CheckFile(s.filename)
 		if err != nil {
 			return nil, err
 		}
 
-		if len(file) > 0 {
-			if err := json.Unmarshal(file, s.storedData); err != nil {
-				return nil, err
-			}
-		}
-		// Check if ACME Account is in ACME V1 format
-		if s.storedData.Account != nil && s.storedData.Account.Registration != nil {
-			isOldRegistration, err := regexp.MatchString(RegistrationURLPathV1Regexp, s.storedData.Account.Registration.URI)
+		if hasData {
+			f, err := os.Open(s.filename)
 			if err != nil {
 				return nil, err
 			}
-			if isOldRegistration {
-				s.storedData.Account = nil
-				s.SaveDataChan <- s.storedData
+			defer f.Close()
+
+			file, err := ioutil.ReadAll(f)
+			if err != nil {
+				return nil, err
+			}
+
+			if len(file) > 0 {
+				if err := json.Unmarshal(file, s.storedData); err != nil {
+					return nil, err
+				}
+			}
+			// Check if ACME Account is in ACME V1 format
+			if s.storedData.Account != nil && s.storedData.Account.Registration != nil {
+				isOldRegistration, err := regexp.MatchString(RegistrationURLPathV1Regexp, s.storedData.Account.Registration.URI)
+				if err != nil {
+					return nil, err
+				}
+				if isOldRegistration {
+					s.storedData.Account = nil
+					s.SaveDataChan <- s.storedData
+				}
 			}
 		}
 	}

provider/acme/local_store_unix.go

@@ -0,0 +1,35 @@
+// +build !windows
+
+package acme
+
+import (
+	"fmt"
+	"os"
+)
+
+// CheckFile checks file permissions and content size
+func CheckFile(name string) (bool, error) {
+	f, err := os.Open(name)
+	if err != nil {
+		if os.IsNotExist(err) {
+			f, err = os.Create(name)
+			if err != nil {
+				return false, err
+			}
+			return false, f.Chmod(0600)
+		}
+		return false, err
+	}
+	defer f.Close()
+
+	fi, err := f.Stat()
+	if err != nil {
+		return false, err
+	}
+
+	if fi.Mode().Perm()&0077 != 0 {
+		return false, fmt.Errorf("permissions %o for %s are too open, please use 600", fi.Mode().Perm(), name)
+	}
+
+	return fi.Size() > 0, nil
+}

provider/acme/local_store_windows.go

@@ -0,0 +1,27 @@
+package acme
+
+import "os"
+
+// CheckFile checks file content size
+// Do not check file permissions on Windows right now
+func CheckFile(name string) (bool, error) {
+	f, err := os.Open(name)
+	if err != nil {
+		if os.IsNotExist(err) {
+			f, err = os.Create(name)
+			if err != nil {
+				return false, err
+			}
+			return false, f.Chmod(0600)
+		}
+		return false, err
+	}
+	defer f.Close()
+
+	fi, err := f.Stat()
+	if err != nil {
+		return false, err
+	}
+
+	return fi.Size() > 0, nil
+}

provider/acme/provider.go

@@ -42,7 +42,7 @@ type Configuration struct {
 	EntryPoint    string         `description:"EntryPoint to use."`
 	OnHostRule    bool           `description:"Enable certificate generation on frontends Host rules."`
 	OnDemand      bool           `description:"Enable on demand certificate generation. This will request a certificate from Let's Encrypt during the first TLS handshake for a hostname that does not yet have a certificate."` //deprecated
-	DNSChallenge  *DNSChallenge  `description:"Activate DNS-01 Challenge"`
+	DNSChallenge  *DNSChallenge  `description:"Activate DNS-02 Challenge"`
 	HTTPChallenge *HTTPChallenge `description:"Activate HTTP-01 Challenge"`
 	Domains       []types.Domain `description:"CN and SANs (alternative domains) to each main domain using format: --acme.domains='main.com,san1.com,san2.com' --acme.domains='*.main.net'. No SANs for wildcards domain. Wildcard domains only accepted with DNSChallenge"`
 }
@@ -72,7 +72,7 @@ type Certificate struct {
 
 // DNSChallenge contains DNS challenge Configuration
 type DNSChallenge struct {
-	Provider         string         `description:"Use a DNS-01 based challenge provider rather than HTTPS."`
+	Provider         string         `description:"Use a DNS-02 based challenge provider rather than HTTPS."`
 	DelayBeforeCheck flaeg.Duration `description:"Assume DNS propagates after a delay in seconds rather than finding and querying nameservers."`
 }
 
@@ -116,7 +116,7 @@ func (p *Provider) init() error {
 
 	p.certificates, err = p.Store.GetCertificates()
 	if err != nil {
-		return fmt.Errorf("unable to get ACME account : %v", err)
+		return fmt.Errorf("unable to get ACME certificates : %v", err)
 	}
 
 	p.watchCertificate()