easy_caddy 0.1.2 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c38478a91bcf7a5ef93a10693e73d829b74ab1e88709fb38112c1120d30e499
-  data.tar.gz: c4923a78a738fdd89079df4f80f3f35ac3185a421be7b2e3ae3509d985168790
+  metadata.gz: f79d1b7b22e30b050b203bfe25656423ab378073dab52891326bce74646ed846
+  data.tar.gz: 412188255ada0400ddadd06e4c737d6863a6f6277ee3202e99e380421fcdee2c
 SHA512:
-  metadata.gz: 59e2de015249c22dc56aa731e9a059655a9548d27582947a6d1ba38bffd713950fc23db4e21867ffee2cb2ae7d6e36bd13a8fe4eff4356e06b25115df2f326c8
-  data.tar.gz: 4a2226c3ad545bdd047dfcb896636eaf52a9fa1bae1a8984d68a7bbf84300e0dc9fcc9c61fc64fe259f994c37b1d3f8fd12e4d413764e6b3775577302f569937
+  metadata.gz: 68a99984be74ff92c495a7edbe02a5bae90ae8d695bfc27746f490dd1ab6932df08bc8d60e2c5d449f0c11c79a3242286b7d441c992e3bd496ba303b8f188b27
+  data.tar.gz: c2d2bddb738808abdbe2d5b95402d96131e8ca83dc9c6150bcc12bbd4072951692f836aa54f8afa4257daf8f20f6de1b856348801c24d52109a75b392a912eb7

data/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.4] — 2026-06-16
+
+### Added
+
+- `ecaddy retrust` — re-trust the local Caddy CA certificate and reissue certs.
+  Runs `caddy untrust` then `caddy trust`, then restarts Caddy so it reissues the
+  short-lived `*.localhost` leaf certs — fixing `net::ERR_CERT_DATE_INVALID` (a stale
+  cached leaf) and authority errors in one step. The trust steps trigger the native
+  macOS password prompt.
+- `ecaddy audit` now detects a leaf certificate that is outside its validity window
+  (expired or not-yet-valid) and reports it as `ERR_CERT_DATE_INVALID` instead of a
+  false "browser-trusted ✓". `audit --fix` offers a restart that escalates to
+  `ecaddy retrust`.
+
+### Changed
+
+- `ecaddy audit --fix` now resolves a root-owned, unwritable log file via an
+  interactive choice — keep as-is, take ownership (`sudo chown`), or delete — rather
+  than forcing a `chmod`. The finding also points to re-registering the site as the
+  durable fix (the fragment is rewritten with `mode 0660`).
+
 ## [0.1.2] — 2026-06-09
 
 ### Added
@@ -63,5 +84,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `SIGTERM`/`SIGINT`, and unregisters on exit — designed to drop into a
   Procfile alongside the Rails server.
 
+[0.1.4]: https://github.com/pniemczyk/easy_caddy/releases/tag/v0.1.4
 [0.1.2]: https://github.com/pniemczyk/easy_caddy/releases/tag/v0.1.2
 [0.1.0]: https://github.com/pniemczyk/easy_caddy/releases/tag/v0.1.0

data/README.md

@@ -235,6 +235,27 @@ Exits `0` if all clear or only INFO findings. Exits `1` on any BLOCK.
 
 ---
 
+### `ecaddy audit`
+
+Full system + TLS audit with optional fixes. Where `doctor` checks the registry,
+`audit` also probes the live Caddy service, the brew-service state, a TLS handshake
+per domain, and the system-keychain trust state.
+
+```bash
+ecaddy audit                # report-only
+ecaddy audit --fix          # prompt to run each suggested fix
+ecaddy audit --site fishme  # limit to one site
+```
+
+With `--fix`, `audit` walks each finding, prints the proposed command, asks for
+confirmation, runs it, and re-verifies — chaining to a fallback fix when the first
+doesn't resolve it (e.g. `caddy trust` → `sudo caddy trust`). It also flags leaf
+certs outside their validity window as `ERR_CERT_DATE_INVALID` (fix: restart →
+`ecaddy retrust`), and for a root-owned, unwritable log file it offers a choice —
+keep as-is, take ownership (`sudo chown`), or delete.
+
+---
+
 ### `ecaddy edit NAME`
 
 Open a site's fragment in `$EDITOR`. Caddy is validated and reloaded after you save.
@@ -247,6 +268,22 @@ This edits the copy in `~/.config/caddy/sites/fishme.caddy`, not your project so
 
 ---
 
+### `ecaddy logs --site NAME`
+
+Tail a site's Caddy log files. `ecaddy` reads the fragment, extracts every
+`output file PATH` directive, and shells out to `tail` on them.
+
+```bash
+ecaddy logs --site fishme               # tail -F (follow)
+ecaddy logs --site fishme --lines 100   # last 100 lines
+ecaddy logs --site fishme --no-follow   # print and exit
+```
+
+Works for both enabled and disabled sites. If the Caddyfile has no `output file`
+directives, `ecaddy` prints guidance and exits.
+
+---
+
 ### `ecaddy remove NAME`
 
 Remove a site's fragment and registry entry entirely.
@@ -268,11 +305,29 @@ ecaddy reload
 
 ---
 
+### `ecaddy retrust`
+
+Re-trust the local Caddy CA _and_ reissue certificates. Run this when your browser
+shows `net::ERR_CERT_DATE_INVALID` or `NET::ERR_CERT_AUTHORITY_INVALID` on a
+`*.localhost` site — the cached leaf cert has expired, or the local CA is missing
+from the system keychain.
+
+```bash
+ecaddy retrust
+```
+
+Runs `caddy untrust` (removes the old cert) then `caddy trust` (re-installs it),
+then restarts Caddy so it reissues the short-lived `*.localhost` leaf certs. macOS
+prompts for your password for each keychain operation. Afterwards, fully reload your
+browser (or quit and reopen it) to drop the stale cached certificate.
+
+---
+
 ### `ecaddy version`
 
 ```bash
 ecaddy version
-# ecaddy 0.1.2
+# ecaddy 0.1.4
 ```
 
 ## Global config layout

data/lib/easy_caddy/caddy.rb

@@ -78,6 +78,16 @@ module EasyCaddy
       [out, $CHILD_STATUS.success?]
     end
 
+    def self.untrust
+      system("#{BINARY} untrust")
+    end
+
+    # @return [Array(String, Boolean)] combined output and whether the command succeeded
+    def self.untrust_with_output
+      out = `#{BINARY} untrust 2>&1`
+      [out, $CHILD_STATUS.success?]
+    end
+
     ADMIN_ENDPOINT = 'http://localhost:2019/pki/ca/local'
 
     # Polls Caddy's admin API until it responds or the timeout elapses.

data/lib/easy_caddy/cli.rb

@@ -15,6 +15,7 @@ require_relative 'commands/ensure'
 require_relative 'commands/run'
 require_relative 'commands/logs'
 require_relative 'commands/audit'
+require_relative 'commands/retrust'
 
 module EasyCaddy
   class CLI < Thor
@@ -99,6 +100,11 @@ module EasyCaddy
       Commands::Audit.new(site: options[:site], fix: options[:fix]).call
     end
 
+    desc 'retrust', 'Re-trust local CA and restart Caddy to reissue certs (fixes net::ERR_CERT_DATE_INVALID)'
+    def retrust
+      Commands::Retrust.new.call
+    end
+
     desc 'version', 'Print ecaddy version'
     def version
       puts "ecaddy #{EasyCaddy::VERSION}"

data/lib/easy_caddy/commands/audit.rb

@@ -24,7 +24,15 @@ module EasyCaddy
       YELLW = "\e[33m"
       RESET = "\e[0m"
 
-      Fix = Data.define(:label, :description, :command, :verify, :escalation, :next_fix)
+      Fix = Data.define(:label, :description, :command, :verify, :escalation, :next_fix, :choices) do
+        def initialize(label:, description:, command:, verify:, escalation:, next_fix:, choices: nil)
+          super
+        end
+      end
+
+      # A single labelled option offered when a Fix has multiple remedies (e.g. a root-owned log
+      # the user may want to keep, take ownership of, or delete). command: nil means "do nothing".
+      Choice = Data.define(:label, :command, :verify)
 
       def initialize(site: nil, fix: false)
         @site_filter = site
@@ -72,7 +80,8 @@ module EasyCaddy
           command: fix[:command],
           verify: fix[:verify],
           escalation: fix[:escalation],
-          next_fix: fix[:next_fix]
+          next_fix: fix[:next_fix],
+          choices: fix[:choices]
         )
       end
       # rubocop:enable Metrics/MethodLength
@@ -89,7 +98,8 @@ module EasyCaddy
           command: fix[:command],
           verify: fix[:verify],
           escalation: fix[:escalation],
-          next_fix: fix[:next_fix]
+          next_fix: fix[:next_fix],
+          choices: fix[:choices]
         )
       end
       # rubocop:enable Metrics/MethodLength
@@ -344,13 +354,21 @@ module EasyCaddy
         end
 
         domains.each do |domain|
-          handshake_ok, detail = tls_probe(domain)
+          handshake_ok, detail, cert = tls_probe(domain)
           unless handshake_ok
             hint, fix = tls_hint_and_fix(detail, domain)
             fail("#{domain}  — TLS ✗  #{detail}", hint: hint, fix: fix)
             next
           end
 
+          unless cert_date_valid?(cert)
+            fail("#{domain}  — TLS ✓ but cert DATE INVALID (browser shows ERR_CERT_DATE_INVALID)  #{detail}",
+                 hint: 'The served leaf certificate is expired or not yet valid. ' \
+                       'Restart Caddy to reissue it, then fully reload the browser.',
+                 fix: cert_date_fix(domain))
+            next
+          end
+
           if browser_trusts?(domain)
             ok("#{domain}  — TLS ✓  browser-trusted ✓  #{detail}")
           else
@@ -362,6 +380,23 @@ module EasyCaddy
         end
       end
 
+      def cert_date_fix(domain)
+        {
+          description: 'Restart Caddy to reissue the leaf certificate',
+          command: 'brew services restart caddy',
+          verify: -> { cert_date_valid?(tls_probe(domain)[2]) },
+          escalation: 'Restart didn\'t refresh the cert — re-trust the CA and reissue in one step.',
+          next_fix: Fix.new(
+            label: "#{domain} cert still date-invalid — re-trusting CA and reissuing",
+            description: 'Full re-trust + restart',
+            command: 'ecaddy retrust',
+            verify: -> { cert_date_valid?(tls_probe(domain)[2]) },
+            escalation: 'Still invalid. Check your system clock, then try `sudo caddy untrust && sudo caddy trust`.',
+            next_fix: nil
+          )
+        }
+      end
+
       def browser_trust_fix(domain)
         {
           description: 'Install Caddy CA into System keychain',
@@ -411,8 +446,8 @@ module EasyCaddy
           ok("log #{path}  (#{humanize_bytes(File.size(path))})")
         else
           fail("log #{path}  — NOT writable by you (root-owned?)",
-               hint: 'Caddy runs as root and created this 0600 log; `caddy validate` runs as ' \
-                     'you and cannot open it. Make it group-writable.',
+               hint: 'Caddy created this 0600 log as root; `caddy validate` runs as you and can\'t open it. ' \
+                     'Durable fix: re-register the site so its fragment carries `mode 0660`.',
                fix: log_permission_fix(path))
         end
       end
@@ -420,19 +455,20 @@ module EasyCaddy
       # rubocop:disable Metrics/MethodLength
       def log_permission_fix(path)
         {
-          description: "Make the log group-writable (chmod #{Caddy::LOG_FILE_MODE})",
-          command: "chmod #{Caddy::LOG_FILE_MODE} #{path}",
-          verify: -> { File.writable?(path) },
-          escalation: "You don't own this file — needs sudo.",
-          next_fix: Fix.new(
-            label: "#{path} still not writable",
-            description: 'chmod the root-owned log via sudo',
-            command: "sudo chmod #{Caddy::LOG_FILE_MODE} #{path}",
-            verify: -> { File.writable?(path) },
-            escalation: "Still not writable. Check `ls -l #{path}`; " \
-                        "you may need `sudo chown $USER:staff #{path}`.",
-            next_fix: nil
-          )
+          description: 'Resolve the root-owned log file',
+          command: nil,
+          verify: -> { File.writable?(path) || !File.exist?(path) },
+          escalation: "Still not resolved. Check `ls -l #{path}`.",
+          next_fix: nil,
+          choices: [
+            Choice.new(label: 'Keep as-is (skip)', command: nil, verify: nil),
+            Choice.new(label: 'Update owner — take ownership (recommended)',
+                       command: "sudo chown \"$USER:staff\" #{path}",
+                       verify: -> { File.writable?(path) }),
+            Choice.new(label: 'Delete — remove the log (Caddy will recreate it)',
+                       command: "sudo rm #{path}",
+                       verify: -> { !File.exist?(path) })
+          ]
         }
       end
       # rubocop:enable Metrics/MethodLength
@@ -495,14 +531,24 @@ module EasyCaddy
           ssl.hostname   = domain
           ssl.sync_close = true
           ssl.connect
-          cn = ssl.peer_cert&.subject&.to_a&.find { |name, _| name == 'CN' }&.at(1) || '?'
+          cert = ssl.peer_cert
+          cn   = cert&.subject&.to_a&.find { |name, _| name == 'CN' }&.at(1) || '?'
           ssl.close
-          [true, "cert CN=#{cn}"]
+          [true, "cert CN=#{cn}", cert]
         end
       rescue Errno::ECONNREFUSED
-        [false, 'connection refused on :443 (Caddy not running or not bound)']
+        [false, 'connection refused on :443 (Caddy not running or not bound)', nil]
       rescue StandardError => e
-        [false, e.message.split("\n").first]
+        [false, e.message.split("\n").first, nil]
+      end
+
+      # True when the leaf cert is currently within its validity window. A cert outside it is
+      # exactly what the browser reports as ERR_CERT_DATE_INVALID.
+      def cert_date_valid?(cert)
+        return true if cert.nil? # can't tell — don't raise a false alarm
+
+        now = Time.now
+        now >= cert.not_before && now <= cert.not_after
       end
       # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength
 
@@ -562,6 +608,8 @@ module EasyCaddy
           return
         end
 
+        return run_choice_fix(fix, prompt) if fix.choices
+
         puts
         puts "  Issue:   #{fix.label}"
         puts "  Fix:     #{fix.description}"
@@ -597,6 +645,33 @@ module EasyCaddy
         end
       end
       # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+
+      # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+      def run_choice_fix(fix, prompt)
+        puts
+        puts "  Issue:   #{fix.label}"
+        choice = prompt.select("  #{fix.description}:") do |menu|
+          fix.choices.each { |c| menu.choice c.label, c }
+        end
+
+        return if choice.command.nil? # "keep as-is" / skip
+
+        puts "  Command: #{choice.command}"
+        unless system(choice.command)
+          puts "  #{RED}✗#{RESET} command failed to run"
+          return
+        end
+
+        return puts("  #{GREEN}✓#{RESET} applied") if choice.verify.nil?
+
+        sleep 0.5
+        if choice.verify.call
+          puts "  #{GREEN}✓#{RESET} applied and verified"
+        else
+          puts "  #{YELLW}!#{RESET} applied, but the issue is still present"
+        end
+      end
+      # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
     end
     # rubocop:enable Metrics/ClassLength
   end

data/lib/easy_caddy/commands/retrust.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require_relative '../caddy'
+require_relative '../error'
+
+module EasyCaddy
+  module Commands
+    # Removes and re-installs Caddy's local root CA, then restarts the service so it
+    # reissues fresh leaf certs — clearing browser ERR_CERT_DATE_INVALID / authority errors.
+    class Retrust
+      # rubocop:disable Metrics/MethodLength
+      def call
+        raise Error, 'Caddy is not running. Start it with: brew services start caddy' unless Caddy.running?
+
+        puts '  Removing local CA from trust store...'
+        puts '    (you may be prompted for your password)'
+        output, success = Caddy.untrust_with_output
+        raise Error, "caddy untrust failed:\n#{output}" unless success
+
+        puts '  Re-trusting local CA...'
+        puts '    (you may be prompted for your password)'
+        output, success = Caddy.trust_with_output
+        raise Error, "caddy trust failed:\n#{output}" unless success
+
+        # Re-trusting only re-installs the root CA; it does not refresh the short-lived
+        # `*.localhost` leaf certs a browser may have cached as expired (ERR_CERT_DATE_INVALID).
+        # Restarting forces Caddy to reissue them.
+        puts '  Restarting Caddy to reissue certificates...'
+        raise Error, 'caddy restart failed — try: brew services restart caddy' unless Caddy.restart_service
+
+        puts '  Done. CA re-trusted and certificates reissued.'
+        puts '  Fully reload your browser (or quit and reopen it) to clear the cached certificate.'
+      end
+      # rubocop:enable Metrics/MethodLength
+    end
+  end
+end

data/lib/easy_caddy/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module EasyCaddy
-  VERSION = '0.1.2'
+  VERSION = '0.1.4'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: easy_caddy
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.4
 platform: ruby
 authors:
 - Pawel Niemczyk
@@ -134,6 +134,7 @@ files:
 - lib/easy_caddy/commands/register_helpers.rb
 - lib/easy_caddy/commands/reload.rb
 - lib/easy_caddy/commands/remove.rb
+- lib/easy_caddy/commands/retrust.rb
 - lib/easy_caddy/commands/run.rb
 - lib/easy_caddy/commands/setup.rb
 - lib/easy_caddy/commands/status.rb