From d80a5414a5712f477d5777496fec8fd0e68dfed0 Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Fri, 31 Oct 2025 17:09:01 -0700
Subject: [PATCH] Override host for acme challenge

---
 .../pki-acme/pki-acme-challenge-service.ts         | 14 +++++++++-----
 backend/src/lib/config/env.ts                      | 11 ++++++++++-
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts b/backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts
index e6464d69c..26dc65aaf 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts
@@ -49,11 +49,15 @@ export const pkiAcmeChallengeServiceFactory = ({
       if (challenge.type !== AcmeChallengeType.HTTP_01) {
         throw new BadRequestError({ message: "Only HTTP-01 challenges are supported for now" });
       }
-      const baseUrl = `http://${challenge.auth.identifierValue}`;
-      const actualBaseUrl = appCfg.isAcmeDevelopmentMode
-        ? `${baseUrl}:${appCfg.ACME_DEVELOPMENT_HTTP01_CHALLENGE_PORT}`
-        : baseUrl;
-      const challengeUrl = new URL(`/.well-known/acme-challenge/${challenge.auth.token}`, actualBaseUrl);
+      let host = challenge.auth.identifierValue;
+      if (appCfg.isAcmeDevelopmentMode && appCfg.ACME_DEVELOPMENT_HTTP01_CHALLENGE_HOST_OVERRIDES[host]) {
+        host = appCfg.ACME_DEVELOPMENT_HTTP01_CHALLENGE_HOST_OVERRIDES[host];
+        logger.warn(
+          { srcHost: challenge.auth.identifierValue, dstHost: host },
+          "Using ACME development HTTP-01 challenge host override"
+        );
+      }
+      const challengeUrl = new URL(`/.well-known/acme-challenge/${challenge.auth.token}`, `http://${host}`);
       logger.info({ challengeUrl }, "Performing ACME HTTP-01 challenge validation");
       try {
         // Notice: well, we are in a transaction, ideally we should not hold transaction and perform
diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts
index 7477bc032..6f0502184 100644
--- a/backend/src/lib/config/env.ts
+++ b/backend/src/lib/config/env.ts
@@ -107,7 +107,16 @@ const envSchema = z
     ROTATION_DEVELOPMENT_MODE: zodStrBool.default("false").optional(),
     DAILY_RESOURCE_CLEAN_UP_DEVELOPMENT_MODE: zodStrBool.default("false").optional(),
     ACME_DEVELOPMENT_MODE: zodStrBool.default("false").optional(),
-    ACME_DEVELOPMENT_HTTP01_CHALLENGE_PORT: z.coerce.number().default(8087),
+    ACME_DEVELOPMENT_HTTP01_CHALLENGE_HOST_OVERRIDES: zpStr(
+      z
+        .string()
+        .optional()
+        .transform((val) => {
+          if (!val) return {};
+          return JSON.parse(val) as Record<string, string>;
+        })
+        .default("{}")
+    ),
     // smtp options
     SMTP_HOST: zpStr(z.string().optional()),
     SMTP_IGNORE_TLS: zodStrBool.default("false"),