caddytls: Expand ACME credentials

[tribut]

This allows using global placeholders such as {file./run/secrets/key_id} when setting up the tls configuration.

The feature was also requested / discussed at https://caddy.community/t/illegal-base64-data-error-with-file-placeholder-for-eab-secrets/33343

Assistance Disclosure

Copilot was used to locate the file and function that this PR modifies.

[CLAassistant]

All committers have signed the CLA.

[Copilot]

Pull request overview

Enables use of global placeholders (e.g. {file./run/secrets/...}) in ACME issuer configuration so values like CA directory endpoints and EAB credentials can be sourced dynamically (e.g. from mounted secrets).

Changes:

• Expand placeholders in ACMEIssuer.CA during provisioning.
• Expand placeholders in ACMEIssuer.ExternalAccount (KeyID, MACKey) during provisioning.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[steadytao]

Copilot's comments are good. And;

Locally, the PR appears to be based on v2.11.2 rather than current master. It is missing #7609 which added placeholder expansion for dns_challenge override_domain in the same ACMEIssuer.Provision() area. Even if GH considers the branch mergeable I would probably double check so the existing override-domain expansion is preserved alongside the new CA/EAB expansion. I would also like to see a targeted provisioning test that verifies placeholders are expanded for CA, ExternalAccount.KeyID and ExternalAccount.MACKey. Can be added by myself if needed.

Also, a quick question. Should TestCA be expanded too? Since this PR expands CA, leaving the fallback/test CA endpoint unexpanded feels a little inconsistent.

[tribut]

Thank you for the feedback @steadytao, I agree that TestCA should be expanded as well.

I've rebased onto current master, redacted the mac key, added TestCA expansion and added a simple test for the fields added in this PR.

Let me know if you have further comments.

[steadytao]

Thank you for the rebase. Looks much better, just did a quick gofmt, after that passes, happy to merge.

[steadytao]

Lint failure is not caused by this PR;

• caused by an action update to v2.12.1 of golangci-lint.

Will be handled separately.