diff --git a/caddyconfig/caddyfile/parse.go b/caddyconfig/caddyfile/parse.go
index 784e4acd9..d04a1ac46 100644
--- a/caddyconfig/caddyfile/parse.go
+++ b/caddyconfig/caddyfile/parse.go
@@ -423,9 +423,9 @@ func (p *parser) doImport(nesting int) error {
 		// make path relative to the file of the _token_ being processed rather
 		// than current working directory (issue #867) and then use glob to get
 		// list of matching filenames
-		absFile, err := caddy.FastAbs(p.File())
+		absFile, err := caddy.FastAbs(p.Dispenser.File())
 		if err != nil {
-			return p.Errf("Failed to get absolute path of file: %s: %v", p.File(), err)
+			return p.Errf("Failed to get absolute path of file: %s: %v", p.Dispenser.File(), err)
 		}
 
 		var matches []string
diff --git a/caddyconfig/httpcaddyfile/builtins.go b/caddyconfig/httpcaddyfile/builtins.go
index af481ac49..3fc08b2c8 100644
--- a/caddyconfig/httpcaddyfile/builtins.go
+++ b/caddyconfig/httpcaddyfile/builtins.go
@@ -998,7 +998,7 @@ func parseLogHelper(h Helper, globalLogNames map[string]struct{}) ([]ConfigValue
 			cl.WriterRaw = caddyconfig.JSONModuleObject(wo, "output", moduleName, h.warnings)
 
 		case "sampling":
-			d := h.NewFromNextSegment()
+			d := h.Dispenser.NewFromNextSegment()
 			for d.NextArg() {
 				// consume any tokens on the same line, if any.
 			}
diff --git a/caddyconfig/httpcaddyfile/directives.go b/caddyconfig/httpcaddyfile/directives.go
index 6011b8591..fd3db9c37 100644
--- a/caddyconfig/httpcaddyfile/directives.go
+++ b/caddyconfig/httpcaddyfile/directives.go
@@ -247,7 +247,7 @@ func (h Helper) MatcherToken() (caddy.ModuleMap, bool, error) {
 	if !h.NextArg() {
 		return nil, false, nil
 	}
-	return matcherSetFromMatcherToken(h.Token(), h.matcherDefs, h.warnings)
+	return matcherSetFromMatcherToken(h.Dispenser.Token(), h.matcherDefs, h.warnings)
 }
 
 // ExtractMatcherSet is like MatcherToken, except this is a higher-level
@@ -266,9 +266,9 @@ func (h Helper) ExtractMatcherSet() (caddy.ModuleMap, error) {
 		// new dispenser should have been made
 		// solely for this directive's tokens,
 		// with no other uses of same slice
-		h.Delete()
+		h.Dispenser.Delete()
 	}
-	h.Reset() // pretend this lookahead never happened
+	h.Dispenser.Reset() // pretend this lookahead never happened
 	return matcherSet, nil
 }
 
diff --git a/cmd/main.go b/cmd/main.go
index 80419d470..47d702ca7 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -302,7 +302,7 @@ type Flags struct {
 // flag given by name. It panics if the flag is not
 // in the flag set.
 func (f Flags) String(name string) string {
-	return f.Lookup(name).Value.String()
+	return f.FlagSet.Lookup(name).Value.String()
 }
 
 // Bool returns the boolean representation of the
diff --git a/logging.go b/logging.go
index fffd57672..128a54de7 100644
--- a/logging.go
+++ b/logging.go
@@ -152,17 +152,17 @@ func (logging *Logging) setupNewDefault(ctx Context) error {
 	}
 
 	// options for the default logger
-	options, err := newDefault.buildOptions()
+	options, err := newDefault.CustomLog.buildOptions()
 	if err != nil {
 		return fmt.Errorf("setting up default log: %v", err)
 	}
 
 	// set up this new log
-	err = newDefault.provision(ctx, logging)
+	err = newDefault.CustomLog.provision(ctx, logging)
 	if err != nil {
 		return fmt.Errorf("setting up default log: %v", err)
 	}
-	newDefault.logger = zap.New(newDefault.core, options...)
+	newDefault.logger = zap.New(newDefault.CustomLog.core, options...)
 
 	// redirect the default caddy logs
 	defaultLoggerMu.Lock()
diff --git a/modules/caddyevents/app.go b/modules/caddyevents/app.go
index e4559fbdb..f88247fda 100644
--- a/modules/caddyevents/app.go
+++ b/modules/caddyevents/app.go
@@ -226,7 +226,7 @@ func (app *App) Emit(ctx caddy.Context, eventName string, data map[string]any) c
 		zap.String("origin", originModuleName))
 
 	// add event info to replacer, make sure it's in the context
-	repl, ok := ctx.Value(caddy.ReplacerCtxKey).(*caddy.Replacer)
+	repl, ok := ctx.Context.Value(caddy.ReplacerCtxKey).(*caddy.Replacer)
 	if !ok {
 		repl = caddy.NewReplacer()
 		ctx.Context = context.WithValue(ctx.Context, caddy.ReplacerCtxKey, repl)
diff --git a/modules/caddyhttp/celmatcher.go b/modules/caddyhttp/celmatcher.go
index 6d7607c48..3d118ea79 100644
--- a/modules/caddyhttp/celmatcher.go
+++ b/modules/caddyhttp/celmatcher.go
@@ -329,14 +329,14 @@ func (pn celPkixName) ConvertToNative(typeDesc reflect.Type) (any, error) {
 
 func (pn celPkixName) ConvertToType(typeVal ref.Type) ref.Val {
 	if typeVal.TypeName() == "string" {
-		return types.String(pn.String())
+		return types.String(pn.Name.String())
 	}
 	panic("not implemented")
 }
 
 func (pn celPkixName) Equal(other ref.Val) ref.Val {
 	if o, ok := other.Value().(string); ok {
-		return types.Bool(pn.String() == o)
+		return types.Bool(pn.Name.String() == o)
 	}
 	return types.ValOrErr(other, "%v is not comparable type", other)
 }
diff --git a/modules/caddyhttp/headers/caddyfile.go b/modules/caddyhttp/headers/caddyfile.go
index 2758f2907..f060471b1 100644
--- a/modules/caddyhttp/headers/caddyfile.go
+++ b/modules/caddyhttp/headers/caddyfile.go
@@ -87,7 +87,7 @@ func parseCaddyfile(h httpcaddyfile.Helper) ([]httpcaddyfile.ConfigValue, error)
 		if err != nil {
 			return nil, h.Err(err.Error())
 		}
-		if len(handler.Response.Delete) > 0 {
+		if len(handler.Response.HeaderOps.Delete) > 0 {
 			handler.Response.Deferred = true
 		}
 	}
diff --git a/modules/caddyhttp/headers/headers.go b/modules/caddyhttp/headers/headers.go
index 5c160c72e..ef9e35e7d 100644
--- a/modules/caddyhttp/headers/headers.go
+++ b/modules/caddyhttp/headers/headers.go
@@ -354,9 +354,9 @@ func (rww *responseWriterWrapper) WriteHeader(status int) {
 	if status < 100 || status > 199 {
 		rww.wroteHeader = true
 	}
-	if rww.require == nil || rww.require.Match(status, rww.Header()) {
+	if rww.require == nil || rww.require.Match(status, rww.ResponseWriterWrapper.Header()) {
 		if rww.headerOps != nil {
-			rww.headerOps.ApplyTo(rww.Header(), rww.replacer)
+			rww.headerOps.ApplyTo(rww.ResponseWriterWrapper.Header(), rww.replacer)
 		}
 	}
 	rww.ResponseWriterWrapper.WriteHeader(status)
diff --git a/modules/caddyhttp/push/handler.go b/modules/caddyhttp/push/handler.go
index a43e76784..1fbe53d83 100644
--- a/modules/caddyhttp/push/handler.go
+++ b/modules/caddyhttp/push/handler.go
@@ -210,7 +210,7 @@ type linkPusher struct {
 }
 
 func (lp linkPusher) WriteHeader(statusCode int) {
-	if links, ok := lp.Header()["Link"]; ok {
+	if links, ok := lp.ResponseWriter.Header()["Link"]; ok {
 		// only initiate these pushes if it hasn't been done yet
 		if val := caddyhttp.GetVar(lp.request.Context(), pushedLink); val == nil {
 			if c := lp.handler.logger.Check(zapcore.DebugLevel, "pushing Link resources"); c != nil {
diff --git a/modules/caddyhttp/responsewriter.go b/modules/caddyhttp/responsewriter.go
index e9d0e0739..904c30c03 100644
--- a/modules/caddyhttp/responsewriter.go
+++ b/modules/caddyhttp/responsewriter.go
@@ -158,7 +158,7 @@ func (rr *responseRecorder) WriteHeader(statusCode int) {
 	if rr.shouldBuffer == nil {
 		rr.stream = true
 	} else {
-		rr.stream = !rr.shouldBuffer(rr.statusCode, rr.Header())
+		rr.stream = !rr.shouldBuffer(rr.statusCode, rr.ResponseWriterWrapper.Header())
 	}
 
 	// 1xx responses aren't final; just informational
diff --git a/modules/caddyhttp/reverseproxy/healthchecks.go b/modules/caddyhttp/reverseproxy/healthchecks.go
index 9da3bfefa..ac42570b2 100644
--- a/modules/caddyhttp/reverseproxy/healthchecks.go
+++ b/modules/caddyhttp/reverseproxy/healthchecks.go
@@ -463,7 +463,7 @@ func (h *Handler) doActiveHealthCheck(dialInfo DialInfo, hostAddr string, networ
 
 	markUnhealthy := func() {
 		// increment failures and then check if it has reached the threshold to mark unhealthy
-		err := upstream.countHealthFail(1)
+		err := upstream.Host.countHealthFail(1)
 		if err != nil {
 			if c := h.HealthChecks.Active.logger.Check(zapcore.ErrorLevel, "could not count active health failure"); c != nil {
 				c.Write(
@@ -473,11 +473,11 @@ func (h *Handler) doActiveHealthCheck(dialInfo DialInfo, hostAddr string, networ
 			}
 			return
 		}
-		if upstream.activeHealthFails() >= h.HealthChecks.Active.Fails {
+		if upstream.Host.activeHealthFails() >= h.HealthChecks.Active.Fails {
 			// dispatch an event that the host newly became unhealthy
 			if upstream.setHealthy(false) {
 				h.events.Emit(h.ctx, "unhealthy", map[string]any{"host": hostAddr})
-				upstream.resetHealth()
+				upstream.Host.resetHealth()
 			}
 		}
 	}
@@ -494,13 +494,13 @@ func (h *Handler) doActiveHealthCheck(dialInfo DialInfo, hostAddr string, networ
 			}
 			return
 		}
-		if upstream.activeHealthPasses() >= h.HealthChecks.Active.Passes {
+		if upstream.Host.activeHealthPasses() >= h.HealthChecks.Active.Passes {
 			if upstream.setHealthy(true) {
 				if c := h.HealthChecks.Active.logger.Check(zapcore.InfoLevel, "host is up"); c != nil {
 					c.Write(zap.String("host", hostAddr))
 				}
 				h.events.Emit(h.ctx, "healthy", map[string]any{"host": hostAddr})
-				upstream.resetHealth()
+				upstream.Host.resetHealth()
 			}
 		}
 	}
@@ -596,7 +596,7 @@ func (h *Handler) countFailure(upstream *Upstream) {
 	}
 
 	// count failure immediately
-	err := upstream.countFail(1)
+	err := upstream.Host.countFail(1)
 	if err != nil {
 		if c := h.HealthChecks.Active.logger.Check(zapcore.ErrorLevel, "could not count failure"); c != nil {
 			c.Write(
diff --git a/modules/caddyhttp/reverseproxy/hosts.go b/modules/caddyhttp/reverseproxy/hosts.go
index bf278f0c7..300003f2b 100644
--- a/modules/caddyhttp/reverseproxy/hosts.go
+++ b/modules/caddyhttp/reverseproxy/hosts.go
@@ -83,7 +83,7 @@ func (u *Upstream) Available() bool {
 func (u *Upstream) Healthy() bool {
 	healthy := u.healthy()
 	if healthy && u.healthCheckPolicy != nil {
-		healthy = u.Fails() < u.healthCheckPolicy.MaxFails
+		healthy = u.Host.Fails() < u.healthCheckPolicy.MaxFails
 	}
 	if healthy && u.cb != nil {
 		healthy = u.cb.OK()
@@ -94,7 +94,7 @@ func (u *Upstream) Healthy() bool {
 // Full returns true if the remote host
 // cannot receive more requests at this time.
 func (u *Upstream) Full() bool {
-	return u.MaxRequests > 0 && u.NumRequests() >= u.MaxRequests
+	return u.MaxRequests > 0 && u.Host.NumRequests() >= u.MaxRequests
 }
 
 // fillDialInfo returns a filled DialInfo for upstream u, using the request
diff --git a/modules/caddyhttp/reverseproxy/httptransport.go b/modules/caddyhttp/reverseproxy/httptransport.go
index d80d5776c..23af0b3f9 100644
--- a/modules/caddyhttp/reverseproxy/httptransport.go
+++ b/modules/caddyhttp/reverseproxy/httptransport.go
@@ -768,7 +768,7 @@ type tcpRWTimeoutConn struct {
 
 func (c *tcpRWTimeoutConn) Read(b []byte) (int, error) {
 	if c.readTimeout > 0 {
-		err := c.SetReadDeadline(time.Now().Add(c.readTimeout))
+		err := c.TCPConn.SetReadDeadline(time.Now().Add(c.readTimeout))
 		if err != nil {
 			if ce := c.logger.Check(zapcore.ErrorLevel, "failed to set read deadline"); ce != nil {
 				ce.Write(zap.Error(err))
@@ -780,7 +780,7 @@ func (c *tcpRWTimeoutConn) Read(b []byte) (int, error) {
 
 func (c *tcpRWTimeoutConn) Write(b []byte) (int, error) {
 	if c.writeTimeout > 0 {
-		err := c.SetWriteDeadline(time.Now().Add(c.writeTimeout))
+		err := c.TCPConn.SetWriteDeadline(time.Now().Add(c.writeTimeout))
 		if err != nil {
 			if ce := c.logger.Check(zapcore.ErrorLevel, "failed to set write deadline"); ce != nil {
 				ce.Write(zap.Error(err))
diff --git a/modules/caddyhttp/reverseproxy/reverseproxy.go b/modules/caddyhttp/reverseproxy/reverseproxy.go
index f6eb58261..88fba55a1 100644
--- a/modules/caddyhttp/reverseproxy/reverseproxy.go
+++ b/modules/caddyhttp/reverseproxy/reverseproxy.go
@@ -554,9 +554,9 @@ func (h *Handler) proxyLoopIteration(r *http.Request, origReq *http.Request, w h
 	repl.Set("http.reverse_proxy.upstream.hostport", dialInfo.Address)
 	repl.Set("http.reverse_proxy.upstream.host", dialInfo.Host)
 	repl.Set("http.reverse_proxy.upstream.port", dialInfo.Port)
-	repl.Set("http.reverse_proxy.upstream.requests", upstream.NumRequests())
+	repl.Set("http.reverse_proxy.upstream.requests", upstream.Host.NumRequests())
 	repl.Set("http.reverse_proxy.upstream.max_requests", upstream.MaxRequests)
-	repl.Set("http.reverse_proxy.upstream.fails", upstream.Fails())
+	repl.Set("http.reverse_proxy.upstream.fails", upstream.Host.Fails())
 
 	// mutate request headers according to this upstream;
 	// because we're in a retry loop, we have to copy
@@ -827,9 +827,9 @@ func (h Handler) addForwardedHeaders(req *http.Request) error {
 // (This method is mostly the beginning of what was borrowed from the net/http/httputil package in the
 // Go standard library which was used as the foundation.)
 func (h *Handler) reverseProxy(rw http.ResponseWriter, req *http.Request, origReq *http.Request, repl *caddy.Replacer, di DialInfo, next caddyhttp.Handler) error {
-	_ = di.Upstream.countRequest(1)
+	_ = di.Upstream.Host.countRequest(1)
 	//nolint:errcheck
-	defer di.Upstream.countRequest(-1)
+	defer di.Upstream.Host.countRequest(-1)
 
 	// point the request to this upstream
 	h.directRequest(req, di)
diff --git a/modules/logging/netwriter.go b/modules/logging/netwriter.go
index c32bf8de8..7d8481e3c 100644
--- a/modules/logging/netwriter.go
+++ b/modules/logging/netwriter.go
@@ -202,7 +202,7 @@ func (reconn *redialerConn) Write(b []byte) (n int, err error) {
 		}
 		if n, err = conn2.Write(b); err == nil {
 			if reconn.Conn != nil {
-				reconn.Close()
+				reconn.Conn.Close()
 			}
 			reconn.Conn = conn2
 		}