278 Commits

Author	SHA1	Message	Date
Rijul	0fab9f0f7d	caddytls: avoid duplicate automation for wildcard-covered hosts (#7697) ... * caddytls: Fix wildcard race in auto-HTTPS launch When evaluating whether to skip managing an individual subdomain due to an existing wildcard configuration, we now explicitly consult the automate loader. Because Caddy apps can start in any order, relying strictly on the TLS app's internal management state was non-deterministic if the HTTP app started first. Checking the automate loader guarantees predictable behavior since it is fully populated during the Provision phase, well before any apps are started. * respond to review comments 1. update requested comment 2. remove personal domain from test 3. add regression test * remove unnecessary mutex lock * refactor: -integration test, +explicit cases * refactor: remove redundant test, add comment * rename file and add header * update copyright year	2026-05-11 00:08:40 +10:00
Zen Dodd	5e76b5ee43	tls: add alpn to managed HTTPS records (#7653) ... * tls: add alpn to managed HTTPS records * tls: centralise HTTPS RR ALPN defaults and registration Reuse shared protocol defaults instead of repeating the default HTTP protocol list, unify server name registration to carry ALPN in one experimental API and reuse the TLS default ALPN ordering for HTTPS RR publication * http: centralise effective protocol resolution for HTTPS RR ALPN	2026-05-10 13:10:29 +10:00
Felix Eckhofer	ef496e58ef	caddytls: Expand ACME credentials (#7554) ... * caddytls: Expand ACME credentials This allows using global placeholders such as {file./run/secrets/key_id} when setting up the tls configuration. * chore(formatting): gofmt on acmeissuer_test	2026-05-03 07:13:57 +10:00
Harsh Patel	d7834676aa	tls: add system and combined CA pool modules (#7406) ... * feat: add system and combined CA pool modules * fix: combining pools using `CertificateProvider` * fix: lint issue * chore: caddyfiletests * doing it for first time, so not sure if its right. * fix: use `x509` native addCert * chore: explicit err handling * Apply suggestion from @mohammed90 --------- Co-authored-by: Mohammed Al Sahaf <mohammed@caffeinatedwonders.com>	2026-04-06 01:13:34 +03:00
Pieter Berkel	4f50458866	tls: expand placeholders in dns_challenge override_domain (#7609)	2026-03-31 05:46:32 +00:00
Tao	5d189aff40	caddytls: Avoid default issuers for implicit tailscale policies (#7577)	2026-03-20 09:36:03 -06:00
Matthew Holt	8499e34e10	caddytls: Ensure key list always gets set (fix #7555)	2026-03-16 16:21:47 -06:00
Matthew Holt	1fbb28720b	Fix lint errors ... Use VerifyConnection instead of VerifyPeerCertificate; the other 2 fixes are "meh" not really a big deal or an issue at all.	2026-03-11 13:33:59 -06:00
Francis Lavoie	d935a6956c	autohttps: Ensure CertMagic config is recreated after autohttps runs (#7510)	2026-03-03 14:44:06 -07:00
Pavel Siomachkin	f145bce553	tls: Add tls_resolvers global option for DNS challenge configuration (#7297) ... Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2026-03-01 15:32:04 -05:00
Matt Holt	95941a71e8	chore: Add nolints to work around haywire linters (#7493) ... * chore: Add nolints to work around haywire linters * More lint wrangling	2026-02-17 16:52:54 -07:00
Francis Lavoie	9fe694c79c	caddytls: Enable debug logging for DNSManager (#7491)	2026-02-16 15:38:56 -07:00
Francis Lavoie	ff4f79aebe	chore: Remove obsolete comment in ech.go (#7487)	2026-02-16 10:17:01 -07:00
moscowchill	d42d39b4bc	caddytls: Return errors instead of nil in client auth provisioning (#7464) ... Two error returns in ClientAuthentication.provision() were returning nil instead of the actual error, silently swallowing failures when converting PEM files to DER and when provisioning the CA pool. This could cause mTLS client authentication to silently fall back to the system trust store, accepting any client certificate signed by a public CA instead of restricting to the configured trust anchors.	2026-02-12 08:42:54 -07:00
Matthew Holt	e0f8d9b204	caddytls: Check type assertion ... Fix https://github.com/mholt/caddy-l4/issues/378	2026-02-03 13:59:53 -07:00
Matthew Holt	935b09de83	caddtls: Skip .ts.net domains for ECH (#6971) ... As it is also a special case in our automatic HTTPS.	2026-01-30 12:24:59 -07:00
Paul B	6a4296b1a4	caddytls: panic when using tls.ca_pool.source.http -> tls.ca (#7393)	2025-12-11 19:27:15 +00:00
Matt Holt	3c9c67e804	caddytls: ECH key rotation (#7356) ... * caddytls: ECH key rotation * Stop rotation goroutine on config unload * Publish ECH keys after rotating	2025-12-10 11:50:35 -07:00
okrc	374b7a637f	caddytls: fix preferred chains options by appending values instead of replacing (#7387)	2025-12-07 16:19:01 +00:00
Herman Slatman	7ebe72bbfe	caddypki: Add support for multiple intermediates in signing chain (#7057) ... * caddypki: Add support for multiple intermediates in signing chain * Move intermediate lifetime configuration check In #7272 a check was changed to ensure that generated intermediate certificates would always use a lifetime that falls within the lifetime of the root. However, when a root and intermediate(s) are supplied, the configuration value was being used instead of the actual lifetimes of the certificates. The check was moved to only be performed when an intermediate is generated; not when loaded from disk. * Add tests for `pemDecodeCertificateChain` and `pemDecodeCertificate` * Use `crypto.Signer` instead of `any` in appropriate places * Use latest Smallstep packages --------- Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-12-03 11:30:00 -07:00
Mohammed Al Sahaf	ddec1838b3	caddytls: correct documentation of LeafFolderLoader (#7327) ... * caddytls: correct documentation of `LeafFolderLoader` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * fmt... Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-11-01 18:29:55 +03:00
Matthew Holt	38848f7f25	caddytls: Allow disabling distributed solving (except http-01)	2025-09-04 08:51:36 -06:00
avery	b898873b90	caddytls: fix regression in external certificate manager support (#7179) ... revert changes to automation.go from e276994174	2025-08-13 09:30:26 -06:00
Matthew Holt	42c888ee1d	Ignore irrelevant linter warning	2025-08-04 16:28:13 -06:00
Matthew Holt	731e6c2482	caddytls: Improve ECH error logging (close #7152)	2025-08-04 16:22:25 -06:00
mountdisk	c712cfcd76	docs: fix some minor issues in the comments (#7101)	2025-06-30 06:50:00 +00:00
Mohammed Al Sahaf	1481c0411a	caddytls: wire up client_auth leaf verifier Caddyfile (#6772) ... * client_auth: wire up leaf verifier Caddyfile Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * review feedback + tests Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-06-09 08:18:36 -06:00
Mohammed Al Sahaf	e039a5bb5c	chore: upgrade .golangci.yml and workflow to v2 (#6924) ... * chore: upgrade .golangci.yml and workflow to v2 run `golangci-lint fmt` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * run `golangci-lint run --fix` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * more lint fixes Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * bring back comments to .golangci.yml Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * appease the linter some more Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * oops Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * use embedded structs Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * use embedded structs where they were used before Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * disable rule `-QF1006` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * missed a spot Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-06-03 02:24:32 +03:00
tongjicoder	5b2eb66418	Use slices.Contains to simplify code (#7039) ... Signed-off-by: tongjicoder <tongjicoder@icloud.com>	2025-05-31 12:03:06 -06:00
Matthew Holt	105eee671c	caddytls: Set local_ip, not remote_ip (#6952) ... Follow-up on 35c8c2d92d where I was a dum-dum	2025-04-21 18:32:51 -06:00
Mohammed Al Sahaf	737936c06b	reverseproxy: reference correct field name in LoadModule (#6978) ... Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-04-21 08:43:27 -06:00
Matthew Holt	fb22a26b1a	caddytls: Allow missing ECH meta file	2025-04-18 12:20:21 -06:00
Matt Holt	1bfa111552	caddytls: Prefer managed wildcard certs over individual subdomain certs (#6959) ... * caddytls: Prefer managed wildcard certs over individual subdomain certs * Repurpose force_automate as no_wildcard * Fix a couple bugs * Restore force_automate and use automate loader as wildcard override	2025-04-18 11:44:23 -06:00
Matthew Holt	35c8c2d92d	caddytls: Add remote_ip to HTTP cert manager (close #6952)	2025-04-17 16:43:06 -06:00
Matthew Holt	9becf61a9f	go.mod: Upgrade to libdns 1.0 beta APIs (requires upgraded DNS providers) ... This is the only way we can properly, reliably support ECH.	2025-04-07 12:43:11 -06:00
Matthew Holt	ea77a9ab67	caddytls: Temporarily treat "" and "@" as equivalent for DNS publication ... Fixes https://github.com/caddyserver/caddy/issues/6895#issuecomment-2750111096	2025-03-25 16:24:16 -06:00
Matthew Holt	782a3c7ac6	caddytls: Don't publish HTTPS record for CNAME'd domain (fix #6922)	2025-03-24 09:55:26 -06:00
Mohammed Al Sahaf	173573035c	core: add modular network_proxy support (#6399) ... * core: add modular `network_proxy` support Co-authored-by: @ImpostorKeanu Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * move modules around Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * add caddyfile implementation Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * address feedbcak * Apply suggestions from code review Co-authored-by: Francis Lavoie <lavofr@gmail.com> * adapt ForwardProxyURL to use the NetworkProxyRaw Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * remove redundant `url` in log Co-authored-by: Matt Holt <mholt@users.noreply.github.com> * code review Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * remove `.source` from the module ID Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> Co-authored-by: Francis Lavoie <lavofr@gmail.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-03-21 17:06:15 +00:00
Matthew Holt	e276994174	caddytls: Initialize permission module earlier (fix #6901) ... Bug introduced in 4ebcfed9c9	2025-03-17 12:02:23 -06:00
Matthew Holt	55c89ccf2a	caddytls: Convert AP subjects to punycode ... Fixes bugs related to TLS automation	2025-03-14 15:44:20 -06:00
Matthew Holt	1f8dab572c	caddytls: Don't publish ECH configs if other records don't exist ... Publishing a DNS record for a name that doesn't have any could make wildcards ineffective, which would be surprising for site owners and could lead to downtime.	2025-03-12 16:33:14 -06:00
Matthew Holt	39262f8663	caddytls: Minor fixes for ECH	2025-03-11 08:12:48 -06:00
jjiang-stripe	49f9af9a4a	caddytls: Fix TrustedCACerts backwards compatibility (#6889) ... * add failing test * fix ca pool provisioning * remove unused param	2025-03-10 12:50:47 -06:00
Matthew Holt	d57ab215a2	caddytls: Pointer receiver (fix #6885)	2025-03-08 14:19:06 -07:00
Steffen Busch	f4432a306a	caddyfile: add error handling for unrecognized subdirective/options in various modules (#6884)	2025-03-08 23:45:05 +03:00
Matthew Holt	4ebcfed9c9	caddytls: Reorder provisioning steps (fix #6877) ... Also add a quick check to allow users to load their own certs for ECH (outer) domains.	2025-03-07 11:18:00 -07:00
Matthew Holt	adbe7f87e6	caddytls: Only make DNS solver if not already set (fix #6880)	2025-03-07 09:46:43 -07:00
Matthew Holt	bc3d497739	caddytls: Fix broken refactor ... Not sure how that happened...	2025-03-06 08:54:40 -07:00
Matthew Holt	a807fe0659	caddytls: Enhance ECH documentation	2025-03-06 08:52:52 -07:00
Matt Holt	d7764dfdbb	caddytls: Encrypted ClientHello (ECH) (#6862) ... * caddytls: Initial commit of Encrypted ClientHello (ECH) * WIP Caddyfile * Fill out Caddyfile support * Enhance godoc comments * Augment, don't overwrite, HTTPS records * WIP * WIP: publication history * Fix republication logic * Apply global DNS module to ACME challenges This allows DNS challenges to be enabled without locally-configured DNS modules * Ignore false positive from prealloc linter * ci: Use only latest Go version (1.24 currently) We no longer support older Go versions, for security benefits. * Remove old commented code Static ECH keys for now * Implement SendAsRetry	2025-03-05 17:04:10 -07:00