1476 Commits

Author	SHA1	Message	Date
Francis Lavoie	2ae0f7af69	reverseproxy: Set Host to {upstream_hostport} automatically if TLS (#7454)	2026-02-09 13:06:19 -07:00
Matthew Holt	e0f8d9b204	caddytls: Check type assertion ... Fix https://github.com/mholt/caddy-l4/issues/378	2026-02-03 13:59:53 -07:00
Matthew Holt	3bb22672f9	reverseproxy: Customizable dial network for SRV upstreams ... By request of a sponsor	2026-02-02 11:25:51 -07:00
Matthew Holt	935b09de83	caddtls: Skip .ts.net domains for ECH (#6971) ... As it is also a special case in our automatic HTTPS.	2026-01-30 12:24:59 -07:00
Matthew Holt	7d24124430	caddyhttp: Reject invalid Host header (fix #7449)	2026-01-30 12:24:16 -07:00
Paulo Henrique	565c1c3054	autohttps: deterministic logic and strict bind checking on Linux (#7435) ... * http: fix non-deterministic auto-https and improve Linux bind matching * docs: restore historical context about Linux bind behavior	2026-01-16 08:51:23 -07:00
Mohammed Al Sahaf	e40bd019ff	caddyfile: add observe_catchall_hosts option (#7434) ... * caddyfile: add `observe_catchall_hosts` option Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * correct JSON field name and doc comment Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2026-01-14 00:06:16 +00:00
Paulo Henrique	62134d65af	reverseproxy: fix error when remote address is not an IP (#7429)	2026-01-13 19:52:56 +00:00
Francis Lavoie	90972fbebc	chore: Dumb prealloc lint fix (#7430)	2026-01-13 14:13:43 -05:00
Tom Paulus	6a57142896	headers: Make ApplyTo nil-safe (#7426)	2026-01-06 17:39:58 -05:00
WeidiDeng	80f2ae92cd	reverseproxy: make error chan bigger when reverse proxying websocket (#7419)	2026-01-06 04:55:47 -05:00
Felix Hildén	1f1be3f4fe	tracing: Add span attributes to tracing module (#7269) ... * WIP tracing span attributes * better test * only write attributes after other middleware (and request) * Fix test to use header response placeholders	2025-12-31 11:33:18 -07:00
Francis Lavoie	decc8a4d6f	logging: log_append Early option, Supports {http.response.body} (#7368) ... * logging: `log_append` early option * logging: `log_append` supports `{http.response.body}` * Convenience auto-early for request body	2025-12-16 23:42:42 -05:00
Francis Lavoie	4037d05760	caddyhttp: {http.request.body_base64} placeholder (#7367)	2025-12-13 21:01:12 -07:00
Paul B	6a4296b1a4	caddytls: panic when using tls.ca_pool.source.http -> tls.ca (#7393)	2025-12-11 19:27:15 +00:00
Matt Holt	3c9c67e804	caddytls: ECH key rotation (#7356) ... * caddytls: ECH key rotation * Stop rotation goroutine on config unload * Publish ECH keys after rotating	2025-12-10 11:50:35 -07:00
okrc	374b7a637f	caddytls: fix preferred chains options by appending values instead of replacing (#7387)	2025-12-07 16:19:01 +00:00
WeidiDeng	6e0cbd0fa0	caddyhttp: create a placeholder for and log ech status (#7328) ... Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2025-12-07 16:01:58 +00:00
Steffen Busch	bfdb04912d	docs: add maybe template function documentation (#7388)	2025-12-06 06:51:28 -05:00
vnxme	31960dc998	Introduce packet conn wrappers (#7180) ... * packet_conn_wrappers: Initial changes * packet_conn_wrappers: Unwrap a packet conn only if there are no wrappers --------- Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-12-04 14:15:56 -07:00
Francis Lavoie	be5f49fbeb	caddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true (#7372)	2025-12-03 18:46:11 +00:00
Herman Slatman	7ebe72bbfe	caddypki: Add support for multiple intermediates in signing chain (#7057) ... * caddypki: Add support for multiple intermediates in signing chain * Move intermediate lifetime configuration check In #7272 a check was changed to ensure that generated intermediate certificates would always use a lifetime that falls within the lifetime of the root. However, when a root and intermediate(s) are supplied, the configuration value was being used instead of the actual lifetimes of the certificates. The check was moved to only be performed when an intermediate is generated; not when loaded from disk. * Add tests for `pemDecodeCertificateChain` and `pemDecodeCertificate` * Use `crypto.Signer` instead of `any` in appropriate places * Use latest Smallstep packages --------- Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-12-03 11:30:00 -07:00
Petr	67a9e0657e	reverseproxy: Fix retries for requests with bodies (#7360) ... * capture the buffered body once, then reset clonedReq.Body before each retry * no copy * keep receiver name * set the buf to nil after extraction and only return it to pool if not nil --------- Co-authored-by: WeidiDeng <weidi_deng@icloud.com>	2025-11-24 12:03:18 -07:00
ledigang	2cb426776c	encode: modernize, replace HasSuffix+TrimSuffix with CutSuffix (#7357) ... Signed-off-by: ledigang <shuangcui@msn.com>	2025-11-21 15:30:26 -07:00
WeidiDeng	a6da1acdc8	reverse_proxy: use interfaces to modify the behaviors of the transports (#7353)	2025-11-17 09:51:37 -07:00
Kévin Dunglas	b3f2db233b	core: custom slog handlers for modules (log contextual data) (#7346)	2025-11-12 13:29:47 -07:00
Marten Seemann	f2199d48b2	chore: update quic-go to v0.56.0, enable qlog for HTTP/3 (#7345)	2025-11-08 00:41:15 -05:00
Kévin Dunglas	8285eba842	caddyhttp: allow customizing the Server header (#7338)	2025-11-03 21:00:27 -07:00
Cooper de Nicola	895b56063a	chore: fix golangci-lint error G602 in caddyhttp (#7334)	2025-11-03 03:04:55 +00:00
Mohammed Al Sahaf	ddec1838b3	caddytls: correct documentation of LeafFolderLoader (#7327) ... * caddytls: correct documentation of `LeafFolderLoader` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * fmt... Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-11-01 18:29:55 +03:00
WeidiDeng	abe0acabb6	reverseproxy: set default values for keepalive if only some of them are set (#7318)	2025-10-25 05:15:55 -04:00
Philipp Keidel	b54e870b26	tracing: switch to autoexport for OpenTelemetry span exporter (#7317)	2025-10-23 17:54:50 -06:00
wyrapeseed	57587ed18e	refactor: use reflect.TypeFor (#7313) ... Signed-off-by: wyrapeseed <wyrapeseed@outlook.com>	2025-10-21 13:26:30 -06:00
WeidiDeng	1e21b660c4	reverseproxy: use http.Protocols to handle h2c requests (#6990)	2025-10-21 16:05:43 +00:00
Mohammed Al Sahaf	595aab8bc0	metrics: resolve per-host inifinite cardinality (#7306)	2025-10-21 06:06:56 +00:00
WeidiDeng	8aca108d2c	reverseproxy: do not disable keepalive if proxy protocol is used (#7300)	2025-10-21 05:09:37 +00:00
WeidiDeng	a7885aabec	intercept: use already buffered response if possible when intercepting (#7028)	2025-10-21 04:48:07 +00:00
Bashayer Alrumahi	f5f25d845a	logging: fix multiple regexp filters on same field (fixes #7049) (#7061) ... * logging: fix multiple regexp filters on same field (fixes #7049) * fix: add proper error handling in MultiRegexpFilter tests * fix: resolve linter and test issues - Fix GCI import formatting issues - Fix MultiRegexpFilter input size limit test by ensuring output doesn't exceed max length after each operation - All tests now pass and linter issues resolved * fix: update integration test for proper JSON encoding - Fix expected JSON output to use Unicode escape sequence for ampersand character - Integration tests now pass	2025-10-16 05:08:53 +00:00
WeidiDeng	1ce2a13ad1	caddyhttp: wrap accepted connection to suppress tls.ConnectionState (#7247)	2025-10-16 03:13:40 +00:00
Chris Seufert	d7185fd002	caddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers (#7265)	2025-10-16 02:47:32 +00:00
Anthony Biondo	7fb39ec1e5	reverseproxy: Use http1.1 upgrade for websocket for extended connect of http2 and http3 (#7305) ... Co-authored-by: WeidiDeng <weidi_deng@icloud.com>	2025-10-16 02:20:20 +00:00
aeris	10ac7da037	logging: Switch from lumberjack to timberjack, add time-rolling options (#7244) ... Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2025-10-15 17:11:10 -04:00
wyrapeseed	d115cd1042	chore: fix some comments (#7303)	2025-10-15 03:58:53 +00:00
joshuamcbeth	de6b78009b	caddyhttp: Add server options keepalive_idle and keepalive_count (#7298) ... * Add Server options KeepAliveIdle (keepalive_idle) and KeepAliveCount (keepalive_count) Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Add Server option KeepAliveDisable (keepalive_disable) Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Remove Server option KeepAliveDisable (keepalive_disable), disable when interval is negative Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Add keepalive parameters to caddyfiletest Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> --------- Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com>	2025-10-14 12:03:23 -06:00
WeidiDeng	2ec28bca43	reverse_proxy: use http1 for outbound tls requests with placeholder that are likely websockets (#7296)	2025-10-09 10:36:49 -06:00
GreyXor	13a4ec7597	basicauth: Implement argon2id (#7186) ... * feat: add argon2id hash-password command * feat: ardon2id owasp safe value * feat: add argon2id compare method * chore: fmt argon2id * docs: more argon2id docs * chore: upgrade x/crypto dep * revert: remove golangci * refactor: argon2id decode * chore: update deps * refactor: simplify argon2id compare return * chore: upgrade dependencies * chore: upgrade dependencies	2025-10-06 17:27:06 -06:00
asttool	bc0e184130	caddyhttp: omit unnecessary reassignment (#7276) ... Signed-off-by: asttool <asttool@outlook.com>	2025-09-26 10:44:58 -06:00
Y.Horie	1e82f9652e	caddypki: check intermediate lifetime to actual root cert lifetime (#7272)	2025-09-26 10:24:52 -06:00
Mohammed Al Sahaf	25be2f26fc	chore: ugh, lint fix... (#7275) ... * chore: ugh, lint fix... Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * more lint fixes Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-09-26 03:14:48 -04:00
Gilbert Gilb's	f5c3094050	cmd: prevent commas in header values from being split (#7268) ... `pflag.GetStringSlice` treats commas as delimiters, which causes issues when passing headers whose values contain commas (`X-Robots-Tag: noindex, nofollow`). These are incorrectly split into multiple headers and errors out: - `X-Robots-Tag: noindex` - ` nofollow` Switch to `pflag.GetStringArray`, which does not split on commas[1]. Note that this changes behavior for cases where multiple headers were provided in a single argument with commas (`--header-down "X-Foo: Bar,X-Bar: Foo"`). Such cases will now be treated as a single header value. If this breaking change is unacceptable, we will need a smarter fallback mechanism. [1] https://github.com/spf13/pflag/pull/90	2025-09-22 21:12:06 -06:00