370 Commits

Author	SHA1	Message	Date
Paulo Henrique	7ffb640a4d	httpcaddyfile: Fix missing TLS connection policies when auto_https is default (#7325) (#7507)	2026-02-21 21:42:03 -05:00
Francis Lavoie	d64c7e67a4	caddyhttp: Option to disable 0-RTT (#7485)	2026-02-16 10:20:47 -07:00
Amirhf	affbb99275	pki: add per-CA configurable maintenance_interval and renewal_window_ratio (#7479) ... * pki: add per-CA configurable maintenance_interval and renewal_window_ratio - Add MaintenanceInterval and RenewalWindowRatio to CA struct (JSON + Caddyfile). - Run one maintenance goroutine per CA using its own interval. - needsRenewal uses per-CA RenewalWindowRatio; invalid/zero ratio falls back to defaults. - Caddyfile: maintenance_interval duration, renewal_window_ratio <0-1>. - Tests: TestCA_needsRenewal, TestParsePKIApp for new options. Fixes #7475 * fix codestyle	2026-02-15 09:10:12 -05:00
Aditya Bhargava	d6a6b486db	httpcaddyfile: Override global dns with acme_dns (fix #7294) (#7458) ... This brings the behaviour in line with what the documentation implies.	2026-02-15 09:04:59 +00:00
mehrdadbn9	929d0e502a	caddyfile: Add renewal_window_ratio global option and tls subdirective (#7473) ... * caddyfile: Add renewal_window_ratio global option Adds support for configuring the TLS certificate renewal window ratio directly in the Caddyfile global options block. This allows users to customize when certificates should be renewed without needing to use JSON configuration. Example usage: { renewal_window_ratio 0.1666 } Fixes #7467 * caddyfile: Add renewal_window_ratio to tls directive and tests Adds support for renewal_window_ratio in the tls directive (not just global options) and adds caddyfile adapt tests for both the global option and tls directive. * fix: inherit global renewal_window_ratio in site policies * fix: correct test expected output for policy consolidation * fix: properly inherit global renewal_window_ratio without removing other code	2026-02-13 16:47:02 -05:00
Matthew Holt	6718bd470f	caddytls: Finish removing prefer_wildcard ... Finish what should have been done a year ago in #6959)	2026-02-12 11:35:28 -07:00
Mohammed Al Sahaf	e40bd019ff	caddyfile: add observe_catchall_hosts option (#7434) ... * caddyfile: add `observe_catchall_hosts` option Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * correct JSON field name and doc comment Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2026-01-14 00:06:16 +00:00
Francis Lavoie	90972fbebc	chore: Dumb prealloc lint fix (#7430)	2026-01-13 14:13:43 -05:00
vnxme	31960dc998	Introduce packet conn wrappers (#7180) ... * packet_conn_wrappers: Initial changes * packet_conn_wrappers: Unwrap a packet conn only if there are no wrappers --------- Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-12-04 14:15:56 -07:00
Chris Seufert	d7185fd002	caddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers (#7265)	2025-10-16 02:47:32 +00:00
wyrapeseed	d115cd1042	chore: fix some comments (#7303)	2025-10-15 03:58:53 +00:00
joshuamcbeth	de6b78009b	caddyhttp: Add server options keepalive_idle and keepalive_count (#7298) ... * Add Server options KeepAliveIdle (keepalive_idle) and KeepAliveCount (keepalive_count) Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Add Server option KeepAliveDisable (keepalive_disable) Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Remove Server option KeepAliveDisable (keepalive_disable), disable when interval is negative Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Add keepalive parameters to caddyfiletest Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> --------- Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com>	2025-10-14 12:03:23 -06:00
Monviech	2f1d270968	httpcaddyfile: Map default_bind to BindHost in globalACMEDefaults (#7278) ... * Implement BindHost fallback in ACME issuer * Fix indentation * Skip creating empty challenges stub in adapted json config * Skip setting BindHost for DNS Challenge * golangci-lint fix --------- Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-10-06 16:48:38 -06:00
Aditya Bhargava	3c003deec6	httpcaddyfile: Add missing DNS challenge check for acme_dns (#7270) ... * add optional argument to `mock` DNS provider * preserve local DNS challenge settings when `acme_dns` is specified * add missing check for `acme_dns`	2025-10-03 14:05:46 -06:00
Pavel	d9cc24f3df	caddypki: Disable internal auto-CA when auto_https is disabled (fix #7211) (#7238) ... Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-09-05 09:41:06 -06:00
Bang Lee	5e2953670e	caddyhttp: add replacer placeholders for escaped values (#7181)	2025-08-25 09:07:51 -06:00
Francis Lavoie	4564261d83	httpcaddyfile: Fix acme_dns regression (#7199)	2025-08-22 15:09:25 -06:00
Matthew Holt	42c888ee1d	Ignore irrelevant linter warning	2025-08-04 16:28:13 -06:00
Matthew Holt	0badb071ef	httpcaddyfile: Fix generated config related to ACME global options ... If global DNS provider is configured, it does not need to be repeated in the JSON. If acme_* options are used, base automation policies should populate their issuers accordingly. Global issuer settings like acme_* options don't need to specify subjects in the automation policy since they should apply as a global default.	2025-08-04 16:22:25 -06:00
Matthew Holt	5b727bde29	httpcaddyfile: Allow naked acme_dns if dns is set (fix #7091)	2025-07-29 11:56:09 -06:00
Francis Lavoie	77dd12cc78	httpcaddyfile: Validates TLS DNS challenge options (#7099) ... * httpcaddyfile: Validates TLS DNS challenge options Adds validation to the TLS Caddyfile adapter to ensure that when DNS challenge options (such as propagation_delay or dns_ttl) are specified, a DNS provider is also configured. Adds new integration tests to verify this validation logic, and implements a new mechanism for adapt tests to assert a config adapt error. * Add some more AI-generated tests asserting config errors * Parallel doesn't work here, we use global variables * Windows fix	2025-06-30 23:58:16 +00:00
Hina🐣 | Developer	0f209f62eb	httpcaddyfile: reject blocks in log_skip directive (#7056)	2025-06-09 21:56:21 -06:00
Youness Farini	092913a7a5	httpcaddyfile: Prevent error handler from overriding sub-handler matchers (#6999) ... Fixes: #6957	2025-06-06 11:46:39 -06:00
Mohammed Al Sahaf	e039a5bb5c	chore: upgrade .golangci.yml and workflow to v2 (#6924) ... * chore: upgrade .golangci.yml and workflow to v2 run `golangci-lint fmt` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * run `golangci-lint run --fix` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * more lint fixes Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * bring back comments to .golangci.yml Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * appease the linter some more Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * oops Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * use embedded structs Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * use embedded structs where they were used before Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * disable rule `-QF1006` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * missed a spot Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-06-03 02:24:32 +03:00
eveneast	a76d005a94	Use maps.Copy for simpler map handling (#7009) ... Signed-off-by: eveneast <qcqs@foxmail.com>	2025-05-13 15:16:47 -06:00
WeidiDeng	8524386737	caddyhttp: Compare paths w/o wildcard if prefixes differ (#7015) ... * fix route sort by comparing paths without wildcard if they don't share the same prefix * sort lexically if paths have the same length	2025-05-13 13:17:52 -06:00
Matt Holt	1bfa111552	caddytls: Prefer managed wildcard certs over individual subdomain certs (#6959) ... * caddytls: Prefer managed wildcard certs over individual subdomain certs * Repurpose force_automate as no_wildcard * Fix a couple bugs * Restore force_automate and use automate loader as wildcard override	2025-04-18 11:44:23 -06:00
Matthew Holt	8dc76676fb	chore: Modernize a couple for loops	2025-03-19 09:53:42 -06:00
Steffen Busch	f4432a306a	caddyfile: add error handling for unrecognized subdirective/options in various modules (#6884)	2025-03-08 23:45:05 +03:00
Matthew Holt	1975408d89	chore: Remove unnecessary explicit type parameters	2025-03-07 11:18:00 -07:00
Matthew Holt	bc3d497739	caddytls: Fix broken refactor ... Not sure how that happened...	2025-03-06 08:54:40 -07:00
Matt Holt	d7764dfdbb	caddytls: Encrypted ClientHello (ECH) (#6862) ... * caddytls: Initial commit of Encrypted ClientHello (ECH) * WIP Caddyfile * Fill out Caddyfile support * Enhance godoc comments * Augment, don't overwrite, HTTPS records * WIP * WIP: publication history * Fix republication logic * Apply global DNS module to ACME challenges This allows DNS challenges to be enabled without locally-configured DNS modules * Ignore false positive from prealloc linter * ci: Use only latest Go version (1.24 currently) We no longer support older Go versions, for security benefits. * Remove old commented code Static ECH keys for now * Implement SendAsRetry	2025-03-05 17:04:10 -07:00
Mohammed Al Sahaf	f2c17d1f3f	testing: sort force-automated hosts (#6756)	2024-12-30 05:38:29 -05:00
Francis Lavoie	afa778ae05	httpcaddyfile: Implement experimental force_automate option (#6712)	2024-12-24 08:58:40 -07:00
Matthew Holt	ed1c594cdb	go.mod: Upgrade ACMEz to v3; and upgrade CertMagic	2024-12-19 12:17:07 -07:00
Francis Lavoie	b116dcea3d	caddyhttp: Add {?query} placeholder (#6714) ... * caddyhttp: Add `{prefixed_query}` placeholder * fastcgi: Preserve query during canonical redirect * Use orig_uri instead for the redirect, shorter Caddyfile shortcut	2024-12-02 08:06:38 -05:00
Nikolai K	b183aec83c	httpcaddyfile: Implement log sampling config (#6682) ... * Allow log sampling configuration from Caddyfile * Add log sampling adapt tests	2024-11-11 16:42:50 -07:00
Francis Lavoie	5c8dc34418	caddytls: Allow disabling storage cleaning, avoids writing two files (#6593)	2024-11-05 10:47:41 -07:00
Francis Lavoie	09b2cbcf4d	caddyhttp: Add MatchWithError to replace SetVar hack (#6596) ... * caddyhttp: Add `MatchWithError` to replace SetVar hack * Error in IP matchers on TLS handshake not complete * Use MatchWithError everywhere possible * Move implementations to MatchWithError versions * Looser interface checking to allow fallback * CEL factories can return RequestMatcherWithError * Clarifying comment since it's subtle that an err is returned * Return 425 Too Early status in IP matchers * Keep AnyMatch signature the same for now * Apparently Deprecated can't be all-uppercase to get IDE linting * Linter	2024-11-04 23:18:50 +00:00
Francis Lavoie	b129ed6be8	httpcaddyfile: Fixes for prefer_wildcard mode (#6636) ... * httpcaddyfile: Fixes for prefer_wildcard mode The wildcard hosts need to be collected first, then considered after, because there's no guarantee that all non-wildcards will appear after all wildcards when looping. Also we should not add a domain to Skip if it doesn't qualify for TLS anyway. * Alternate solution by avoiding adding APs altogether if covered by wildcard	2024-10-30 17:09:12 +00:00
Aaron Paterson	0182fb87fa	core: addresses.go funcs renames (#6622) ... * right side in tls ln * remove ParseNetworkAddressFromHostPort * ignore placeholder port * remove println * update test cases (!!!) * [] * comment * Trim * Update addresses.go	2024-10-21 08:02:29 -06:00
David Wood	1391e8ed9a	chore: fix some function names in comment (#6650)	2024-10-21 07:39:58 +00:00
Mohammed Al Sahaf	388c7e898c	metrics: move metrics up, outside servers (#6606) ... * metrics: move `metrics` up, outside `servers` This change moves the metrics configuration from per-server level to a single config knob within the `http` app. Enabling `metrics` in any of the configured servers inside `http` enables metrics for all servers. Fix #6604 Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * normalize domain name --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2024-10-18 09:54:21 -06:00
Francis Lavoie	d7564d632f	caddytls: Drop rate_limit and burst, has been deprecated (#6611)	2024-10-07 17:39:47 -04:00
Mohammed Al Sahaf	41f5dd56e1	metrics: scope metrics to active config, add optional per-host metrics (#6531) ... * Add per host config * Pass host label when option is enabled * Test per host enabled * metrics: scope metrics per loaded config * doc and linter Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * inject the custom registry into the admin handler Co-Authored-By: Dave Henderson <dhenderson@gmail.com> * remove `TODO` comment * fixes Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * refactor to delay metrics admin handler provision Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> Co-authored-by: Hussam Almarzooq <me@hussam.io> Co-authored-by: Dave Henderson <dhenderson@gmail.com>	2024-10-02 08:23:26 -06:00
Francis Lavoie	16724842d9	caddyhttp: Implement auto_https prefer_wildcard option (#6146) ... * Allow specifying multiple `auto_https` options * Implement `auto_https prefer_wildcard` option * Adapt tests, add mock DNS module for config testing * Rebase fix	2024-10-02 07:31:58 -06:00
Aaron Paterson	4b1a9b6cc1	core: Implement socket activation listeners (#6573) ... * caddy adapt for listen_protocols * adapt listen_socket * allow multiple listen sockets for port ranges and readd socket fd listen logic * readd logic to start servers according to listener protocols * gofmt * adapt caddytest * gosec * fmt and rename listen to listenWithSocket * fmt and rename listen to listenWithSocket * more consistent error msg * non unix listenReusableWithSocketFile * remove unused func * doc comment typo * nonosec * commit * doc comments * more doc comments * comment was misleading, cardinality did not change * addressesWithProtocols * update test * fd/ and fdgram/ * rm addr * actually write... * i guess we doin' "skip": now * wrong var in placeholder * wrong var in placeholder II * update param name in comment * dont save nil file pointers * windows * key -> parsedKey * osx * multiple default_bind with protocols * check for h1 and h2 listener netw	2024-09-30 10:55:03 -06:00
Francis Lavoie	2faeac0a10	chore: Use slices package where possible (#6585) ... * chore: Use slices package where possible * More, mostly using ContainsFunc * Even more slice operations	2024-09-25 14:30:56 -06:00
Omar Ramadan	d85cc2ec10	logging: Customizable zap cores (#6381)	2024-06-10 09:03:24 -06:00
Matt Holt	9ba999141b	caddyhttp: Trace individual middleware handlers (#6313) ... * caddyhttp: Trace individual middleware handlers * Fix typo	2024-05-18 14:48:42 -06:00