331 Commits

Author	SHA1	Message	Date
newklei	2dbcdefbbe	forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545) ... When using copy_headers in a forward_auth block, client-supplied headers with the same names were not being removed before being forwarded to the backend. This happens because PR #6608 added a MatchNot guard that skips the Set operation when the auth service does not return a given header. That guard prevents setting headers to empty strings, which is the correct behavior, but it also means a client can send X-User-Id: admin in their request and if the auth service validates the token without returning X-User-Id, Caddy skips the Set and the client value passes through unchanged to the backend. The fix adds an unconditional delete route for each copy_headers entry, placed just before the existing conditional set route. The delete always runs regardless of what the auth service returns. The conditional set still only runs when the auth service provides that header. The end result is: - Client-supplied headers are always removed - When the auth service returns the header, the backend gets that value - When the auth service does not return the header, the backend sees nothing Existing behavior is unchanged for any deployment where the auth service returns all of the configured copy_headers entries. Fixes GHSA-7r4p-vjf4-gxv4	2026-03-03 23:30:49 -05:00
Salent Olivick	7b34e3107e	core: Check whether @id is unique (#7002) ... * caddy.go: Check whether @id is unique(#6991) * Alternate implementation, using Gemini 3.1 --------- Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2026-03-03 15:09:49 -07:00
Francis Lavoie	a6acb3902c	proxyproto: Generated test coverage (#7540)	2026-03-03 15:08:09 -07:00
Francis Lavoie	45cf61b127	logging: Ensure slog error level logs don't print stack traces (#7512)	2026-03-03 14:44:42 -07:00
prettysunflower	2dd3852416	fix(caddyfile): Prevent parser to panic when no token were added by empty {block} (#7543)	2026-03-03 13:16:21 -05:00
Akın Demirci	11b56c6cfc	reverseproxy: Fix health_port being ignored in health checks (#7533)	2026-03-03 13:10:54 -05:00
Pavel Siomachkin	f145bce553	tls: Add tls_resolvers global option for DNS challenge configuration (#7297) ... Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2026-03-01 15:32:04 -05:00
Francis Lavoie	9873752978	logging: Support zstd roll compression (#7515)	2026-02-23 16:04:45 -07:00
Dean Ruina	294dfff443	logging: add DirMode options and propagate FileMode to rotations (#7335) ... Co-authored-by: Francis Lavoie <lavofr@gmail.com>	2026-02-23 07:27:27 +00:00
Paulo Henrique	76b198f586	http: Sort auto-HTTPS redirect routes by host specificity (fixes #7390) (#7502)	2026-02-21 21:42:40 -05:00
Matt Holt	95941a71e8	chore: Add nolints to work around haywire linters (#7493) ... * chore: Add nolints to work around haywire linters * More lint wrangling	2026-02-17 16:52:54 -07:00
Francis Lavoie	3adcafd4c1	admin: Fix tests locally, properly isolate storage (#7486) ... * admin: Fix tests locally, properly isolate storage * Fix flaky pki_test * Drop testdata dir logic * Safer temp dir * Test handlers without a full server	2026-02-17 13:14:06 -07:00
Amirhf	091add5ae3	caddytest: make TestReverseProxyHealthCheck deterministic with poll instead of sleep (#7474) ... Start lightweight backend servers before starting Caddy so active health checks probe a ready backend instead of the same Caddy instance during provisioning. This removes the startup race without fixed sleeps or polling.	2026-02-17 06:41:38 -05:00
Francis Lavoie	d64c7e67a4	caddyhttp: Option to disable 0-RTT (#7485)	2026-02-16 10:20:47 -07:00
Aditya Bhargava	d6a6b486db	httpcaddyfile: Override global dns with acme_dns (fix #7294) (#7458) ... This brings the behaviour in line with what the documentation implies.	2026-02-15 09:04:59 +00:00
mehrdadbn9	929d0e502a	caddyfile: Add renewal_window_ratio global option and tls subdirective (#7473) ... * caddyfile: Add renewal_window_ratio global option Adds support for configuring the TLS certificate renewal window ratio directly in the Caddyfile global options block. This allows users to customize when certificates should be renewed without needing to use JSON configuration. Example usage: { renewal_window_ratio 0.1666 } Fixes #7467 * caddyfile: Add renewal_window_ratio to tls directive and tests Adds support for renewal_window_ratio in the tls directive (not just global options) and adds caddyfile adapt tests for both the global option and tls directive. * fix: inherit global renewal_window_ratio in site policies * fix: correct test expected output for policy consolidation * fix: properly inherit global renewal_window_ratio without removing other code	2026-02-13 16:47:02 -05:00
WeidiDeng	47f3e8f8dc	use math/rand/v2 instead of math/rand (#7413)	2026-02-11 09:15:51 -07:00
Kévin Dunglas	598b08f9ae	test: mark Assert* functions as test helpers (#7380)	2025-12-08 22:32:00 +00:00
Bashayer Alrumahi	f5f25d845a	logging: fix multiple regexp filters on same field (fixes #7049) (#7061) ... * logging: fix multiple regexp filters on same field (fixes #7049) * fix: add proper error handling in MultiRegexpFilter tests * fix: resolve linter and test issues - Fix GCI import formatting issues - Fix MultiRegexpFilter input size limit test by ensuring output doesn't exceed max length after each operation - All tests now pass and linter issues resolved * fix: update integration test for proper JSON encoding - Fix expected JSON output to use Unicode escape sequence for ampersand character - Integration tests now pass	2025-10-16 05:08:53 +00:00
WeidiDeng	1ce2a13ad1	caddyhttp: wrap accepted connection to suppress tls.ConnectionState (#7247)	2025-10-16 03:13:40 +00:00
Chris Seufert	d7185fd002	caddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers (#7265)	2025-10-16 02:47:32 +00:00
joshuamcbeth	de6b78009b	caddyhttp: Add server options keepalive_idle and keepalive_count (#7298) ... * Add Server options KeepAliveIdle (keepalive_idle) and KeepAliveCount (keepalive_count) Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Add Server option KeepAliveDisable (keepalive_disable) Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Remove Server option KeepAliveDisable (keepalive_disable), disable when interval is negative Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Add keepalive parameters to caddyfiletest Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> --------- Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com>	2025-10-14 12:03:23 -06:00
Aditya Bhargava	3c003deec6	httpcaddyfile: Add missing DNS challenge check for acme_dns (#7270) ... * add optional argument to `mock` DNS provider * preserve local DNS challenge settings when `acme_dns` is specified * add missing check for `acme_dns`	2025-10-03 14:05:46 -06:00
Artur H.	0ba8786b35	caddyfile: Allow block to do nothing if nothing passed to import (#7206)	2025-09-12 20:29:09 +00:00
Artur H.	551f793700	caddyfile: Fix importing nested tokens for {block} (#7189)	2025-08-22 21:29:34 +00:00
Francis Lavoie	4564261d83	httpcaddyfile: Fix acme_dns regression (#7199)	2025-08-22 15:09:25 -06:00
Matthew Holt	0badb071ef	httpcaddyfile: Fix generated config related to ACME global options ... If global DNS provider is configured, it does not need to be repeated in the JSON. If acme_* options are used, base automation policies should populate their issuers accordingly. Global issuer settings like acme_* options don't need to specify subjects in the automation policy since they should apply as a global default.	2025-08-04 16:22:25 -06:00
Matthew Holt	4fd2acb5c9	Add test for 5b727bde29	2025-07-30 14:43:20 -06:00
Zongze Wu	bbf1dfcea2	headers: Support placeholders in replacement search patterns (#7117) ... * fix: resolve http.request placeholders in header directive find operation - Skip regex compilation during provision when placeholders are detected - Compile regex at runtime after placeholder replacement - Preserves performance for static regexes while enabling dynamic placeholders - Fixes #7109 * test: add tests for placeholder detection in header replacements - Test containsPlaceholders function edge cases - Test provision skips compilation for dynamic regexes - Test end-to-end placeholder replacement functionality	2025-07-14 14:55:00 -06:00
Francis Lavoie	77dd12cc78	httpcaddyfile: Validates TLS DNS challenge options (#7099) ... * httpcaddyfile: Validates TLS DNS challenge options Adds validation to the TLS Caddyfile adapter to ensure that when DNS challenge options (such as propagation_delay or dns_ttl) are specified, a DNS provider is also configured. Adds new integration tests to verify this validation logic, and implements a new mechanism for adapt tests to assert a config adapt error. * Add some more AI-generated tests asserting config errors * Parallel doesn't work here, we use global variables * Windows fix	2025-06-30 23:58:16 +00:00
Mohammed Al Sahaf	1481c0411a	caddytls: wire up client_auth leaf verifier Caddyfile (#6772) ... * client_auth: wire up leaf verifier Caddyfile Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * review feedback + tests Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-06-09 08:18:36 -06:00
Youness Farini	092913a7a5	httpcaddyfile: Prevent error handler from overriding sub-handler matchers (#6999) ... Fixes: #6957	2025-06-06 11:46:39 -06:00
Mohammed Al Sahaf	e039a5bb5c	chore: upgrade .golangci.yml and workflow to v2 (#6924) ... * chore: upgrade .golangci.yml and workflow to v2 run `golangci-lint fmt` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * run `golangci-lint run --fix` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * more lint fixes Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * bring back comments to .golangci.yml Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * appease the linter some more Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * oops Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * use embedded structs Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * use embedded structs where they were used before Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * disable rule `-QF1006` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * missed a spot Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-06-03 02:24:32 +03:00
Mohammed Al Sahaf	44d078b670	acme_server: fix policy parsing in caddyfile (#7006) ... Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-05-08 11:54:07 -06:00
Matt Holt	1bfa111552	caddytls: Prefer managed wildcard certs over individual subdomain certs (#6959) ... * caddytls: Prefer managed wildcard certs over individual subdomain certs * Repurpose force_automate as no_wildcard * Fix a couple bugs * Restore force_automate and use automate loader as wildcard override	2025-04-18 11:44:23 -06:00
Mohammed Al Sahaf	173573035c	core: add modular network_proxy support (#6399) ... * core: add modular `network_proxy` support Co-authored-by: @ImpostorKeanu Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * move modules around Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * add caddyfile implementation Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * address feedbcak * Apply suggestions from code review Co-authored-by: Francis Lavoie <lavofr@gmail.com> * adapt ForwardProxyURL to use the NetworkProxyRaw Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * remove redundant `url` in log Co-authored-by: Matt Holt <mholt@users.noreply.github.com> * code review Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * remove `.source` from the module ID Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> Co-authored-by: Francis Lavoie <lavofr@gmail.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-03-21 17:06:15 +00:00
baruchyahalom	8861eae223	caddytest: Support configuration defaults override (#6850)	2025-03-03 14:35:54 +00:00
Arsh	e48b75843b	header: match subdirective for response matching (#6765)	2025-01-07 22:48:06 -07:00
Francis Lavoie	afa778ae05	httpcaddyfile: Implement experimental force_automate option (#6712)	2024-12-24 08:58:40 -07:00
Matthew Holt	ed1c594cdb	go.mod: Upgrade ACMEz to v3; and upgrade CertMagic	2024-12-19 12:17:07 -07:00
Kévin Dunglas	d0e209e1da	encode: good defaults (#6737) ... * feat: good default for encode * fix tests and add a new one	2024-12-10 16:48:30 -07:00
Kévin Dunglas	290cfea08f	fileserver: add a test for precompressed defaults (#6743)	2024-12-10 16:48:02 -07:00
Kévin Dunglas	efd9251ad3	fileserver: Add first_exist_fallback strategy for try_files (#6699) ... * feat: add first_exist_or_fallback strategy for try_files * fix tests * linter	2024-12-03 05:44:49 -07:00
Francis Lavoie	b116dcea3d	caddyhttp: Add {?query} placeholder (#6714) ... * caddyhttp: Add `{prefixed_query}` placeholder * fastcgi: Preserve query during canonical redirect * Use orig_uri instead for the redirect, shorter Caddyfile shortcut	2024-12-02 08:06:38 -05:00
Kévin Dunglas	eddbccd298	fastcgi: remove dir redirection when useless in php_fastcgi (#6698) ... * perf: remove dir redirection when useless in php_fastcgi * fix test * review * fix * fix * simplify * simplify again * restore test * add test	2024-11-21 10:38:31 -07:00
Nikolai K	b183aec83c	httpcaddyfile: Implement log sampling config (#6682) ... * Allow log sampling configuration from Caddyfile * Add log sampling adapt tests	2024-11-11 16:42:50 -07:00
Francis Lavoie	5c8dc34418	caddytls: Allow disabling storage cleaning, avoids writing two files (#6593)	2024-11-05 10:47:41 -07:00
Atakan Yenel	cc23ad6402	fileserver: Add file_limit option for browse (to be experimental) (#6648) ... * Add file_limit option for file_server browse * Move file_limit inside browse. * add file_server_file_limit caddyfile adapt test.	2024-11-05 09:35:32 -07:00
Francis Lavoie	05cfb121ec	forwardauth: Skip copying missing response headers (#6608)	2024-11-04 14:58:53 -07:00
Francis Lavoie	b129ed6be8	httpcaddyfile: Fixes for prefer_wildcard mode (#6636) ... * httpcaddyfile: Fixes for prefer_wildcard mode The wildcard hosts need to be collected first, then considered after, because there's no guarantee that all non-wildcards will appear after all wildcards when looping. Also we should not add a domain to Skip if it doesn't qualify for TLS anyway. * Alternate solution by avoiding adding APs altogether if covered by wildcard	2024-10-30 17:09:12 +00:00