294 Commits

Author	SHA1	Message	Date
Aditya Bhargava	d6a6b486db	httpcaddyfile: Override global dns with acme_dns (fix #7294) (#7458) ... This brings the behaviour in line with what the documentation implies.	2026-02-15 09:04:59 +00:00
mehrdadbn9	929d0e502a	caddyfile: Add renewal_window_ratio global option and tls subdirective (#7473) ... * caddyfile: Add renewal_window_ratio global option Adds support for configuring the TLS certificate renewal window ratio directly in the Caddyfile global options block. This allows users to customize when certificates should be renewed without needing to use JSON configuration. Example usage: { renewal_window_ratio 0.1666 } Fixes #7467 * caddyfile: Add renewal_window_ratio to tls directive and tests Adds support for renewal_window_ratio in the tls directive (not just global options) and adds caddyfile adapt tests for both the global option and tls directive. * fix: inherit global renewal_window_ratio in site policies * fix: correct test expected output for policy consolidation * fix: properly inherit global renewal_window_ratio without removing other code	2026-02-13 16:47:02 -05:00
WeidiDeng	47f3e8f8dc	use math/rand/v2 instead of math/rand (#7413)	2026-02-11 09:15:51 -07:00
Bashayer Alrumahi	f5f25d845a	logging: fix multiple regexp filters on same field (fixes #7049) (#7061) ... * logging: fix multiple regexp filters on same field (fixes #7049) * fix: add proper error handling in MultiRegexpFilter tests * fix: resolve linter and test issues - Fix GCI import formatting issues - Fix MultiRegexpFilter input size limit test by ensuring output doesn't exceed max length after each operation - All tests now pass and linter issues resolved * fix: update integration test for proper JSON encoding - Fix expected JSON output to use Unicode escape sequence for ampersand character - Integration tests now pass	2025-10-16 05:08:53 +00:00
WeidiDeng	1ce2a13ad1	caddyhttp: wrap accepted connection to suppress tls.ConnectionState (#7247)	2025-10-16 03:13:40 +00:00
Chris Seufert	d7185fd002	caddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers (#7265)	2025-10-16 02:47:32 +00:00
joshuamcbeth	de6b78009b	caddyhttp: Add server options keepalive_idle and keepalive_count (#7298) ... * Add Server options KeepAliveIdle (keepalive_idle) and KeepAliveCount (keepalive_count) Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Add Server option KeepAliveDisable (keepalive_disable) Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Remove Server option KeepAliveDisable (keepalive_disable), disable when interval is negative Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> * Add keepalive parameters to caddyfiletest Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com> --------- Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com>	2025-10-14 12:03:23 -06:00
Aditya Bhargava	3c003deec6	httpcaddyfile: Add missing DNS challenge check for acme_dns (#7270) ... * add optional argument to `mock` DNS provider * preserve local DNS challenge settings when `acme_dns` is specified * add missing check for `acme_dns`	2025-10-03 14:05:46 -06:00
Artur H.	0ba8786b35	caddyfile: Allow block to do nothing if nothing passed to import (#7206)	2025-09-12 20:29:09 +00:00
Artur H.	551f793700	caddyfile: Fix importing nested tokens for {block} (#7189)	2025-08-22 21:29:34 +00:00
Francis Lavoie	4564261d83	httpcaddyfile: Fix acme_dns regression (#7199)	2025-08-22 15:09:25 -06:00
Matthew Holt	0badb071ef	httpcaddyfile: Fix generated config related to ACME global options ... If global DNS provider is configured, it does not need to be repeated in the JSON. If acme_* options are used, base automation policies should populate their issuers accordingly. Global issuer settings like acme_* options don't need to specify subjects in the automation policy since they should apply as a global default.	2025-08-04 16:22:25 -06:00
Matthew Holt	4fd2acb5c9	Add test for 5b727bde2992e7cb9987208453db42ae6e1c6e1e	2025-07-30 14:43:20 -06:00
Zongze Wu	bbf1dfcea2	headers: Support placeholders in replacement search patterns (#7117) ... * fix: resolve http.request placeholders in header directive find operation - Skip regex compilation during provision when placeholders are detected - Compile regex at runtime after placeholder replacement - Preserves performance for static regexes while enabling dynamic placeholders - Fixes #7109 * test: add tests for placeholder detection in header replacements - Test containsPlaceholders function edge cases - Test provision skips compilation for dynamic regexes - Test end-to-end placeholder replacement functionality	2025-07-14 14:55:00 -06:00
Francis Lavoie	77dd12cc78	httpcaddyfile: Validates TLS DNS challenge options (#7099) ... * httpcaddyfile: Validates TLS DNS challenge options Adds validation to the TLS Caddyfile adapter to ensure that when DNS challenge options (such as propagation_delay or dns_ttl) are specified, a DNS provider is also configured. Adds new integration tests to verify this validation logic, and implements a new mechanism for adapt tests to assert a config adapt error. * Add some more AI-generated tests asserting config errors * Parallel doesn't work here, we use global variables * Windows fix	2025-06-30 23:58:16 +00:00
Mohammed Al Sahaf	1481c0411a	caddytls: wire up client_auth leaf verifier Caddyfile (#6772) ... * client_auth: wire up leaf verifier Caddyfile Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * review feedback + tests Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-06-09 08:18:36 -06:00
Youness Farini	092913a7a5	httpcaddyfile: Prevent error handler from overriding sub-handler matchers (#6999) ... Fixes: #6957	2025-06-06 11:46:39 -06:00
Mohammed Al Sahaf	e039a5bb5c	chore: upgrade .golangci.yml and workflow to v2 (#6924) ... * chore: upgrade .golangci.yml and workflow to v2 run `golangci-lint fmt` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * run `golangci-lint run --fix` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * more lint fixes Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * bring back comments to .golangci.yml Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * appease the linter some more Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * oops Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * use embedded structs Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * use embedded structs where they were used before Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * disable rule `-QF1006` Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * missed a spot Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-06-03 02:24:32 +03:00
Mohammed Al Sahaf	44d078b670	acme_server: fix policy parsing in caddyfile (#7006) ... Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2025-05-08 11:54:07 -06:00
Matt Holt	1bfa111552	caddytls: Prefer managed wildcard certs over individual subdomain certs (#6959) ... * caddytls: Prefer managed wildcard certs over individual subdomain certs * Repurpose force_automate as no_wildcard * Fix a couple bugs * Restore force_automate and use automate loader as wildcard override	2025-04-18 11:44:23 -06:00
Mohammed Al Sahaf	173573035c	core: add modular network_proxy support (#6399) ... * core: add modular `network_proxy` support Co-authored-by: @ImpostorKeanu Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * move modules around Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * add caddyfile implementation Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * address feedbcak * Apply suggestions from code review Co-authored-by: Francis Lavoie <lavofr@gmail.com> * adapt ForwardProxyURL to use the NetworkProxyRaw Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * remove redundant `url` in log Co-authored-by: Matt Holt <mholt@users.noreply.github.com> * code review Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * remove `.source` from the module ID Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> Co-authored-by: Francis Lavoie <lavofr@gmail.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2025-03-21 17:06:15 +00:00
Arsh	e48b75843b	header: match subdirective for response matching (#6765)	2025-01-07 22:48:06 -07:00
Francis Lavoie	afa778ae05	httpcaddyfile: Implement experimental force_automate option (#6712)	2024-12-24 08:58:40 -07:00
Matthew Holt	ed1c594cdb	go.mod: Upgrade ACMEz to v3; and upgrade CertMagic	2024-12-19 12:17:07 -07:00
Kévin Dunglas	d0e209e1da	encode: good defaults (#6737) ... * feat: good default for encode * fix tests and add a new one	2024-12-10 16:48:30 -07:00
Kévin Dunglas	290cfea08f	fileserver: add a test for precompressed defaults (#6743)	2024-12-10 16:48:02 -07:00
Kévin Dunglas	efd9251ad3	fileserver: Add first_exist_fallback strategy for try_files (#6699) ... * feat: add first_exist_or_fallback strategy for try_files * fix tests * linter	2024-12-03 05:44:49 -07:00
Francis Lavoie	b116dcea3d	caddyhttp: Add {?query} placeholder (#6714) ... * caddyhttp: Add `{prefixed_query}` placeholder * fastcgi: Preserve query during canonical redirect * Use orig_uri instead for the redirect, shorter Caddyfile shortcut	2024-12-02 08:06:38 -05:00
Kévin Dunglas	eddbccd298	fastcgi: remove dir redirection when useless in php_fastcgi (#6698) ... * perf: remove dir redirection when useless in php_fastcgi * fix test * review * fix * fix * simplify * simplify again * restore test * add test	2024-11-21 10:38:31 -07:00
Nikolai K	b183aec83c	httpcaddyfile: Implement log sampling config (#6682) ... * Allow log sampling configuration from Caddyfile * Add log sampling adapt tests	2024-11-11 16:42:50 -07:00
Francis Lavoie	5c8dc34418	caddytls: Allow disabling storage cleaning, avoids writing two files (#6593)	2024-11-05 10:47:41 -07:00
Atakan Yenel	cc23ad6402	fileserver: Add file_limit option for browse (to be experimental) (#6648) ... * Add file_limit option for file_server browse * Move file_limit inside browse. * add file_server_file_limit caddyfile adapt test.	2024-11-05 09:35:32 -07:00
Francis Lavoie	05cfb121ec	forwardauth: Skip copying missing response headers (#6608)	2024-11-04 14:58:53 -07:00
Francis Lavoie	b129ed6be8	httpcaddyfile: Fixes for prefer_wildcard mode (#6636) ... * httpcaddyfile: Fixes for prefer_wildcard mode The wildcard hosts need to be collected first, then considered after, because there's no guarantee that all non-wildcards will appear after all wildcards when looping. Also we should not add a domain to Skip if it doesn't qualify for TLS anyway. * Alternate solution by avoiding adding APs altogether if covered by wildcard	2024-10-30 17:09:12 +00:00
David Wood	1391e8ed9a	chore: fix some function names in comment (#6650)	2024-10-21 07:39:58 +00:00
Mohammed Al Sahaf	388c7e898c	metrics: move metrics up, outside servers (#6606) ... * metrics: move `metrics` up, outside `servers` This change moves the metrics configuration from per-server level to a single config knob within the `http` app. Enabling `metrics` in any of the configured servers inside `http` enables metrics for all servers. Fix #6604 Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * normalize domain name --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2024-10-18 09:54:21 -06:00
Mohammed Al Sahaf	dd5decabe7	tests: fix caddyfile adapt warnings (#6619) ... Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2024-10-10 13:38:49 -06:00
Francis Lavoie	d7564d632f	caddytls: Drop rate_limit and burst, has been deprecated (#6611)	2024-10-07 17:39:47 -04:00
Mohammed Al Sahaf	41f5dd56e1	metrics: scope metrics to active config, add optional per-host metrics (#6531) ... * Add per host config * Pass host label when option is enabled * Test per host enabled * metrics: scope metrics per loaded config * doc and linter Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * inject the custom registry into the admin handler Co-Authored-By: Dave Henderson <dhenderson@gmail.com> * remove `TODO` comment * fixes Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * refactor to delay metrics admin handler provision Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> Co-authored-by: Hussam Almarzooq <me@hussam.io> Co-authored-by: Dave Henderson <dhenderson@gmail.com>	2024-10-02 08:23:26 -06:00
Francis Lavoie	16724842d9	caddyhttp: Implement auto_https prefer_wildcard option (#6146) ... * Allow specifying multiple `auto_https` options * Implement `auto_https prefer_wildcard` option * Adapt tests, add mock DNS module for config testing * Rebase fix	2024-10-02 07:31:58 -06:00
Aaron Paterson	4b1a9b6cc1	core: Implement socket activation listeners (#6573) ... * caddy adapt for listen_protocols * adapt listen_socket * allow multiple listen sockets for port ranges and readd socket fd listen logic * readd logic to start servers according to listener protocols * gofmt * adapt caddytest * gosec * fmt and rename listen to listenWithSocket * fmt and rename listen to listenWithSocket * more consistent error msg * non unix listenReusableWithSocketFile * remove unused func * doc comment typo * nonosec * commit * doc comments * more doc comments * comment was misleading, cardinality did not change * addressesWithProtocols * update test * fd/ and fdgram/ * rm addr * actually write... * i guess we doin' "skip": now * wrong var in placeholder * wrong var in placeholder II * update param name in comment * dont save nil file pointers * windows * key -> parsedKey * osx * multiple default_bind with protocols * check for h1 and h2 listener netw	2024-09-30 10:55:03 -06:00
lollipopkit🏳️‍⚧️	5c47c2f147	fileserver: browse: Configurable default sort (#6502) ... * fileserver: add `sort` options * fix: test * fileserver: check options in `Provison` * fileserver: more obvious err alerts in sort options * fileserver: move `sort` to `browse` --------- Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2024-08-30 09:01:37 -06:00
Mohammed Al Sahaf	4ade967005	reverseproxy: allow user to define source address (#6504) ... * reverseproxy: allow user to define source address Closes #6503 Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * reverse_proxy: caddyfile support for local_address Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2024-08-22 19:52:05 +00:00
Jesper Brix Rosenkilde	54a0c8f948	reverseproxy: Active health checks request body option (#6520) ... * Add an option to specify the body used for active health checks * Replacer on request body	2024-08-19 10:55:55 -06:00
Steffen Busch	b85b6c6469	replacer: {file.*} global placeholder strips trailing newline (#6411) ... Co-authored-by: Kanashimia <chad@redpilled.dev>	2024-08-07 19:39:15 +00:00
lollipopkit🏳️‍⚧️	b198678174	browse: Customizable default sort options (#6468) ... * fileserver: add `sort` options * fix: test * fileserver: check options in `Provison` * fileserver: more obvious err alerts in sort options	2024-08-05 08:27:45 -06:00
Jesper Brix Rosenkilde	07c863637d	reverseproxy: Caddyfile support for health_method (#6454) ... * Add Caddyfile support of setting active health check request method * Add integration test for active health check request method	2024-07-12 17:01:58 -04:00
Kévin Dunglas	0287009ee5	intercept: fix http.intercept.header.* placeholder (#6429)	2024-07-03 08:43:13 -06:00
a	aca4002fd8	caddyfile: Pass blocks to import for snippets (#6130) ... * a * a * a * a * a * a	2024-06-14 11:27:51 -06:00
Francis Lavoie	40c582ce82	caddyhttp: Fix merging consecutive client_ip or remote_ip matchers (#6350)	2024-05-30 07:32:17 -06:00