.github/CONTRIBUTING.md

@@ -25,7 +25,7 @@ Other menu items:
 
 You can have a huge impact on the project by helping with its code. To contribute code to Caddy, first submit or comment in an issue to discuss your contribution, then open a [pull request](https://github.com/caddyserver/caddy/pulls) (PR). If you're new to our community, that's okay: **we gladly welcome pull requests from anyone, regardless of your native language or coding experience.** You can get familiar with Caddy's code base by using [code search at Sourcegraph](https://sourcegraph.com/github.com/caddyserver/caddy).
 
-We hold contributions to a high standard for quality :bowtie:, so don't be surprised if we ask for revisions—even if it seems small or insignificant. Please don't take it personally. :blue_heart: If your change is on the right track, we can guide you to make it mergeable.
+We hold contributions to a high standard for quality :bowtie:, so don't be surprised if we ask for revisions—even if it seems small or insignificant. Please don't take it personally. :blue_heart: If your change is on the right track, we can guide you to make it mergable.
 
 Here are some of the expectations we have of contributors:
 

.github/ISSUE_TEMPLATE/ISSUE.yml

@@ -1,31 +0,0 @@
-name: Issue
-description: An actionable development item, like a bug report or feature request
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thank you for opening an issue! This is for actionable development items like bug reports and feature requests.
-        If you have a question about using Caddy, please [post on our forums](https://caddy.community) instead.
-  - type: textarea
-    id: content
-    attributes:
-      label: Issue Details
-      placeholder: Describe the issue here. Be specific by providing complete logs and minimal instructions to reproduce, or a thoughtful proposal, etc.
-    validations:
-      required: true
-  - type: dropdown
-    id: assistance-disclosure
-    attributes:
-      label: Assistance Disclosure
-      description: "Our project allows assistance by AI/LLM tools as long as it is disclosed and described so we can better respond. Please certify whether you have used any such tooling related to this issue:"
-      options:
-        - 
-        - AI used
-        - AI not used
-    validations:
-      required: true
-  - type: input
-    id: assistance-description
-    attributes:
-      label: If AI was used, describe the extent to which it was used.
-      description: 'Examples: "ChatGPT translated from my native language" or "Claude proposed this change/feature"'

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +0,0 @@
-blank_issues_enabled: false
-contact_links:
-  - name: Caddy forum
-    url: https://caddy.community
-    about: If you have questions (or answers!) about using Caddy, please use our forum

.github/SECURITY.md

@@ -5,11 +5,11 @@ The Caddy project would like to make sure that it stays on top of all practicall
 
 ## Supported Versions
 
-| Version  | Supported |
-| -------- | ----------|
-| 2.latest | ✔️        |
-| 1.x      | :x:       |
-| < 1.x    | :x:       |
+| Version | Supported          |
+| ------- | ------------------ |
+| 2.x     | ✔️ |
+| 1.x     | :x:                |
+| < 1.x   | :x:                |
 
 
 ## Acceptable Scope
@@ -48,9 +48,9 @@ We consider publicly-registered domain names to be public information. This nece
 
 It will speed things up if you suggest a working patch, such as a code diff, and explain why and how it works. Reports that are not actionable, do not contain enough information, are too pushy/demanding, or are not able to convince us that it is a viable and practical attack on the web server itself may be deferred to a later time or possibly ignored, depending on available resources. Priority will be given to credible, responsible reports that are constructive, specific, and actionable. (We get a lot of invalid reports.) Thank you for understanding.
 
-When you are ready, please submit a [new private vulnerability report](https://github.com/caddyserver/caddy/security/advisories/new).
+When you are ready, please email Matt Holt (the author) directly: matt at dyanim dot com.
 
-Please don't encrypt the message. It only makes the process more complicated.
+Please don't encrypt the email body. It only makes the process more complicated.
 
 Please also understand that due to our nature as an open source project, we do not have a budget to award security bounties. We can only thank you.
 

.github/dependabot.yml

@@ -3,20 +3,5 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
-    open-pull-requests-limit: 1
-    groups:
-      actions-deps:
-        patterns:
-          - "*"
-    schedule:
-      interval: "monthly"
-    
-  - package-ecosystem: "gomod"
-    directory: "/"
-    open-pull-requests-limit: 1
-    groups:
-      all-updates:
-        patterns:
-          - "*"
     schedule:
       interval: "monthly"

.github/pull_request_template.md

@@ -1,29 +0,0 @@
-
-
-
-## Assistance Disclosure
-<!--
-Thank you for contributing! Please note:
-
-The use of AI/LLM tools is allowed so long as it is disclosed, so
-that we can provide better code review and maintain project quality.
-
-If you used AI/LLM tooling in any way related to this PR, please
-let us know to what extent it was utilized.
-
-Examples:
-
-"No AI was used."
-"I wrote the code, but Claude generated the tests."
-"I consulted ChatGPT for a solution, but I authored/coded it myself."
-"Cody generated the code, and I verified it is correct."
-"Copilot provided tab completion for code and comments."
-
-We expect that you have vetted your contributions for correctness.
-Additionally, signing our CLA certifies that you have the rights to
-contribute this change.
-
-Replace the text below with your disclosure:
--->
-
-_This PR is missing an assistance disclosure._

.github/workflows/ai.yml

@@ -1,30 +0,0 @@
-name: AI Moderator
-permissions: read-all
-on:
-  issues:
-    types: [opened]
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-jobs:
-  spam-detection:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-      models: read
-      contents: read
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
-      - uses: github/ai-moderator@6bcdb2a79c2e564db8d76d7d4439d91a044c4eb6
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          spam-label: 'spam'
-          ai-label: 'ai-generated'
-          minimize-detected-comments: true
-          # Built-in prompt configuration (all enabled by default)
-          enable-spam-detection: true
-          enable-link-spam-detection: true
-          enable-ai-detection: true
-          # custom-prompt-path: '.github/prompts/my-custom.prompt.yml'  # Optional

.github/workflows/ci.yml

@@ -12,32 +12,28 @@ on:
       - master
       - 2.*
 
-env:
-  GOFLAGS: '-tags=nobadger,nomysql,nopgx'
-  # https://github.com/actions/setup-go/issues/491
-  GOTOOLCHAIN: local
-
-permissions:
-  contents: read
-
 jobs:
   test:
     strategy:
       # Default is true, cancels jobs for other platforms in the matrix if one fails
       fail-fast: false
       matrix:
-        os:
+        os: 
           - linux
           - mac
           - windows
-        go:
-          - '1.25'
+        go: 
+          - '1.21'
+          - '1.22'
 
         include:
         # Set the minimum Go patch version for the given Go minor
         # Usable via ${{ matrix.GO_SEMVER }}
-        - go: '1.25'
-          GO_SEMVER: '~1.25.0'
+        - go: '1.21'
+          GO_SEMVER: '~1.21.0'
+
+        - go: '1.22'
+          GO_SEMVER: '~1.22.1'
 
         # Set some variables per OS, usable via ${{ matrix.VAR }}
         # OS_LABEL: the VM label from GitHub Actions (see https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#standard-github-hosted-runners-for-public-repositories)
@@ -59,21 +55,13 @@ jobs:
           SUCCESS: 'True'
 
     runs-on: ${{ matrix.OS_LABEL }}
-    permissions:
-      contents: read
-      pull-requests: read
-      actions: write # to allow uploading artifacts and cache
-    steps:
-    - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
-      with:
-        egress-policy: audit
 
+    steps:
     - name: Checkout code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@v4
 
     - name: Install Go
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      uses: actions/setup-go@v5
       with:
         go-version: ${{ matrix.GO_SEMVER }}
         check-latest: true
@@ -111,7 +99,7 @@ jobs:
       env:
         CGO_ENABLED: 0
       run: |
-        go build -trimpath -ldflags="-w -s" -v
+        go build -tags nobdger -trimpath -ldflags="-w -s" -v
 
     - name: Smoke test Caddy
       working-directory: ./cmd/caddy
@@ -120,7 +108,7 @@ jobs:
         ./caddy stop
 
     - name: Publish Build Artifact
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      uses: actions/upload-artifact@v4
       with:
         name: caddy_${{ runner.os }}_go${{ matrix.go }}_${{ steps.vars.outputs.short_sha }}
         path: ${{ matrix.CADDY_BIN_PATH }}
@@ -134,7 +122,7 @@ jobs:
       # continue-on-error: true
       run: |
         # (go test -v -coverprofile=cover-profile.out -race ./... 2>&1) > test-results/test-result.out
-        go test -v -coverprofile="cover-profile.out" -short -race ./...
+        go test -tags nobadger -v -coverprofile="cover-profile.out" -short -race ./...
         # echo "status=$?" >> $GITHUB_OUTPUT
 
     # Relevant step if we reinvestigate publishing test/coverage reports
@@ -154,58 +142,26 @@ jobs:
 
   s390x-test:
     name: test (s390x on IBM Z)
-    permissions:
-      contents: read
-      pull-requests: read
     runs-on: ubuntu-latest
-    if: github.event.pull_request.head.repo.full_name == 'caddyserver/caddy' && github.actor != 'dependabot[bot]'
+    if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
     continue-on-error: true  # August 2020: s390x VM is down due to weather and power issues
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
-        with:
-          egress-policy: audit
-          allowed-endpoints: ci-s390x.caddyserver.com:22
-
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4
       - name: Run Tests
         run: |
-          set +e
           mkdir -p ~/.ssh && echo -e "${SSH_KEY//_/\\n}" > ~/.ssh/id_ecdsa && chmod og-rwx ~/.ssh/id_ecdsa
 
           # short sha is enough?
           short_sha=$(git rev-parse --short HEAD)
 
-          # To shorten the following lines
-          ssh_opts="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
-          ssh_host="$CI_USER@ci-s390x.caddyserver.com"
-
           # The environment is fresh, so there's no point in keeping accepting and adding the key.
-          rsync -arz -e "ssh $ssh_opts" --progress --delete --exclude '.git' . "$ssh_host":/var/tmp/"$short_sha"
-          ssh $ssh_opts -t "$ssh_host" bash <<EOF
-          cd /var/tmp/$short_sha
-          go version
-          go env
-          printf "\n\n"
-          retries=3
-          exit_code=0
-          while ((retries > 0)); do
-            CGO_ENABLED=0 go test -p 1 -v ./...
-            exit_code=$?
-            if ((exit_code == 0)); then
-              break
-            fi
-            echo "\n\nTest failed: \$exit_code, retrying..."
-            ((retries--))
-          done
-          echo "Remote exit code: \$exit_code"
-          exit \$exit_code
-          EOF
+          rsync -arz -e "ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" --progress --delete --exclude '.git' . "$CI_USER"@ci-s390x.caddyserver.com:/var/tmp/"$short_sha"
+          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -t "$CI_USER"@ci-s390x.caddyserver.com "cd /var/tmp/$short_sha; go version; go env; printf "\n\n";CGO_ENABLED=0 go test -tags nobadger -v ./..."
           test_result=$?
 
           # There's no need leaving the files around
-          ssh $ssh_opts "$ssh_host" "rm -rf /var/tmp/'$short_sha'"
+          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null "$CI_USER"@ci-s390x.caddyserver.com "rm -rf /var/tmp/'$short_sha'"
 
           echo "Test exit code: $test_result"
           exit $test_result
@@ -215,35 +171,11 @@ jobs:
 
   goreleaser-check:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-    if: github.event.pull_request.head.repo.full_name == 'caddyserver/caddy' && github.actor != 'dependabot[bot]'
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
-        with:
-          egress-policy: audit
-
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4
       
-      - uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
+      - uses: goreleaser/goreleaser-action@v5
         with:
           version: latest
           args: check
-      - name: Install Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
-        with:
-          go-version: "~1.25"
-          check-latest: true
-      - name: Install xcaddy
-        run: |
-          go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
-          xcaddy version
-      - uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
-        with:
-          version: latest
-          args: build --single-target --snapshot
-        env:
-          TAG: ${{ github.head_ref || github.ref_name }}

.github/workflows/cross-build.yml

@@ -10,21 +10,12 @@ on:
       - master
       - 2.*
 
-env:
-  GOFLAGS: '-tags=nobadger,nomysql,nopgx'
-  CGO_ENABLED: '0'
-  # https://github.com/actions/setup-go/issues/491
-  GOTOOLCHAIN: local
-
-permissions:
-  contents: read
-
 jobs:
   build:
     strategy:
       fail-fast: false
       matrix:
-        goos:
+        goos: 
           - 'aix'
           - 'linux'
           - 'solaris'
@@ -35,31 +26,23 @@ jobs:
           - 'windows'
           - 'darwin'
           - 'netbsd'
-        go:
-          - '1.25'
+        go: 
+          - '1.22'
 
         include:
         # Set the minimum Go patch version for the given Go minor
         # Usable via ${{ matrix.GO_SEMVER }}
-        - go: '1.25'
-          GO_SEMVER: '~1.25.0'
+        - go: '1.22'
+          GO_SEMVER: '~1.22.1'
 
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
     continue-on-error: true
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
-        with:
-          egress-policy: audit
-
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v4
 
       - name: Install Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ matrix.GO_SEMVER }}
           check-latest: true
@@ -76,9 +59,11 @@ jobs:
 
       - name: Run Build
         env:
+          CGO_ENABLED: 0
           GOOS: ${{ matrix.goos }}
           GOARCH: ${{ matrix.goos == 'aix' && 'ppc64' || 'amd64' }}
         shell: bash
         continue-on-error: true
         working-directory: ./cmd/caddy
-        run: go build -trimpath -o caddy-"$GOOS"-$GOARCH 2> /dev/null
+        run: |
+          GOOS=$GOOS GOARCH=$GOARCH go build -tags nobadger -trimpath -o caddy-"$GOOS"-$GOARCH 2> /dev/null

.github/workflows/lint.yml

@@ -13,10 +13,6 @@ on:
 permissions:
   contents: read
 
-env:
-  # https://github.com/actions/setup-go/issues/491
-  GOTOOLCHAIN: local
-
 jobs:
   # From https://github.com/golangci/golangci-lint-action
   golangci:
@@ -44,21 +40,19 @@ jobs:
     runs-on: ${{ matrix.OS_LABEL }}
 
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          egress-policy: audit
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
-        with:
-          go-version: '~1.25'
+          go-version: '~1.22.1'
           check-latest: true
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        uses: golangci/golangci-lint-action@v5
         with:
-          version: latest
+          version: v1.55
+
+          # Workaround for https://github.com/golangci/golangci-lint-action/issues/135
+          skip-pkg-cache: true
 
           # Windows times out frequently after about 5m50s if we don't set a longer timeout.
           args: --timeout 10m
@@ -67,39 +61,10 @@ jobs:
           # only-new-issues: true
 
   govulncheck:
-    permissions:
-      contents: read
-      pull-requests: read
     runs-on: ubuntu-latest
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
-        with:
-          egress-policy: audit
-
       - name: govulncheck
-        uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
+        uses: golang/govulncheck-action@v1
         with:
-          go-version-input: '~1.25.0'
+          go-version-input: '~1.22.1'
           check-latest: true
-  
-  dependency-review:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
-        with:
-          egress-policy: audit
-
-      - name: 'Checkout Repository'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1
-        with:
-          comment-summary-in-pr: on-failure
-          # https://github.com/actions/dependency-review-action/issues/430#issuecomment-1468975566
-          base-ref: ${{ github.event.pull_request.base.sha || 'master' }}
-          head-ref: ${{ github.event.pull_request.head.sha || github.ref }}

.github/workflows/release.yml

@@ -5,13 +5,6 @@ on:
     tags:
       - 'v*.*.*'
 
-env:
-  # https://github.com/actions/setup-go/issues/491
-  GOTOOLCHAIN: local
-
-permissions:
-  contents: read
-
 jobs:
   release:
     name: Release
@@ -20,13 +13,13 @@ jobs:
         os: 
           - ubuntu-latest
         go: 
-          - '1.25'
+          - '1.21'
 
         include:
         # Set the minimum Go patch version for the given Go minor
         # Usable via ${{ matrix.GO_SEMVER }}
-        - go: '1.25'
-          GO_SEMVER: '~1.25.0'
+        - go: '1.21'
+          GO_SEMVER: '~1.21.0'
 
     runs-on: ${{ matrix.os }}
     # https://github.com/sigstore/cosign/issues/1258#issuecomment-1002251233
@@ -38,24 +31,19 @@ jobs:
       contents: write
 
     steps:
-    - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
-      with:
-        egress-policy: audit
-
     - name: Checkout code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@v4
       with:
         fetch-depth: 0
 
     - name: Install Go
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      uses: actions/setup-go@v5
       with:
         go-version: ${{ matrix.GO_SEMVER }}
         check-latest: true
 
     # Force fetch upstream tags -- because 65 minutes
-    # tl;dr: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 runs this line:
+    # tl;dr: actions/checkout@v4 runs this line:
     #   git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +ebc278ec98bb24f2852b61fde2a9bf2e3d83818b:refs/tags/
     # which makes its own local lightweight tag, losing all the annotations in the process. Our earlier script ran:
     #   git fetch --prune --unshallow
@@ -109,20 +97,16 @@ jobs:
         git verify-tag "${{ steps.vars.outputs.version_tag }}" || exit 1
 
     - name: Install Cosign
-      uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # main
+      uses: sigstore/cosign-installer@main
     - name: Cosign version
       run: cosign version
     - name: Install Syft
-      uses: anchore/sbom-action/download-syft@7b36ad622f042cab6f59a75c2ac24ccb256e9b45 # main
+      uses: anchore/sbom-action/download-syft@main
     - name: Syft version
       run: syft version
-    - name: Install xcaddy
-      run: |
-        go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
-        xcaddy version
     # GoReleaser will take care of publishing those artifacts into the release
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
+      uses: goreleaser/goreleaser-action@v5
       with:
         version: latest
         args: release --clean --timeout 60m

.github/workflows/release_published.yml

@@ -5,9 +5,6 @@ on:
   release:
     types: [published]
 
-permissions:
-  contents: read
-
 jobs:
   release:
     name: Release Published
@@ -16,20 +13,12 @@ jobs:
         os: 
           - ubuntu-latest
     runs-on: ${{ matrix.os }}
-    permissions:
-      contents: read
-      pull-requests: read
-      actions: write
+
     steps:
 
     # See https://github.com/peter-evans/repository-dispatch
-    - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
-      with:
-        egress-policy: audit
-
     - name: Trigger event on caddyserver/dist
-      uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+      uses: peter-evans/repository-dispatch@v3
       with:
         token: ${{ secrets.REPO_DISPATCH_TOKEN }}
         repository: caddyserver/dist
@@ -37,7 +26,7 @@ jobs:
         client-payload: '{"tag": "${{ github.event.release.tag_name }}"}'
 
     - name: Trigger event on caddyserver/caddy-docker
-      uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+      uses: peter-evans/repository-dispatch@v3
       with:
         token: ${{ secrets.REPO_DISPATCH_TOKEN }}
         repository: caddyserver/caddy-docker

.github/workflows/scorecard.yml

@@ -1,86 +0,0 @@
-# This workflow uses actions that are not certified by GitHub. They are provided
-# by a third-party and are governed by separate terms of service, privacy
-# policy, and support documentation.
-
-name: OpenSSF Scorecard supply-chain security
-on:
-  # For Branch-Protection check. Only the default branch is supported. See
-  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
-  branch_protection_rule:
-  # To guarantee Maintained check is occasionally updated. See
-  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
-  schedule:
-    - cron: '20 2 * * 5'
-  push:
-    branches: [ "master", "2.*" ]
-  pull_request:
-    branches: [ "master", "2.*" ]
-
-
-# Declare default permissions as read only.
-permissions: read-all
-
-jobs:
-  analysis:
-    name: Scorecard analysis
-    runs-on: ubuntu-latest
-    # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
-    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
-    permissions:
-      # Needed to upload the results to code-scanning dashboard.
-      security-events: write
-      # Needed to publish results and get a badge (see publish_results below).
-      id-token: write
-      # Uncomment the permissions below if installing in a private repository.
-      # contents: read
-      # actions: read
-
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
-        with:
-          egress-policy: audit
-
-      - name: "Checkout code"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: "Run analysis"
-        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
-          # - you want to enable the Branch-Protection check on a *public* repository, or
-          # - you are installing Scorecard on a *private* repository
-          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
-          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
-
-          # Public repositories:
-          #   - Publish results to OpenSSF REST API for easy access by consumers
-          #   - Allows the repository to include the Scorecard badge.
-          #   - See https://github.com/ossf/scorecard-action#publishing-results.
-          # For private repositories:
-          #   - `publish_results` will always be set to `false`, regardless
-          #     of the value entered here.
-          publish_results: true
-
-          # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
-          # file_mode: git
-
-      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
-      # format to the repository Actions tab.
-      - name: "Upload artifact"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: SARIF file
-          path: results.sarif
-          retention-days: 5
-
-      # Upload the results to GitHub's code scanning dashboard (optional).
-      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
-      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
-        with:
-          sarif_file: results.sarif

.golangci.yml

@@ -1,19 +1,25 @@
-version: "2"
-run:
-  issues-exit-code: 1
-  tests: false
-  build-tags:
-    - nobadger
-    - nomysql
-    - nopgx
-output:
-  formats:
-    text:
-      path: stdout
-      print-linter-name: true
-      print-issued-lines: true
+linters-settings:
+  errcheck:
+    ignore: fmt:.*,go.uber.org/zap/zapcore:^Add.*
+    ignoretests: true
+  gci:
+    sections:
+      - standard # Standard section: captures all standard packages.
+      - default # Default section: contains all imports that could not be matched to another section type.
+      - prefix(github.com/caddyserver/caddy/v2/cmd) # ensure that this is always at the top and always has a line break.
+      - prefix(github.com/caddyserver/caddy) # Custom section: groups all imports with the specified Prefix.
+    # Skip generated files.
+    # Default: true
+    skip-generated: true
+    # Enable custom order of sections.
+    # If `true`, make the section order the same as the order of `sections`.
+    # Default: false
+    custom-order: true
+  exhaustive:
+    ignore-enum-types: reflect.Kind|svc.Cmd
+
 linters:
-  default: none
+  disable-all: true
   enable:
     - asasalint
     - asciicheck
@@ -27,96 +33,136 @@ linters:
     - errcheck
     - errname
     - exhaustive
+    - exportloopref
+    - gci
+    - gofmt
+    - goimports
+    - gofumpt
     - gosec
+    - gosimple
     - govet
-    - importas
     - ineffassign
+    - importas
     - misspell
     - prealloc
     - promlinter
     - sloglint
     - sqlclosecheck
     - staticcheck
+    - tenv
     - testableexamples
     - testifylint
     - tparallel
+    - typecheck
     - unconvert
     - unused
     - wastedassign
     - whitespace
     - zerologlint
-  settings:
-    staticcheck:
-      checks: ["all", "-ST1000", "-ST1003", "-ST1016", "-ST1020", "-ST1021", "-ST1022",  "-QF1006", "-QF1008"] # default, and exclude 1 more undesired check
-    errcheck:
-      exclude-functions:
-        - fmt.*
-        - (go.uber.org/zap/zapcore.ObjectEncoder).AddObject
-        - (go.uber.org/zap/zapcore.ObjectEncoder).AddArray
-    exhaustive:
-      ignore-enum-types: reflect.Kind|svc.Cmd
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    rules:
-      - linters:
-          - gosec
-        text: G115 # TODO: Either we should fix the issues or nuke the linter if it's bad
-      - linters:
-          - gosec
-        text: G107 # we aren't calling unknown URL
-      - linters:
-          - gosec
-        text: G203 # as a web server that's expected to handle any template, this is totally in the hands of the user.
-      - linters:
-          - gosec
-        text: G204 # we're shelling out to known commands, not relying on user-defined input.
-      - linters:
-          - gosec
-        # the choice of weakrand is deliberate, hence the named import "weakrand"
-        path: modules/caddyhttp/reverseproxy/selectionpolicies.go
-        text: G404
-      - linters:
-          - gosec
-        path: modules/caddyhttp/reverseproxy/streaming.go
-        text: G404
-      - linters:
-          - dupl
-        path: modules/logging/filters.go
-      - linters:
-          - dupl
-        path: modules/caddyhttp/matchers.go
-      - linters:
-          - dupl
-        path: modules/caddyhttp/vars.go
-      - linters:
-          - errcheck
-        path: _test\.go
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
-formatters:
-  enable:
-    - gci
-    - gofmt
-    - gofumpt
-    - goimports
-  settings:
-    gci:
-      sections:
-        - standard # Standard section: captures all standard packages.
-        - default # Default section: contains all imports that could not be matched to another section type.
-        - prefix(github.com/caddyserver/caddy/v2/cmd) # ensure that this is always at the top and always has a line break.
-        - prefix(github.com/caddyserver/caddy) # Custom section: groups all imports with the specified Prefix.
-      custom-order: true
-  exclusions:
-    generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+  # these are implicitly disabled:
+  # - containedctx
+  # - contextcheck
+  # - cyclop
+  # - depguard
+  # - errchkjson
+  # - errorlint
+  # - exhaustruct
+  # - execinquery
+  # - exhaustruct
+  # - forbidigo
+  # - forcetypeassert
+  # - funlen
+  # - ginkgolinter
+  # - gocheckcompilerdirectives
+  # - gochecknoglobals
+  # - gochecknoinits
+  # - gochecksumtype
+  # - gocognit
+  # - goconst
+  # - gocritic
+  # - gocyclo
+  # - godot
+  # - godox
+  # - goerr113
+  # - goheader
+  # - gomnd
+  # - gomoddirectives
+  # - gomodguard
+  # - goprintffuncname
+  # - gosmopolitan
+  # - grouper
+  # - inamedparam
+  # - interfacebloat
+  # - ireturn
+  # - lll
+  # - loggercheck
+  # - maintidx
+  # - makezero
+  # - mirror
+  # - musttag
+  # - nakedret
+  # - nestif
+  # - nilerr
+  # - nilnil
+  # - nlreturn
+  # - noctx
+  # - nolintlint
+  # - nonamedreturns
+  # - nosprintfhostport
+  # - paralleltest
+  # - perfsprint
+  # - predeclared
+  # - protogetter
+  # - reassign
+  # - revive
+  # - rowserrcheck
+  # - stylecheck
+  # - tagalign
+  # - tagliatelle
+  # - testpackage
+  # - thelper
+  # - unparam
+  # - usestdlibvars
+  # - varnamelen
+  # - wrapcheck
+  # - wsl
+
+run:
+  # default concurrency is a available CPU number.
+  # concurrency: 4 # explicitly omit this value to fully utilize available resources.
+  deadline: 5m
+  issues-exit-code: 1
+  tests: false
+
+# output configuration options
+output:
+  format: 'colored-line-number'
+  print-issued-lines: true
+  print-linter-name: true
+
+issues:
+  exclude-rules:
+    # we aren't calling unknown URL
+    - text: 'G107' # G107: Url provided to HTTP request as taint input
+      linters:
+        - gosec
+    # as a web server that's expected to handle any template, this is totally in the hands of the user.
+    - text: 'G203' # G203: Use of unescaped data in HTML templates
+      linters:
+        - gosec
+    # we're shelling out to known commands, not relying on user-defined input.
+    - text: 'G204' # G204: Audit use of command execution
+      linters:
+        - gosec
+    # the choice of weakrand is deliberate, hence the named import "weakrand"
+    - path: modules/caddyhttp/reverseproxy/selectionpolicies.go
+      text: 'G404' # G404: Insecure random number source (rand)
+      linters:
+        - gosec
+    - path: modules/caddyhttp/reverseproxy/streaming.go
+      text: 'G404' # G404: Insecure random number source (rand)
+      linters:
+        - gosec
+    - path: modules/logging/filters.go
+      linters:
+        - dupl

.goreleaser.yml

@@ -1,5 +1,3 @@
-version: 2
-
 before:
   hooks:
     # The build is done in this particular way to build Caddy in a designated directory named in .gitignore.
@@ -12,9 +10,6 @@ before:
     - mkdir -p caddy-build
     - cp cmd/caddy/main.go caddy-build/main.go
     - /bin/sh -c 'cd ./caddy-build && go mod init caddy'
-    # prepare syso files for windows embedding
-    - /bin/sh -c 'for a in amd64 arm arm64; do XCADDY_SKIP_BUILD=1 GOOS=windows GOARCH=$a xcaddy build {{.Env.TAG}}; done'
-    - /bin/sh -c 'mv /tmp/buildenv_*/*.syso caddy-build'
     # GoReleaser doesn't seem to offer {{.Tag}} at this stage, so we have to embed it into the env
     # so we run: TAG=$(git describe --abbrev=0) goreleaser release --rm-dist --skip-publish --skip-validate
     - go mod edit -require=github.com/caddyserver/caddy/v2@{{.Env.TAG}} ./caddy-build/go.mod
@@ -34,6 +29,7 @@ builds:
 - env:
   - CGO_ENABLED=0
   - GO111MODULE=on
+  main: main.go
   dir: ./caddy-build
   binary: caddy
   goos:
@@ -83,8 +79,6 @@ builds:
   - -s -w
   tags:
   - nobadger
-  - nomysql
-  - nopgx
 
 signs:
   - cmd: cosign
@@ -111,7 +105,7 @@ archives:
   - id: default
     format_overrides:
       - goos: windows
-        formats: zip
+        format: zip
     name_template: >-
       {{ .ProjectName }}_
       {{- .Version }}_
@@ -192,9 +186,6 @@ nfpms:
       preremove: ./caddy-dist/scripts/preremove.sh
       postremove: ./caddy-dist/scripts/postremove.sh
 
-    provides:
-      - httpd
-
 release:
   github:
     owner: caddyserver

.pre-commit-config.yaml

@@ -1,20 +0,0 @@
-repos:
-- repo: https://github.com/gitleaks/gitleaks
-  rev: v8.16.3
-  hooks:
-  - id: gitleaks
-- repo: https://github.com/golangci/golangci-lint
-  rev: v1.52.2
-  hooks:
-  - id: golangci-lint-config-verify
-  - id: golangci-lint
-  - id: golangci-lint-fmt
-- repo: https://github.com/jumanjihouse/pre-commit-hooks
-  rev: 3.0.0
-  hooks:
-  - id: shellcheck
-- repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.4.0
-  hooks:
-  - id: end-of-file-fixer
-  - id: trailing-whitespace

README.md

@@ -14,10 +14,9 @@
 <p align="center">Caddy is an extensible server platform that uses TLS by default.</p>
 <p align="center">
 	<a href="https://github.com/caddyserver/caddy/actions/workflows/ci.yml"><img src="https://github.com/caddyserver/caddy/actions/workflows/ci.yml/badge.svg"></a>
-	<a href="https://www.bestpractices.dev/projects/7141"><img src="https://www.bestpractices.dev/projects/7141/badge"></a>
 	<a href="https://pkg.go.dev/github.com/caddyserver/caddy/v2"><img src="https://img.shields.io/badge/godoc-reference-%23007d9c.svg"></a>
 	<br>
-	<a href="https://x.com/caddyserver" title="@caddyserver on Twitter"><img src="https://img.shields.io/twitter/follow/caddyserver" alt="@caddyserver on Twitter"></a>
+	<a href="https://twitter.com/caddyserver" title="@caddyserver on Twitter"><img src="https://img.shields.io/badge/twitter-@caddyserver-55acee.svg" alt="@caddyserver on Twitter"></a>
 	<a href="https://caddy.community" title="Caddy Forum"><img src="https://img.shields.io/badge/community-forum-ff69b4.svg" alt="Caddy Forum"></a>
 	<br>
 	<a href="https://sourcegraph.com/github.com/caddyserver/caddy?badge" title="Caddy on Sourcegraph"><img src="https://sourcegraph.com/github.com/caddyserver/caddy/-/badge.svg" alt="Caddy on Sourcegraph"></a>
@@ -68,7 +67,6 @@
 	- Fully-managed local CA for internal names & IPs
 	- Can coordinate with other Caddy instances in a cluster
 	- Multi-issuer fallback
-	- Encrypted ClientHello (ECH) support
 - **Stays up when other servers go down** due to TLS/OCSP/certificate-related issues
 - **Production-ready** after serving trillions of requests and managing millions of TLS certificates
 - **Scales to hundreds of thousands of sites** as proven in production
@@ -89,7 +87,7 @@ See [our online documentation](https://caddyserver.com/docs/install) for other i
 
 Requirements:
 
-- [Go 1.25.0 or newer](https://golang.org/dl/)
+- [Go 1.21 or newer](https://golang.org/dl/)
 
 ### For development
 
@@ -133,7 +131,7 @@ $ xcaddy build
 4. Initialize a Go module: `go mod init caddy`
 5. (Optional) Pin Caddy version: `go get github.com/caddyserver/caddy/v2@version` replacing `version` with a git tag, commit, or branch name.
 6. (Optional) Add plugins by adding their import: `_ "import/path/here"`
-7. Compile: `go build -tags=nobadger,nomysql,nopgx`
+7. Compile: `go build`
 
 
 
@@ -178,7 +176,7 @@ The docs are also open source. You can contribute to them here: https://github.c
 
 ## Getting help
 
-- We advise companies using Caddy to secure a support contract through [Ardan Labs](https://www.ardanlabs.com) before help is needed.
+- We advise companies using Caddy to secure a support contract through [Ardan Labs](https://www.ardanlabs.com/my/contact-us?dd=caddy) before help is needed.
 
 - A [sponsorship](https://github.com/sponsors/mholt) goes a long way! We can offer private help to sponsors. If Caddy is benefitting your company, please consider a sponsorship. This not only helps fund full-time work to ensure the longevity of the project, it provides your company the resources, support, and discounts you need; along with being a great look for your company to your customers and potential customers!
 
@@ -194,8 +192,8 @@ Matthew Holt began developing Caddy in 2014 while studying computer science at B
 
 **The name "Caddy" is trademarked.** The name of the software is "Caddy", not "Caddy Server" or "CaddyServer". Please call it "Caddy" or, if you wish to clarify, "the Caddy web server". Caddy is a registered trademark of Stack Holdings GmbH.
 
-- _Project on X: [@caddyserver](https://x.com/caddyserver)_
-- _Author on X: [@mholt6](https://x.com/mholt6)_
+- _Project on Twitter: [@caddyserver](https://twitter.com/caddyserver)_
+- _Author on Twitter: [@mholt6](https://twitter.com/mholt6)_
 
 Caddy is a project of [ZeroSSL](https://zerossl.com), a Stack Holdings company.
 

admin.go

@@ -34,7 +34,6 @@ import (
 	"os"
 	"path"
 	"regexp"
-	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -214,15 +213,14 @@ type AdminPermissions struct {
 
 // newAdminHandler reads admin's config and returns an http.Handler suitable
 // for use in an admin endpoint server, which will be listening on listenAddr.
-func (admin *AdminConfig) newAdminHandler(addr NetworkAddress, remote bool, _ Context) adminHandler {
+func (admin *AdminConfig) newAdminHandler(addr NetworkAddress, remote bool) adminHandler {
 	muxWrap := adminHandler{mux: http.NewServeMux()}
 
 	// secure the local or remote endpoint respectively
 	if remote {
 		muxWrap.remoteControl = admin.Remote
 	} else {
-		// see comment in allowedOrigins() as to why we disable the host check for unix/fd networks
-		muxWrap.enforceHost = !addr.isWildcardInterface() && !addr.IsUnixNetwork() && !addr.IsFdNetwork()
+		muxWrap.enforceHost = !addr.isWildcardInterface()
 		muxWrap.allowedOrigins = admin.allowedOrigins(addr)
 		muxWrap.enforceOrigin = admin.EnforceOrigin
 	}
@@ -271,6 +269,7 @@ func (admin *AdminConfig) newAdminHandler(addr NetworkAddress, remote bool, _ Co
 	// register third-party module endpoints
 	for _, m := range GetModules("admin.api") {
 		router := m.New().(AdminRouter)
+		handlerLabel := m.ID.Name()
 		for _, route := range router.Routes() {
 			addRoute(route.Pattern, handlerLabel, route.Handler)
 		}
@@ -311,43 +310,47 @@ func (admin AdminConfig) allowedOrigins(addr NetworkAddress) []*url.URL {
 	for _, o := range admin.Origins {
 		uniqueOrigins[o] = struct{}{}
 	}
-	// RFC 2616, Section 14.26:
-	// "A client MUST include a Host header field in all HTTP/1.1 request
-	// messages. If the requested URI does not include an Internet host
-	// name for the service being requested, then the Host header field MUST
-	// be given with an empty value."
-	//
-	// UPDATE July 2023: Go broke this by patching a minor security bug in 1.20.6.
-	// Understandable, but frustrating. See:
-	// https://github.com/golang/go/issues/60374
-	// See also the discussion here:
-	// https://github.com/golang/go/issues/61431
-	//
-	// We can no longer conform to RFC 2616 Section 14.26 from either Go or curl
-	// in purity. (Curl allowed no host between 7.40 and 7.50, but now requires a
-	// bogus host; see https://superuser.com/a/925610.) If we disable Host/Origin
-	// security checks, the infosec community assures me that it is secure to do
-	// so, because:
-	//
-	// 1) Browsers do not allow access to unix sockets
-	// 2) DNS is irrelevant to unix sockets
-	//
-	// If either of those two statements ever fail to hold true, it is not the
-	// fault of Caddy.
-	//
-	// Thus, we do not fill out allowed origins and do not enforce Host
-	// requirements for unix sockets. Enforcing it leads to confusion and
-	// frustration, when UDS have their own permissions from the OS.
-	// Enforcing host requirements here is effectively security theater,
-	// and a false sense of security.
-	//
-	// See also the discussion in #6832.
-	if admin.Origins == nil && !addr.IsUnixNetwork() && !addr.IsFdNetwork() {
+	if admin.Origins == nil {
 		if addr.isLoopback() {
-			uniqueOrigins[net.JoinHostPort("localhost", addr.port())] = struct{}{}
-			uniqueOrigins[net.JoinHostPort("::1", addr.port())] = struct{}{}
-			uniqueOrigins[net.JoinHostPort("127.0.0.1", addr.port())] = struct{}{}
-		} else {
+			if addr.IsUnixNetwork() {
+				// RFC 2616, Section 14.26:
+				// "A client MUST include a Host header field in all HTTP/1.1 request
+				// messages. If the requested URI does not include an Internet host
+				// name for the service being requested, then the Host header field MUST
+				// be given with an empty value."
+				//
+				// UPDATE July 2023: Go broke this by patching a minor security bug in 1.20.6.
+				// Understandable, but frustrating. See:
+				// https://github.com/golang/go/issues/60374
+				// See also the discussion here:
+				// https://github.com/golang/go/issues/61431
+				//
+				// We can no longer conform to RFC 2616 Section 14.26 from either Go or curl
+				// in purity. (Curl allowed no host between 7.40 and 7.50, but now requires a
+				// bogus host; see https://superuser.com/a/925610.) If we disable Host/Origin
+				// security checks, the infosec community assures me that it is secure to do
+				// so, because:
+				// 1) Browsers do not allow access to unix sockets
+				// 2) DNS is irrelevant to unix sockets
+				//
+				// I am not quite ready to trust either of those external factors, so instead
+				// of disabling Host/Origin checks, we now allow specific Host values when
+				// accessing the admin endpoint over unix sockets. I definitely don't trust
+				// DNS (e.g. I don't trust 'localhost' to always resolve to the local host),
+				// and IP shouldn't even be used, but if it is for some reason, I think we can
+				// at least be reasonably assured that 127.0.0.1 and ::1 route to the local
+				// machine, meaning that a hypothetical browser origin would have to be on the
+				// local machine as well.
+				uniqueOrigins[""] = struct{}{}
+				uniqueOrigins["127.0.0.1"] = struct{}{}
+				uniqueOrigins["::1"] = struct{}{}
+			} else {
+				uniqueOrigins[net.JoinHostPort("localhost", addr.port())] = struct{}{}
+				uniqueOrigins[net.JoinHostPort("::1", addr.port())] = struct{}{}
+				uniqueOrigins[net.JoinHostPort("127.0.0.1", addr.port())] = struct{}{}
+			}
+		}
+		if !addr.IsUnixNetwork() {
 			uniqueOrigins[addr.JoinHostPort(0)] = struct{}{}
 		}
 	}
@@ -378,9 +381,7 @@ func (admin AdminConfig) allowedOrigins(addr NetworkAddress) []*url.URL {
 // for the admin endpoint exists in cfg, a default one is used, so
 // that there is always an admin server (unless it is explicitly
 // configured to be disabled).
-// Critically note that some elements and functionality of the context
-// may not be ready, e.g. storage. Tread carefully.
-func replaceLocalAdminServer(cfg *Config, ctx Context) error {
+func replaceLocalAdminServer(cfg *Config) error {
 	// always* be sure to close down the old admin endpoint
 	// as gracefully as possible, even if the new one is
 	// disabled -- careful to use reference to the current
@@ -422,14 +423,7 @@ func replaceLocalAdminServer(cfg *Config, ctx Context) error {
 		return err
 	}
 
-	handler := cfg.Admin.newAdminHandler(addr, false, ctx)
-
-	// run the provisioners for loaded modules to make sure local
-	// state is properly re-initialized in the new admin server
-	err = cfg.Admin.provisionAdminRouters(ctx)
-	if err != nil {
-		return err
-	}
+	handler := cfg.Admin.newAdminHandler(addr, false)
 
 	ln, err := addr.Listen(context.TODO(), 0, net.ListenConfig{})
 	if err != nil {
@@ -550,14 +544,7 @@ func replaceRemoteAdminServer(ctx Context, cfg *Config) error {
 
 	// make the HTTP handler but disable Host/Origin enforcement
 	// because we are using TLS authentication instead
-	handler := cfg.Admin.newAdminHandler(addr, true, ctx)
-
-	// run the provisioners for loaded modules to make sure local
-	// state is properly re-initialized in the new admin server
-	err = cfg.Admin.provisionAdminRouters(ctx)
-	if err != nil {
-		return err
-	}
+	handler := cfg.Admin.newAdminHandler(addr, true)
 
 	// create client certificate pool for TLS mutual auth, and extract public keys
 	// so that we can enforce access controls at the application layer
@@ -688,7 +675,13 @@ func (remote RemoteAdmin) enforceAccessControls(r *http.Request) error {
 					// key recognized; make sure its HTTP request is permitted
 					for _, accessPerm := range adminAccess.Permissions {
 						// verify method
-						methodFound := accessPerm.Methods == nil || slices.Contains(accessPerm.Methods, r.Method)
+						methodFound := accessPerm.Methods == nil
+						for _, method := range accessPerm.Methods {
+							if method == r.Method {
+								methodFound = true
+								break
+							}
+						}
 						if !methodFound {
 							return APIError{
 								HTTPStatus: http.StatusForbidden,
@@ -884,9 +877,13 @@ func (h adminHandler) handleError(w http.ResponseWriter, r *http.Request, err er
 // a trustworthy/expected value. This helps to mitigate DNS
 // rebinding attacks.
 func (h adminHandler) checkHost(r *http.Request) error {
-	allowed := slices.ContainsFunc(h.allowedOrigins, func(u *url.URL) bool {
-		return r.Host == u.Host
-	})
+	var allowed bool
+	for _, allowedOrigin := range h.allowedOrigins {
+		if r.Host == allowedOrigin.Host {
+			allowed = true
+			break
+		}
+	}
 	if !allowed {
 		return APIError{
 			HTTPStatus: http.StatusForbidden,
@@ -946,7 +943,7 @@ func (h adminHandler) originAllowed(origin *url.URL) bool {
 	return false
 }
 
-// etagHasher returns the hasher we used on the config to both
+// etagHasher returns a the hasher we used on the config to both
 // produce and verify ETags.
 func etagHasher() hash.Hash { return xxhash.New() }
 
@@ -1150,7 +1147,7 @@ traverseLoop:
 						return fmt.Errorf("[%s] invalid array index '%s': %v",
 							path, idxStr, err)
 					}
-					if idx < 0 || (method != http.MethodPut && idx >= len(arr)) || idx > len(arr) {
+					if idx < 0 || idx >= len(arr) {
 						return fmt.Errorf("[%s] array index out of bounds: %s", path, idxStr)
 					}
 				}

admin_test.go

@@ -15,20 +15,12 @@
 package caddy
 
 import (
-	"context"
-	"crypto/x509"
 	"encoding/json"
 	"fmt"
-	"maps"
 	"net/http"
-	"net/http/httptest"
 	"reflect"
 	"sync"
 	"testing"
-
-	"github.com/caddyserver/certmagic"
-	"github.com/prometheus/client_golang/prometheus"
-	dto "github.com/prometheus/client_model/go"
 )
 
 var testCfg = []byte(`{
@@ -207,723 +199,7 @@ func TestETags(t *testing.T) {
 }
 
 func BenchmarkLoad(b *testing.B) {
-	for b.Loop() {
+	for i := 0; i < b.N; i++ {
 		Load(testCfg, true)
 	}
 }
-
-func TestAdminHandlerErrorHandling(t *testing.T) {
-	initAdminMetrics()
-
-	handler := adminHandler{
-		mux: http.NewServeMux(),
-	}
-
-	handler.mux.Handle("/error", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		err := fmt.Errorf("test error")
-		handler.handleError(w, r, err)
-	}))
-
-	req := httptest.NewRequest(http.MethodGet, "/error", nil)
-	rr := httptest.NewRecorder()
-
-	handler.ServeHTTP(rr, req)
-
-	if rr.Code == http.StatusOK {
-		t.Error("expected error response, got success")
-	}
-
-	var apiErr APIError
-	if err := json.NewDecoder(rr.Body).Decode(&apiErr); err != nil {
-		t.Fatalf("decoding response: %v", err)
-	}
-	if apiErr.Message != "test error" {
-		t.Errorf("expected error message 'test error', got '%s'", apiErr.Message)
-	}
-}
-
-func initAdminMetrics() {
-	if adminMetrics.requestErrors != nil {
-		prometheus.Unregister(adminMetrics.requestErrors)
-	}
-	if adminMetrics.requestCount != nil {
-		prometheus.Unregister(adminMetrics.requestCount)
-	}
-
-	adminMetrics.requestErrors = prometheus.NewCounterVec(prometheus.CounterOpts{
-		Namespace: "caddy",
-		Subsystem: "admin_http",
-		Name:      "request_errors_total",
-		Help:      "Number of errors that occurred handling admin endpoint requests",
-	}, []string{"handler", "path", "method"})
-
-	adminMetrics.requestCount = prometheus.NewCounterVec(prometheus.CounterOpts{
-		Namespace: "caddy",
-		Subsystem: "admin_http",
-		Name:      "requests_total",
-		Help:      "Count of requests to the admin endpoint",
-	}, []string{"handler", "path", "code", "method"}) // Added code and method labels
-
-	prometheus.MustRegister(adminMetrics.requestErrors)
-	prometheus.MustRegister(adminMetrics.requestCount)
-}
-
-func TestAdminHandlerBuiltinRouteErrors(t *testing.T) {
-	initAdminMetrics()
-
-	cfg := &Config{
-		Admin: &AdminConfig{
-			Listen: "localhost:2019",
-		},
-	}
-
-	err := replaceLocalAdminServer(cfg, Context{})
-	if err != nil {
-		t.Fatalf("setting up admin server: %v", err)
-	}
-	defer func() {
-		stopAdminServer(localAdminServer)
-	}()
-
-	tests := []struct {
-		name           string
-		path           string
-		method         string
-		expectedStatus int
-	}{
-		{
-			name:           "stop endpoint wrong method",
-			path:           "/stop",
-			method:         http.MethodGet,
-			expectedStatus: http.StatusMethodNotAllowed,
-		},
-		{
-			name:           "config endpoint wrong content-type",
-			path:           "/config/",
-			method:         http.MethodPost,
-			expectedStatus: http.StatusBadRequest,
-		},
-		{
-			name:           "config ID missing ID",
-			path:           "/id/",
-			method:         http.MethodGet,
-			expectedStatus: http.StatusBadRequest,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			req := httptest.NewRequest(test.method, fmt.Sprintf("http://localhost:2019%s", test.path), nil)
-			rr := httptest.NewRecorder()
-
-			localAdminServer.Handler.ServeHTTP(rr, req)
-
-			if rr.Code != test.expectedStatus {
-				t.Errorf("expected status %d but got %d", test.expectedStatus, rr.Code)
-			}
-
-			metricValue := testGetMetricValue(map[string]string{
-				"path":    test.path,
-				"handler": "admin",
-				"method":  test.method,
-			})
-			if metricValue != 1 {
-				t.Errorf("expected error metric to be incremented once, got %v", metricValue)
-			}
-		})
-	}
-}
-
-func testGetMetricValue(labels map[string]string) float64 {
-	promLabels := prometheus.Labels{}
-	maps.Copy(promLabels, labels)
-
-	metric, err := adminMetrics.requestErrors.GetMetricWith(promLabels)
-	if err != nil {
-		return 0
-	}
-
-	pb := &dto.Metric{}
-	metric.Write(pb)
-	return pb.GetCounter().GetValue()
-}
-
-type mockRouter struct {
-	routes []AdminRoute
-}
-
-func (m mockRouter) Routes() []AdminRoute {
-	return m.routes
-}
-
-type mockModule struct {
-	mockRouter
-}
-
-func (m *mockModule) CaddyModule() ModuleInfo {
-	return ModuleInfo{
-		ID: "admin.api.mock",
-		New: func() Module {
-			mm := &mockModule{
-				mockRouter: mockRouter{
-					routes: m.routes,
-				},
-			}
-			return mm
-		},
-	}
-}
-
-func TestNewAdminHandlerRouterRegistration(t *testing.T) {
-	originalModules := make(map[string]ModuleInfo)
-	maps.Copy(originalModules, modules)
-	defer func() {
-		modules = originalModules
-	}()
-
-	mockRoute := AdminRoute{
-		Pattern: "/mock",
-		Handler: AdminHandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
-			w.WriteHeader(http.StatusOK)
-			return nil
-		}),
-	}
-
-	mock := &mockModule{
-		mockRouter: mockRouter{
-			routes: []AdminRoute{mockRoute},
-		},
-	}
-	RegisterModule(mock)
-
-	addr, err := ParseNetworkAddress("localhost:2019")
-	if err != nil {
-		t.Fatalf("Failed to parse address: %v", err)
-	}
-
-	admin := &AdminConfig{
-		EnforceOrigin: false,
-	}
-	handler := admin.newAdminHandler(addr, false, Context{})
-
-	req := httptest.NewRequest("GET", "/mock", nil)
-	req.Host = "localhost:2019"
-	rr := httptest.NewRecorder()
-
-	handler.ServeHTTP(rr, req)
-
-	if rr.Code != http.StatusOK {
-		t.Errorf("Expected status code %d but got %d", http.StatusOK, rr.Code)
-		t.Logf("Response body: %s", rr.Body.String())
-	}
-
-	if len(admin.routers) != 1 {
-		t.Errorf("Expected 1 router to be stored, got %d", len(admin.routers))
-	}
-}
-
-type mockProvisionableRouter struct {
-	mockRouter
-	provisionErr error
-	provisioned  bool
-}
-
-func (m *mockProvisionableRouter) Provision(Context) error {
-	m.provisioned = true
-	return m.provisionErr
-}
-
-type mockProvisionableModule struct {
-	*mockProvisionableRouter
-}
-
-func (m *mockProvisionableModule) CaddyModule() ModuleInfo {
-	return ModuleInfo{
-		ID: "admin.api.mock_provision",
-		New: func() Module {
-			mm := &mockProvisionableModule{
-				mockProvisionableRouter: &mockProvisionableRouter{
-					mockRouter:   m.mockRouter,
-					provisionErr: m.provisionErr,
-				},
-			}
-			return mm
-		},
-	}
-}
-
-func TestAdminRouterProvisioning(t *testing.T) {
-	tests := []struct {
-		name         string
-		provisionErr error
-		wantErr      bool
-		routersAfter int // expected number of routers after provisioning
-	}{
-		{
-			name:         "successful provisioning",
-			provisionErr: nil,
-			wantErr:      false,
-			routersAfter: 0,
-		},
-		{
-			name:         "provisioning error",
-			provisionErr: fmt.Errorf("provision failed"),
-			wantErr:      true,
-			routersAfter: 1,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			originalModules := make(map[string]ModuleInfo)
-			maps.Copy(originalModules, modules)
-			defer func() {
-				modules = originalModules
-			}()
-
-			mockRoute := AdminRoute{
-				Pattern: "/mock",
-				Handler: AdminHandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
-					return nil
-				}),
-			}
-
-			// Create provisionable module
-			mock := &mockProvisionableModule{
-				mockProvisionableRouter: &mockProvisionableRouter{
-					mockRouter: mockRouter{
-						routes: []AdminRoute{mockRoute},
-					},
-					provisionErr: test.provisionErr,
-				},
-			}
-			RegisterModule(mock)
-
-			admin := &AdminConfig{}
-			addr, err := ParseNetworkAddress("localhost:2019")
-			if err != nil {
-				t.Fatalf("Failed to parse address: %v", err)
-			}
-
-			_ = admin.newAdminHandler(addr, false, Context{})
-			err = admin.provisionAdminRouters(Context{})
-
-			if test.wantErr {
-				if err == nil {
-					t.Error("Expected error but got nil")
-				}
-			} else {
-				if err != nil {
-					t.Errorf("Expected no error but got: %v", err)
-				}
-			}
-
-			if len(admin.routers) != test.routersAfter {
-				t.Errorf("Expected %d routers after provisioning, got %d", test.routersAfter, len(admin.routers))
-			}
-		})
-	}
-}
-
-func TestAllowedOriginsUnixSocket(t *testing.T) {
-	// see comment in allowedOrigins() as to why we do not fill out allowed origins for UDS
-	tests := []struct {
-		name          string
-		addr          NetworkAddress
-		origins       []string
-		expectOrigins []string
-	}{
-		{
-			name: "unix socket with default origins",
-			addr: NetworkAddress{
-				Network: "unix",
-				Host:    "/tmp/caddy.sock",
-			},
-			origins:       nil, // default origins
-			expectOrigins: []string{},
-		},
-		{
-			name: "unix socket with custom origins",
-			addr: NetworkAddress{
-				Network: "unix",
-				Host:    "/tmp/caddy.sock",
-			},
-			origins: []string{"example.com"},
-			expectOrigins: []string{
-				"example.com",
-			},
-		},
-		{
-			name: "tcp socket on localhost gets all loopback addresses",
-			addr: NetworkAddress{
-				Network:   "tcp",
-				Host:      "localhost",
-				StartPort: 2019,
-				EndPort:   2019,
-			},
-			origins: nil,
-			expectOrigins: []string{
-				"localhost:2019",
-				"[::1]:2019",
-				"127.0.0.1:2019",
-			},
-		},
-	}
-
-	for i, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			admin := AdminConfig{
-				Origins: test.origins,
-			}
-
-			got := admin.allowedOrigins(test.addr)
-
-			var gotOrigins []string
-			for _, u := range got {
-				gotOrigins = append(gotOrigins, u.Host)
-			}
-
-			if len(gotOrigins) != len(test.expectOrigins) {
-				t.Errorf("%d: Expected %d origins but got %d", i, len(test.expectOrigins), len(gotOrigins))
-				return
-			}
-
-			expectMap := make(map[string]struct{})
-			for _, origin := range test.expectOrigins {
-				expectMap[origin] = struct{}{}
-			}
-
-			gotMap := make(map[string]struct{})
-			for _, origin := range gotOrigins {
-				gotMap[origin] = struct{}{}
-			}
-
-			if !reflect.DeepEqual(expectMap, gotMap) {
-				t.Errorf("%d: Origins mismatch.\nExpected: %v\nGot: %v", i, test.expectOrigins, gotOrigins)
-			}
-		})
-	}
-}
-
-func TestReplaceRemoteAdminServer(t *testing.T) {
-	const testCert = `MIIDCTCCAfGgAwIBAgIUXsqJ1mY8pKlHQtI3HJ23x2eZPqwwDQYJKoZIhvcNAQEL
-BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTIzMDEwMTAwMDAwMFoXDTI0MDEw
-MTAwMDAwMFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEA4O4S6BSoYcoxvRqI+h7yPOjF6KjntjzVVm9M+uHK4lzX
-F1L3pSxJ2nDD4wZEV3FJ5yFOHVFqkG2vXG3BIczOlYG7UeNmKbQnKc5kZj3HGUrS
-VGEktA4OJbeZhhWP15gcXN5eDM2eH3g9BFXVX6AURxLiUXzhNBUEZuj/OEyH9yEF
-/qPCE+EjzVvWxvBXwgz/io4r4yok/Vq/bxJ6FlV6R7DX5oJSXyO0VEHZPi9DIyNU
-kK3F/r4U1sWiJGWOs8i3YQWZ2ejh1C0aLFZpPcCGGgMNpoF31gyYP6ZuPDUyCXsE
-g36UUw1JHNtIXYcLhnXuqj4A8TybTDpgXLqvwA9DBQIDAQABo1MwUTAdBgNVHQ4E
-FgQUc13z30pFC63rr/HGKOE7E82vjXwwHwYDVR0jBBgwFoAUc13z30pFC63rr/HG
-KOE7E82vjXwwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAHO3j
-oeiUXXJ7xD4P8Wj5t9d+E8lE1Xv1Dk3Z+EdG5+dan+RcToE42JJp9zB7FIh5Qz8g
-W77LAjqh5oyqz3A2VJcyVgfE3uJP1R1mJM7JfGHf84QH4TZF2Q1RZY4SZs0VQ6+q
-5wSlIZ4NXDy4Q4XkIJBGS61wT8IzYFXYBpx4PCP1Qj0PIE4sevEGwjsBIgxK307o
-BxF8AWe6N6e4YZmQLGjQ+SeH0iwZb6vpkHyAY8Kj2hvK+cq2P7vU3VGi0t3r1F8L
-IvrXHCvO2BMNJ/1UK1M4YNX8LYJqQhg9hEsIROe1OE/m3VhxIYMJI+qZXk9yHfgJ
-vq+SH04xKhtFudVBAQ==`
-
-	tests := []struct {
-		name    string
-		cfg     *Config
-		wantErr bool
-	}{
-		{
-			name:    "nil config",
-			cfg:     nil,
-			wantErr: false,
-		},
-		{
-			name: "nil admin config",
-			cfg: &Config{
-				Admin: nil,
-			},
-			wantErr: false,
-		},
-		{
-			name: "nil remote config",
-			cfg: &Config{
-				Admin: &AdminConfig{},
-			},
-			wantErr: false,
-		},
-		{
-			name: "invalid listen address",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Remote: &RemoteAdmin{
-						Listen: "invalid:address",
-					},
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name: "valid config",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{},
-					Remote: &RemoteAdmin{
-						Listen: "localhost:2021",
-						AccessControl: []*AdminAccess{
-							{
-								PublicKeys:  []string{testCert},
-								Permissions: []AdminPermissions{{Methods: []string{"GET"}, Paths: []string{"/test"}}},
-							},
-						},
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "invalid certificate",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{},
-					Remote: &RemoteAdmin{
-						Listen: "localhost:2021",
-						AccessControl: []*AdminAccess{
-							{
-								PublicKeys:  []string{"invalid-cert-data"},
-								Permissions: []AdminPermissions{{Methods: []string{"GET"}, Paths: []string{"/test"}}},
-							},
-						},
-					},
-				},
-			},
-			wantErr: true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			ctx := Context{
-				Context: context.Background(),
-				cfg:     test.cfg,
-			}
-
-			if test.cfg != nil {
-				test.cfg.storage = &certmagic.FileStorage{Path: t.TempDir()}
-			}
-
-			if test.cfg != nil && test.cfg.Admin != nil && test.cfg.Admin.Identity != nil {
-				identityCertCache = certmagic.NewCache(certmagic.CacheOptions{
-					GetConfigForCert: func(certmagic.Certificate) (*certmagic.Config, error) {
-						return &certmagic.Config{}, nil
-					},
-				})
-			}
-
-			err := replaceRemoteAdminServer(ctx, test.cfg)
-
-			if test.wantErr {
-				if err == nil {
-					t.Error("Expected error but got nil")
-				}
-			} else {
-				if err != nil {
-					t.Errorf("Expected no error but got: %v", err)
-				}
-			}
-
-			// Clean up
-			if remoteAdminServer != nil {
-				_ = stopAdminServer(remoteAdminServer)
-			}
-		})
-	}
-}
-
-type mockIssuer struct {
-	configSet *certmagic.Config
-}
-
-func (m *mockIssuer) Issue(ctx context.Context, csr *x509.CertificateRequest) (*certmagic.IssuedCertificate, error) {
-	return &certmagic.IssuedCertificate{
-		Certificate: []byte(csr.Raw),
-	}, nil
-}
-
-func (m *mockIssuer) SetConfig(cfg *certmagic.Config) {
-	m.configSet = cfg
-}
-
-func (m *mockIssuer) IssuerKey() string {
-	return "mock"
-}
-
-type mockIssuerModule struct {
-	*mockIssuer
-}
-
-func (m *mockIssuerModule) CaddyModule() ModuleInfo {
-	return ModuleInfo{
-		ID: "tls.issuance.acme",
-		New: func() Module {
-			return &mockIssuerModule{mockIssuer: new(mockIssuer)}
-		},
-	}
-}
-
-func TestManageIdentity(t *testing.T) {
-	originalModules := make(map[string]ModuleInfo)
-	maps.Copy(originalModules, modules)
-	defer func() {
-		modules = originalModules
-	}()
-
-	RegisterModule(&mockIssuerModule{})
-
-	certPEM := []byte(`-----BEGIN CERTIFICATE-----
-MIIDujCCAqKgAwIBAgIIE31FZVaPXTUwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE
-BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
-cm5ldCBBdXRob3JpdHkgRzIwHhcNMTQwMTI5MTMyNzQzWhcNMTQwNTI5MDAwMDAw
-WjBpMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
-TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEYMBYGA1UEAwwPbWFp
-bC5nb29nbGUuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3lcub2pUwkjC
-5GJQA2ZZfJJi6d1QHhEmkX9VxKYGp6gagZuRqJWy9TXP6++1ZzQQxqZLD0TkuxZ9
-8i9Nz00000CCBjCCAQQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGgG
-CCsGAQUFBwEBBFwwWjArBggrBgEFBQcwAoYfaHR0cDovL3BraS5nb29nbGUuY29t
-L0dJQUcyLmNydDArBggrBgEFBQcwAYYfaHR0cDovL2NsaWVudHMxLmdvb2dsZS5j
-b20vb2NzcDAdBgNVHQ4EFgQUiJxtimAuTfwb+aUtBn5UYKreKvMwDAYDVR0TAQH/
-BAIwADAfBgNVHSMEGDAWgBRK3QYWG7z2aLV29YG2u2IaulqBLzAXBgNVHREEEDAO
-ggxtYWlsLmdvb2dsZTANBgkqhkiG9w0BAQUFAAOCAQEAMP6IWgNGZE8wP9TjFjSZ
-3mmW3A1eIr0CuPwNZ2LJ5ZD1i70ojzcj4I9IdP5yPg9CAEV4hNASbM1LzfC7GmJE
-tPzW5tRmpKVWZGRgTgZI8Hp/xZXMwLh9ZmXV4kESFAGj5G5FNvJyUV7R5Eh+7OZX
-7G4jJ4ZGJh+5jzN9HdJJHQHGYNIYOzC7+HH9UMwCjX9vhQ4RjwFZJThS2Yb+y7pb
-9yxTJZoXC6J0H5JpnZb7kZEJ+Xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
------END CERTIFICATE-----`)
-
-	keyPEM := []byte(`-----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRS0LmTwUT0iwP
-...
------END PRIVATE KEY-----`)
-
-	testStorage := certmagic.FileStorage{Path: t.TempDir()}
-	err := testStorage.Store(context.Background(), "localhost/localhost.crt", certPEM)
-	if err != nil {
-		t.Fatal(err)
-	}
-	err = testStorage.Store(context.Background(), "localhost/localhost.key", keyPEM)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	tests := []struct {
-		name       string
-		cfg        *Config
-		wantErr    bool
-		checkState func(*testing.T, *Config)
-	}{
-		{
-			name: "nil config",
-			cfg:  nil,
-		},
-		{
-			name: "nil admin config",
-			cfg: &Config{
-				Admin: nil,
-			},
-		},
-		{
-			name: "nil identity config",
-			cfg: &Config{
-				Admin: &AdminConfig{},
-			},
-		},
-		{
-			name: "default issuer when none specified",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{
-						Identifiers: []string{"localhost"},
-					},
-				},
-				storage: &testStorage,
-			},
-			checkState: func(t *testing.T, cfg *Config) {
-				if len(cfg.Admin.Identity.issuers) == 0 {
-					t.Error("Expected at least 1 issuer to be configured")
-					return
-				}
-				if _, ok := cfg.Admin.Identity.issuers[0].(*mockIssuerModule); !ok {
-					t.Error("Expected mock issuer to be configured")
-				}
-			},
-		},
-		{
-			name: "custom issuer",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{
-						Identifiers: []string{"localhost"},
-						IssuersRaw: []json.RawMessage{
-							json.RawMessage(`{"module": "acme"}`),
-						},
-					},
-				},
-				storage: &certmagic.FileStorage{Path: "testdata"},
-			},
-			checkState: func(t *testing.T, cfg *Config) {
-				if len(cfg.Admin.Identity.issuers) != 1 {
-					t.Fatalf("Expected 1 issuer, got %d", len(cfg.Admin.Identity.issuers))
-				}
-				mockIss, ok := cfg.Admin.Identity.issuers[0].(*mockIssuerModule)
-				if !ok {
-					t.Fatal("Expected mock issuer")
-				}
-				if mockIss.configSet == nil {
-					t.Error("Issuer config was not set")
-				}
-			},
-		},
-		{
-			name: "invalid issuer module",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{
-						Identifiers: []string{"localhost"},
-						IssuersRaw: []json.RawMessage{
-							json.RawMessage(`{"module": "doesnt_exist"}`),
-						},
-					},
-				},
-			},
-			wantErr: true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			if identityCertCache != nil {
-				// Reset the cert cache before each test
-				identityCertCache.Stop()
-				identityCertCache = nil
-			}
-
-			ctx := Context{
-				Context:         context.Background(),
-				cfg:             test.cfg,
-				moduleInstances: make(map[string][]Module),
-			}
-
-			err := manageIdentity(ctx, test.cfg)
-
-			if test.wantErr {
-				if err == nil {
-					t.Error("Expected error but got nil")
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("Expected no error but got: %v", err)
-			}
-
-			if test.checkState != nil {
-				test.checkState(t, test.cfg)
-			}
-		})
-	}
-}

caddy.go

@@ -81,17 +81,13 @@ type Config struct {
 	// associated value.
 	AppsRaw ModuleMap `json:"apps,omitempty" caddy:"namespace="`
 
-	apps map[string]App
-
-	// failedApps is a map of apps that failed to provision with their underlying error.
-	failedApps   map[string]error
-	storage      certmagic.Storage
-	eventEmitter eventEmitter
+	apps    map[string]App
+	storage certmagic.Storage
 
 	cancelFunc context.CancelFunc
 
-	// fileSystems is a dict of fileSystems that will later be loaded from and added to.
-	fileSystems FileSystems
+	// filesystems is a dict of filesystems that will later be loaded from and added to.
+	filesystems FileSystems
 }
 
 // App is a thing that Caddy runs.
@@ -401,78 +397,6 @@ func unsyncedDecodeAndRun(cfgJSON []byte, allowPersist bool) error {
 // will want to use Run instead, which also
 // updates the config's raw state.
 func run(newCfg *Config, start bool) (Context, error) {
-	ctx, err := provisionContext(newCfg, start)
-	if err != nil {
-		globalMetrics.configSuccess.Set(0)
-		return ctx, err
-	}
-
-	if !start {
-		return ctx, nil
-	}
-
-	defer func() {
-		// if newCfg fails to start completely, clean up the already provisioned modules
-		// partially copied from provisionContext
-		if err != nil {
-			globalMetrics.configSuccess.Set(0)
-			ctx.cfg.cancelFunc()
-
-			if currentCtx.cfg != nil {
-				certmagic.Default.Storage = currentCtx.cfg.storage
-			}
-		}
-	}()
-
-	// Provision any admin routers which may need to access
-	// some of the other apps at runtime
-	err = ctx.cfg.Admin.provisionAdminRouters(ctx)
-	if err != nil {
-		return ctx, err
-	}
-
-	// Start
-	err = func() error {
-		started := make([]string, 0, len(ctx.cfg.apps))
-		for name, a := range ctx.cfg.apps {
-			err := a.Start()
-			if err != nil {
-				// an app failed to start, so we need to stop
-				// all other apps that were already started
-				for _, otherAppName := range started {
-					err2 := ctx.cfg.apps[otherAppName].Stop()
-					if err2 != nil {
-						err = fmt.Errorf("%v; additionally, aborting app %s: %v",
-							err, otherAppName, err2)
-					}
-				}
-				return fmt.Errorf("%s app module: start: %v", name, err)
-			}
-			started = append(started, name)
-		}
-		return nil
-	}()
-	if err != nil {
-		return ctx, err
-	}
-	globalMetrics.configSuccess.Set(1)
-	globalMetrics.configSuccessTime.SetToCurrentTime()
-
-	// TODO: This event is experimental and subject to change.
-	ctx.emitEvent("started", nil)
-
-	// now that the user's config is running, finish setting up anything else,
-	// such as remote admin endpoint, config loader, etc.
-	err = finishSettingUp(ctx, ctx.cfg)
-	return ctx, err
-}
-
-// provisionContext creates a new context from the given configuration and provisions
-// storage and apps.
-// If `newCfg` is nil a new empty configuration will be created.
-// If `replaceAdminServer` is true any currently active admin server will be replaced
-// with a new admin server based on the provided configuration.
-func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error) {
 	// because we will need to roll back any state
 	// modifications if this function errors, we
 	// keep a single error value and scope all
@@ -495,7 +419,6 @@ func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error)
 	ctx, cancel := NewContext(Context{Context: context.Background(), cfg: newCfg})
 	defer func() {
 		if err != nil {
-			globalMetrics.configSuccess.Set(0)
 			// if there were any errors during startup,
 			// we should cancel the new context we created
 			// since the associated config won't be used;
@@ -520,12 +443,19 @@ func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error)
 		return ctx, err
 	}
 
+	// start the admin endpoint (and stop any prior one)
+	if start {
+		err = replaceLocalAdminServer(newCfg)
+		if err != nil {
+			return ctx, fmt.Errorf("starting caddy administration endpoint: %v", err)
+		}
+	}
+
 	// create the new filesystem map
-	newCfg.fileSystems = &filesystems.FileSystemMap{}
+	newCfg.filesystems = &filesystems.FilesystemMap{}
 
 	// prepare the new config for use
 	newCfg.apps = make(map[string]App)
-	newCfg.failedApps = make(map[string]error)
 
 	// set up global storage and make it CertMagic's default storage, too
 	err = func() error {
@@ -552,14 +482,6 @@ func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error)
 		return ctx, err
 	}
 
-	// start the admin endpoint (and stop any prior one)
-	if replaceAdminServer {
-		err = replaceLocalAdminServer(newCfg, ctx)
-		if err != nil {
-			return ctx, fmt.Errorf("starting caddy administration endpoint: %v", err)
-		}
-	}
-
 	// Load and Provision each app and their submodules
 	err = func() error {
 		for appName := range newCfg.AppsRaw {
@@ -569,16 +491,49 @@ func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error)
 		}
 		return nil
 	}()
-	return ctx, err
-}
+	if err != nil {
+		return ctx, err
+	}
 
-// ProvisionContext creates a new context from the configuration and provisions storage
-// and app modules.
-// The function is intended for testing and advanced use cases only, typically `Run` should be
-// use to ensure a fully functional caddy instance.
-// EXPERIMENTAL: While this is public the interface and implementation details of this function may change.
-func ProvisionContext(newCfg *Config) (Context, error) {
-	return provisionContext(newCfg, false)
+	if !start {
+		return ctx, nil
+	}
+
+	// Provision any admin routers which may need to access
+	// some of the other apps at runtime
+	err = newCfg.Admin.provisionAdminRouters(ctx)
+	if err != nil {
+		return ctx, err
+	}
+
+	// Start
+	err = func() error {
+		started := make([]string, 0, len(newCfg.apps))
+		for name, a := range newCfg.apps {
+			err := a.Start()
+			if err != nil {
+				// an app failed to start, so we need to stop
+				// all other apps that were already started
+				for _, otherAppName := range started {
+					err2 := newCfg.apps[otherAppName].Stop()
+					if err2 != nil {
+						err = fmt.Errorf("%v; additionally, aborting app %s: %v",
+							err, otherAppName, err2)
+					}
+				}
+				return fmt.Errorf("%s app module: start: %v", name, err)
+			}
+			started = append(started, name)
+		}
+		return nil
+	}()
+	if err != nil {
+		return ctx, err
+	}
+
+	// now that the user's config is running, finish setting up anything else,
+	// such as remote admin endpoint, config loader, etc.
+	return ctx, finishSettingUp(ctx, newCfg)
 }
 
 // finishSettingUp should be run after all apps have successfully started.
@@ -717,9 +672,6 @@ func unsyncedStop(ctx Context) {
 		return
 	}
 
-	// TODO: This event is experimental and subject to change.
-	ctx.emitEvent("stopping", nil)
-
 	// stop each app
 	for name, a := range ctx.cfg.apps {
 		err := a.Stop()
@@ -749,10 +701,8 @@ func Validate(cfg *Config) error {
 // Errors are logged along the way, and an appropriate exit
 // code is emitted.
 func exitProcess(ctx context.Context, logger *zap.Logger) {
-	// let the rest of the program know we're quitting; only do it once
-	if !atomic.CompareAndSwapInt32(exiting, 0, 1) {
-		return
-	}
+	// let the rest of the program know we're quitting
+	atomic.StoreInt32(exiting, 1)
 
 	// give the OS or service/process manager our 2 weeks' notice: we quit
 	if err := notify.Stopping(); err != nil {
@@ -919,7 +869,7 @@ func InstanceID() (uuid.UUID, error) {
 		if err != nil {
 			return uuid, err
 		}
-		err = os.MkdirAll(appDataDir, 0o700)
+		err = os.MkdirAll(appDataDir, 0o600)
 		if err != nil {
 			return uuid, err
 		}
@@ -1062,98 +1012,6 @@ func Version() (simple, full string) {
 	return
 }
 
-// Event represents something that has happened or is happening.
-// An Event value is not synchronized, so it should be copied if
-// being used in goroutines.
-//
-// EXPERIMENTAL: Events are subject to change.
-type Event struct {
-	// If non-nil, the event has been aborted, meaning
-	// propagation has stopped to other handlers and
-	// the code should stop what it was doing. Emitters
-	// may choose to use this as a signal to adjust their
-	// code path appropriately.
-	Aborted error
-
-	// The data associated with the event. Usually the
-	// original emitter will be the only one to set or
-	// change these values, but the field is exported
-	// so handlers can have full access if needed.
-	// However, this map is not synchronized, so
-	// handlers must not use this map directly in new
-	// goroutines; instead, copy the map to use it in a
-	// goroutine. Data may be nil.
-	Data map[string]any
-
-	id     uuid.UUID
-	ts     time.Time
-	name   string
-	origin Module
-}
-
-// NewEvent creates a new event, but does not emit the event. To emit an
-// event, call Emit() on the current instance of the caddyevents app insteaad.
-//
-// EXPERIMENTAL: Subject to change.
-func NewEvent(ctx Context, name string, data map[string]any) (Event, error) {
-	id, err := uuid.NewRandom()
-	if err != nil {
-		return Event{}, fmt.Errorf("generating new event ID: %v", err)
-	}
-	name = strings.ToLower(name)
-	return Event{
-		Data:   data,
-		id:     id,
-		ts:     time.Now(),
-		name:   name,
-		origin: ctx.Module(),
-	}, nil
-}
-
-func (e Event) ID() uuid.UUID        { return e.id }
-func (e Event) Timestamp() time.Time { return e.ts }
-func (e Event) Name() string         { return e.name }
-func (e Event) Origin() Module       { return e.origin } // Returns the module that originated the event. May be nil, usually if caddy core emits the event.
-
-// CloudEvent exports event e as a structure that, when
-// serialized as JSON, is compatible with the
-// CloudEvents spec.
-func (e Event) CloudEvent() CloudEvent {
-	dataJSON, _ := json.Marshal(e.Data)
-	var source string
-	if e.Origin() == nil {
-		source = "caddy"
-	} else {
-		source = string(e.Origin().CaddyModule().ID)
-	}
-	return CloudEvent{
-		ID:              e.id.String(),
-		Source:          source,
-		SpecVersion:     "1.0",
-		Type:            e.name,
-		Time:            e.ts,
-		DataContentType: "application/json",
-		Data:            dataJSON,
-	}
-}
-
-// CloudEvent is a JSON-serializable structure that
-// is compatible with the CloudEvents specification.
-// See https://cloudevents.io.
-// EXPERIMENTAL: Subject to change.
-type CloudEvent struct {
-	ID              string          `json:"id"`
-	Source          string          `json:"source"`
-	SpecVersion     string          `json:"specversion"`
-	Type            string          `json:"type"`
-	Time            time.Time       `json:"time"`
-	DataContentType string          `json:"datacontenttype,omitempty"`
-	Data            json.RawMessage `json:"data,omitempty"`
-}
-
-// ErrEventAborted cancels an event.
-var ErrEventAborted = errors.New("event aborted")
-
 // ActiveContext returns the currently-active context.
 // This function is experimental and might be changed
 // or removed in the future.

caddy_test.go

@@ -15,7 +15,6 @@
 package caddy
 
 import (
-	"context"
 	"testing"
 	"time"
 )
@@ -73,21 +72,3 @@ func TestParseDuration(t *testing.T) {
 		}
 	}
 }
-
-func TestEvent_CloudEvent_NilOrigin(t *testing.T) {
-	ctx, _ := NewContext(Context{Context: context.Background()}) // module will be nil by default
-	event, err := NewEvent(ctx, "started", nil)
-	if err != nil {
-		t.Fatalf("NewEvent() error = %v", err)
-	}
-
-	// This should not panic
-	ce := event.CloudEvent()
-
-	if ce.Source != "caddy" {
-		t.Errorf("Expected CloudEvent Source to be 'caddy', got '%s'", ce.Source)
-	}
-	if ce.Type != "started" {
-		t.Errorf("Expected CloudEvent Type to be 'started', got '%s'", ce.Type)
-	}
-}

caddyconfig/caddyfile/adapter.go

@@ -68,7 +68,7 @@ func (a Adapter) Adapt(body []byte, options map[string]any) ([]byte, []caddyconf
 // TODO: also perform this check on imported files
 func FormattingDifference(filename string, body []byte) (caddyconfig.Warning, bool) {
 	// replace windows-style newlines to normalize comparison
-	normalizedBody := bytes.ReplaceAll(body, []byte("\r\n"), []byte("\n"))
+	normalizedBody := bytes.Replace(body, []byte("\r\n"), []byte("\n"), -1)
 
 	formatted := Format(normalizedBody)
 	if bytes.Equal(formatted, normalizedBody) {

caddyconfig/caddyfile/dispenser.go

@@ -308,9 +308,9 @@ func (d *Dispenser) CountRemainingArgs() int {
 }
 
 // RemainingArgs loads any more arguments (tokens on the same line)
-// into a slice of strings and returns them. Open curly brace tokens
-// also indicate the end of arguments, and the curly brace is not
-// included in the return value nor is it loaded.
+// into a slice and returns them. Open curly brace tokens also indicate
+// the end of arguments, and the curly brace is not included in
+// the return value nor is it loaded.
 func (d *Dispenser) RemainingArgs() []string {
 	var args []string
 	for d.NextArg() {
@@ -320,9 +320,9 @@ func (d *Dispenser) RemainingArgs() []string {
 }
 
 // RemainingArgsRaw loads any more arguments (tokens on the same line,
-// retaining quotes) into a slice of strings and returns them.
-// Open curly brace tokens also indicate the end of arguments,
-// and the curly brace is not included in the return value nor is it loaded.
+// retaining quotes) into a slice and returns them. Open curly brace
+// tokens also indicate the end of arguments, and the curly brace is
+// not included in the return value nor is it loaded.
 func (d *Dispenser) RemainingArgsRaw() []string {
 	var args []string
 	for d.NextArg() {
@@ -331,18 +331,6 @@ func (d *Dispenser) RemainingArgsRaw() []string {
 	return args
 }
 
-// RemainingArgsAsTokens loads any more arguments (tokens on the same line)
-// into a slice of Token-structs and returns them. Open curly brace tokens
-// also indicate the end of arguments, and the curly brace is not included
-// in the return value nor is it loaded.
-func (d *Dispenser) RemainingArgsAsTokens() []Token {
-	var args []Token
-	for d.NextArg() {
-		args = append(args, d.Token())
-	}
-	return args
-}
-
 // NewFromNextSegment returns a new dispenser with a copy of
 // the tokens from the current token until the end of the
 // "directive" whether that be to the end of the line or
@@ -427,7 +415,7 @@ func (d *Dispenser) EOFErr() error {
 
 // Err generates a custom parse-time error with a message of msg.
 func (d *Dispenser) Err(msg string) error {
-	return d.WrapErr(errors.New(msg))
+	return d.Errf(msg)
 }
 
 // Errf is like Err, but for formatted error messages

caddyconfig/caddyfile/dispenser_test.go

@@ -274,66 +274,6 @@ func TestDispenser_RemainingArgs(t *testing.T) {
 	}
 }
 
-func TestDispenser_RemainingArgsAsTokens(t *testing.T) {
-	input := `dir1 arg1 arg2 arg3
-			  dir2 arg4 arg5
-			  dir3 arg6 { arg7
-			  dir4`
-	d := NewTestDispenser(input)
-
-	d.Next() // dir1
-
-	args := d.RemainingArgsAsTokens()
-
-	tokenTexts := make([]string, 0, len(args))
-	for _, arg := range args {
-		tokenTexts = append(tokenTexts, arg.Text)
-	}
-
-	if expected := []string{"arg1", "arg2", "arg3"}; !reflect.DeepEqual(tokenTexts, expected) {
-		t.Errorf("RemainingArgsAsTokens(): Expected %v, got %v", expected, tokenTexts)
-	}
-
-	d.Next() // dir2
-
-	args = d.RemainingArgsAsTokens()
-
-	tokenTexts = tokenTexts[:0]
-	for _, arg := range args {
-		tokenTexts = append(tokenTexts, arg.Text)
-	}
-
-	if expected := []string{"arg4", "arg5"}; !reflect.DeepEqual(tokenTexts, expected) {
-		t.Errorf("RemainingArgsAsTokens(): Expected %v, got %v", expected, tokenTexts)
-	}
-
-	d.Next() // dir3
-
-	args = d.RemainingArgsAsTokens()
-	tokenTexts = tokenTexts[:0]
-	for _, arg := range args {
-		tokenTexts = append(tokenTexts, arg.Text)
-	}
-
-	if expected := []string{"arg6"}; !reflect.DeepEqual(tokenTexts, expected) {
-		t.Errorf("RemainingArgsAsTokens(): Expected %v, got %v", expected, tokenTexts)
-	}
-
-	d.Next() // {
-	d.Next() // arg7
-	d.Next() // dir4
-
-	args = d.RemainingArgsAsTokens()
-	tokenTexts = tokenTexts[:0]
-	for _, arg := range args {
-		tokenTexts = append(tokenTexts, arg.Text)
-	}
-
-	if len(args) != 0 {
-		t.Errorf("RemainingArgsAsTokens(): Expected %v, got %v", []string{}, tokenTexts)
-	}
-}
-
 func TestDispenser_ArgErr_Err(t *testing.T) {
 	input := `dir1 {
 			  }

caddyconfig/caddyfile/formatter.go

@@ -61,8 +61,7 @@ func Format(input []byte) []byte {
 		heredocMarker        []rune
 		heredocClosingMarker []rune
 
-		nesting         int // indentation level
-		withinBackquote bool
+		nesting int // indentation level
 	)
 
 	write := func(ch rune) {
@@ -89,12 +88,9 @@ func Format(input []byte) []byte {
 			}
 			panic(err)
 		}
-		if ch == '`' {
-			withinBackquote = !withinBackquote
-		}
 
 		// detect whether we have the start of a heredoc
-		if !quoted && (heredoc == heredocClosed && !heredocEscaped) &&
+		if !quoted && !(heredoc != heredocClosed || heredocEscaped) &&
 			space && last == '<' && ch == '<' {
 			write(ch)
 			heredoc = heredocOpening
@@ -224,7 +220,7 @@ func Format(input []byte) []byte {
 			openBrace = false
 			if beginningOfLine {
 				indent()
-			} else if !openBraceSpace || !unicode.IsSpace(last) {
+			} else if !openBraceSpace {
 				write(' ')
 			}
 			write('{')
@@ -240,23 +236,14 @@ func Format(input []byte) []byte {
 		switch {
 		case ch == '{':
 			openBrace = true
-			openBraceSpace = spacePrior && !beginningOfLine
-			if openBraceSpace && newLines == 0 {
-				write(' ')
-			}
 			openBraceWritten = false
-			if withinBackquote {
-				write('{')
-				openBraceWritten = true
-				continue
+			openBraceSpace = spacePrior && !beginningOfLine
+			if openBraceSpace {
+				write(' ')
 			}
 			continue
 
 		case ch == '}' && (spacePrior || !openBrace):
-			if withinBackquote {
-				write('}')
-				continue
-			}
 			if last != '\n' {
 				nextLine()
 			}

caddyconfig/caddyfile/formatter_test.go

@@ -432,31 +432,6 @@ block2 {
 	heredoc \<<HEREDOC
 	respond "More than one space will be eaten" 200
 }
-`,
-		},
-		{
-			description: "Preserve braces wrapped by backquotes",
-			input:       "block {respond `All braces should remain: {{now | date \"2006\"}}`}",
-			expect:      "block {respond `All braces should remain: {{now | date \"2006\"}}`}",
-		},
-		{
-			description: "Preserve braces wrapped by quotes",
-			input:       "block {respond \"All braces should remain: {{now | date `2006`}}\"}",
-			expect:      "block {respond \"All braces should remain: {{now | date `2006`}}\"}",
-		},
-		{
-			description: "No trailing space on line before env variable",
-			input: `{
-	a
-
-	{$ENV_VAR}
-}
-`,
-			expect: `{
-	a
-
-	{$ENV_VAR}
-}
 `,
 		},
 	} {

caddyconfig/caddyfile/importgraph.go

@@ -16,7 +16,6 @@ package caddyfile
 
 import (
 	"fmt"
-	"slices"
 )
 
 type adjacency map[string][]string
@@ -92,7 +91,12 @@ func (i *importGraph) areConnected(from, to string) bool {
 	if !ok {
 		return false
 	}
-	return slices.Contains(al, to)
+	for _, v := range al {
+		if v == to {
+			return true
+		}
+	}
+	return false
 }
 
 func (i *importGraph) willCycle(from, to string) bool {

caddyconfig/caddyfile/lexer.go

@@ -137,7 +137,7 @@ func (l *lexer) next() (bool, error) {
 		}
 
 		// detect whether we have the start of a heredoc
-		if (!quoted && !btQuoted) && (!inHeredoc && !heredocEscaped) &&
+		if !(quoted || btQuoted) && !(inHeredoc || heredocEscaped) &&
 			len(val) > 1 && string(val[:2]) == "<<" {
 			// a space means it's just a regular token and not a heredoc
 			if ch == ' ' {
@@ -323,8 +323,7 @@ func (l *lexer) finalizeHeredoc(val []rune, marker string) ([]rune, error) {
 
 		// if the padding doesn't match exactly at the start then we can't safely strip
 		if index != 0 {
-			cleanLineText := strings.TrimRight(lineText, "\r\n")
-			return nil, fmt.Errorf("mismatched leading whitespace in heredoc <<%s on line #%d [%s], expected whitespace [%s] to match the closing marker", marker, l.line+lineNum+1, cleanLineText, paddingToStrip)
+			return nil, fmt.Errorf("mismatched leading whitespace in heredoc <<%s on line #%d [%s], expected whitespace [%s] to match the closing marker", marker, l.line+lineNum+1, lineText, paddingToStrip)
 		}
 
 		// strip, then append the line, with the newline, to the output.

caddyconfig/caddyfile/parse.go

@@ -214,12 +214,7 @@ func (p *parser) addresses() error {
 		value := p.Val()
 		token := p.Token()
 
-		// Reject request matchers if trying to define them globally
-		if strings.HasPrefix(value, "@") {
-			return p.Errf("request matchers may not be defined globally, they must be in a site block; found %s", value)
-		}
-
-		// Special case: import directive replaces tokens during parse-time
+		// special case: import directive replaces tokens during parse-time
 		if value == "import" && p.isNewLine() {
 			err := p.doImport(0)
 			if err != nil {
@@ -264,13 +259,8 @@ func (p *parser) addresses() error {
 				return p.Errf("Site addresses cannot contain a comma ',': '%s' - put a space after the comma to separate site addresses", value)
 			}
 
-			// After the above, a comma surrounded by spaces would result
-			// in an empty token which we should ignore
-			if value != "" {
-				// Add the token as a site address
-				token.Text = value
-				p.block.Keys = append(p.block.Keys, token)
-			}
+			token.Text = value
+			p.block.Keys = append(p.block.Keys, token)
 		}
 
 		// Advance token and possibly break out of loop or return error
@@ -369,40 +359,9 @@ func (p *parser) doImport(nesting int) error {
 	// set up a replacer for non-variadic args replacement
 	repl := makeArgsReplacer(args)
 
-	// grab all the tokens (if it exists) from within a block that follows the import
-	var blockTokens []Token
-	for currentNesting := p.Nesting(); p.NextBlock(currentNesting); {
-		blockTokens = append(blockTokens, p.Token())
-	}
-	// initialize with size 1
-	blockMapping := make(map[string][]Token, 1)
-	if len(blockTokens) > 0 {
-		// use such tokens to create a new dispenser, and then use it to parse each block
-		bd := NewDispenser(blockTokens)
-
-		// one iteration processes one sub-block inside the import
-		for bd.Next() {
-			currentMappingKey := bd.Val()
-
-			if currentMappingKey == "{" {
-				return p.Err("anonymous blocks are not supported")
-			}
-
-			// load up all arguments (if there even are any)
-			currentMappingTokens := bd.RemainingArgsAsTokens()
-
-			// load up the entire block
-			for mappingNesting := bd.Nesting(); bd.NextBlock(mappingNesting); {
-				currentMappingTokens = append(currentMappingTokens, bd.Token())
-			}
-
-			blockMapping[currentMappingKey] = currentMappingTokens
-		}
-	}
-
 	// splice out the import directive and its arguments
 	// (2 tokens, plus the length of args)
-	tokensBefore := p.tokens[:p.cursor-1-len(args)-len(blockTokens)]
+	tokensBefore := p.tokens[:p.cursor-1-len(args)]
 	tokensAfter := p.tokens[p.cursor+1:]
 	var importedTokens []Token
 	var nodes []string
@@ -418,7 +377,7 @@ func (p *parser) doImport(nesting int) error {
 		// make path relative to the file of the _token_ being processed rather
 		// than current working directory (issue #867) and then use glob to get
 		// list of matching filenames
-		absFile, err := caddy.FastAbs(p.Dispenser.File())
+		absFile, err := filepath.Abs(p.Dispenser.File())
 		if err != nil {
 			return p.Errf("Failed to get absolute path of file: %s: %v", p.Dispenser.File(), err)
 		}
@@ -531,33 +490,6 @@ func (p *parser) doImport(nesting int) error {
 				maybeSnippet = false
 			}
 		}
-		// if it is {block}, we substitute with all tokens in the block
-		// if it is {blocks.*}, we substitute with the tokens in the mapping for the *
-		var skip bool
-		var tokensToAdd []Token
-		switch {
-		case token.Text == "{block}":
-			tokensToAdd = blockTokens
-		case strings.HasPrefix(token.Text, "{blocks.") && strings.HasSuffix(token.Text, "}"):
-			// {blocks.foo.bar} will be extracted to key `foo.bar`
-			blockKey := strings.TrimPrefix(strings.TrimSuffix(token.Text, "}"), "{blocks.")
-			val, ok := blockMapping[blockKey]
-			if ok {
-				tokensToAdd = val
-			}
-		default:
-			skip = true
-		}
-		if !skip {
-			if len(tokensToAdd) == 0 {
-				// if there is no content in the snippet block, don't do any replacement
-				// this allows snippets which contained {block}/{block.*} before this change to continue functioning as normal
-				tokensCopy = append(tokensCopy, token)
-			} else {
-				tokensCopy = append(tokensCopy, tokensToAdd...)
-			}
-			continue
-		}
 
 		if maybeSnippet {
 			tokensCopy = append(tokensCopy, token)
@@ -579,7 +511,7 @@ func (p *parser) doImport(nesting int) error {
 	// splice the imported tokens in the place of the import statement
 	// and rewind cursor so Next() will land on first imported token
 	p.tokens = append(tokensBefore, append(tokensCopy, tokensAfter...)...)
-	p.cursor -= len(args) + len(blockTokens) + 1
+	p.cursor -= len(args) + 1
 
 	return nil
 }
@@ -617,7 +549,7 @@ func (p *parser) doSingleImport(importFile string) ([]Token, error) {
 
 	// Tack the file path onto these tokens so errors show the imported file's name
 	// (we use full, absolute path to avoid bugs: issue #1892)
-	filename, err := caddy.FastAbs(importFile)
+	filename, err := filepath.Abs(importFile)
 	if err != nil {
 		return nil, p.Errf("Failed to get absolute path of file: %s: %v", importFile, err)
 	}

caddyconfig/caddyfile/parse_test.go

@@ -18,7 +18,6 @@ import (
 	"bytes"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 )
 
@@ -556,10 +555,6 @@ func TestParseAll(t *testing.T) {
 			{"localhost:1234", "http://host2"},
 		}},
 
-		{`foo.example.com   ,   example.com`, false, [][]string{
-			{"foo.example.com", "example.com"},
-		}},
-
 		{`localhost:1234, http://host2,`, true, [][]string{}},
 
 		{`http://host1.com, http://host2.com {
@@ -619,8 +614,8 @@ func TestParseAll(t *testing.T) {
 		}
 		for j, block := range blocks {
 			if len(block.Keys) != len(test.keys[j]) {
-				t.Errorf("Test %d: Expected %d keys in block %d, got %d: %v",
-					i, len(test.keys[j]), j, len(block.Keys), block.Keys)
+				t.Errorf("Test %d: Expected %d keys in block %d, got %d",
+					i, len(test.keys[j]), j, len(block.Keys))
 				continue
 			}
 			for k, addr := range block.GetKeysText() {
@@ -862,74 +857,6 @@ func TestSnippetAcrossMultipleFiles(t *testing.T) {
 	}
 }
 
-func TestRejectsGlobalMatcher(t *testing.T) {
-	p := testParser(`
-		@rejected path /foo
-
-		(common) {
-			gzip foo
-			errors stderr
-		}
-
-		http://example.com {
-			import common
-		}
-	`)
-	_, err := p.parseAll()
-	if err == nil {
-		t.Fatal("Expected an error, but got nil")
-	}
-	expected := "request matchers may not be defined globally, they must be in a site block; found @rejected, at Testfile:2"
-	if err.Error() != expected {
-		t.Errorf("Expected error to be '%s' but got '%v'", expected, err)
-	}
-}
-
-func TestRejectAnonymousImportBlock(t *testing.T) {
-	p := testParser(`
-		(site) {
-			http://{args[0]} https://{args[0]} {
-				{block}
-			}
-		}
-
-		import site test.domain {
-			{ 
-				header_up Host {host}
-				header_up X-Real-IP {remote_host}
-			}
-		}
-	`)
-	_, err := p.parseAll()
-	if err == nil {
-		t.Fatal("Expected an error, but got nil")
-	}
-	expected := "anonymous blocks are not supported"
-	if !strings.HasPrefix(err.Error(), "anonymous blocks are not supported") {
-		t.Errorf("Expected error to start with '%s' but got '%v'", expected, err)
-	}
-}
-
-func TestAcceptSiteImportWithBraces(t *testing.T) {
-	p := testParser(`
-		(site) {
-			http://{args[0]} https://{args[0]} {
-				{block}
-			}
-		}
-
-		import site test.domain {
-			reverse_proxy http://192.168.1.1:8080 { 
-				header_up Host {host}
-			}
-		}
-	`)
-	_, err := p.parseAll()
-	if err != nil {
-		t.Errorf("Expected error to be nil but got '%v'", err)
-	}
-}
-
 func testParser(input string) parser {
 	return parser{Dispenser: NewTestDispenser(input)}
 }

caddyconfig/httpcaddyfile/addresses.go

@@ -31,7 +31,7 @@ import (
 	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
 )
 
-// mapAddressToProtocolToServerBlocks returns a map of listener address to list of server
+// mapAddressToServerBlocks returns a map of listener address to list of server
 // blocks that will be served on that address. To do this, each server block is
 // expanded so that each one is considered individually, although keys of a
 // server block that share the same address stay grouped together so the config
@@ -77,15 +77,10 @@ import (
 // repetition may be undesirable, so call consolidateAddrMappings() to map
 // multiple addresses to the same lists of server blocks (a many:many mapping).
 // (Doing this is essentially a map-reduce technique.)
-func (st *ServerType) mapAddressToProtocolToServerBlocks(originalServerBlocks []serverBlock,
+func (st *ServerType) mapAddressToServerBlocks(originalServerBlocks []serverBlock,
 	options map[string]any,
-) (map[string]map[string][]serverBlock, error) {
-	addrToProtocolToServerBlocks := map[string]map[string][]serverBlock{}
-
-	type keyWithParsedKey struct {
-		key       caddyfile.Token
-		parsedKey Address
-	}
+) (map[string][]serverBlock, error) {
+	sbmap := make(map[string][]serverBlock)
 
 	for i, sblock := range originalServerBlocks {
 		// within a server block, we need to map all the listener addresses
@@ -93,48 +88,27 @@ func (st *ServerType) mapAddressToProtocolToServerBlocks(originalServerBlocks []
 		// will be served by them; this has the effect of treating each
 		// key of a server block as its own, but without having to repeat its
 		// contents in cases where multiple keys really can be served together
-		addrToProtocolToKeyWithParsedKeys := map[string]map[string][]keyWithParsedKey{}
+		addrToKeys := make(map[string][]caddyfile.Token)
 		for j, key := range sblock.block.Keys {
-			parsedKey, err := ParseAddress(key.Text)
-			if err != nil {
-				return nil, fmt.Errorf("parsing key: %v", err)
-			}
-			parsedKey = parsedKey.Normalize()
-
 			// a key can have multiple listener addresses if there are multiple
 			// arguments to the 'bind' directive (although they will all have
 			// the same port, since the port is defined by the key or is implicit
 			// through automatic HTTPS)
-			listeners, err := st.listenersForServerBlockAddress(sblock, parsedKey, options)
+			addrs, err := st.listenerAddrsForServerBlockKey(sblock, key.Text, options)
 			if err != nil {
 				return nil, fmt.Errorf("server block %d, key %d (%s): determining listener address: %v", i, j, key.Text, err)
 			}
 
-			// associate this key with its protocols and each listener address served with them
-			kwpk := keyWithParsedKey{key, parsedKey}
-			for addr, protocols := range listeners {
-				protocolToKeyWithParsedKeys, ok := addrToProtocolToKeyWithParsedKeys[addr]
-				if !ok {
-					protocolToKeyWithParsedKeys = map[string][]keyWithParsedKey{}
-					addrToProtocolToKeyWithParsedKeys[addr] = protocolToKeyWithParsedKeys
-				}
-
-				// an empty protocol indicates the default, a nil or empty value in the ListenProtocols array
-				if len(protocols) == 0 {
-					protocols[""] = struct{}{}
-				}
-				for prot := range protocols {
-					protocolToKeyWithParsedKeys[prot] = append(
-						protocolToKeyWithParsedKeys[prot],
-						kwpk)
-				}
+			// associate this key with each listener address it is served on
+			for _, addr := range addrs {
+				addrToKeys[addr] = append(addrToKeys[addr], key)
 			}
 		}
 
 		// make a slice of the map keys so we can iterate in sorted order
-		addrs := make([]string, 0, len(addrToProtocolToKeyWithParsedKeys))
-		for addr := range addrToProtocolToKeyWithParsedKeys {
-			addrs = append(addrs, addr)
+		addrs := make([]string, 0, len(addrToKeys))
+		for k := range addrToKeys {
+			addrs = append(addrs, k)
 		}
 		sort.Strings(addrs)
 
@@ -144,132 +118,85 @@ func (st *ServerType) mapAddressToProtocolToServerBlocks(originalServerBlocks []
 		// server block are only the ones which use the address; but
 		// the contents (tokens) are of course the same
 		for _, addr := range addrs {
-			protocolToKeyWithParsedKeys := addrToProtocolToKeyWithParsedKeys[addr]
-
-			prots := make([]string, 0, len(protocolToKeyWithParsedKeys))
-			for prot := range protocolToKeyWithParsedKeys {
-				prots = append(prots, prot)
-			}
-			sort.Strings(prots)
-
-			protocolToServerBlocks, ok := addrToProtocolToServerBlocks[addr]
-			if !ok {
-				protocolToServerBlocks = map[string][]serverBlock{}
-				addrToProtocolToServerBlocks[addr] = protocolToServerBlocks
-			}
-
-			for _, prot := range prots {
-				keyWithParsedKeys := protocolToKeyWithParsedKeys[prot]
-
-				keys := make([]caddyfile.Token, len(keyWithParsedKeys))
-				parsedKeys := make([]Address, len(keyWithParsedKeys))
-
-				for k, keyWithParsedKey := range keyWithParsedKeys {
-					keys[k] = keyWithParsedKey.key
-					parsedKeys[k] = keyWithParsedKey.parsedKey
+			keys := addrToKeys[addr]
+			// parse keys so that we only have to do it once
+			parsedKeys := make([]Address, 0, len(keys))
+			for _, key := range keys {
+				addr, err := ParseAddress(key.Text)
+				if err != nil {
+					return nil, fmt.Errorf("parsing key '%s': %v", key.Text, err)
 				}
-
-				protocolToServerBlocks[prot] = append(protocolToServerBlocks[prot], serverBlock{
-					block: caddyfile.ServerBlock{
-						Keys:     keys,
-						Segments: sblock.block.Segments,
-					},
-					pile:       sblock.pile,
-					parsedKeys: parsedKeys,
-				})
+				parsedKeys = append(parsedKeys, addr.Normalize())
 			}
-		}
-	}
-
-	return addrToProtocolToServerBlocks, nil
-}
-
-// consolidateAddrMappings eliminates repetition of identical server blocks in a mapping of
-// single listener addresses to protocols to lists of server blocks. Since multiple addresses
-// may serve multiple protocols to identical sites (server block contents), this function turns
-// a 1:many mapping into a many:many mapping. Server block contents (tokens) must be
-// exactly identical so that reflect.DeepEqual returns true in order for the addresses to be combined.
-// Identical entries are deleted from the addrToServerBlocks map. Essentially, each pairing (each
-// association from multiple addresses to multiple server blocks; i.e. each element of
-// the returned slice) becomes a server definition in the output JSON.
-func (st *ServerType) consolidateAddrMappings(addrToProtocolToServerBlocks map[string]map[string][]serverBlock) []sbAddrAssociation {
-	sbaddrs := make([]sbAddrAssociation, 0, len(addrToProtocolToServerBlocks))
-
-	addrs := make([]string, 0, len(addrToProtocolToServerBlocks))
-	for addr := range addrToProtocolToServerBlocks {
-		addrs = append(addrs, addr)
-	}
-	sort.Strings(addrs)
-
-	for _, addr := range addrs {
-		protocolToServerBlocks := addrToProtocolToServerBlocks[addr]
-
-		prots := make([]string, 0, len(protocolToServerBlocks))
-		for prot := range protocolToServerBlocks {
-			prots = append(prots, prot)
-		}
-		sort.Strings(prots)
-
-		for _, prot := range prots {
-			serverBlocks := protocolToServerBlocks[prot]
-
-			// now find other addresses that map to identical
-			// server blocks and add them to our map of listener
-			// addresses and protocols, while removing them from
-			// the original map
-			listeners := map[string]map[string]struct{}{}
-
-			for otherAddr, otherProtocolToServerBlocks := range addrToProtocolToServerBlocks {
-				for otherProt, otherServerBlocks := range otherProtocolToServerBlocks {
-					if addr == otherAddr && prot == otherProt || reflect.DeepEqual(serverBlocks, otherServerBlocks) {
-						listener, ok := listeners[otherAddr]
-						if !ok {
-							listener = map[string]struct{}{}
-							listeners[otherAddr] = listener
-						}
-						listener[otherProt] = struct{}{}
-						delete(otherProtocolToServerBlocks, otherProt)
-					}
-				}
-			}
-
-			addresses := make([]string, 0, len(listeners))
-			for lnAddr := range listeners {
-				addresses = append(addresses, lnAddr)
-			}
-			sort.Strings(addresses)
-
-			addressesWithProtocols := make([]addressWithProtocols, 0, len(listeners))
-
-			for _, lnAddr := range addresses {
-				lnProts := listeners[lnAddr]
-				prots := make([]string, 0, len(lnProts))
-				for prot := range lnProts {
-					prots = append(prots, prot)
-				}
-				sort.Strings(prots)
-
-				addressesWithProtocols = append(addressesWithProtocols, addressWithProtocols{
-					address:   lnAddr,
-					protocols: prots,
-				})
-			}
-
-			sbaddrs = append(sbaddrs, sbAddrAssociation{
-				addressesWithProtocols: addressesWithProtocols,
-				serverBlocks:           serverBlocks,
+			sbmap[addr] = append(sbmap[addr], serverBlock{
+				block: caddyfile.ServerBlock{
+					Keys:     keys,
+					Segments: sblock.block.Segments,
+				},
+				pile: sblock.pile,
+				keys: parsedKeys,
 			})
 		}
 	}
 
+	return sbmap, nil
+}
+
+// consolidateAddrMappings eliminates repetition of identical server blocks in a mapping of
+// single listener addresses to lists of server blocks. Since multiple addresses may serve
+// identical sites (server block contents), this function turns a 1:many mapping into a
+// many:many mapping. Server block contents (tokens) must be exactly identical so that
+// reflect.DeepEqual returns true in order for the addresses to be combined. Identical
+// entries are deleted from the addrToServerBlocks map. Essentially, each pairing (each
+// association from multiple addresses to multiple server blocks; i.e. each element of
+// the returned slice) becomes a server definition in the output JSON.
+func (st *ServerType) consolidateAddrMappings(addrToServerBlocks map[string][]serverBlock) []sbAddrAssociation {
+	sbaddrs := make([]sbAddrAssociation, 0, len(addrToServerBlocks))
+	for addr, sblocks := range addrToServerBlocks {
+		// we start with knowing that at least this address
+		// maps to these server blocks
+		a := sbAddrAssociation{
+			addresses:    []string{addr},
+			serverBlocks: sblocks,
+		}
+
+		// now find other addresses that map to identical
+		// server blocks and add them to our list of
+		// addresses, while removing them from the map
+		for otherAddr, otherSblocks := range addrToServerBlocks {
+			if addr == otherAddr {
+				continue
+			}
+			if reflect.DeepEqual(sblocks, otherSblocks) {
+				a.addresses = append(a.addresses, otherAddr)
+				delete(addrToServerBlocks, otherAddr)
+			}
+		}
+		sort.Strings(a.addresses)
+
+		sbaddrs = append(sbaddrs, a)
+	}
+
+	// sort them by their first address (we know there will always be at least one)
+	// to avoid problems with non-deterministic ordering (makes tests flaky)
+	sort.Slice(sbaddrs, func(i, j int) bool {
+		return sbaddrs[i].addresses[0] < sbaddrs[j].addresses[0]
+	})
+
 	return sbaddrs
 }
 
-// listenersForServerBlockAddress essentially converts the Caddyfile site addresses to a map from
-// Caddy listener addresses and the protocols to serve them with to the parsed address for each server block.
-func (st *ServerType) listenersForServerBlockAddress(sblock serverBlock, addr Address,
+// listenerAddrsForServerBlockKey essentially converts the Caddyfile
+// site addresses to Caddy listener addresses for each server block.
+func (st *ServerType) listenerAddrsForServerBlockKey(sblock serverBlock, key string,
 	options map[string]any,
-) (map[string]map[string]struct{}, error) {
+) ([]string, error) {
+	addr, err := ParseAddress(key)
+	if err != nil {
+		return nil, fmt.Errorf("parsing key: %v", err)
+	}
+	addr = addr.Normalize()
+
 	switch addr.Scheme {
 	case "wss":
 		return nil, fmt.Errorf("the scheme wss:// is only supported in browsers; use https:// instead")
@@ -303,58 +230,55 @@ func (st *ServerType) listenersForServerBlockAddress(sblock serverBlock, addr Ad
 
 	// error if scheme and port combination violate convention
 	if (addr.Scheme == "http" && lnPort == httpsPort) || (addr.Scheme == "https" && lnPort == httpPort) {
-		return nil, fmt.Errorf("[%s] scheme and port violate convention", addr.String())
+		return nil, fmt.Errorf("[%s] scheme and port violate convention", key)
 	}
 
-	// the bind directive specifies hosts (and potentially network), and the protocols to serve them with, but is optional
-	lnCfgVals := make([]addressesWithProtocols, 0, len(sblock.pile["bind"]))
+	// the bind directive specifies hosts (and potentially network), but is optional
+	lnHosts := make([]string, 0, len(sblock.pile["bind"]))
 	for _, cfgVal := range sblock.pile["bind"] {
-		if val, ok := cfgVal.Value.(addressesWithProtocols); ok {
-			lnCfgVals = append(lnCfgVals, val)
-		}
+		lnHosts = append(lnHosts, cfgVal.Value.([]string)...)
 	}
-	if len(lnCfgVals) == 0 {
-		if defaultBindValues, ok := options["default_bind"].([]ConfigValue); ok {
-			for _, defaultBindValue := range defaultBindValues {
-				lnCfgVals = append(lnCfgVals, defaultBindValue.Value.(addressesWithProtocols))
-			}
+	if len(lnHosts) == 0 {
+		if defaultBind, ok := options["default_bind"].([]string); ok {
+			lnHosts = defaultBind
 		} else {
-			lnCfgVals = []addressesWithProtocols{{
-				addresses: []string{""},
-				protocols: nil,
-			}}
+			lnHosts = []string{""}
 		}
 	}
 
 	// use a map to prevent duplication
-	listeners := map[string]map[string]struct{}{}
-	for _, lnCfgVal := range lnCfgVals {
-		for _, lnAddr := range lnCfgVal.addresses {
-			lnNetw, lnHost, _, err := caddy.SplitNetworkAddress(lnAddr)
-			if err != nil {
-				return nil, fmt.Errorf("splitting listener address: %v", err)
-			}
-			networkAddr, err := caddy.ParseNetworkAddress(caddy.JoinNetworkAddress(lnNetw, lnHost, lnPort))
-			if err != nil {
-				return nil, fmt.Errorf("parsing network address: %v", err)
-			}
-			if _, ok := listeners[addr.String()]; !ok {
-				listeners[networkAddr.String()] = map[string]struct{}{}
-			}
-			for _, protocol := range lnCfgVal.protocols {
-				listeners[networkAddr.String()][protocol] = struct{}{}
-			}
+	listeners := make(map[string]struct{})
+	for _, lnHost := range lnHosts {
+		// normally we would simply append the port,
+		// but if lnHost is IPv6, we need to ensure it
+		// is enclosed in [ ]; net.JoinHostPort does
+		// this for us, but lnHost might also have a
+		// network type in front (e.g. "tcp/") leading
+		// to "[tcp/::1]" which causes parsing failures
+		// later; what we need is "tcp/[::1]", so we have
+		// to split the network and host, then re-combine
+		network, host, ok := strings.Cut(lnHost, "/")
+		if !ok {
+			host = network
+			network = ""
 		}
+		host = strings.Trim(host, "[]") // IPv6
+		networkAddr := caddy.JoinNetworkAddress(network, host, lnPort)
+		addr, err := caddy.ParseNetworkAddress(networkAddr)
+		if err != nil {
+			return nil, fmt.Errorf("parsing network address: %v", err)
+		}
+		listeners[addr.String()] = struct{}{}
 	}
 
-	return listeners, nil
-}
+	// now turn map into list
+	listenersList := make([]string, 0, len(listeners))
+	for lnStr := range listeners {
+		listenersList = append(listenersList, lnStr)
+	}
+	sort.Strings(listenersList)
 
-// addressesWithProtocols associates a list of listen addresses
-// with a list of protocols to serve them with
-type addressesWithProtocols struct {
-	addresses []string
-	protocols []string
+	return listenersList, nil
 }
 
 // Address represents a site address. It contains

caddyconfig/httpcaddyfile/builtins.go

@@ -15,7 +15,6 @@
 package httpcaddyfile
 
 import (
-	"encoding/json"
 	"fmt"
 	"html"
 	"net/http"
@@ -25,7 +24,7 @@ import (
 	"time"
 
 	"github.com/caddyserver/certmagic"
-	"github.com/mholt/acmez/v3/acme"
+	"github.com/mholt/acmez/v2/acme"
 	"go.uber.org/zap/zapcore"
 
 	"github.com/caddyserver/caddy/v2"
@@ -52,40 +51,19 @@ func init() {
 	RegisterDirective("log", parseLog)
 	RegisterHandlerDirective("skip_log", parseLogSkip)
 	RegisterHandlerDirective("log_skip", parseLogSkip)
-	RegisterHandlerDirective("log_name", parseLogName)
 }
 
 // parseBind parses the bind directive. Syntax:
 //
-//		bind <addresses...> [{
-//	   protocols [h1|h2|h2c|h3] [...]
-//	 }]
+//	bind <addresses...>
 func parseBind(h Helper) ([]ConfigValue, error) {
 	h.Next() // consume directive name
-	var addresses, protocols []string
-	addresses = h.RemainingArgs()
-
-	for h.NextBlock(0) {
-		switch h.Val() {
-		case "protocols":
-			protocols = h.RemainingArgs()
-			if len(protocols) == 0 {
-				return nil, h.Errf("protocols requires one or more arguments")
-			}
-		default:
-			return nil, h.Errf("unknown subdirective: %s", h.Val())
-		}
-	}
-
-	return []ConfigValue{{Class: "bind", Value: addressesWithProtocols{
-		addresses: addresses,
-		protocols: protocols,
-	}}}, nil
+	return []ConfigValue{{Class: "bind", Value: h.RemainingArgs()}}, nil
 }
 
 // parseTLS parses the tls directive. Syntax:
 //
-//	tls [<email>|internal|force_automate]|[<cert_file> <key_file>] {
+//	tls [<email>|internal]|[<cert_file> <key_file>] {
 //	    protocols <min> [<max>]
 //	    ciphers   <cipher_suites...>
 //	    curves    <curves...>
@@ -100,7 +78,7 @@ func parseBind(h Helper) ([]ConfigValue, error) {
 //	    ca                            <acme_ca_endpoint>
 //	    ca_root                       <pem_file>
 //	    key_type                      [ed25519|p256|p384|rsa2048|rsa4096]
-//	    dns                           [<provider_name> [...]]    (required, though, if DNS is not configured as global option)
+//	    dns                           <provider_name> [...]
 //	    propagation_delay             <duration>
 //	    propagation_timeout           <duration>
 //	    resolvers                     <dns_servers...>
@@ -108,7 +86,6 @@ func parseBind(h Helper) ([]ConfigValue, error) {
 //	    dns_challenge_override_domain <domain>
 //	    on_demand
 //	    reuse_private_keys
-//	    force_automate
 //	    eab                           <key_id> <mac_key>
 //	    issuer                        <module_name> [...]
 //	    get_certificate               <module_name> [...]
@@ -128,10 +105,6 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
 	var certManagers []certmagic.Manager
 	var onDemand bool
 	var reusePrivateKeys bool
-	var forceAutomate bool
-
-	// Track which DNS challenge options are set
-	var dnsOptionsSet []string
 
 	firstLine := h.RemainingArgs()
 	switch len(firstLine) {
@@ -139,10 +112,8 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
 	case 1:
 		if firstLine[0] == "internal" {
 			internalIssuer = new(caddytls.InternalIssuer)
-		} else if firstLine[0] == "force_automate" {
-			forceAutomate = true
 		} else if !strings.Contains(firstLine[0], "@") {
-			return nil, h.Err("single argument must either be 'internal', 'force_automate', or an email address")
+			return nil, h.Err("single argument must either be 'internal' or an email address")
 		} else {
 			acmeIssuer = &caddytls.ACMEIssuer{
 				Email: firstLine[0],
@@ -316,6 +287,10 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
 			certManagers = append(certManagers, certManager)
 
 		case "dns":
+			if !h.NextArg() {
+				return nil, h.ArgErr()
+			}
+			provName := h.Val()
 			if acmeIssuer == nil {
 				acmeIssuer = new(caddytls.ACMEIssuer)
 			}
@@ -325,19 +300,12 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
 			if acmeIssuer.Challenges.DNS == nil {
 				acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
 			}
-			// DNS provider configuration optional, since it may be configured globally via the TLS app with global options
-			if h.NextArg() {
-				provName := h.Val()
-				modID := "dns.providers." + provName
-				unm, err := caddyfile.UnmarshalModule(h.Dispenser, modID)
-				if err != nil {
-					return nil, err
-				}
-				acmeIssuer.Challenges.DNS.ProviderRaw = caddyconfig.JSONModuleObject(unm, "name", provName, h.warnings)
-			} else if h.Option("dns") == nil {
-				// if DNS is omitted locally, it needs to be configured globally
-				return nil, h.ArgErr()
+			modID := "dns.providers." + provName
+			unm, err := caddyfile.UnmarshalModule(h.Dispenser, modID)
+			if err != nil {
+				return nil, err
 			}
+			acmeIssuer.Challenges.DNS.ProviderRaw = caddyconfig.JSONModuleObject(unm, "name", provName, h.warnings)
 
 		case "resolvers":
 			args := h.RemainingArgs()
@@ -353,7 +321,6 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
 			if acmeIssuer.Challenges.DNS == nil {
 				acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
 			}
-			dnsOptionsSet = append(dnsOptionsSet, "resolvers")
 			acmeIssuer.Challenges.DNS.Resolvers = args
 
 		case "propagation_delay":
@@ -375,7 +342,6 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
 			if acmeIssuer.Challenges.DNS == nil {
 				acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
 			}
-			dnsOptionsSet = append(dnsOptionsSet, "propagation_delay")
 			acmeIssuer.Challenges.DNS.PropagationDelay = caddy.Duration(delay)
 
 		case "propagation_timeout":
@@ -403,7 +369,6 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
 			if acmeIssuer.Challenges.DNS == nil {
 				acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
 			}
-			dnsOptionsSet = append(dnsOptionsSet, "propagation_timeout")
 			acmeIssuer.Challenges.DNS.PropagationTimeout = caddy.Duration(timeout)
 
 		case "dns_ttl":
@@ -425,7 +390,6 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
 			if acmeIssuer.Challenges.DNS == nil {
 				acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
 			}
-			dnsOptionsSet = append(dnsOptionsSet, "dns_ttl")
 			acmeIssuer.Challenges.DNS.TTL = caddy.Duration(ttl)
 
 		case "dns_challenge_override_domain":
@@ -442,7 +406,6 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
 			if acmeIssuer.Challenges.DNS == nil {
 				acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
 			}
-			dnsOptionsSet = append(dnsOptionsSet, "dns_challenge_override_domain")
 			acmeIssuer.Challenges.DNS.OverrideDomain = arg[0]
 
 		case "ca_root":
@@ -478,18 +441,6 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
 		}
 	}
 
-	// Validate DNS challenge config: any DNS challenge option except "dns" requires a DNS provider
-	if acmeIssuer != nil && acmeIssuer.Challenges != nil && acmeIssuer.Challenges.DNS != nil {
-		dnsCfg := acmeIssuer.Challenges.DNS
-		providerSet := dnsCfg.ProviderRaw != nil || h.Option("dns") != nil
-		if len(dnsOptionsSet) > 0 && !providerSet {
-			return nil, h.Errf(
-				"setting DNS challenge options [%s] requires a DNS provider (set with the 'dns' subdirective or 'acme_dns' global option)",
-				strings.Join(dnsOptionsSet, ", "),
-			)
-		}
-	}
-
 	// a naked tls directive is not allowed
 	if len(firstLine) == 0 && !hasBlock {
 		return nil, h.ArgErr()
@@ -597,15 +548,6 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
 		})
 	}
 
-	// if enabled, the names in the site addresses will be
-	// added to the automation policies
-	if forceAutomate {
-		configVals = append(configVals, ConfigValue{
-			Class: "tls.force_automate",
-			Value: true,
-		})
-	}
-
 	// custom certificate selection
 	if len(certSelector.AnyTag) > 0 {
 		cp.CertSelection = &certSelector
@@ -864,18 +806,13 @@ func parseHandleErrors(h Helper) ([]ConfigValue, error) {
 		return nil, h.Errf("segment was not parsed as a subroute")
 	}
 
-	// wrap the subroutes
-	wrappingRoute := caddyhttp.Route{
-		HandlersRaw: []json.RawMessage{caddyconfig.JSONModuleObject(subroute, "handler", "subroute", nil)},
-	}
-	subroute = &caddyhttp.Subroute{
-		Routes: []caddyhttp.Route{wrappingRoute},
-	}
 	if expression != "" {
 		statusMatcher := caddy.ModuleMap{
 			"expression": h.JSON(caddyhttp.MatchExpression{Expr: expression}),
 		}
-		subroute.Routes[0].MatcherSetsRaw = []caddy.ModuleMap{statusMatcher}
+		for i := range subroute.Routes {
+			subroute.Routes[i].MatcherSetsRaw = []caddy.ModuleMap{statusMatcher}
+		}
 	}
 	return []ConfigValue{
 		{
@@ -911,7 +848,6 @@ func parseInvoke(h Helper) (caddyhttp.MiddlewareHandler, error) {
 //	log <logger_name> {
 //	    hostnames <hostnames...>
 //	    output <writer_module> ...
-//	    core   <core_module> ...
 //	    format <encoder_module> ...
 //	    level  <level>
 //	}
@@ -978,7 +914,7 @@ func parseLogHelper(h Helper, globalLogNames map[string]struct{}) ([]ConfigValue
 	// this is useful for setting up loggers per subdomain in a site block
 	// with a wildcard domain
 	customHostnames := []string{}
-	noHostname := false
+
 	for h.NextBlock(0) {
 		switch h.Val() {
 		case "hostnames":
@@ -1023,66 +959,6 @@ func parseLogHelper(h Helper, globalLogNames map[string]struct{}) ([]ConfigValue
 			}
 			cl.WriterRaw = caddyconfig.JSONModuleObject(wo, "output", moduleName, h.warnings)
 
-		case "sampling":
-			d := h.Dispenser.NewFromNextSegment()
-			for d.NextArg() {
-				// consume any tokens on the same line, if any.
-			}
-
-			sampling := &caddy.LogSampling{}
-			for nesting := d.Nesting(); d.NextBlock(nesting); {
-				subdir := d.Val()
-				switch subdir {
-				case "interval":
-					if !d.NextArg() {
-						return nil, d.ArgErr()
-					}
-					interval, err := time.ParseDuration(d.Val() + "ns")
-					if err != nil {
-						return nil, d.Errf("failed to parse interval: %v", err)
-					}
-					sampling.Interval = interval
-				case "first":
-					if !d.NextArg() {
-						return nil, d.ArgErr()
-					}
-					first, err := strconv.Atoi(d.Val())
-					if err != nil {
-						return nil, d.Errf("failed to parse first: %v", err)
-					}
-					sampling.First = first
-				case "thereafter":
-					if !d.NextArg() {
-						return nil, d.ArgErr()
-					}
-					thereafter, err := strconv.Atoi(d.Val())
-					if err != nil {
-						return nil, d.Errf("failed to parse thereafter: %v", err)
-					}
-					sampling.Thereafter = thereafter
-				default:
-					return nil, d.Errf("unrecognized subdirective: %s", subdir)
-				}
-			}
-
-			cl.Sampling = sampling
-
-		case "core":
-			if !h.NextArg() {
-				return nil, h.ArgErr()
-			}
-			moduleName := h.Val()
-			moduleID := "caddy.logging.cores." + moduleName
-			unm, err := caddyfile.UnmarshalModule(h.Dispenser, moduleID)
-			if err != nil {
-				return nil, err
-			}
-			core, ok := unm.(zapcore.Core)
-			if !ok {
-				return nil, h.Errf("module %s (%T) is not a zapcore.Core", moduleID, unm)
-			}
-			cl.CoreRaw = caddyconfig.JSONModuleObject(core, "module", moduleName, h.warnings)
-
 		case "format":
 			if !h.NextArg() {
 				return nil, h.ArgErr()
@@ -1124,12 +1000,6 @@ func parseLogHelper(h Helper, globalLogNames map[string]struct{}) ([]ConfigValue
 				cl.Exclude = append(cl.Exclude, h.Val())
 			}
 
-		case "no_hostname":
-			if h.NextArg() {
-				return nil, h.ArgErr()
-			}
-			noHostname = true
-
 		default:
 			return nil, h.Errf("unrecognized subdirective: %s", h.Val())
 		}
@@ -1137,7 +1007,7 @@ func parseLogHelper(h Helper, globalLogNames map[string]struct{}) ([]ConfigValue
 
 	var val namedCustomLog
 	val.hostnames = customHostnames
-	val.noHostname = noHostname
+
 	isEmptyConfig := reflect.DeepEqual(cl, new(caddy.CustomLog))
 
 	// Skip handling of empty logging configs
@@ -1186,20 +1056,5 @@ func parseLogSkip(h Helper) (caddyhttp.MiddlewareHandler, error) {
 	if h.NextArg() {
 		return nil, h.ArgErr()
 	}
-
-	if h.NextBlock(0) {
-		return nil, h.Err("log_skip directive does not accept blocks")
-	}
-
 	return caddyhttp.VarsMiddleware{"log_skip": true}, nil
 }
-
-// parseLogName parses the log_name directive. Syntax:
-//
-//	log_name <names...>
-func parseLogName(h Helper) (caddyhttp.MiddlewareHandler, error) {
-	h.Next() // consume directive name
-	return caddyhttp.VarsMiddleware{
-		caddyhttp.AccessLoggerNameVarKey: h.RemainingArgs(),
-	}, nil
-}

caddyconfig/httpcaddyfile/builtins_test.go

@@ -25,12 +25,11 @@ func TestLogDirectiveSyntax(t *testing.T) {
 		{
 			input: `:8080 {
 				log {
-					core mock
 					output file foo.log
 				}
 			}
 			`,
-			output:      `{"logging":{"logs":{"default":{"exclude":["http.log.access.log0"]},"log0":{"writer":{"filename":"foo.log","output":"file"},"core":{"module":"mock"},"include":["http.log.access.log0"]}}},"apps":{"http":{"servers":{"srv0":{"listen":[":8080"],"logs":{"default_logger_name":"log0"}}}}}}`,
+			output:      `{"logging":{"logs":{"default":{"exclude":["http.log.access.log0"]},"log0":{"writer":{"filename":"foo.log","output":"file"},"include":["http.log.access.log0"]}}},"apps":{"http":{"servers":{"srv0":{"listen":[":8080"],"logs":{"default_logger_name":"log0"}}}}}}`,
 			expectError: false,
 		},
 		{
@@ -54,26 +53,11 @@ func TestLogDirectiveSyntax(t *testing.T) {
 		{
 			input: `:8080 {
 				log name-override {
-					core mock
 					output file foo.log
 				}
 			}
 			`,
-			output:      `{"logging":{"logs":{"default":{"exclude":["http.log.access.name-override"]},"name-override":{"writer":{"filename":"foo.log","output":"file"},"core":{"module":"mock"},"include":["http.log.access.name-override"]}}},"apps":{"http":{"servers":{"srv0":{"listen":[":8080"],"logs":{"default_logger_name":"name-override"}}}}}}`,
-			expectError: false,
-		},
-		{
-			input: `:8080 {
-				log {
-					sampling {
-						interval 2
-						first 3
-						thereafter 4
-					}
-				}
-			}
-			`,
-			output:      `{"logging":{"logs":{"default":{"exclude":["http.log.access.log0"]},"log0":{"sampling":{"interval":2,"first":3,"thereafter":4},"include":["http.log.access.log0"]}}},"apps":{"http":{"servers":{"srv0":{"listen":[":8080"],"logs":{"default_logger_name":"log0"}}}}}}`,
+			output:      `{"logging":{"logs":{"default":{"exclude":["http.log.access.name-override"]},"name-override":{"writer":{"filename":"foo.log","output":"file"},"include":["http.log.access.name-override"]}}},"apps":{"http":{"servers":{"srv0":{"listen":[":8080"],"logs":{"default_logger_name":"name-override"}}}}}}`,
 			expectError: false,
 		},
 	} {

caddyconfig/httpcaddyfile/directives.go

@@ -16,9 +16,7 @@ package httpcaddyfile
 
 import (
 	"encoding/json"
-	"maps"
 	"net"
-	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -55,7 +53,6 @@ var defaultDirectiveOrder = []string{
 	"log_append",
 	"skip_log", // TODO: deprecated, renamed to log_skip
 	"log_skip",
-	"log_name",
 
 	"header",
 	"copy_response_headers", // only in reverse_proxy's handle_response
@@ -76,7 +73,6 @@ var defaultDirectiveOrder = []string{
 	"request_header",
 	"encode",
 	"push",
-	"intercept",
 	"templates",
 
 	// special routing & dispatching directives
@@ -102,6 +98,17 @@ var defaultDirectiveOrder = []string{
 // plugins or by the user via the "order" global option.
 var directiveOrder = defaultDirectiveOrder
 
+// directiveIsOrdered returns true if dir is
+// a known, ordered (sorted) directive.
+func directiveIsOrdered(dir string) bool {
+	for _, d := range directiveOrder {
+		if d == dir {
+			return true
+		}
+	}
+	return false
+}
+
 // RegisterDirective registers a unique directive dir with an
 // associated unmarshaling (setup) function. When directive dir
 // is encountered in a Caddyfile, setupFunc will be called to
@@ -152,7 +159,7 @@ func RegisterHandlerDirective(dir string, setupFunc UnmarshalHandlerFunc) {
 // EXPERIMENTAL: This API may change or be removed.
 func RegisterDirectiveOrder(dir string, position Positional, standardDir string) {
 	// check if directive was already ordered
-	if slices.Contains(directiveOrder, dir) {
+	if directiveIsOrdered(dir) {
 		panic("directive '" + dir + "' already ordered")
 	}
 
@@ -163,7 +170,12 @@ func RegisterDirectiveOrder(dir string, position Positional, standardDir string)
 	// check if directive exists in standard distribution, since
 	// we can't allow plugins to depend on one another; we can't
 	// guarantee the order that plugins are loaded in.
-	foundStandardDir := slices.Contains(defaultDirectiveOrder, standardDir)
+	foundStandardDir := false
+	for _, d := range defaultDirectiveOrder {
+		if d == standardDir {
+			foundStandardDir = true
+		}
+	}
 	if !foundStandardDir {
 		panic("the 3rd argument '" + standardDir + "' must be a directive that exists in the standard distribution of Caddy")
 	}
@@ -174,12 +186,10 @@ func RegisterDirectiveOrder(dir string, position Positional, standardDir string)
 		if d != standardDir {
 			continue
 		}
-		switch position {
-		case Before:
+		if position == Before {
 			newOrder = append(newOrder[:i], append([]string{dir}, newOrder[i:]...)...)
-		case After:
+		} else if position == After {
 			newOrder = append(newOrder[:i+1], append([]string{dir}, newOrder[i+1:]...)...)
-		case First, Last:
 		}
 		break
 	}
@@ -368,7 +378,9 @@ func parseSegmentAsConfig(h Helper) ([]ConfigValue, error) {
 		// copy existing matcher definitions so we can augment
 		// new ones that are defined only in this scope
 		matcherDefs := make(map[string]caddy.ModuleMap, len(h.matcherDefs))
-		maps.Copy(matcherDefs, h.matcherDefs)
+		for key, val := range h.matcherDefs {
+			matcherDefs[key] = val
+		}
 
 		// find and extract any embedded matcher definitions in this scope
 		for i := 0; i < len(segments); i++ {
@@ -484,29 +496,12 @@ func sortRoutes(routes []ConfigValue) {
 			// we can only confidently compare path lengths if both
 			// directives have a single path to match (issue #5037)
 			if iPathLen > 0 && jPathLen > 0 {
-				// trim the trailing wildcard if there is one
-				iPathTrimmed := strings.TrimSuffix(iPM[0], "*")
-				jPathTrimmed := strings.TrimSuffix(jPM[0], "*")
-
 				// if both paths are the same except for a trailing wildcard,
 				// sort by the shorter path first (which is more specific)
-				if iPathTrimmed == jPathTrimmed {
+				if strings.TrimSuffix(iPM[0], "*") == strings.TrimSuffix(jPM[0], "*") {
 					return iPathLen < jPathLen
 				}
 
-				// we use the trimmed length to compare the paths
-				// https://github.com/caddyserver/caddy/issues/7012#issuecomment-2870142195
-				// credit to https://github.com/Hellio404
-				// for sorts with many items, mixing matchers w/ and w/o wildcards will confuse the sort and result in incorrect orders
-				iPathLen = len(iPathTrimmed)
-				jPathLen = len(jPathTrimmed)
-
-				// if both paths have the same length, sort lexically
-				// https://github.com/caddyserver/caddy/pull/7015#issuecomment-2871993588
-				if iPathLen == jPathLen {
-					return iPathTrimmed < jPathTrimmed
-				}
-
 				// sort most-specific (longest) path first
 				return iPathLen > jPathLen
 			}
@@ -534,9 +529,9 @@ func sortRoutes(routes []ConfigValue) {
 // a "pile" of config values, keyed by class name,
 // as well as its parsed keys for convenience.
 type serverBlock struct {
-	block      caddyfile.ServerBlock
-	pile       map[string][]ConfigValue // config values obtained from directives
-	parsedKeys []Address
+	block caddyfile.ServerBlock
+	pile  map[string][]ConfigValue // config values obtained from directives
+	keys  []Address
 }
 
 // hostsFromKeys returns a list of all the non-empty hostnames found in
@@ -553,7 +548,7 @@ type serverBlock struct {
 func (sb serverBlock) hostsFromKeys(loggerMode bool) []string {
 	// ensure each entry in our list is unique
 	hostMap := make(map[string]struct{})
-	for _, addr := range sb.parsedKeys {
+	for _, addr := range sb.keys {
 		if addr.Host == "" {
 			if !loggerMode {
 				// server block contains a key like ":443", i.e. the host portion
@@ -585,7 +580,7 @@ func (sb serverBlock) hostsFromKeys(loggerMode bool) []string {
 func (sb serverBlock) hostsFromKeysNotHTTP(httpPort string) []string {
 	// ensure each entry in our list is unique
 	hostMap := make(map[string]struct{})
-	for _, addr := range sb.parsedKeys {
+	for _, addr := range sb.keys {
 		if addr.Host == "" {
 			continue
 		}
@@ -606,17 +601,23 @@ func (sb serverBlock) hostsFromKeysNotHTTP(httpPort string) []string {
 // hasHostCatchAllKey returns true if sb has a key that
 // omits a host portion, i.e. it "catches all" hosts.
 func (sb serverBlock) hasHostCatchAllKey() bool {
-	return slices.ContainsFunc(sb.parsedKeys, func(addr Address) bool {
-		return addr.Host == ""
-	})
+	for _, addr := range sb.keys {
+		if addr.Host == "" {
+			return true
+		}
+	}
+	return false
 }
 
 // isAllHTTP returns true if all sb keys explicitly specify
 // the http:// scheme
 func (sb serverBlock) isAllHTTP() bool {
-	return !slices.ContainsFunc(sb.parsedKeys, func(addr Address) bool {
-		return addr.Scheme != "http"
-	})
+	for _, addr := range sb.keys {
+		if addr.Scheme != "http" {
+			return false
+		}
+	}
+	return true
 }
 
 // Positional are the supported modes for ordering directives.

caddyconfig/httpcaddyfile/directives_test.go

@@ -78,7 +78,7 @@ func TestHostsFromKeys(t *testing.T) {
 			[]string{"example.com:2015"},
 		},
 	} {
-		sb := serverBlock{parsedKeys: tc.keys}
+		sb := serverBlock{keys: tc.keys}
 
 		// test in normal mode
 		actual := sb.hostsFromKeys(false)

caddyconfig/httpcaddyfile/httptype.go

@@ -15,7 +15,6 @@
 package httpcaddyfile
 
 import (
-	"cmp"
 	"encoding/json"
 	"fmt"
 	"net"
@@ -172,7 +171,7 @@ func (st ServerType) Setup(
 	}
 
 	// map
-	sbmap, err := st.mapAddressToProtocolToServerBlocks(originalServerBlocks, options)
+	sbmap, err := st.mapAddressToServerBlocks(originalServerBlocks, options)
 	if err != nil {
 		return nil, warnings, err
 	}
@@ -187,25 +186,12 @@ func (st ServerType) Setup(
 		return nil, warnings, err
 	}
 
-	// hoist the metrics config from per-server to global
-	metrics, _ := options["metrics"].(*caddyhttp.Metrics)
-	for _, s := range servers {
-		if s.Metrics != nil {
-			metrics = cmp.Or(metrics, &caddyhttp.Metrics{})
-			metrics = &caddyhttp.Metrics{
-				PerHost: metrics.PerHost || s.Metrics.PerHost,
-			}
-			s.Metrics = nil // we don't need it anymore
-		}
-	}
-
 	// now that each server is configured, make the HTTP app
 	httpApp := caddyhttp.App{
 		HTTPPort:      tryInt(options["http_port"], &warnings),
 		HTTPSPort:     tryInt(options["https_port"], &warnings),
 		GracePeriod:   tryDuration(options["grace_period"], &warnings),
 		ShutdownDelay: tryDuration(options["shutdown_delay"], &warnings),
-		Metrics:       metrics,
 		Servers:       servers,
 	}
 
@@ -350,7 +336,7 @@ func (st ServerType) Setup(
 
 				// avoid duplicates by sorting + compacting
 				sort.Strings(defaultLog.Exclude)
-				defaultLog.Exclude = slices.Compact(defaultLog.Exclude)
+				defaultLog.Exclude = slices.Compact[[]string, string](defaultLog.Exclude)
 			}
 		}
 		// we may have not actually added anything, so remove if empty
@@ -416,20 +402,6 @@ func (ServerType) evaluateGlobalOptionsBlock(serverBlocks []serverBlock, options
 			options[opt] = append(existingOpts, logOpts...)
 			continue
 		}
-		// Also fold multiple "default_bind" options together into an
-		// array so that server blocks can have multiple binds by default.
-		if opt == "default_bind" {
-			existingOpts, ok := options[opt].([]ConfigValue)
-			if !ok {
-				existingOpts = []ConfigValue{}
-			}
-			defaultBindOpts, ok := val.([]ConfigValue)
-			if !ok {
-				return nil, fmt.Errorf("unexpected type from 'default_bind' global options: %T", val)
-			}
-			options[opt] = append(existingOpts, defaultBindOpts...)
-			continue
-		}
 
 		options[opt] = val
 	}
@@ -548,8 +520,8 @@ func (st *ServerType) serversFromPairings(
 	if hsp, ok := options["https_port"].(int); ok {
 		httpsPort = strconv.Itoa(hsp)
 	}
-	autoHTTPS := []string{}
-	if ah, ok := options["auto_https"].([]string); ok {
+	autoHTTPS := "on"
+	if ah, ok := options["auto_https"].(string); ok {
 		autoHTTPS = ah
 	}
 
@@ -564,74 +536,28 @@ func (st *ServerType) serversFromPairings(
 					if k == j {
 						continue
 					}
-					if slices.Contains(sblock2.block.GetKeysText(), key) {
+					if sliceContains(sblock2.block.GetKeysText(), key) {
 						return nil, fmt.Errorf("ambiguous site definition: %s", key)
 					}
 				}
 			}
 		}
 
-		var (
-			addresses []string
-			protocols [][]string
-		)
-
-		for _, addressWithProtocols := range p.addressesWithProtocols {
-			addresses = append(addresses, addressWithProtocols.address)
-			protocols = append(protocols, addressWithProtocols.protocols)
-		}
-
 		srv := &caddyhttp.Server{
-			Listen:          addresses,
-			ListenProtocols: protocols,
-		}
-
-		// remove srv.ListenProtocols[j] if it only contains the default protocols
-		for j, lnProtocols := range srv.ListenProtocols {
-			srv.ListenProtocols[j] = nil
-			for _, lnProtocol := range lnProtocols {
-				if lnProtocol != "" {
-					srv.ListenProtocols[j] = lnProtocols
-					break
-				}
-			}
-		}
-
-		// remove srv.ListenProtocols if it only contains the default protocols for all listen addresses
-		listenProtocols := srv.ListenProtocols
-		srv.ListenProtocols = nil
-		for _, lnProtocols := range listenProtocols {
-			if lnProtocols != nil {
-				srv.ListenProtocols = listenProtocols
-				break
-			}
+			Listen: p.addresses,
 		}
 
 		// handle the auto_https global option
-		for _, val := range autoHTTPS {
-			switch val {
+		if autoHTTPS != "on" {
+			srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig)
+			switch autoHTTPS {
 			case "off":
-				if srv.AutoHTTPS == nil {
-					srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig)
-				}
 				srv.AutoHTTPS.Disabled = true
-
 			case "disable_redirects":
-				if srv.AutoHTTPS == nil {
-					srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig)
-				}
 				srv.AutoHTTPS.DisableRedir = true
-
 			case "disable_certs":
-				if srv.AutoHTTPS == nil {
-					srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig)
-				}
 				srv.AutoHTTPS.DisableCerts = true
-
 			case "ignore_loaded_certs":
-				if srv.AutoHTTPS == nil {
-					srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig)
-				}
 				srv.AutoHTTPS.IgnoreLoadedCerts = true
 			}
 		}
@@ -640,7 +566,7 @@ func (st *ServerType) serversFromPairings(
 		// See ParseAddress() where parsing should later reject paths
 		// See https://github.com/caddyserver/caddy/pull/4728 for a full explanation
 		for _, sblock := range p.serverBlocks {
-			for _, addr := range sblock.parsedKeys {
+			for _, addr := range sblock.keys {
 				if addr.Path != "" {
 					caddy.Log().Named("caddyfile").Warn("Using a path in a site address is deprecated; please use the 'handle' directive instead", zap.String("address", addr.String()))
 				}
@@ -658,7 +584,7 @@ func (st *ServerType) serversFromPairings(
 			var iLongestPath, jLongestPath string
 			var iLongestHost, jLongestHost string
 			var iWildcardHost, jWildcardHost bool
-			for _, addr := range p.serverBlocks[i].parsedKeys {
+			for _, addr := range p.serverBlocks[i].keys {
 				if strings.Contains(addr.Host, "*") || addr.Host == "" {
 					iWildcardHost = true
 				}
@@ -669,7 +595,7 @@ func (st *ServerType) serversFromPairings(
 					iLongestPath = addr.Path
 				}
 			}
-			for _, addr := range p.serverBlocks[j].parsedKeys {
+			for _, addr := range p.serverBlocks[j].keys {
 				if strings.Contains(addr.Host, "*") || addr.Host == "" {
 					jWildcardHost = true
 				}
@@ -701,7 +627,7 @@ func (st *ServerType) serversFromPairings(
 		})
 
 		var hasCatchAllTLSConnPolicy, addressQualifiesForTLS bool
-		autoHTTPSWillAddConnPolicy := srv.AutoHTTPS == nil || !srv.AutoHTTPS.Disabled
+		autoHTTPSWillAddConnPolicy := autoHTTPS != "off"
 
 		// if needed, the ServerLogConfig is initialized beforehand so
 		// that all server blocks can populate it with data, even when not
@@ -747,14 +673,6 @@ func (st *ServerType) serversFromPairings(
 				}
 			}
 
-			// collect hosts that are forced to be automated
-			forceAutomatedNames := make(map[string]struct{})
-			if _, ok := sblock.pile["tls.force_automate"]; ok {
-				for _, host := range hosts {
-					forceAutomatedNames[host] = struct{}{}
-				}
-			}
-
 			// tls: connection policies
 			if cpVals, ok := sblock.pile["tls.connection_policy"]; ok {
 				// tls connection policies
@@ -785,21 +703,15 @@ func (st *ServerType) serversFromPairings(
 						cp.FallbackSNI = fallbackSNI
 					}
 
-					// only append this policy if it actually changes something,
-					// or if the configuration explicitly automates certs for
-					// these names (this is necessary to hoist a connection policy
-					// above one that may manually load a wildcard cert that would
-					// otherwise clobber the automated one; the code that appends
-					// policies that manually load certs comes later, so they're
-					// lower in the list)
-					if !cp.SettingsEmpty() || mapContains(forceAutomatedNames, hosts) {
+					// only append this policy if it actually changes something
+					if !cp.SettingsEmpty() {
 						srv.TLSConnPolicies = append(srv.TLSConnPolicies, cp)
 						hasCatchAllTLSConnPolicy = len(hosts) == 0
 					}
 				}
 			}
 
-			for _, addr := range sblock.parsedKeys {
+			for _, addr := range sblock.keys {
 				// if server only uses HTTP port, auto-HTTPS will not apply
 				if listenersUseAnyPortOtherThan(srv.Listen, httpPort) {
 					// exclude any hosts that were defined explicitly with "http://"
@@ -808,7 +720,7 @@ func (st *ServerType) serversFromPairings(
 						if srv.AutoHTTPS == nil {
 							srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig)
 						}
-						if !slices.Contains(srv.AutoHTTPS.Skip, addr.Host) {
+						if !sliceContains(srv.AutoHTTPS.Skip, addr.Host) {
 							srv.AutoHTTPS.Skip = append(srv.AutoHTTPS.Skip, addr.Host)
 						}
 					}
@@ -822,7 +734,7 @@ func (st *ServerType) serversFromPairings(
 				// https://caddy.community/t/making-sense-of-auto-https-and-why-disabling-it-still-serves-https-instead-of-http/9761
 				createdTLSConnPolicies, ok := sblock.pile["tls.connection_policy"]
 				hasTLSEnabled := (ok && len(createdTLSConnPolicies) > 0) ||
-					(addr.Host != "" && srv.AutoHTTPS != nil && !slices.Contains(srv.AutoHTTPS.Skip, addr.Host))
+					(addr.Host != "" && srv.AutoHTTPS != nil && !sliceContains(srv.AutoHTTPS.Skip, addr.Host))
 
 				// we'll need to remember if the address qualifies for auto-HTTPS, so we
 				// can add a TLS conn policy if necessary
@@ -830,7 +742,6 @@ func (st *ServerType) serversFromPairings(
 					(addr.Scheme != "http" && addr.Port != httpPort && hasTLSEnabled) {
 					addressQualifiesForTLS = true
 				}
-
 				// predict whether auto-HTTPS will add the conn policy for us; if so, we
 				// may not need to add one for this server
 				autoHTTPSWillAddConnPolicy = autoHTTPSWillAddConnPolicy &&
@@ -886,15 +797,6 @@ func (st *ServerType) serversFromPairings(
 			sblockLogHosts := sblock.hostsFromKeys(true)
 			for _, cval := range sblock.pile["custom_log"] {
 				ncl := cval.Value.(namedCustomLog)
-
-				// if `no_hostname` is set, then this logger will not
-				// be associated with any of the site block's hostnames,
-				// and only be usable via the `log_name` directive
-				// or the `access_logger_names` variable
-				if ncl.noHostname {
-					continue
-				}
-
 				if sblock.hasHostCatchAllKey() && len(ncl.hostnames) == 0 {
 					// all requests for hosts not able to be listed should use
 					// this log because it's a catch-all-hosts server block
@@ -962,10 +864,7 @@ func (st *ServerType) serversFromPairings(
 		if addressQualifiesForTLS &&
 			!hasCatchAllTLSConnPolicy &&
 			(len(srv.TLSConnPolicies) > 0 || !autoHTTPSWillAddConnPolicy || defaultSNI != "" || fallbackSNI != "") {
-			srv.TLSConnPolicies = append(srv.TLSConnPolicies, &caddytls.ConnectionPolicy{
-				DefaultSNI:  defaultSNI,
-				FallbackSNI: fallbackSNI,
-			})
+			srv.TLSConnPolicies = append(srv.TLSConnPolicies, &caddytls.ConnectionPolicy{DefaultSNI: defaultSNI, FallbackSNI: fallbackSNI})
 		}
 
 		// tidy things up a bit
@@ -978,7 +877,8 @@ func (st *ServerType) serversFromPairings(
 		servers[fmt.Sprintf("srv%d", i)] = srv
 	}
 
-	if err := applyServerOptions(servers, options, warnings); err != nil {
+	err := applyServerOptions(servers, options, warnings)
+	if err != nil {
 		return nil, fmt.Errorf("applying global server options: %v", err)
 	}
 
@@ -1023,7 +923,7 @@ func detectConflictingSchemes(srv *caddyhttp.Server, serverBlocks []serverBlock,
 	}
 
 	for _, sblock := range serverBlocks {
-		for _, addr := range sblock.parsedKeys {
+		for _, addr := range sblock.keys {
 			if addr.Scheme == "http" || addr.Port == httpPort {
 				if err := checkAndSetHTTP(addr); err != nil {
 					return err
@@ -1061,40 +961,11 @@ func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.Connecti
 
 			// if they're exactly equal in every way, just keep one of them
 			if reflect.DeepEqual(cps[i], cps[j]) {
-				cps = slices.Delete(cps, j, j+1)
+				cps = append(cps[:j], cps[j+1:]...)
 				i--
 				break
 			}
 
-			// as a special case, if there are adjacent TLS conn policies that are identical except
-			// by their matchers, and the matchers are specifically just ServerName ("sni") matchers
-			// (by far the most common), we can combine them into a single policy
-			if i == j-1 && len(cps[i].MatchersRaw) == 1 && len(cps[j].MatchersRaw) == 1 {
-				if iSNIMatcherJSON, ok := cps[i].MatchersRaw["sni"]; ok {
-					if jSNIMatcherJSON, ok := cps[j].MatchersRaw["sni"]; ok {
-						// position of policies and the matcher criteria check out; if settings are
-						// the same, then we can combine the policies; we have to unmarshal and
-						// remarshal the matchers though
-						if cps[i].SettingsEqual(*cps[j]) {
-							var iSNIMatcher caddytls.MatchServerName
-							if err := json.Unmarshal(iSNIMatcherJSON, &iSNIMatcher); err == nil {
-								var jSNIMatcher caddytls.MatchServerName
-								if err := json.Unmarshal(jSNIMatcherJSON, &jSNIMatcher); err == nil {
-									iSNIMatcher = append(iSNIMatcher, jSNIMatcher...)
-									cps[i].MatchersRaw["sni"], err = json.Marshal(iSNIMatcher)
-									if err != nil {
-										return nil, fmt.Errorf("recombining SNI matchers: %v", err)
-									}
-									cps = slices.Delete(cps, j, j+1)
-									i--
-									break
-								}
-							}
-						}
-					}
-				}
-			}
-
 			// if they have the same matcher, try to reconcile each field: either they must
 			// be identical, or we have to be able to combine them safely
 			if reflect.DeepEqual(cps[i].MatchersRaw, cps[j].MatchersRaw) {
@@ -1128,12 +999,6 @@ func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.Connecti
 					return nil, fmt.Errorf("two policies with same match criteria have conflicting default SNI: %s vs. %s",
 						cps[i].DefaultSNI, cps[j].DefaultSNI)
 				}
-				if cps[i].FallbackSNI != "" &&
-					cps[j].FallbackSNI != "" &&
-					cps[i].FallbackSNI != cps[j].FallbackSNI {
-					return nil, fmt.Errorf("two policies with same match criteria have conflicting fallback SNI: %s vs. %s",
-						cps[i].FallbackSNI, cps[j].FallbackSNI)
-				}
 				if cps[i].ProtocolMin != "" &&
 					cps[j].ProtocolMin != "" &&
 					cps[i].ProtocolMin != cps[j].ProtocolMin {
@@ -1174,9 +1039,6 @@ func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.Connecti
 				if cps[i].DefaultSNI == "" && cps[j].DefaultSNI != "" {
 					cps[i].DefaultSNI = cps[j].DefaultSNI
 				}
-				if cps[i].FallbackSNI == "" && cps[j].FallbackSNI != "" {
-					cps[i].FallbackSNI = cps[j].FallbackSNI
-				}
 				if cps[i].ProtocolMin == "" && cps[j].ProtocolMin != "" {
 					cps[i].ProtocolMin = cps[j].ProtocolMin
 				}
@@ -1190,19 +1052,18 @@ func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.Connecti
 				} else if cps[i].CertSelection != nil && cps[j].CertSelection != nil {
 					// if both have one, then combine AnyTag
 					for _, tag := range cps[j].CertSelection.AnyTag {
-						if !slices.Contains(cps[i].CertSelection.AnyTag, tag) {
+						if !sliceContains(cps[i].CertSelection.AnyTag, tag) {
 							cps[i].CertSelection.AnyTag = append(cps[i].CertSelection.AnyTag, tag)
 						}
 					}
 				}
 
-				cps = slices.Delete(cps, j, j+1)
+				cps = append(cps[:j], cps[j+1:]...)
 				i--
 				break
 			}
 		}
 	}
-
 	return cps, nil
 }
 
@@ -1274,7 +1135,7 @@ func appendSubrouteToRouteList(routeList caddyhttp.RouteList,
 func buildSubroute(routes []ConfigValue, groupCounter counter, needsSorting bool) (*caddyhttp.Subroute, error) {
 	if needsSorting {
 		for _, val := range routes {
-			if !slices.Contains(directiveOrder, val.directive) {
+			if !directiveIsOrdered(val.directive) {
 				return nil, fmt.Errorf("directive '%s' is not an ordered HTTP handler, so it cannot be used here - try placing within a route block or using the order global option", val.directive)
 			}
 		}
@@ -1452,7 +1313,7 @@ func (st *ServerType) compileEncodedMatcherSets(sblock serverBlock) ([]caddy.Mod
 	var matcherPairs []*hostPathPair
 
 	var catchAllHosts bool
-	for _, addr := range sblock.parsedKeys {
+	for _, addr := range sblock.keys {
 		// choose a matcher pair that should be shared by this
 		// server block; if none exists yet, create one
 		var chosenMatcherPair *hostPathPair
@@ -1484,16 +1345,25 @@ func (st *ServerType) compileEncodedMatcherSets(sblock serverBlock) ([]caddy.Mod
 
 		// add this server block's keys to the matcher
 		// pair if it doesn't already exist
-		if addr.Host != "" && !slices.Contains(chosenMatcherPair.hostm, addr.Host) {
-			chosenMatcherPair.hostm = append(chosenMatcherPair.hostm, addr.Host)
+		if addr.Host != "" {
+			var found bool
+			for _, h := range chosenMatcherPair.hostm {
+				if h == addr.Host {
+					found = true
+					break
+				}
+			}
+			if !found {
+				chosenMatcherPair.hostm = append(chosenMatcherPair.hostm, addr.Host)
+			}
 		}
 	}
 
 	// iterate each pairing of host and path matchers and
 	// put them into a map for JSON encoding
-	var matcherSets []map[string]caddyhttp.RequestMatcherWithError
+	var matcherSets []map[string]caddyhttp.RequestMatcher
 	for _, mp := range matcherPairs {
-		matcherSet := make(map[string]caddyhttp.RequestMatcherWithError)
+		matcherSet := make(map[string]caddyhttp.RequestMatcher)
 		if len(mp.hostm) > 0 {
 			matcherSet["host"] = mp.hostm
 		}
@@ -1552,17 +1422,12 @@ func parseMatcherDefinitions(d *caddyfile.Dispenser, matchers map[string]caddy.M
 		if err != nil {
 			return err
 		}
-
-		if rm, ok := unm.(caddyhttp.RequestMatcherWithError); ok {
-			matchers[definitionName][matcherName] = caddyconfig.JSON(rm, nil)
-			return nil
+		rm, ok := unm.(caddyhttp.RequestMatcher)
+		if !ok {
+			return fmt.Errorf("matcher module '%s' is not a request matcher", matcherName)
 		}
-		// nolint:staticcheck
-		if rm, ok := unm.(caddyhttp.RequestMatcher); ok {
-			matchers[definitionName][matcherName] = caddyconfig.JSON(rm, nil)
-			return nil
-		}
-		return fmt.Errorf("matcher module '%s' is not a request matcher", matcherName)
+		matchers[definitionName][matcherName] = caddyconfig.JSON(rm, nil)
+		return nil
 	}
 
 	// if the next token is quoted, we can assume it's not a matcher name
@@ -1606,7 +1471,7 @@ func parseMatcherDefinitions(d *caddyfile.Dispenser, matchers map[string]caddy.M
 	return nil
 }
 
-func encodeMatcherSet(matchers map[string]caddyhttp.RequestMatcherWithError) (caddy.ModuleMap, error) {
+func encodeMatcherSet(matchers map[string]caddyhttp.RequestMatcher) (caddy.ModuleMap, error) {
 	msEncoded := make(caddy.ModuleMap)
 	for matcherName, val := range matchers {
 		jsonBytes, err := json.Marshal(val)
@@ -1666,6 +1531,16 @@ func tryDuration(val any, warnings *[]caddyconfig.Warning) caddy.Duration {
 	return durationVal
 }
 
+// sliceContains returns true if needle is in haystack.
+func sliceContains(haystack []string, needle string) bool {
+	for _, s := range haystack {
+		if s == needle {
+			return true
+		}
+	}
+	return false
+}
+
 // listenersUseAnyPortOtherThan returns true if there are any
 // listeners in addresses that use a port which is not otherPort.
 // Mostly borrowed from unexported method in caddyhttp package.
@@ -1686,18 +1561,6 @@ func listenersUseAnyPortOtherThan(addresses []string, otherPort string) bool {
 	return false
 }
 
-func mapContains[K comparable, V any](m map[K]V, keys []K) bool {
-	if len(m) == 0 || len(keys) == 0 {
-		return false
-	}
-	for _, key := range keys {
-		if _, ok := m[key]; ok {
-			return true
-		}
-	}
-	return false
-}
-
 // specificity returns len(s) minus any wildcards (*) and
 // placeholders ({...}). Basically, it's a length count
 // that penalizes the use of wildcards and placeholders.
@@ -1735,25 +1598,17 @@ func (c counter) nextGroup() string {
 }
 
 type namedCustomLog struct {
-	name       string
-	hostnames  []string
-	log        *caddy.CustomLog
-	noHostname bool
-}
-
-// addressWithProtocols associates a listen address with
-// the protocols to serve it with
-type addressWithProtocols struct {
-	address   string
-	protocols []string
+	name      string
+	hostnames []string
+	log       *caddy.CustomLog
 }
 
 // sbAddrAssociation is a mapping from a list of
-// addresses with protocols, and a list of server
-// blocks that are served on those addresses.
+// addresses to a list of server blocks that are
+// served on those addresses.
 type sbAddrAssociation struct {
-	addressesWithProtocols []addressWithProtocols
-	serverBlocks           []serverBlock
+	addresses    []string
+	serverBlocks []serverBlock
 }
 
 const (

caddyconfig/httpcaddyfile/options.go

@@ -15,17 +15,14 @@
 package httpcaddyfile
 
 import (
-	"slices"
 	"strconv"
 
 	"github.com/caddyserver/certmagic"
-	"github.com/libdns/libdns"
-	"github.com/mholt/acmez/v3/acme"
+	"github.com/mholt/acmez/v2/acme"
 
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
 	"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
-	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
 	"github.com/caddyserver/caddy/v2/modules/caddytls"
 )
 
@@ -33,20 +30,19 @@ func init() {
 	RegisterGlobalOption("debug", parseOptTrue)
 	RegisterGlobalOption("http_port", parseOptHTTPPort)
 	RegisterGlobalOption("https_port", parseOptHTTPSPort)
-	RegisterGlobalOption("default_bind", parseOptDefaultBind)
+	RegisterGlobalOption("default_bind", parseOptStringList)
 	RegisterGlobalOption("grace_period", parseOptDuration)
 	RegisterGlobalOption("shutdown_delay", parseOptDuration)
 	RegisterGlobalOption("default_sni", parseOptSingleString)
 	RegisterGlobalOption("fallback_sni", parseOptSingleString)
 	RegisterGlobalOption("order", parseOptOrder)
 	RegisterGlobalOption("storage", parseOptStorage)
-	RegisterGlobalOption("storage_check", parseStorageCheck)
-	RegisterGlobalOption("storage_clean_interval", parseStorageCleanInterval)
+	RegisterGlobalOption("storage_clean_interval", parseOptDuration)
 	RegisterGlobalOption("renew_interval", parseOptDuration)
 	RegisterGlobalOption("ocsp_interval", parseOptDuration)
 	RegisterGlobalOption("acme_ca", parseOptSingleString)
 	RegisterGlobalOption("acme_ca_root", parseOptSingleString)
-	RegisterGlobalOption("acme_dns", parseOptDNS)
+	RegisterGlobalOption("acme_dns", parseOptACMEDNS)
 	RegisterGlobalOption("acme_eab", parseOptACMEEAB)
 	RegisterGlobalOption("cert_issuer", parseOptCertIssuer)
 	RegisterGlobalOption("skip_install_trust", parseOptTrue)
@@ -56,15 +52,12 @@ func init() {
 	RegisterGlobalOption("local_certs", parseOptTrue)
 	RegisterGlobalOption("key_type", parseOptSingleString)
 	RegisterGlobalOption("auto_https", parseOptAutoHTTPS)
-	RegisterGlobalOption("metrics", parseMetricsOptions)
 	RegisterGlobalOption("servers", parseServerOptions)
 	RegisterGlobalOption("ocsp_stapling", parseOCSPStaplingOptions)
 	RegisterGlobalOption("cert_lifetime", parseOptDuration)
 	RegisterGlobalOption("log", parseLogOptions)
 	RegisterGlobalOption("preferred_chains", parseOptPreferredChains)
 	RegisterGlobalOption("persist_config", parseOptPersistConfig)
-	RegisterGlobalOption("dns", parseOptDNS)
-	RegisterGlobalOption("ech", parseOptECH)
 }
 
 func parseOptTrue(d *caddyfile.Dispenser, _ any) (any, error) { return true, nil }
@@ -117,12 +110,17 @@ func parseOptOrder(d *caddyfile.Dispenser, _ any) (any, error) {
 	}
 	pos := Positional(d.Val())
 
-	// if directive already had an order, drop it
-	newOrder := slices.DeleteFunc(directiveOrder, func(d string) bool {
-		return d == dirName
-	})
+	newOrder := directiveOrder
 
-	// act on the positional; if it's First or Last, we're done right away
+	// if directive exists, first remove it
+	for i, d := range newOrder {
+		if d == dirName {
+			newOrder = append(newOrder[:i], newOrder[i+1:]...)
+			break
+		}
+	}
+
+	// act on the positional
 	switch pos {
 	case First:
 		newOrder = append([]string{dirName}, newOrder...)
@@ -131,7 +129,6 @@ func parseOptOrder(d *caddyfile.Dispenser, _ any) (any, error) {
 		}
 		directiveOrder = newOrder
 		return newOrder, nil
-
 	case Last:
 		newOrder = append(newOrder, dirName)
 		if d.NextArg() {
@@ -139,11 +136,8 @@ func parseOptOrder(d *caddyfile.Dispenser, _ any) (any, error) {
 		}
 		directiveOrder = newOrder
 		return newOrder, nil
-
-	// if it's Before or After, continue
 	case Before:
 	case After:
-
 	default:
 		return nil, d.Errf("unknown positional '%s'", pos)
 	}
@@ -157,17 +151,17 @@ func parseOptOrder(d *caddyfile.Dispenser, _ any) (any, error) {
 		return nil, d.ArgErr()
 	}
 
-	// get the position of the target directive
-	targetIndex := slices.Index(newOrder, otherDir)
-	if targetIndex == -1 {
-		return nil, d.Errf("directive '%s' not found", otherDir)
+	// insert directive into proper position
+	for i, d := range newOrder {
+		if d == otherDir {
+			if pos == Before {
+				newOrder = append(newOrder[:i], append([]string{dirName}, newOrder[i:]...)...)
+			} else if pos == After {
+				newOrder = append(newOrder[:i+1], append([]string{dirName}, newOrder[i+1:]...)...)
+			}
+			break
+		}
 	}
-	// if we're inserting after, we need to increment the index to go after
-	if pos == After {
-		targetIndex++
-	}
-	// insert the directive into the new order
-	newOrder = slices.Insert(newOrder, targetIndex, dirName)
 
 	directiveOrder = newOrder
 
@@ -193,40 +187,6 @@ func parseOptStorage(d *caddyfile.Dispenser, _ any) (any, error) {
 	return storage, nil
 }
 
-func parseStorageCheck(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
-	if !d.Next() {
-		return "", d.ArgErr()
-	}
-	val := d.Val()
-	if d.Next() {
-		return "", d.ArgErr()
-	}
-	if val != "off" {
-		return "", d.Errf("storage_check must be 'off'")
-	}
-	return val, nil
-}
-
-func parseStorageCleanInterval(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
-	if !d.Next() {
-		return "", d.ArgErr()
-	}
-	val := d.Val()
-	if d.Next() {
-		return "", d.ArgErr()
-	}
-	if val == "off" {
-		return false, nil
-	}
-	dur, err := caddy.ParseDuration(d.Val())
-	if err != nil {
-		return nil, d.Errf("failed to parse storage_clean_interval, must be a duration or 'off' %w", err)
-	}
-	return caddy.Duration(dur), nil
-}
-
 func parseOptDuration(d *caddyfile.Dispenser, _ any) (any, error) {
 	if !d.Next() { // consume option name
 		return nil, d.ArgErr()
@@ -241,6 +201,25 @@ func parseOptDuration(d *caddyfile.Dispenser, _ any) (any, error) {
 	return caddy.Duration(dur), nil
 }
 
+func parseOptACMEDNS(d *caddyfile.Dispenser, _ any) (any, error) {
+	if !d.Next() { // consume option name
+		return nil, d.ArgErr()
+	}
+	if !d.Next() { // get DNS module name
+		return nil, d.ArgErr()
+	}
+	modID := "dns.providers." + d.Val()
+	unm, err := caddyfile.UnmarshalModule(d, modID)
+	if err != nil {
+		return nil, err
+	}
+	prov, ok := unm.(certmagic.DNSProvider)
+	if !ok {
+		return nil, d.Errf("module %s (%T) is not a certmagic.DNSProvider", modID, unm)
+	}
+	return prov, nil
+}
+
 func parseOptACMEEAB(d *caddyfile.Dispenser, _ any) (any, error) {
 	eab := new(acme.EAB)
 	d.Next() // consume option name
@@ -305,32 +284,13 @@ func parseOptSingleString(d *caddyfile.Dispenser, _ any) (any, error) {
 	return val, nil
 }
 
-func parseOptDefaultBind(d *caddyfile.Dispenser, _ any) (any, error) {
+func parseOptStringList(d *caddyfile.Dispenser, _ any) (any, error) {
 	d.Next() // consume option name
-
-	var addresses, protocols []string
-	addresses = d.RemainingArgs()
-
-	if len(addresses) == 0 {
-		addresses = append(addresses, "")
+	val := d.RemainingArgs()
+	if len(val) == 0 {
+		return "", d.ArgErr()
 	}
-
-	for d.NextBlock(0) {
-		switch d.Val() {
-		case "protocols":
-			protocols = d.RemainingArgs()
-			if len(protocols) == 0 {
-				return nil, d.Errf("protocols requires one or more arguments")
-			}
-		default:
-			return nil, d.Errf("unknown subdirective: %s", d.Val())
-		}
-	}
-
-	return []ConfigValue{{Class: "bind", Value: addressesWithProtocols{
-		addresses: addresses,
-		protocols: protocols,
-	}}}, nil
+	return val, nil
 }
 
 func parseOptAdmin(d *caddyfile.Dispenser, _ any) (any, error) {
@@ -415,10 +375,36 @@ func parseOptOnDemand(d *caddyfile.Dispenser, _ any) (any, error) {
 			ond.PermissionRaw = caddyconfig.JSONModuleObject(perm, "module", modName, nil)
 
 		case "interval":
-			return nil, d.Errf("the on_demand_tls 'interval' option is no longer supported, remove it from your config")
+			if !d.NextArg() {
+				return nil, d.ArgErr()
+			}
+			dur, err := caddy.ParseDuration(d.Val())
+			if err != nil {
+				return nil, err
+			}
+			if ond == nil {
+				ond = new(caddytls.OnDemandConfig)
+			}
+			if ond.RateLimit == nil {
+				ond.RateLimit = new(caddytls.RateLimit)
+			}
+			ond.RateLimit.Interval = caddy.Duration(dur)
 
 		case "burst":
-			return nil, d.Errf("the on_demand_tls 'burst' option is no longer supported, remove it from your config")
+			if !d.NextArg() {
+				return nil, d.ArgErr()
+			}
+			burst, err := strconv.Atoi(d.Val())
+			if err != nil {
+				return nil, err
+			}
+			if ond == nil {
+				ond = new(caddytls.OnDemandConfig)
+			}
+			if ond.RateLimit == nil {
+				ond.RateLimit = new(caddytls.RateLimit)
+			}
+			ond.RateLimit.Burst = burst
 
 		default:
 			return nil, d.Errf("unrecognized parameter '%s'", d.Val())
@@ -447,42 +433,19 @@ func parseOptPersistConfig(d *caddyfile.Dispenser, _ any) (any, error) {
 
 func parseOptAutoHTTPS(d *caddyfile.Dispenser, _ any) (any, error) {
 	d.Next() // consume option name
-	val := d.RemainingArgs()
-	if len(val) == 0 {
+	if !d.Next() {
 		return "", d.ArgErr()
 	}
-	for _, v := range val {
-		switch v {
-		case "off":
-		case "disable_redirects":
-		case "disable_certs":
-		case "ignore_loaded_certs":
-		case "prefer_wildcard":
-		default:
-			return "", d.Errf("auto_https must be one of 'off', 'disable_redirects', 'disable_certs', 'ignore_loaded_certs', or 'prefer_wildcard'")
-		}
+	val := d.Val()
+	if d.Next() {
+		return "", d.ArgErr()
+	}
+	if val != "off" && val != "disable_redirects" && val != "disable_certs" && val != "ignore_loaded_certs" {
+		return "", d.Errf("auto_https must be one of 'off', 'disable_redirects', 'disable_certs', or 'ignore_loaded_certs'")
 	}
 	return val, nil
 }
 
-func unmarshalCaddyfileMetricsOptions(d *caddyfile.Dispenser) (any, error) {
-	d.Next() // consume option name
-	metrics := new(caddyhttp.Metrics)
-	for d.NextBlock(0) {
-		switch d.Val() {
-		case "per_host":
-			metrics.PerHost = true
-		default:
-			return nil, d.Errf("unrecognized servers option '%s'", d.Val())
-		}
-	}
-	return metrics, nil
-}
-
-func parseMetricsOptions(d *caddyfile.Dispenser, _ any) (any, error) {
-	return unmarshalCaddyfileMetricsOptions(d)
-}
-
 func parseServerOptions(d *caddyfile.Dispenser, _ any) (any, error) {
 	return unmarshalCaddyfileServerOptions(d)
 }
@@ -552,74 +515,3 @@ func parseOptPreferredChains(d *caddyfile.Dispenser, _ any) (any, error) {
 	d.Next()
 	return caddytls.ParseCaddyfilePreferredChainsOptions(d)
 }
-
-func parseOptDNS(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
-	optName := d.Val()
-
-	// get DNS module name
-	if !d.Next() {
-		// this is allowed if this is the "acme_dns" option since it may refer to the globally-configured "dns" option's value
-		if optName == "acme_dns" {
-			return nil, nil
-		}
-		return nil, d.ArgErr()
-	}
-	modID := "dns.providers." + d.Val()
-	unm, err := caddyfile.UnmarshalModule(d, modID)
-	if err != nil {
-		return nil, err
-	}
-	switch unm.(type) {
-	case libdns.RecordGetter,
-		libdns.RecordSetter,
-		libdns.RecordAppender,
-		libdns.RecordDeleter:
-	default:
-		return nil, d.Errf("module %s (%T) is not a libdns provider", modID, unm)
-	}
-	return unm, nil
-}
-
-func parseOptECH(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
-
-	ech := new(caddytls.ECH)
-
-	publicNames := d.RemainingArgs()
-	for _, publicName := range publicNames {
-		ech.Configs = append(ech.Configs, caddytls.ECHConfiguration{
-			PublicName: publicName,
-		})
-	}
-	if len(ech.Configs) == 0 {
-		return nil, d.ArgErr()
-	}
-
-	for nesting := d.Nesting(); d.NextBlock(nesting); {
-		switch d.Val() {
-		case "dns":
-			if !d.Next() {
-				return nil, d.ArgErr()
-			}
-			providerName := d.Val()
-			modID := "dns.providers." + providerName
-			unm, err := caddyfile.UnmarshalModule(d, modID)
-			if err != nil {
-				return nil, err
-			}
-			ech.Publication = append(ech.Publication, &caddytls.ECHPublication{
-				Configs: publicNames,
-				PublishersRaw: caddy.ModuleMap{
-					"dns": caddyconfig.JSON(caddytls.ECHDNSPublisher{
-						ProviderRaw: caddyconfig.JSONModuleObject(unm, "name", providerName, nil),
-					}, nil),
-				},
-			})
-		default:
-			return nil, d.Errf("ech: unrecognized subdirective '%s'", d.Val())
-		}
-	}
-
-	return ech, nil
-}

caddyconfig/httpcaddyfile/serveroptions.go

@@ -17,7 +17,6 @@ package httpcaddyfile
 import (
 	"encoding/json"
 	"fmt"
-	"slices"
 
 	"github.com/dustin/go-humanize"
 
@@ -51,7 +50,6 @@ type serverOptions struct {
 	ClientIPHeaders      []string
 	ShouldLogCredentials bool
 	Metrics              *caddyhttp.Metrics
-	Trace                bool // TODO: EXPERIMENTAL
 }
 
 func unmarshalCaddyfileServerOptions(d *caddyfile.Dispenser) (any, error) {
@@ -181,7 +179,7 @@ func unmarshalCaddyfileServerOptions(d *caddyfile.Dispenser) (any, error) {
 				if proto != "h1" && proto != "h2" && proto != "h2c" && proto != "h3" {
 					return nil, d.Errf("unknown protocol '%s': expected h1, h2, h2c, or h3", proto)
 				}
-				if slices.Contains(serverOpts.Protocols, proto) {
+				if sliceContains(serverOpts.Protocols, proto) {
 					return nil, d.Errf("protocol %s specified more than once", proto)
 				}
 				serverOpts.Protocols = append(serverOpts.Protocols, proto)
@@ -230,7 +228,7 @@ func unmarshalCaddyfileServerOptions(d *caddyfile.Dispenser) (any, error) {
 		case "client_ip_headers":
 			headers := d.RemainingArgs()
 			for _, header := range headers {
-				if slices.Contains(serverOpts.ClientIPHeaders, header) {
+				if sliceContains(serverOpts.ClientIPHeaders, header) {
 					return nil, d.Errf("client IP header %s specified more than once", header)
 				}
 				serverOpts.ClientIPHeaders = append(serverOpts.ClientIPHeaders, header)
@@ -240,22 +238,47 @@ func unmarshalCaddyfileServerOptions(d *caddyfile.Dispenser) (any, error) {
 			}
 
 		case "metrics":
-			caddy.Log().Warn("The nested 'metrics' option inside `servers` is deprecated and will be removed in the next major version. Use the global 'metrics' option instead.")
-			serverOpts.Metrics = new(caddyhttp.Metrics)
-			for nesting := d.Nesting(); d.NextBlock(nesting); {
-				switch d.Val() {
-				case "per_host":
-					serverOpts.Metrics.PerHost = true
-				default:
-					return nil, d.Errf("unrecognized metrics option '%s'", d.Val())
-				}
-			}
-
-		case "trace":
 			if d.NextArg() {
 				return nil, d.ArgErr()
 			}
-			serverOpts.Trace = true
+			if nesting := d.Nesting(); d.NextBlock(nesting) {
+				return nil, d.ArgErr()
+			}
+			serverOpts.Metrics = new(caddyhttp.Metrics)
+
+		// TODO: DEPRECATED. (August 2022)
+		case "protocol":
+			caddy.Log().Named("caddyfile").Warn("DEPRECATED: protocol sub-option will be removed soon")
+
+			for nesting := d.Nesting(); d.NextBlock(nesting); {
+				switch d.Val() {
+				case "allow_h2c":
+					caddy.Log().Named("caddyfile").Warn("DEPRECATED: allow_h2c will be removed soon; use protocols option instead")
+
+					if d.NextArg() {
+						return nil, d.ArgErr()
+					}
+					if sliceContains(serverOpts.Protocols, "h2c") {
+						return nil, d.Errf("protocol h2c already specified")
+					}
+					serverOpts.Protocols = append(serverOpts.Protocols, "h2c")
+
+				case "strict_sni_host":
+					caddy.Log().Named("caddyfile").Warn("DEPRECATED: protocol > strict_sni_host in this position will be removed soon; move up to the servers block instead")
+
+					if d.NextArg() && d.Val() != "insecure_off" && d.Val() != "on" {
+						return nil, d.Errf("strict_sni_host only supports 'on' or 'insecure_off', got '%s'", d.Val())
+					}
+					boolVal := true
+					if d.Val() == "insecure_off" {
+						boolVal = false
+					}
+					serverOpts.StrictSNIHost = &boolVal
+
+				default:
+					return nil, d.Errf("unrecognized protocol option '%s'", d.Val())
+				}
+			}
 
 		default:
 			return nil, d.Errf("unrecognized servers option '%s'", d.Val())
@@ -292,15 +315,24 @@ func applyServerOptions(
 
 	for key, server := range servers {
 		// find the options that apply to this server
-		optsIndex := slices.IndexFunc(serverOpts, func(s serverOptions) bool {
-			return s.ListenerAddress == "" || slices.Contains(server.Listen, s.ListenerAddress)
-		})
+		opts := func() *serverOptions {
+			for _, entry := range serverOpts {
+				if entry.ListenerAddress == "" {
+					return &entry
+				}
+				for _, listener := range server.Listen {
+					if entry.ListenerAddress == listener {
+						return &entry
+					}
+				}
+			}
+			return nil
+		}()
 
 		// if none apply, then move to the next server
-		if optsIndex == -1 {
+		if opts == nil {
 			continue
 		}
-		opts := serverOpts[optsIndex]
 
 		// set all the options
 		server.ListenerWrappersRaw = opts.ListenerWrappersRaw
@@ -319,17 +351,10 @@ func applyServerOptions(
 		server.Metrics = opts.Metrics
 		if opts.ShouldLogCredentials {
 			if server.Logs == nil {
-				server.Logs = new(caddyhttp.ServerLogConfig)
+				server.Logs = &caddyhttp.ServerLogConfig{}
 			}
 			server.Logs.ShouldLogCredentials = opts.ShouldLogCredentials
 		}
-		if opts.Trace {
-			// TODO: THIS IS EXPERIMENTAL (MAY 2024)
-			if server.Logs == nil {
-				server.Logs = new(caddyhttp.ServerLogConfig)
-			}
-			server.Logs.Trace = opts.Trace
-		}
 
 		if opts.Name != "" {
 			nameReplacements[key] = opts.Name

caddyconfig/httpcaddyfile/shorthands.go

@@ -36,7 +36,6 @@ func NewShorthandReplacer() ShorthandReplacer {
 		{regexp.MustCompile(`{re\.([\w-\.]*)}`), "{http.regexp.$1}"},
 		{regexp.MustCompile(`{vars\.([\w-]*)}`), "{http.vars.$1}"},
 		{regexp.MustCompile(`{rp\.([\w-\.]*)}`), "{http.reverse_proxy.$1}"},
-		{regexp.MustCompile(`{resp\.([\w-\.]*)}`), "{http.intercept.$1}"},
 		{regexp.MustCompile(`{err\.([\w-\.]*)}`), "{http.error.$1}"},
 		{regexp.MustCompile(`{file_match\.([\w-]*)}`), "{http.matchers.file.$1}"},
 	}
@@ -52,30 +51,19 @@ func NewShorthandReplacer() ShorthandReplacer {
 // be used in the Caddyfile, and the right is the replacement.
 func placeholderShorthands() []string {
 	return []string{
+		"{dir}", "{http.request.uri.path.dir}",
+		"{file}", "{http.request.uri.path.file}",
 		"{host}", "{http.request.host}",
 		"{hostport}", "{http.request.hostport}",
 		"{port}", "{http.request.port}",
-		"{orig_method}", "{http.request.orig_method}",
-		"{orig_uri}", "{http.request.orig_uri}",
-		"{orig_path}", "{http.request.orig_uri.path}",
-		"{orig_dir}", "{http.request.orig_uri.path.dir}",
-		"{orig_file}", "{http.request.orig_uri.path.file}",
-		"{orig_query}", "{http.request.orig_uri.query}",
-		"{orig_?query}", "{http.request.orig_uri.prefixed_query}",
 		"{method}", "{http.request.method}",
-		"{uri}", "{http.request.uri}",
-		"{%uri}", "{http.request.uri_escaped}",
 		"{path}", "{http.request.uri.path}",
-		"{%path}", "{http.request.uri.path_escaped}",
-		"{dir}", "{http.request.uri.path.dir}",
-		"{file}", "{http.request.uri.path.file}",
 		"{query}", "{http.request.uri.query}",
-		"{%query}", "{http.request.uri.query_escaped}",
-		"{?query}", "{http.request.uri.prefixed_query}",
 		"{remote}", "{http.request.remote}",
 		"{remote_host}", "{http.request.remote.host}",
 		"{remote_port}", "{http.request.remote.port}",
 		"{scheme}", "{http.request.scheme}",
+		"{uri}", "{http.request.uri}",
 		"{uuid}", "{http.request.uuid}",
 		"{tls_cipher}", "{http.request.tls.cipher_suite}",
 		"{tls_version}", "{http.request.tls.version}",

caddyconfig/httpcaddyfile/tlsapp.go

@@ -19,13 +19,12 @@ import (
 	"encoding/json"
 	"fmt"
 	"reflect"
-	"slices"
 	"sort"
 	"strconv"
 	"strings"
 
 	"github.com/caddyserver/certmagic"
-	"github.com/mholt/acmez/v3/acme"
+	"github.com/mholt/acmez/v2/acme"
 
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
@@ -45,8 +44,8 @@ func (st ServerType) buildTLSApp(
 	if hp, ok := options["http_port"].(int); ok {
 		httpPort = strconv.Itoa(hp)
 	}
-	autoHTTPS := []string{}
-	if ah, ok := options["auto_https"].([]string); ok {
+	autoHTTPS := "on"
+	if ah, ok := options["auto_https"].(string); ok {
 		autoHTTPS = ah
 	}
 
@@ -54,25 +53,23 @@ func (st ServerType) buildTLSApp(
 	// key, so that they don't get forgotten/omitted by auto-HTTPS
 	// (since they won't appear in route matchers)
 	httpsHostsSharedWithHostlessKey := make(map[string]struct{})
-	if !slices.Contains(autoHTTPS, "off") {
+	if autoHTTPS != "off" {
 		for _, pair := range pairings {
 			for _, sb := range pair.serverBlocks {
-				for _, addr := range sb.parsedKeys {
-					if addr.Host != "" {
-						continue
-					}
-
-					// this server block has a hostless key, now
-					// go through and add all the hosts to the set
-					for _, otherAddr := range sb.parsedKeys {
-						if otherAddr.Original == addr.Original {
-							continue
-						}
-						if otherAddr.Host != "" && otherAddr.Scheme != "http" && otherAddr.Port != httpPort {
-							httpsHostsSharedWithHostlessKey[otherAddr.Host] = struct{}{}
+				for _, addr := range sb.keys {
+					if addr.Host == "" {
+						// this server block has a hostless key, now
+						// go through and add all the hosts to the set
+						for _, otherAddr := range sb.keys {
+							if otherAddr.Original == addr.Original {
+								continue
+							}
+							if otherAddr.Host != "" && otherAddr.Scheme != "http" && otherAddr.Port != httpPort {
+								httpsHostsSharedWithHostlessKey[otherAddr.Host] = struct{}{}
+							}
 						}
+						break
 					}
-					break
 				}
 			}
 		}
@@ -92,33 +89,9 @@ func (st ServerType) buildTLSApp(
 		tlsApp.Automation.Policies = append(tlsApp.Automation.Policies, catchAllAP)
 	}
 
-	var wildcardHosts []string                        // collect all hosts that have a wildcard in them, and aren't HTTP
-	forcedAutomatedNames := make(map[string]struct{}) // explicitly configured to be automated, even if covered by a wildcard
-
-	for _, p := range pairings {
-		var addresses []string
-		for _, addressWithProtocols := range p.addressesWithProtocols {
-			addresses = append(addresses, addressWithProtocols.address)
-		}
-		if !listenersUseAnyPortOtherThan(addresses, httpPort) {
-			continue
-		}
-		for _, sblock := range p.serverBlocks {
-			for _, addr := range sblock.parsedKeys {
-				if strings.HasPrefix(addr.Host, "*.") {
-					wildcardHosts = append(wildcardHosts, addr.Host[2:])
-				}
-			}
-		}
-	}
-
 	for _, p := range pairings {
 		// avoid setting up TLS automation policies for a server that is HTTP-only
-		var addresses []string
-		for _, addressWithProtocols := range p.addressesWithProtocols {
-			addresses = append(addresses, addressWithProtocols.address)
-		}
-		if !listenersUseAnyPortOtherThan(addresses, httpPort) {
+		if !listenersUseAnyPortOtherThan(p.addresses, httpPort) {
 			continue
 		}
 
@@ -135,12 +108,6 @@ func (st ServerType) buildTLSApp(
 				return nil, warnings, err
 			}
 
-			// make a plain copy so we can compare whether we made any changes
-			apCopy, err := newBaseAutomationPolicy(options, warnings, true)
-			if err != nil {
-				return nil, warnings, err
-			}
-
 			sblockHosts := sblock.hostsFromKeys(false)
 			if len(sblockHosts) == 0 && catchAllAP != nil {
 				ap = catchAllAP
@@ -151,13 +118,6 @@ func (st ServerType) buildTLSApp(
 				ap.OnDemand = true
 			}
 
-			// collect hosts that are forced to have certs automated for their specific name
-			if _, ok := sblock.pile["tls.force_automate"]; ok {
-				for _, host := range sblockHosts {
-					forcedAutomatedNames[host] = struct{}{}
-				}
-			}
-
 			// reuse private keys tls
 			if _, ok := sblock.pile["tls.reuse_private_keys"]; ok {
 				ap.ReusePrivateKeys = true
@@ -221,8 +181,8 @@ func (st ServerType) buildTLSApp(
 					if acmeIssuer.Challenges.BindHost == "" {
 						// only binding to one host is supported
 						var bindHost string
-						if asserted, ok := cfgVal.Value.(addressesWithProtocols); ok && len(asserted.addresses) > 0 {
-							bindHost = asserted.addresses[0]
+						if bindHosts, ok := cfgVal.Value.([]string); ok && len(bindHosts) > 0 {
+							bindHost = bindHosts[0]
 						}
 						acmeIssuer.Challenges.BindHost = bindHost
 					}
@@ -250,21 +210,9 @@ func (st ServerType) buildTLSApp(
 				catchAllAP = ap
 			}
 
-			hostsNotHTTP := sblock.hostsFromKeysNotHTTP(httpPort)
-			sort.Strings(hostsNotHTTP) // solely for deterministic test results
-
-			// if the we prefer wildcards and the AP is unchanged,
-			// then we can skip this AP because it should be covered
-			// by an AP with a wildcard
-			if slices.Contains(autoHTTPS, "prefer_wildcard") {
-				if hostsCoveredByWildcard(hostsNotHTTP, wildcardHosts) &&
-					reflect.DeepEqual(ap, apCopy) {
-					continue
-				}
-			}
-
 			// associate our new automation policy with this server block's hosts
-			ap.SubjectsRaw = hostsNotHTTP
+			ap.SubjectsRaw = sblock.hostsFromKeysNotHTTP(httpPort)
+			sort.Strings(ap.SubjectsRaw) // solely for deterministic test results
 
 			// if a combination of public and internal names were given
 			// for this same server block and no issuer was specified, we
@@ -303,7 +251,6 @@ func (st ServerType) buildTLSApp(
 					ap2.IssuersRaw = []json.RawMessage{caddyconfig.JSONModuleObject(caddytls.InternalIssuer{}, "module", "internal", &warnings)}
 				}
 			}
-
 			if tlsApp.Automation == nil {
 				tlsApp.Automation = new(caddytls.AutomationConfig)
 			}
@@ -338,7 +285,7 @@ func (st ServerType) buildTLSApp(
 					combined = reflect.New(reflect.TypeOf(cl)).Elem()
 				}
 				clVal := reflect.ValueOf(cl)
-				for i := range clVal.Len() {
+				for i := 0; i < clVal.Len(); i++ {
 					combined = reflect.Append(combined, clVal.Index(i))
 				}
 				loadersByName[name] = combined.Interface().(caddytls.CertificateLoader)
@@ -357,42 +304,6 @@ func (st ServerType) buildTLSApp(
 		tlsApp.Automation.OnDemand = onDemand
 	}
 
-	// set up "global" (to the TLS app) DNS provider config
-	if globalDNS, ok := options["dns"]; ok && globalDNS != nil {
-		tlsApp.DNSRaw = caddyconfig.JSONModuleObject(globalDNS, "name", globalDNS.(caddy.Module).CaddyModule().ID.Name(), nil)
-	}
-
-	// set up ECH from Caddyfile options
-	if ech, ok := options["ech"].(*caddytls.ECH); ok {
-		tlsApp.EncryptedClientHello = ech
-
-		// outer server names will need certificates, so make sure they're included
-		// in an automation policy for them that applies any global options
-		ap, err := newBaseAutomationPolicy(options, warnings, true)
-		if err != nil {
-			return nil, warnings, err
-		}
-		for _, cfg := range ech.Configs {
-			if cfg.PublicName != "" {
-				ap.SubjectsRaw = append(ap.SubjectsRaw, cfg.PublicName)
-			}
-		}
-		if tlsApp.Automation == nil {
-			tlsApp.Automation = new(caddytls.AutomationConfig)
-		}
-		tlsApp.Automation.Policies = append(tlsApp.Automation.Policies, ap)
-	}
-
-	// if the storage clean interval is a boolean, then it's "off" to disable cleaning
-	if sc, ok := options["storage_check"].(string); ok && sc == "off" {
-		tlsApp.DisableStorageCheck = true
-	}
-
-	// if the storage clean interval is a boolean, then it's "off" to disable cleaning
-	if sci, ok := options["storage_clean_interval"].(bool); ok && !sci {
-		tlsApp.DisableStorageClean = true
-	}
-
 	// set the storage clean interval if configured
 	if storageCleanInterval, ok := options["storage_clean_interval"].(caddy.Duration); ok {
 		if tlsApp.Automation == nil {
@@ -433,7 +344,7 @@ func (st ServerType) buildTLSApp(
 	internalAP := &caddytls.AutomationPolicy{
 		IssuersRaw: []json.RawMessage{json.RawMessage(`{"module":"internal"}`)},
 	}
-	if !slices.Contains(autoHTTPS, "off") && !slices.Contains(autoHTTPS, "disable_certs") {
+	if autoHTTPS != "off" && autoHTTPS != "disable_certs" {
 		for h := range httpsHostsSharedWithHostlessKey {
 			al = append(al, h)
 			if !certmagic.SubjectQualifiesForPublicCert(h) {
@@ -441,13 +352,6 @@ func (st ServerType) buildTLSApp(
 			}
 		}
 	}
-	for name := range forcedAutomatedNames {
-		if slices.Contains(al, name) {
-			continue
-		}
-		al = append(al, name)
-	}
-	slices.Sort(al) // to stabilize the adapt output
 	if len(al) > 0 {
 		tlsApp.CertificatesRaw["automate"] = caddyconfig.JSON(al, &warnings)
 	}
@@ -464,12 +368,12 @@ func (st ServerType) buildTLSApp(
 		globalEmail := options["email"]
 		globalACMECA := options["acme_ca"]
 		globalACMECARoot := options["acme_ca_root"]
-		_, globalACMEDNS := options["acme_dns"] // can be set to nil (to use globally-defined "dns" value instead), but it is still set
+		globalACMEDNS := options["acme_dns"]
 		globalACMEEAB := options["acme_eab"]
 		globalPreferredChains := options["preferred_chains"]
-		hasGlobalACMEDefaults := globalEmail != nil || globalACMECA != nil || globalACMECARoot != nil || globalACMEDNS || globalACMEEAB != nil || globalPreferredChains != nil
+		hasGlobalACMEDefaults := globalEmail != nil || globalACMECA != nil || globalACMECARoot != nil || globalACMEDNS != nil || globalACMEEAB != nil || globalPreferredChains != nil
 		if hasGlobalACMEDefaults {
-			for i := range tlsApp.Automation.Policies {
+			for i := 0; i < len(tlsApp.Automation.Policies); i++ {
 				ap := tlsApp.Automation.Policies[i]
 				if len(ap.Issuers) == 0 && automationPolicyHasAllPublicNames(ap) {
 					// for public names, create default issuers which will later be filled in with configured global defaults
@@ -549,11 +453,10 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
 	globalEmail := options["email"]
 	globalACMECA := options["acme_ca"]
 	globalACMECARoot := options["acme_ca_root"]
-	globalACMEDNS, globalACMEDNSok := options["acme_dns"] // can be set to nil (to use globally-defined "dns" value instead), but it is still set
+	globalACMEDNS := options["acme_dns"]
 	globalACMEEAB := options["acme_eab"]
 	globalPreferredChains := options["preferred_chains"]
 	globalCertLifetime := options["cert_lifetime"]
-	globalHTTPPort, globalHTTPSPort := options["http_port"], options["https_port"]
 
 	if globalEmail != nil && acmeIssuer.Email == "" {
 		acmeIssuer.Email = globalEmail.(string)
@@ -561,25 +464,14 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
 	if globalACMECA != nil && acmeIssuer.CA == "" {
 		acmeIssuer.CA = globalACMECA.(string)
 	}
-	if globalACMECARoot != nil && !slices.Contains(acmeIssuer.TrustedRootsPEMFiles, globalACMECARoot.(string)) {
+	if globalACMECARoot != nil && !sliceContains(acmeIssuer.TrustedRootsPEMFiles, globalACMECARoot.(string)) {
 		acmeIssuer.TrustedRootsPEMFiles = append(acmeIssuer.TrustedRootsPEMFiles, globalACMECARoot.(string))
 	}
-	if globalACMEDNSok {
-		globalDNS := options["dns"]
-		if globalDNS != nil {
-			// If global `dns` is set, do NOT set provider in issuer, just set empty dns config
-			acmeIssuer.Challenges = &caddytls.ChallengesConfig{
-				DNS: &caddytls.DNSChallengeConfig{},
-			}
-		} else if globalACMEDNS != nil {
-			// Set a global DNS provider if `acme_dns` is set and `dns` is NOT set
-			acmeIssuer.Challenges = &caddytls.ChallengesConfig{
-				DNS: &caddytls.DNSChallengeConfig{
-					ProviderRaw: caddyconfig.JSONModuleObject(globalACMEDNS, "name", globalACMEDNS.(caddy.Module).CaddyModule().ID.Name(), nil),
-				},
-			}
-		} else {
-			return fmt.Errorf("acme_dns specified without DNS provider config, but no provider specified with 'dns' global option")
+	if globalACMEDNS != nil && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.DNS == nil) {
+		acmeIssuer.Challenges = &caddytls.ChallengesConfig{
+			DNS: &caddytls.DNSChallengeConfig{
+				ProviderRaw: caddyconfig.JSONModuleObject(globalACMEDNS, "name", globalACMEDNS.(caddy.Module).CaddyModule().ID.Name(), nil),
+			},
 		}
 	}
 	if globalACMEEAB != nil && acmeIssuer.ExternalAccount == nil {
@@ -588,25 +480,7 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
 	if globalPreferredChains != nil && acmeIssuer.PreferredChains == nil {
 		acmeIssuer.PreferredChains = globalPreferredChains.(*caddytls.ChainPreference)
 	}
-	// only configure alt HTTP and TLS-ALPN ports if the DNS challenge is not enabled (wouldn't hurt, but isn't necessary since the DNS challenge is exclusive of others)
-	if globalHTTPPort != nil && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.DNS == nil) && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.HTTP == nil || acmeIssuer.Challenges.HTTP.AlternatePort == 0) {
-		if acmeIssuer.Challenges == nil {
-			acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
-		}
-		if acmeIssuer.Challenges.HTTP == nil {
-			acmeIssuer.Challenges.HTTP = new(caddytls.HTTPChallengeConfig)
-		}
-		acmeIssuer.Challenges.HTTP.AlternatePort = globalHTTPPort.(int)
-	}
-	if globalHTTPSPort != nil && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.DNS == nil) && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.TLSALPN == nil || acmeIssuer.Challenges.TLSALPN.AlternatePort == 0) {
-		if acmeIssuer.Challenges == nil {
-			acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
-		}
-		if acmeIssuer.Challenges.TLSALPN == nil {
-			acmeIssuer.Challenges.TLSALPN = new(caddytls.TLSALPNChallengeConfig)
-		}
-		acmeIssuer.Challenges.TLSALPN.AlternatePort = globalHTTPSPort.(int)
-	}
+
 	if globalCertLifetime != nil && acmeIssuer.CertificateLifetime == 0 {
 		acmeIssuer.CertificateLifetime = globalCertLifetime.(caddy.Duration)
 	}
@@ -627,18 +501,12 @@ func newBaseAutomationPolicy(
 	_, hasLocalCerts := options["local_certs"]
 	keyType, hasKeyType := options["key_type"]
 	ocspStapling, hasOCSPStapling := options["ocsp_stapling"]
-	hasGlobalAutomationOpts := hasIssuers || hasLocalCerts || hasKeyType || hasOCSPStapling
 
-	globalACMECA := options["acme_ca"]
-	globalACMECARoot := options["acme_ca_root"]
-	_, globalACMEDNS := options["acme_dns"] // can be set to nil (to use globally-defined "dns" value instead), but it is still set
-	globalACMEEAB := options["acme_eab"]
-	globalPreferredChains := options["preferred_chains"]
-	hasGlobalACMEDefaults := globalACMECA != nil || globalACMECARoot != nil || globalACMEDNS || globalACMEEAB != nil || globalPreferredChains != nil
+	hasGlobalAutomationOpts := hasIssuers || hasLocalCerts || hasKeyType || hasOCSPStapling
 
 	// if there are no global options related to automation policies
 	// set, then we can just return right away
-	if !hasGlobalAutomationOpts && !hasGlobalACMEDefaults {
+	if !hasGlobalAutomationOpts {
 		if always {
 			return new(caddytls.AutomationPolicy), nil
 		}
@@ -660,14 +528,6 @@ func newBaseAutomationPolicy(
 		ap.Issuers = []certmagic.Issuer{new(caddytls.InternalIssuer)}
 	}
 
-	if hasGlobalACMEDefaults {
-		for i := range ap.Issuers {
-			if err := fillInGlobalACMEDefaults(ap.Issuers[i], options); err != nil {
-				return nil, fmt.Errorf("filling in global issuer defaults for issuer %d: %v", i, err)
-			}
-		}
-	}
-
 	if hasOCSPStapling {
 		ocspConfig := ocspStapling.(certmagic.OCSPConfig)
 		ap.DisableOCSPStapling = ocspConfig.DisableStapling
@@ -702,7 +562,7 @@ func consolidateAutomationPolicies(aps []*caddytls.AutomationPolicy) []*caddytls
 			if !automationPolicyHasAllPublicNames(aps[i]) {
 				// if this automation policy has internal names, we might as well remove it
 				// so auto-https can implicitly use the internal issuer
-				aps = slices.Delete(aps, i, i+1)
+				aps = append(aps[:i], aps[i+1:]...)
 				i--
 			}
 		}
@@ -719,7 +579,7 @@ outer:
 		for j := i + 1; j < len(aps); j++ {
 			// if they're exactly equal in every way, just keep one of them
 			if reflect.DeepEqual(aps[i], aps[j]) {
-				aps = slices.Delete(aps, j, j+1)
+				aps = append(aps[:j], aps[j+1:]...)
 				// must re-evaluate current i against next j; can't skip it!
 				// even if i decrements to -1, will be incremented to 0 immediately
 				i--
@@ -749,18 +609,18 @@ outer:
 					// cause example.com to be served by the less specific policy for
 					// '*.com', which might be different (yes we've seen this happen)
 					if automationPolicyShadows(i, aps) >= j {
-						aps = slices.Delete(aps, i, i+1)
+						aps = append(aps[:i], aps[i+1:]...)
 						i--
 						continue outer
 					}
 				} else {
 					// avoid repeated subjects
 					for _, subj := range aps[j].SubjectsRaw {
-						if !slices.Contains(aps[i].SubjectsRaw, subj) {
+						if !sliceContains(aps[i].SubjectsRaw, subj) {
 							aps[i].SubjectsRaw = append(aps[i].SubjectsRaw, subj)
 						}
 					}
-					aps = slices.Delete(aps, j, j+1)
+					aps = append(aps[:j], aps[j+1:]...)
 					j--
 				}
 			}
@@ -780,9 +640,13 @@ func automationPolicyIsSubset(a, b *caddytls.AutomationPolicy) bool {
 		return false
 	}
 	for _, aSubj := range a.SubjectsRaw {
-		inSuperset := slices.ContainsFunc(b.SubjectsRaw, func(bSubj string) bool {
-			return certmagic.MatchWildcard(aSubj, bSubj)
-		})
+		var inSuperset bool
+		for _, bSubj := range b.SubjectsRaw {
+			if certmagic.MatchWildcard(aSubj, bSubj) {
+				inSuperset = true
+				break
+			}
+		}
 		if !inSuperset {
 			return false
 		}
@@ -827,28 +691,14 @@ func subjectQualifiesForPublicCert(ap *caddytls.AutomationPolicy, subj string) b
 // automationPolicyHasAllPublicNames returns true if all the names on the policy
 // do NOT qualify for public certs OR are tailscale domains.
 func automationPolicyHasAllPublicNames(ap *caddytls.AutomationPolicy) bool {
-	return !slices.ContainsFunc(ap.SubjectsRaw, func(i string) bool {
-		return !subjectQualifiesForPublicCert(ap, i) || isTailscaleDomain(i)
-	})
+	for _, subj := range ap.SubjectsRaw {
+		if !subjectQualifiesForPublicCert(ap, subj) || isTailscaleDomain(subj) {
+			return false
+		}
+	}
+	return true
 }
 
 func isTailscaleDomain(name string) bool {
 	return strings.HasSuffix(strings.ToLower(name), ".ts.net")
 }
-
-func hostsCoveredByWildcard(hosts []string, wildcards []string) bool {
-	if len(hosts) == 0 || len(wildcards) == 0 {
-		return false
-	}
-	for _, host := range hosts {
-		for _, wildcard := range wildcards {
-			if strings.HasPrefix(host, "*.") {
-				continue
-			}
-			if certmagic.MatchWildcard(host, "*."+wildcard) {
-				return true
-			}
-		}
-	}
-	return false
-}

caddyconfig/httploader.go

@@ -35,7 +35,7 @@ func init() {
 // If the response is not a JSON config, a config adapter must be specified
 // either in the loader config (`adapter`), or in the Content-Type HTTP header
 // returned in the HTTP response from the server. The Content-Type header is
-// read just like the admin API's `/load` endpoint. If you don't have control
+// read just like the admin API's `/load` endpoint. Uf you don't have control
 // over the HTTP server (but can still trust its response), you can override
 // the Content-Type header by setting the `adapter` property in this config.
 type HTTPLoader struct {

caddytest/caddytest.go

@@ -31,12 +31,12 @@ import (
 	_ "github.com/caddyserver/caddy/v2/modules/standard"
 )
 
-// Config store any configuration required to make the tests run
-type Config struct {
+// Defaults store any configuration required to make the tests run
+type Defaults struct {
 	// Port we expect caddy to listening on
 	AdminPort int
 	// Certificates we expect to be loaded before attempting to run the tests
-	Certificates []string
+	Certifcates []string
 	// TestRequestTimeout is the time to wait for a http request to
 	TestRequestTimeout time.Duration
 	// LoadRequestTimeout is the time to wait for the config to be loaded against the caddy server
@@ -44,9 +44,9 @@ type Config struct {
 }
 
 // Default testing values
-var Default = Config{
+var Default = Defaults{
 	AdminPort:          2999, // different from what a real server also running on a developer's machine might be
-	Certificates:       []string{"/caddy.localhost.crt", "/caddy.localhost.key"},
+	Certifcates:        []string{"/caddy.localhost.crt", "/caddy.localhost.key"},
 	TestRequestTimeout: 5 * time.Second,
 	LoadRequestTimeout: 5 * time.Second,
 }
@@ -61,7 +61,6 @@ type Tester struct {
 	Client       *http.Client
 	configLoaded bool
 	t            testing.TB
-	config       Config
 }
 
 // NewTester will create a new testing client with an attached cookie jar
@@ -79,29 +78,9 @@ func NewTester(t testing.TB) *Tester {
 		},
 		configLoaded: false,
 		t:            t,
-		config:       Default,
 	}
 }
 
-// WithDefaultOverrides this will override the default test configuration with the provided values.
-func (tc *Tester) WithDefaultOverrides(overrides Config) *Tester {
-	if overrides.AdminPort != 0 {
-		tc.config.AdminPort = overrides.AdminPort
-	}
-	if len(overrides.Certificates) > 0 {
-		tc.config.Certificates = overrides.Certificates
-	}
-	if overrides.TestRequestTimeout != 0 {
-		tc.config.TestRequestTimeout = overrides.TestRequestTimeout
-		tc.Client.Timeout = overrides.TestRequestTimeout
-	}
-	if overrides.LoadRequestTimeout != 0 {
-		tc.config.LoadRequestTimeout = overrides.LoadRequestTimeout
-	}
-
-	return tc
-}
-
 type configLoadError struct {
 	Response string
 }
@@ -134,7 +113,7 @@ func (tc *Tester) initServer(rawConfig string, configType string) error {
 		return nil
 	}
 
-	err := validateTestPrerequisites(tc)
+	err := validateTestPrerequisites(tc.t)
 	if err != nil {
 		tc.t.Skipf("skipping tests as failed integration prerequisites. %s", err)
 		return nil
@@ -142,7 +121,7 @@ func (tc *Tester) initServer(rawConfig string, configType string) error {
 
 	tc.t.Cleanup(func() {
 		if tc.t.Failed() && tc.configLoaded {
-			res, err := http.Get(fmt.Sprintf("http://localhost:%d/config/", tc.config.AdminPort))
+			res, err := http.Get(fmt.Sprintf("http://localhost:%d/config/", Default.AdminPort))
 			if err != nil {
 				tc.t.Log("unable to read the current config")
 				return
@@ -157,25 +136,11 @@ func (tc *Tester) initServer(rawConfig string, configType string) error {
 	})
 
 	rawConfig = prependCaddyFilePath(rawConfig)
-	// normalize JSON config
-	if configType == "json" {
-		tc.t.Logf("Before: %s", rawConfig)
-		var conf any
-		if err := json.Unmarshal([]byte(rawConfig), &conf); err != nil {
-			return err
-		}
-		c, err := json.Marshal(conf)
-		if err != nil {
-			return err
-		}
-		rawConfig = string(c)
-		tc.t.Logf("After: %s", rawConfig)
-	}
 	client := &http.Client{
-		Timeout: tc.config.LoadRequestTimeout,
+		Timeout: Default.LoadRequestTimeout,
 	}
 	start := time.Now()
-	req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/load", tc.config.AdminPort), strings.NewReader(rawConfig))
+	req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/load", Default.AdminPort), strings.NewReader(rawConfig))
 	if err != nil {
 		tc.t.Errorf("failed to create request. %s", err)
 		return err
@@ -226,11 +191,11 @@ func (tc *Tester) ensureConfigRunning(rawConfig string, configType string) error
 	}
 
 	client := &http.Client{
-		Timeout: tc.config.LoadRequestTimeout,
+		Timeout: Default.LoadRequestTimeout,
 	}
 
 	fetchConfig := func(client *http.Client) any {
-		resp, err := client.Get(fmt.Sprintf("http://localhost:%d/config/", tc.config.AdminPort))
+		resp, err := client.Get(fmt.Sprintf("http://localhost:%d/config/", Default.AdminPort))
 		if err != nil {
 			return nil
 		}
@@ -258,30 +223,30 @@ func (tc *Tester) ensureConfigRunning(rawConfig string, configType string) error
 }
 
 const initConfig = `{
-	admin localhost:%d
+	admin localhost:2999
 }
 `
 
 // validateTestPrerequisites ensures the certificates are available in the
 // designated path and Caddy sub-process is running.
-func validateTestPrerequisites(tc *Tester) error {
+func validateTestPrerequisites(t testing.TB) error {
 	// check certificates are found
-	for _, certName := range tc.config.Certificates {
+	for _, certName := range Default.Certifcates {
 		if _, err := os.Stat(getIntegrationDir() + certName); errors.Is(err, fs.ErrNotExist) {
 			return fmt.Errorf("caddy integration test certificates (%s) not found", certName)
 		}
 	}
 
-	if isCaddyAdminRunning(tc) != nil {
+	if isCaddyAdminRunning() != nil {
 		// setup the init config file, and set the cleanup afterwards
 		f, err := os.CreateTemp("", "")
 		if err != nil {
 			return err
 		}
-		tc.t.Cleanup(func() {
+		t.Cleanup(func() {
 			os.Remove(f.Name())
 		})
-		if _, err := fmt.Fprintf(f, initConfig, tc.config.AdminPort); err != nil {
+		if _, err := f.WriteString(initConfig); err != nil {
 			return err
 		}
 
@@ -292,23 +257,23 @@ func validateTestPrerequisites(tc *Tester) error {
 		}()
 
 		// wait for caddy to start serving the initial config
-		for retries := 10; retries > 0 && isCaddyAdminRunning(tc) != nil; retries-- {
+		for retries := 10; retries > 0 && isCaddyAdminRunning() != nil; retries-- {
 			time.Sleep(1 * time.Second)
 		}
 	}
 
 	// one more time to return the error
-	return isCaddyAdminRunning(tc)
+	return isCaddyAdminRunning()
 }
 
-func isCaddyAdminRunning(tc *Tester) error {
+func isCaddyAdminRunning() error {
 	// assert that caddy is running
 	client := &http.Client{
-		Timeout: tc.config.LoadRequestTimeout,
+		Timeout: Default.LoadRequestTimeout,
 	}
-	resp, err := client.Get(fmt.Sprintf("http://localhost:%d/config/", tc.config.AdminPort))
+	resp, err := client.Get(fmt.Sprintf("http://localhost:%d/config/", Default.AdminPort))
 	if err != nil {
-		return fmt.Errorf("caddy integration test caddy server not running. Expected to be listening on localhost:%d", tc.config.AdminPort)
+		return fmt.Errorf("caddy integration test caddy server not running. Expected to be listening on localhost:%d", Default.AdminPort)
 	}
 	resp.Body.Close()
 

caddytest/caddytest_test.go

@@ -1,7 +1,6 @@
 package caddytest
 
 import (
-	"net/http"
 	"strings"
 	"testing"
 )
@@ -32,97 +31,3 @@ func TestReplaceCertificatePaths(t *testing.T) {
 		t.Error("expected redirect uri to be unchanged")
 	}
 }
-
-func TestLoadUnorderedJSON(t *testing.T) {
-	tester := NewTester(t)
-	tester.InitServer(`
-	{
-		"logging": {
-			"logs": {
-				"default": {
-					"level": "DEBUG",
-					"writer": {
-						"output": "stdout"
-					}
-				},
-				"sStdOutLogs": {
-					"level": "DEBUG",
-					"writer": {
-						"output": "stdout"
-					},
-					"include": [
-						"http.*",
-						"admin.*"
-					]
-				},
-				"sFileLogs": {
-					"level": "DEBUG",
-					"writer": {
-						"output": "stdout"
-					},
-					"include": [
-						"http.*",
-						"admin.*"
-					]
-				}
-			}
-		},
-		"admin": {
-			"listen": "localhost:2999"
-		},
-		"apps": {
-			"pki": {
-				"certificate_authorities" : {
-				  "local" : {
-					"install_trust": false
-				  }
-				}
-			},
-			"http": {
-				"http_port": 9080,
-				"https_port": 9443,
-				"servers": {
-					"s_server": {
-						"listen": [
-							":9080"
-						],
-						"routes": [
-							{
-								"handle": [
-									{
-										"handler": "static_response",
-										"body": "Hello"
-									}
-								]
-							},
-							{
-								"match": [
-									{
-										"host": [
-											"localhost",
-											"127.0.0.1"
-										]
-									}
-								]
-							}
-						],
-						"logs": {
-							"default_logger_name": "sStdOutLogs",
-							"logger_names": {
-								"localhost": "sStdOutLogs",
-								"127.0.0.1": "sFileLogs"
-							}
-						}
-					}
-				}
-			}
-		}
-	}
-  `, "json")
-	req, err := http.NewRequest(http.MethodGet, "http://localhost:9080/", nil)
-	if err != nil {
-		t.Fail()
-		return
-	}
-	tester.AssertResponseCode(req, 200)
-}

caddytest/integration/acme_test.go

@@ -6,20 +6,17 @@ import (
 	"crypto/elliptic"
 	"crypto/rand"
 	"fmt"
-	"log/slog"
 	"net"
 	"net/http"
 	"strings"
 	"testing"
 
-	"github.com/mholt/acmez/v3"
-	"github.com/mholt/acmez/v3/acme"
-	smallstepacme "github.com/smallstep/certificates/acme"
-	"go.uber.org/zap"
-	"go.uber.org/zap/exp/zapslog"
-
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddytest"
+	"github.com/mholt/acmez/v2"
+	"github.com/mholt/acmez/v2/acme"
+	smallstepacme "github.com/smallstep/certificates/acme"
+	"go.uber.org/zap"
 )
 
 const acmeChallengePort = 9081
@@ -51,7 +48,7 @@ func TestACMEServerWithDefaults(t *testing.T) {
 		Client: &acme.Client{
 			Directory:  "https://acme.localhost:9443/acme/local/directory",
 			HTTPClient: tester.Client,
-			Logger:     slog.New(zapslog.NewHandler(logger.Core())),
+			Logger:     logger,
 		},
 		ChallengeSolvers: map[string]acmez.Solver{
 			acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
@@ -120,7 +117,7 @@ func TestACMEServerWithMismatchedChallenges(t *testing.T) {
 		Client: &acme.Client{
 			Directory:  "https://acme.localhost:9443/acme/local/directory",
 			HTTPClient: tester.Client,
-			Logger:     slog.New(zapslog.NewHandler(logger.Core())),
+			Logger:     logger,
 		},
 		ChallengeSolvers: map[string]acmez.Solver{
 			acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},

caddytest/integration/acmeserver_test.go

@@ -5,16 +5,13 @@ import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
-	"log/slog"
 	"strings"
 	"testing"
 
-	"github.com/mholt/acmez/v3"
-	"github.com/mholt/acmez/v3/acme"
-	"go.uber.org/zap"
-	"go.uber.org/zap/exp/zapslog"
-
 	"github.com/caddyserver/caddy/v2/caddytest"
+	"github.com/mholt/acmez/v2"
+	"github.com/mholt/acmez/v2/acme"
+	"go.uber.org/zap"
 )
 
 func TestACMEServerDirectory(t *testing.T) {
@@ -79,7 +76,7 @@ func TestACMEServerAllowPolicy(t *testing.T) {
 		Client: &acme.Client{
 			Directory:  "https://acme.localhost:9443/acme/local/directory",
 			HTTPClient: tester.Client,
-			Logger:     slog.New(zapslog.NewHandler(logger.Core())),
+			Logger:     logger,
 		},
 		ChallengeSolvers: map[string]acmez.Solver{
 			acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
@@ -168,7 +165,7 @@ func TestACMEServerDenyPolicy(t *testing.T) {
 		Client: &acme.Client{
 			Directory:  "https://acme.localhost:9443/acme/local/directory",
 			HTTPClient: tester.Client,
-			Logger:     slog.New(zapslog.NewHandler(logger.Core())),
+			Logger:     logger,
 		},
 		ChallengeSolvers: map[string]acmez.Solver{
 			acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},

caddytest/integration/caddyfile_adapt/acme_dns_configured.caddyfiletest

@@ -1,68 +0,0 @@
-{
-	acme_dns mock foo
-}
-
-example.com {
-	respond "Hello World"
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"body": "Hello World",
-													"handler": "static_response"
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"tls": {
-			"automation": {
-				"policies": [
-					{
-						"issuers": [
-							{
-								"challenges": {
-									"dns": {
-										"provider": {
-											"name": "mock"
-										}
-									}
-								},
-								"module": "acme"
-							}
-						]
-					}
-				]
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/acme_dns_naked_use_dns_defaults.caddyfiletest

@@ -1,53 +0,0 @@
-{
-	dns mock
-	acme_dns
-}
-
-example.com {
-
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"example.com"
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"tls": {
-			"automation": {
-				"policies": [
-					{
-						"issuers": [
-							{
-								"challenges": {
-									"dns": {}
-								},
-								"module": "acme"
-							}
-						]
-					}
-				]
-			},
-			"dns": {
-				"name": "mock"
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/acme_dns_naked_without_dns.caddyfiletest

@@ -1,9 +0,0 @@
-{
-	acme_dns
-}
-
-example.com {
-	respond "Hello World"
-}
-----------
-acme_dns specified without DNS provider config, but no provider specified with 'dns' global option

caddytest/integration/caddyfile_adapt/acme_server_policy-allow.caddyfiletest

@@ -1,72 +0,0 @@
-{
-	pki {
-		ca custom-ca {
-			name "Custom CA"
-		}
-	}
-}
-
-acme.example.com {
-	acme_server {
-		ca custom-ca
-		allow {
-			domains host-1.internal.example.com host-2.internal.example.com
-		}
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"acme.example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"ca": "custom-ca",
-													"handler": "acme_server",
-													"policy": {
-														"allow": {
-															"domains": [
-																"host-1.internal.example.com",
-																"host-2.internal.example.com"
-															]
-														}
-													}
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"pki": {
-			"certificate_authorities": {
-				"custom-ca": {
-					"name": "Custom CA"
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/acme_server_policy-both.caddyfiletest

@@ -1,80 +0,0 @@
-{
-	pki {
-		ca custom-ca {
-			name "Custom CA"
-		}
-	}
-}
-
-acme.example.com {
-	acme_server {
-		ca custom-ca
-		allow {
-			domains host-1.internal.example.com host-2.internal.example.com
-		}
-		deny {
-			domains dc.internal.example.com
-		}
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"acme.example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"ca": "custom-ca",
-													"handler": "acme_server",
-													"policy": {
-														"allow": {
-															"domains": [
-																"host-1.internal.example.com",
-																"host-2.internal.example.com"
-															]
-														},
-														"deny": {
-															"domains": [
-																"dc.internal.example.com"
-															]
-														}
-													}
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"pki": {
-			"certificate_authorities": {
-				"custom-ca": {
-					"name": "Custom CA"
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/acme_server_policy-deny.caddyfiletest

@@ -1,71 +0,0 @@
-{
-	pki {
-		ca custom-ca {
-			name "Custom CA"
-		}
-	}
-}
-
-acme.example.com {
-	acme_server {
-		ca custom-ca
-		deny {
-			domains dc.internal.example.com
-		}
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"acme.example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"ca": "custom-ca",
-													"handler": "acme_server",
-													"policy": {
-														"deny": {
-															"domains": [
-																"dc.internal.example.com"
-															]
-														}
-													}
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"pki": {
-			"certificate_authorities": {
-				"custom-ca": {
-					"name": "Custom CA"
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/acme_server_sign_with_root.caddyfiletest

@@ -1,67 +0,0 @@
-{
-	pki {
-		ca internal {
-			name "Internal"
-			root_cn "Internal Root Cert"
-			intermediate_cn "Internal Intermediate Cert"
-		}
-	}
-}
-acme.example.com {
-	acme_server {
-		ca internal
-		sign_with_root
-	}
-}
-
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"acme.example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"ca": "internal",
-													"handler": "acme_server",
-													"sign_with_root": true
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"pki": {
-			"certificate_authorities": {
-				"internal": {
-					"name": "Internal",
-					"root_common_name": "Internal Root Cert",
-					"intermediate_common_name": "Internal Intermediate Cert"
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/ambiguous_site_definition.caddyfiletest

@@ -1,12 +0,0 @@
-example.com
-handle {
-	respond "one"
-}
-
-example.com
-handle {
-	respond "two"
-}
-----------
-Caddyfile:6: unrecognized directive: example.com
-Did you mean to define a second site? If so, you must use curly braces around each site to separate their configurations.

caddytest/integration/caddyfile_adapt/ambiguous_site_definition_duplicate_key.caddyfiletest

@@ -1,9 +0,0 @@
-:8080 {
-	respond "one"
-}
-
-:8080 {
-	respond "two"
-}
-----------
-ambiguous site definition: :8080

caddytest/integration/caddyfile_adapt/bind_fd_fdgram_h123.caddyfiletest

@@ -1,142 +0,0 @@
-{
-	auto_https disable_redirects
-	admin off
-}
-
-http://localhost {
-	bind fd/{env.CADDY_HTTP_FD} {
-		protocols h1
-	}
-	log
-	respond "Hello, HTTP!"
-}
-
-https://localhost {
-	bind fd/{env.CADDY_HTTPS_FD} {
-		protocols h1 h2
-	}
-	bind fdgram/{env.CADDY_HTTP3_FD} {
-		protocols h3
-	}
-	log
-	respond "Hello, HTTPS!"
-}
-----------
-{
-	"admin": {
-		"disabled": true
-	},
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						"fd/{env.CADDY_HTTPS_FD}",
-						"fdgram/{env.CADDY_HTTP3_FD}"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"body": "Hello, HTTPS!",
-													"handler": "static_response"
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					],
-					"automatic_https": {
-						"disable_redirects": true
-					},
-					"logs": {
-						"logger_names": {
-							"localhost": [
-								""
-							]
-						}
-					},
-					"listen_protocols": [
-						[
-							"h1",
-							"h2"
-						],
-						[
-							"h3"
-						]
-					]
-				},
-				"srv1": {
-					"automatic_https": {
-						"disable_redirects": true
-					}
-				},
-				"srv2": {
-					"listen": [
-						"fd/{env.CADDY_HTTP_FD}"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"body": "Hello, HTTP!",
-													"handler": "static_response"
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					],
-					"automatic_https": {
-						"disable_redirects": true,
-						"skip": [
-							"localhost"
-						]
-					},
-					"logs": {
-						"logger_names": {
-							"localhost": [
-								""
-							]
-						}
-					},
-					"listen_protocols": [
-						[
-							"h1"
-						]
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/directive_as_site_address.caddyfiletest

@@ -1,5 +0,0 @@
-handle
-
-respond "should not work"
-----------
-Caddyfile:1: parsed 'handle' as a site address, but it is a known directive; directives must appear in a site block

caddytest/integration/caddyfile_adapt/duplicate_listener_address_global.caddyfiletest

@@ -1,12 +0,0 @@
-{
-	servers {
-		srv0 {
-			listen :8080
-		}
-		srv1 {
-			listen :8080
-		}
-	}
-}
-----------
-parsing caddyfile tokens for 'servers': unrecognized servers option 'srv0', at Caddyfile:3

caddytest/integration/caddyfile_adapt/encode_options.caddyfiletest

@@ -21,8 +21,6 @@ encode {
 	zstd
 	gzip 5
 }
-
-encode
 ----------
 {
 	"apps": {
@@ -78,17 +76,6 @@ encode
 										"zstd",
 										"gzip"
 									]
-								},
-								{
-									"encodings": {
-										"gzip": {},
-										"zstd": {}
-									},
-									"handler": "encode",
-									"prefer": [
-										"zstd",
-										"gzip"
-									]
 								}
 							]
 						}

caddytest/integration/caddyfile_adapt/error_example.caddyfiletest

@@ -106,29 +106,20 @@ example.com {
 										"handler": "subroute",
 										"routes": [
 											{
+												"group": "group0",
 												"handle": [
 													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"group": "group0",
-																"handle": [
-																	{
-																		"handler": "rewrite",
-																		"uri": "/{http.error.status_code}.html"
-																	}
-																]
-															},
-															{
-																"handle": [
-																	{
-																		"handler": "file_server",
-																		"hide": [
-																			"./Caddyfile"
-																		]
-																	}
-																]
-															}
+														"handler": "rewrite",
+														"uri": "/{http.error.status_code}.html"
+													}
+												]
+											},
+											{
+												"handle": [
+													{
+														"handler": "file_server",
+														"hide": [
+															"./Caddyfile"
 														]
 													}
 												]

caddytest/integration/caddyfile_adapt/error_multi_site_blocks.caddyfiletest

@@ -165,17 +165,8 @@ bar.localhost {
 											{
 												"handle": [
 													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"handle": [
-																	{
-																		"body": "404 or 410 error",
-																		"handler": "static_response"
-																	}
-																]
-															}
-														]
+														"body": "404 or 410 error",
+														"handler": "static_response"
 													}
 												],
 												"match": [
@@ -187,17 +178,8 @@ bar.localhost {
 											{
 												"handle": [
 													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"handle": [
-																	{
-																		"body": "Error In range [500 .. 599]",
-																		"handler": "static_response"
-																	}
-																]
-															}
-														]
+														"body": "Error In range [500 .. 599]",
+														"handler": "static_response"
 													}
 												],
 												"match": [
@@ -226,17 +208,8 @@ bar.localhost {
 											{
 												"handle": [
 													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"handle": [
-																	{
-																		"body": "404 or 410 error from second site",
-																		"handler": "static_response"
-																	}
-																]
-															}
-														]
+														"body": "404 or 410 error from second site",
+														"handler": "static_response"
 													}
 												],
 												"match": [
@@ -248,17 +221,8 @@ bar.localhost {
 											{
 												"handle": [
 													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"handle": [
-																	{
-																		"body": "Error In range [500 .. 599] from second site",
-																		"handler": "static_response"
-																	}
-																]
-															}
-														]
+														"body": "Error In range [500 .. 599] from second site",
+														"handler": "static_response"
 													}
 												],
 												"match": [

caddytest/integration/caddyfile_adapt/error_range_codes.caddyfiletest

@@ -96,17 +96,8 @@ localhost:3010 {
 											{
 												"handle": [
 													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"handle": [
-																	{
-																		"body": "Error in the [400 .. 499] range",
-																		"handler": "static_response"
-																	}
-																]
-															}
-														]
+														"body": "Error in the [400 .. 499] range",
+														"handler": "static_response"
 													}
 												],
 												"match": [

caddytest/integration/caddyfile_adapt/error_range_simple_codes.caddyfiletest

@@ -116,17 +116,8 @@ localhost:2099 {
 											{
 												"handle": [
 													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"handle": [
-																	{
-																		"body": "Error in the [400 .. 499] range",
-																		"handler": "static_response"
-																	}
-																]
-															}
-														]
+														"body": "Error in the [400 .. 499] range",
+														"handler": "static_response"
 													}
 												],
 												"match": [
@@ -138,17 +129,8 @@ localhost:2099 {
 											{
 												"handle": [
 													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"handle": [
-																	{
-																		"body": "Error code is equal to 500 or in the [300..399] range",
-																		"handler": "static_response"
-																	}
-																]
-															}
-														]
+														"body": "Error code is equal to 500 or in the [300..399] range",
+														"handler": "static_response"
 													}
 												],
 												"match": [

caddytest/integration/caddyfile_adapt/error_simple_codes.caddyfiletest

@@ -96,17 +96,8 @@ localhost:3010 {
 											{
 												"handle": [
 													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"handle": [
-																	{
-																		"body": "404 or 410 error",
-																		"handler": "static_response"
-																	}
-																]
-															}
-														]
+														"body": "404 or 410 error",
+														"handler": "static_response"
 													}
 												],
 												"match": [

caddytest/integration/caddyfile_adapt/error_sort.caddyfiletest

@@ -116,17 +116,8 @@ localhost:2099 {
 											{
 												"handle": [
 													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"handle": [
-																	{
-																		"body": "Error in the [400 .. 499] range",
-																		"handler": "static_response"
-																	}
-																]
-															}
-														]
+														"body": "Error in the [400 .. 499] range",
+														"handler": "static_response"
 													}
 												],
 												"match": [
@@ -138,17 +129,8 @@ localhost:2099 {
 											{
 												"handle": [
 													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"handle": [
-																	{
-																		"body": "Fallback route: code outside the [400..499] range",
-																		"handler": "static_response"
-																	}
-																]
-															}
-														]
+														"body": "Fallback route: code outside the [400..499] range",
+														"handler": "static_response"
 													}
 												]
 											}

caddytest/integration/caddyfile_adapt/error_subhandlers.caddyfiletest

@@ -1,260 +0,0 @@
-{
-	http_port 2099
-}
-localhost:2099 {
-	root * /var/www/
-	file_server
-
-	handle_errors 404 {
-		handle /en/* {
-			respond "not found" 404
-		}
-		handle /es/* {
-			respond "no encontrado"
-		}
-		handle {
-			respond "default not found"
-		}
-	}
-	handle_errors {
-		handle /en/* {
-			respond "English error"
-		}
-		handle /es/* {
-			respond "Spanish error"
-		}
-		handle {
-			respond "Default error"
-		}
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"http_port": 2099,
-			"servers": {
-				"srv0": {
-					"listen": [
-						":2099"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handler": "vars",
-													"root": "/var/www/"
-												},
-												{
-													"handler": "file_server",
-													"hide": [
-														"./Caddyfile"
-													]
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					],
-					"errors": {
-						"routes": [
-							{
-								"match": [
-									{
-										"host": [
-											"localhost"
-										]
-									}
-								],
-								"handle": [
-									{
-										"handler": "subroute",
-										"routes": [
-											{
-												"handle": [
-													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"group": "group3",
-																"handle": [
-																	{
-																		"handler": "subroute",
-																		"routes": [
-																			{
-																				"handle": [
-																					{
-																						"body": "not found",
-																						"handler": "static_response",
-																						"status_code": 404
-																					}
-																				]
-																			}
-																		]
-																	}
-																],
-																"match": [
-																	{
-																		"path": [
-																			"/en/*"
-																		]
-																	}
-																]
-															},
-															{
-																"group": "group3",
-																"handle": [
-																	{
-																		"handler": "subroute",
-																		"routes": [
-																			{
-																				"handle": [
-																					{
-																						"body": "no encontrado",
-																						"handler": "static_response"
-																					}
-																				]
-																			}
-																		]
-																	}
-																],
-																"match": [
-																	{
-																		"path": [
-																			"/es/*"
-																		]
-																	}
-																]
-															},
-															{
-																"group": "group3",
-																"handle": [
-																	{
-																		"handler": "subroute",
-																		"routes": [
-																			{
-																				"handle": [
-																					{
-																						"body": "default not found",
-																						"handler": "static_response"
-																					}
-																				]
-																			}
-																		]
-																	}
-																]
-															}
-														]
-													}
-												],
-												"match": [
-													{
-														"expression": "{http.error.status_code} in [404]"
-													}
-												]
-											},
-											{
-												"handle": [
-													{
-														"handler": "subroute",
-														"routes": [
-															{
-																"group": "group8",
-																"handle": [
-																	{
-																		"handler": "subroute",
-																		"routes": [
-																			{
-																				"handle": [
-																					{
-																						"body": "English error",
-																						"handler": "static_response"
-																					}
-																				]
-																			}
-																		]
-																	}
-																],
-																"match": [
-																	{
-																		"path": [
-																			"/en/*"
-																		]
-																	}
-																]
-															},
-															{
-																"group": "group8",
-																"handle": [
-																	{
-																		"handler": "subroute",
-																		"routes": [
-																			{
-																				"handle": [
-																					{
-																						"body": "Spanish error",
-																						"handler": "static_response"
-																					}
-																				]
-																			}
-																		]
-																	}
-																],
-																"match": [
-																	{
-																		"path": [
-																			"/es/*"
-																		]
-																	}
-																]
-															},
-															{
-																"group": "group8",
-																"handle": [
-																	{
-																		"handler": "subroute",
-																		"routes": [
-																			{
-																				"handle": [
-																					{
-																						"body": "Default error",
-																						"handler": "static_response"
-																					}
-																				]
-																			}
-																		]
-																	}
-																]
-															}
-														]
-													}
-												]
-											}
-										]
-									}
-								],
-								"terminal": true
-							}
-						]
-					}
-				}
-			}
-		}
-	}
-}
-

caddytest/integration/caddyfile_adapt/file_server_file_limit.caddyfiletest

@@ -1,36 +0,0 @@
-:80
-
-file_server {
-	browse {
-		file_limit 4000
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":80"
-					],
-					"routes": [
-						{
-							"handle": [
-								{
-									"browse": {
-										"file_limit": 4000
-									},
-									"handler": "file_server",
-									"hide": [
-										"./Caddyfile"
-									]
-								}
-							]
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/file_server_precompressed.caddyfiletest

@@ -3,10 +3,6 @@
 file_server {
 	precompressed zstd br gzip
 }
-
-file_server {
-	precompressed
-}
 ----------
 {
 	"apps": {
@@ -34,22 +30,6 @@ file_server {
 										"br",
 										"gzip"
 									]
-								},
-								{
-									"handler": "file_server",
-									"hide": [
-										"./Caddyfile"
-									],
-									"precompressed": {
-										"br": {},
-										"gzip": {},
-										"zstd": {}
-									},
-									"precompressed_order": [
-										"br",
-										"zstd",
-										"gzip"
-									]
 								}
 							]
 						}

caddytest/integration/caddyfile_adapt/file_server_sort.caddyfiletest

@@ -1,39 +0,0 @@
-:80
-
-file_server {
-	browse {
-		sort size desc
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":80"
-					],
-					"routes": [
-						{
-							"handle": [
-								{
-									"browse": {
-										"sort": [
-											"size",
-											"desc"
-										]
-									},
-									"handler": "file_server",
-									"hide": [
-										"./Caddyfile"
-									]
-								}
-							]
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/forward_auth_authelia.caddyfiletest

@@ -1,6 +1,6 @@
 app.example.com {
 	forward_auth authelia:9091 {
-		uri /api/authz/forward-auth
+		uri /api/verify?rd=https://authelia.example.com
 		copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
 	}
 
@@ -39,13 +39,6 @@ app.example.com {
 																]
 															},
 															"routes": [
-																{
-																	"handle": [
-																		{
-																			"handler": "vars"
-																		}
-																	]
-																},
 																{
 																	"handle": [
 																		{
@@ -54,104 +47,19 @@ app.example.com {
 																				"set": {
 																					"Remote-Email": [
 																						"{http.reverse_proxy.header.Remote-Email}"
-																					]
-																				}
-																			}
-																		}
-																	],
-																	"match": [
-																		{
-																			"not": [
-																				{
-																					"vars": {
-																						"{http.reverse_proxy.header.Remote-Email}": [
-																							""
-																						]
-																					}
-																				}
-																			]
-																		}
-																	]
-																},
-																{
-																	"handle": [
-																		{
-																			"handler": "headers",
-																			"request": {
-																				"set": {
+																					],
 																					"Remote-Groups": [
 																						"{http.reverse_proxy.header.Remote-Groups}"
-																					]
-																				}
-																			}
-																		}
-																	],
-																	"match": [
-																		{
-																			"not": [
-																				{
-																					"vars": {
-																						"{http.reverse_proxy.header.Remote-Groups}": [
-																							""
-																						]
-																					}
-																				}
-																			]
-																		}
-																	]
-																},
-																{
-																	"handle": [
-																		{
-																			"handler": "headers",
-																			"request": {
-																				"set": {
+																					],
 																					"Remote-Name": [
 																						"{http.reverse_proxy.header.Remote-Name}"
-																					]
-																				}
-																			}
-																		}
-																	],
-																	"match": [
-																		{
-																			"not": [
-																				{
-																					"vars": {
-																						"{http.reverse_proxy.header.Remote-Name}": [
-																							""
-																						]
-																					}
-																				}
-																			]
-																		}
-																	]
-																},
-																{
-																	"handle": [
-																		{
-																			"handler": "headers",
-																			"request": {
-																				"set": {
+																					],
 																					"Remote-User": [
 																						"{http.reverse_proxy.header.Remote-User}"
 																					]
 																				}
 																			}
 																		}
-																	],
-																	"match": [
-																		{
-																			"not": [
-																				{
-																					"vars": {
-																						"{http.reverse_proxy.header.Remote-User}": [
-																							""
-																						]
-																					}
-																				}
-																			]
-																		}
 																	]
 																}
 															]
@@ -172,7 +80,7 @@ app.example.com {
 													},
 													"rewrite": {
 														"method": "GET",
-														"uri": "/api/authz/forward-auth"
+														"uri": "/api/verify?rd=https://authelia.example.com"
 													},
 													"upstreams": [
 														{

caddytest/integration/caddyfile_adapt/forward_auth_rename_headers.caddyfiletest

@@ -28,13 +28,6 @@ forward_auth localhost:9000 {
 												]
 											},
 											"routes": [
-												{
-													"handle": [
-														{
-															"handler": "vars"
-														}
-													]
-												},
 												{
 													"handle": [
 														{
@@ -43,131 +36,22 @@ forward_auth localhost:9000 {
 																"set": {
 																	"1": [
 																		"{http.reverse_proxy.header.A}"
-																	]
-																}
-															}
-														}
-													],
-													"match": [
-														{
-															"not": [
-																{
-																	"vars": {
-																		"{http.reverse_proxy.header.A}": [
-																			""
-																		]
-																	}
-																}
-															]
-														}
-													]
-												},
-												{
-													"handle": [
-														{
-															"handler": "headers",
-															"request": {
-																"set": {
-																	"B": [
-																		"{http.reverse_proxy.header.B}"
-																	]
-																}
-															}
-														}
-													],
-													"match": [
-														{
-															"not": [
-																{
-																	"vars": {
-																		"{http.reverse_proxy.header.B}": [
-																			""
-																		]
-																	}
-																}
-															]
-														}
-													]
-												},
-												{
-													"handle": [
-														{
-															"handler": "headers",
-															"request": {
-																"set": {
+																	],
 																	"3": [
 																		"{http.reverse_proxy.header.C}"
-																	]
-																}
-															}
-														}
-													],
-													"match": [
-														{
-															"not": [
-																{
-																	"vars": {
-																		"{http.reverse_proxy.header.C}": [
-																			""
-																		]
-																	}
-																}
-															]
-														}
-													]
-												},
-												{
-													"handle": [
-														{
-															"handler": "headers",
-															"request": {
-																"set": {
+																	],
+																	"5": [
+																		"{http.reverse_proxy.header.E}"
+																	],
+																	"B": [
+																		"{http.reverse_proxy.header.B}"
+																	],
 																	"D": [
 																		"{http.reverse_proxy.header.D}"
 																	]
 																}
 															}
 														}
-													],
-													"match": [
-														{
-															"not": [
-																{
-																	"vars": {
-																		"{http.reverse_proxy.header.D}": [
-																			""
-																		]
-																	}
-																}
-															]
-														}
-													]
-												},
-												{
-													"handle": [
-														{
-															"handler": "headers",
-															"request": {
-																"set": {
-																	"5": [
-																		"{http.reverse_proxy.header.E}"
-																	]
-																}
-															}
-														}
-													],
-													"match": [
-														{
-															"not": [
-																{
-																	"vars": {
-																		"{http.reverse_proxy.header.E}": [
-																			""
-																		]
-																	}
-																}
-															]
-														}
 													]
 												}
 											]

caddytest/integration/caddyfile_adapt/global_options.caddyfiletest

@@ -9,8 +9,6 @@
 	storage file_system {
 		root /data
 	}
-	storage_check off
-	storage_clean_interval off
 	acme_ca https://example.com
 	acme_ca_root /path/to/ca.crt
 	ocsp_stapling off
@@ -19,6 +17,8 @@
 	admin off
 	on_demand_tls {
 		ask https://example.com
+		interval 30s
+		burst 20
 	}
 	local_certs
 	key_type ed25519
@@ -72,12 +72,14 @@
 					"permission": {
 						"endpoint": "https://example.com",
 						"module": "http"
+					},
+					"rate_limit": {
+						"interval": 30000000000,
+						"burst": 20
 					}
 				}
 			},
-			"disable_ocsp_stapling": true,
-			"disable_storage_check": true,
-			"disable_storage_clean": true
+			"disable_ocsp_stapling": true
 		}
 	}
 }

caddytest/integration/caddyfile_adapt/global_options_acme.caddyfiletest

@@ -17,6 +17,8 @@
 	admin off
 	on_demand_tls {
 		ask https://example.com
+		interval 30s
+		burst 20
 	}
 	storage_clean_interval 7d
 	renew_interval 1d
@@ -61,14 +63,6 @@
 						"issuers": [
 							{
 								"ca": "https://example.com",
-								"challenges": {
-									"http": {
-										"alternate_port": 8080
-									},
-									"tls-alpn": {
-										"alternate_port": 8443
-									}
-								},
 								"email": "test@example.com",
 								"external_account": {
 									"key_id": "4K2scIVbBpNd-78scadB2g",
@@ -87,6 +81,10 @@
 					"permission": {
 						"endpoint": "https://example.com",
 						"module": "http"
+					},
+					"rate_limit": {
+						"interval": 30000000000,
+						"burst": 20
 					}
 				},
 				"ocsp_interval": 172800000000000,

caddytest/integration/caddyfile_adapt/global_options_admin.caddyfiletest

@@ -16,6 +16,8 @@
 	}
 	on_demand_tls {
 		ask https://example.com
+		interval 30s
+		burst 20
 	}
 	local_certs
 	key_type ed25519
@@ -72,6 +74,10 @@
 					"permission": {
 						"endpoint": "https://example.com",
 						"module": "http"
+					},
+					"rate_limit": {
+						"interval": 30000000000,
+						"burst": 20
 					}
 				}
 			}

caddytest/integration/caddyfile_adapt/global_options_log_sampling.caddyfiletest

@@ -1,23 +0,0 @@
-{
-	log {
-		sampling {
-			interval 300
-			first 50
-			thereafter 40
-		}
-	}
-}
-----------
-{
-	"logging": {
-		"logs": {
-			"default": {
-				"sampling": {
-					"interval": 300,
-					"first": 50,
-					"thereafter": 40
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/global_options_preferred_chains.caddyfiletest

@@ -31,6 +31,9 @@ example.com
 			"automation": {
 				"policies": [
 					{
+						"subjects": [
+							"example.com"
+						],
 						"issuers": [
 							{
 								"module": "acme",

caddytest/integration/caddyfile_adapt/header.caddyfiletest

@@ -12,14 +12,10 @@
 	@images path /images/*
 	header @images {
 		Cache-Control "public, max-age=3600, stale-while-revalidate=86400"
-		match {
-			status 200
-		}
 	}
 	header {
 		+Link "Foo"
 		+Link "Bar"
-		match status 200
 	}
 	header >Set Defer
 	header >Replace Deferred Replacement
@@ -46,11 +42,6 @@
 								{
 									"handler": "headers",
 									"response": {
-										"require": {
-											"status_code": [
-												200
-											]
-										},
 										"set": {
 											"Cache-Control": [
 												"public, max-age=3600, stale-while-revalidate=86400"
@@ -145,11 +136,6 @@
 												"Foo",
 												"Bar"
 											]
-										},
-										"require": {
-											"status_code": [
-												200
-											]
 										}
 									}
 								},

caddytest/integration/caddyfile_adapt/header_placeholder_search.caddyfiletest

@@ -1,64 +0,0 @@
-:80 {
-	header Test-Static ":443" "STATIC-WORKS"
-	header Test-Dynamic ":{http.request.local.port}" "DYNAMIC-WORKS"
-	header Test-Complex "port-{http.request.local.port}-end" "COMPLEX-{http.request.method}"
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":80"
-					],
-					"routes": [
-						{
-							"handle": [
-								{
-									"handler": "headers",
-									"response": {
-										"replace": {
-											"Test-Static": [
-												{
-													"replace": "STATIC-WORKS",
-													"search_regexp": ":443"
-												}
-											]
-										}
-									}
-								},
-								{
-									"handler": "headers",
-									"response": {
-										"replace": {
-											"Test-Dynamic": [
-												{
-													"replace": "DYNAMIC-WORKS",
-													"search_regexp": ":{http.request.local.port}"
-												}
-											]
-										}
-									}
-								},
-								{
-									"handler": "headers",
-									"response": {
-										"replace": {
-											"Test-Complex": [
-												{
-													"replace": "COMPLEX-{http.request.method}",
-													"search_regexp": "port-{http.request.local.port}-end"
-												}
-											]
-										}
-									}
-								}
-							]
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/heredoc.caddyfiletest

@@ -1,12 +1,11 @@
 example.com {
-	respond <<EOF
+    respond <<EOF
     <html>
       <head><title>Foo</title>
       <body>Foo</body>
     </html>
     EOF 200
 }
-
 ----------
 {
 	"apps": {

caddytest/integration/caddyfile_adapt/heredoc_extra_indentation.caddyfiletest

@@ -1,41 +0,0 @@
-:80
-
-handle {
-	respond <<END
-        line1
-        line2
-  END
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":80"
-					],
-					"routes": [
-						{
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"body": "      line1\n      line2",
-													"handler": "static_response"
-												}
-											]
-										}
-									]
-								}
-							]
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/heredoc_incomplete.caddyfiletest

@@ -1,9 +0,0 @@
-:80
-
-handle {
-    respond <<EOF
-    Hello
-# missing EOF marker
-}
-----------
-mismatched leading whitespace in heredoc <<EOF on line #5 [    Hello], expected whitespace [# missing ] to match the closing marker

caddytest/integration/caddyfile_adapt/heredoc_invalid_marker.caddyfiletest

@@ -1,9 +0,0 @@
-:80
-
-handle {
-    respond <<END!
-    Hello
-    END!
-}
-----------
-heredoc marker on line #4 must contain only alpha-numeric characters, dashes and underscores; got 'END!'

caddytest/integration/caddyfile_adapt/heredoc_mismatched_whitespace.caddyfiletest

@@ -1,10 +0,0 @@
-:80
-
-handle {
-	respond <<END
-	line1
-	line2
-  END
-}
-----------
-mismatched leading whitespace in heredoc <<END on line #5 [	line1], expected whitespace [  ] to match the closing marker

caddytest/integration/caddyfile_adapt/heredoc_missing_marker.caddyfiletest

@@ -1,9 +0,0 @@
-:80
-
-handle {
-    respond << 
-    Hello
-    END
-}
-----------
-parsing caddyfile tokens for 'handle': unrecognized directive: Hello - are you sure your Caddyfile structure (nesting and braces) is correct?, at Caddyfile:7

caddytest/integration/caddyfile_adapt/heredoc_too_many_angle_brackets.caddyfiletest

@@ -1,9 +0,0 @@
-:80
-
-handle {
-    respond <<<END
-    Hello
-    END
-}
-----------
-too many '<' for heredoc on line #4; only use two, for example <<END

caddytest/integration/caddyfile_adapt/import_block_anonymous.caddyfiletest

@@ -1,13 +0,0 @@
-(site) {
-    http://{args[0]} https://{args[0]} {
-        {block}
-    }
-}
-import site test.domain {
-    { 
-        header_up Host {host}
-        header_up X-Real-IP {remote_host}
-    }
-}
-----------
-anonymous blocks are not supported

caddytest/integration/caddyfile_adapt/import_block_snippet.caddyfiletest

@@ -1,58 +0,0 @@
-(snippet) {
-	header {
-		{block}
-	}
-}
-
-example.com {
-	import snippet {
-		foo bar
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handler": "headers",
-													"response": {
-														"set": {
-															"Foo": [
-																"bar"
-															]
-														}
-													}
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/import_block_snippet_args.caddyfiletest

@@ -1,56 +0,0 @@
-(snippet) {
-	{block}
-}
-
-example.com {
-	import snippet {
-		header foo bar
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handler": "headers",
-													"response": {
-														"set": {
-															"Foo": [
-																"bar"
-															]
-														}
-													}
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/import_block_with_site_block.caddyfiletest

@@ -1,65 +0,0 @@
-(site) {
-	https://{args[0]} {
-		{block}
-	}
-}
-
-import site test.domain {
-	reverse_proxy http://192.168.1.1:8080 {
-		header_up Host {host}
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"test.domain"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handler": "reverse_proxy",
-													"headers": {
-														"request": {
-															"set": {
-																"Host": [
-																	"{http.request.host}"
-																]
-															}
-														}
-													},
-													"upstreams": [
-														{
-															"dial": "192.168.1.1:8080"
-														}
-													]
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/import_blocks_snippet.caddyfiletest

@@ -1,76 +0,0 @@
-(snippet) {
-	header {
-		{blocks.foo}
-	}
-	header {
-		{blocks.bar}
-	}
-}
-
-example.com {
-	import snippet {
-		foo {
-			foo a
-		}
-		bar {
-			bar b
-		}
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handler": "headers",
-													"response": {
-														"set": {
-															"Foo": [
-																"a"
-															]
-														}
-													}
-												},
-												{
-													"handler": "headers",
-													"response": {
-														"set": {
-															"Bar": [
-																"b"
-															]
-														}
-													}
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/import_blocks_snippet_nested.caddyfiletest

@@ -1,82 +0,0 @@
-(snippet) {
-	header {
-		{blocks.bar}
-	}
-	import sub_snippet {
-		bar {
-			{blocks.foo}
-		}
-	}
-}
-(sub_snippet) {
-	header {
-		{blocks.bar}
-	}
-}
-example.com {
-	import snippet {
-		foo {
-			foo a
-		}
-		bar {
-			bar b
-		}
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handler": "headers",
-													"response": {
-														"set": {
-															"Bar": [
-																"b"
-															]
-														}
-													}
-												},
-												{
-													"handler": "headers",
-													"response": {
-														"set": {
-															"Foo": [
-																"a"
-															]
-														}
-													}
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/import_cycle.caddyfiletest

@@ -1,12 +0,0 @@
-(import1) {
-	import import2
-}
-
-(import2) {
-	import import1
-}
-
-import import1
-
-----------
-a cycle of imports exists between Caddyfile:import2 and Caddyfile:import1

caddytest/integration/caddyfile_adapt/intercept_response.caddyfiletest

@@ -1,230 +0,0 @@
-localhost
-
-respond "To intercept"
-
-intercept {
-	@500 status 500
-	replace_status @500 400
-
-	@all status 2xx 3xx 4xx 5xx
-	replace_status @all {http.error.status_code}
-
-	replace_status {http.error.status_code}
-
-	@accel header X-Accel-Redirect *
-	handle_response @accel {
-		respond "Header X-Accel-Redirect!"
-	}
-
-	@another {
-		header X-Another *
-	}
-	handle_response @another {
-		respond "Header X-Another!"
-	}
-
-	@401 status 401
-	handle_response @401 {
-		respond "Status 401!"
-	}
-
-	handle_response {
-		respond "Any! This should be last in the JSON!"
-	}
-
-	@403 {
-		status 403
-	}
-	handle_response @403 {
-		respond "Status 403!"
-	}
-
-	@multi {
-		status 401 403
-		status 404
-		header Foo *
-		header Bar *
-	}
-	handle_response @multi {
-		respond "Headers Foo, Bar AND statuses 401, 403 and 404!"
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handle_response": [
-														{
-															"match": {
-																"status_code": [
-																	500
-																]
-															},
-															"status_code": 400
-														},
-														{
-															"match": {
-																"status_code": [
-																	2,
-																	3,
-																	4,
-																	5
-																]
-															},
-															"status_code": "{http.error.status_code}"
-														},
-														{
-															"match": {
-																"headers": {
-																	"X-Accel-Redirect": [
-																		"*"
-																	]
-																}
-															},
-															"routes": [
-																{
-																	"handle": [
-																		{
-																			"body": "Header X-Accel-Redirect!",
-																			"handler": "static_response"
-																		}
-																	]
-																}
-															]
-														},
-														{
-															"match": {
-																"headers": {
-																	"X-Another": [
-																		"*"
-																	]
-																}
-															},
-															"routes": [
-																{
-																	"handle": [
-																		{
-																			"body": "Header X-Another!",
-																			"handler": "static_response"
-																		}
-																	]
-																}
-															]
-														},
-														{
-															"match": {
-																"status_code": [
-																	401
-																]
-															},
-															"routes": [
-																{
-																	"handle": [
-																		{
-																			"body": "Status 401!",
-																			"handler": "static_response"
-																		}
-																	]
-																}
-															]
-														},
-														{
-															"match": {
-																"status_code": [
-																	403
-																]
-															},
-															"routes": [
-																{
-																	"handle": [
-																		{
-																			"body": "Status 403!",
-																			"handler": "static_response"
-																		}
-																	]
-																}
-															]
-														},
-														{
-															"match": {
-																"headers": {
-																	"Bar": [
-																		"*"
-																	],
-																	"Foo": [
-																		"*"
-																	]
-																},
-																"status_code": [
-																	401,
-																	403,
-																	404
-																]
-															},
-															"routes": [
-																{
-																	"handle": [
-																		{
-																			"body": "Headers Foo, Bar AND statuses 401, 403 and 404!",
-																			"handler": "static_response"
-																		}
-																	]
-																}
-															]
-														},
-														{
-															"status_code": "{http.error.status_code}"
-														},
-														{
-															"routes": [
-																{
-																	"handle": [
-																		{
-																			"body": "Any! This should be last in the JSON!",
-																			"handler": "static_response"
-																		}
-																	]
-																}
-															]
-														}
-													],
-													"handler": "intercept"
-												},
-												{
-													"body": "To intercept",
-													"handler": "static_response"
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/invoke_undefined_named_route.caddyfiletest

@@ -1,5 +0,0 @@
-example.com {
-	invoke foo
-}
-----------
-cannot invoke named route 'foo', which was not defined

caddytest/integration/caddyfile_adapt/log_filter_with_header.txt

@@ -1,151 +0,0 @@
-localhost {
-	log {
-		output file ./caddy.access.log
-	}
-	log health_check_log {
-		output file ./caddy.access.health.log
-		no_hostname
-	}
-	log general_log {
-		output file ./caddy.access.general.log
-		no_hostname
-	}
-	@healthCheck `header_regexp('User-Agent', '^some-regexp$') || path('/healthz*')`
-	handle @healthCheck {
-		log_name health_check_log general_log
-		respond "Healthy"
-	}
-
-	handle {
-		respond "Hello World"
-	}
-}
-----------
-{
-	"logging": {
-		"logs": {
-			"default": {
-				"exclude": [
-					"http.log.access.general_log",
-					"http.log.access.health_check_log",
-					"http.log.access.log0"
-				]
-			},
-			"general_log": {
-				"writer": {
-					"filename": "./caddy.access.general.log",
-					"output": "file"
-				},
-				"include": [
-					"http.log.access.general_log"
-				]
-			},
-			"health_check_log": {
-				"writer": {
-					"filename": "./caddy.access.health.log",
-					"output": "file"
-				},
-				"include": [
-					"http.log.access.health_check_log"
-				]
-			},
-			"log0": {
-				"writer": {
-					"filename": "./caddy.access.log",
-					"output": "file"
-				},
-				"include": [
-					"http.log.access.log0"
-				]
-			}
-		}
-	},
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"group": "group2",
-											"handle": [
-												{
-													"handler": "subroute",
-													"routes": [
-														{
-															"handle": [
-																{
-																	"access_logger_names": [
-																		"health_check_log",
-																		"general_log"
-																	],
-																	"handler": "vars"
-																},
-																{
-																	"body": "Healthy",
-																	"handler": "static_response"
-																}
-															]
-														}
-													]
-												}
-											],
-											"match": [
-												{
-													"expression": {
-														"expr": "header_regexp('User-Agent', '^some-regexp$') || path('/healthz*')",
-														"name": "healthCheck"
-													}
-												}
-											]
-										},
-										{
-											"group": "group2",
-											"handle": [
-												{
-													"handler": "subroute",
-													"routes": [
-														{
-															"handle": [
-																{
-																	"body": "Hello World",
-																	"handler": "static_response"
-																}
-															]
-														}
-													]
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					],
-					"logs": {
-						"logger_names": {
-							"localhost": [
-								"log0"
-							]
-						}
-					}
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/log_sampling.caddyfiletest

@@ -1,45 +0,0 @@
-:80 {
-	log {
-		sampling {
-			interval 300
-			first 50
-			thereafter 40
-		}
-	}
-}
-----------
-{
-	"logging": {
-		"logs": {
-			"default": {
-				"exclude": [
-					"http.log.access.log0"
-				]
-			},
-			"log0": {
-				"sampling": {
-					"interval": 300,
-					"first": 50,
-					"thereafter": 40
-				},
-				"include": [
-					"http.log.access.log0"
-				]
-			}
-		}
-	},
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":80"
-					],
-					"logs": {
-						"default_logger_name": "log0"
-					}
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/map_and_vars_with_raw_types.caddyfiletest

@@ -1,23 +1,23 @@
 example.com
 
-map {host} {my_placeholder} {magic_number} {
+map {host}             {my_placeholder}  {magic_number} {
 	# Should output boolean "true" and an integer
-	example.com true 3
+	example.com        true              3
 
 	# Should output a string and null
-	foo.example.com "string value"
+	foo.example.com    "string value"
 
 	# Should output two strings (quoted int)
-	(.*)\.example.com "${1} subdomain" "5"
+	(.*)\.example.com  "${1} subdomain"  "5"
 
 	# Should output null and a string (quoted int)
-	~.*\.net$ - `7`
+	~.*\.net$          -                 `7`
 
 	# Should output a float and the string "false"
-	~.*\.xyz$ 123.456 "false"
+	~.*\.xyz$          123.456           "false"
 
 	# Should output two strings, second being escaped quote
-	default "unknown domain" \"""
+	default            "unknown domain"  \"""
 }
 
 vars foo bar
@@ -27,7 +27,6 @@ vars {
 	ghi 2.3
 	jkl "mn op"
 }
-
 ----------
 {
 	"apps": {

caddytest/integration/caddyfile_adapt/matcher_outside_site_block.caddyfiletest

@@ -1,9 +0,0 @@
-@foo {
-	path /foo
-}
-
-handle {
-	respond "should not work"
-}
-----------
-request matchers may not be defined globally, they must be in a site block; found @foo, at Caddyfile:1

caddytest/integration/caddyfile_adapt/matcher_syntax.caddyfiletest

@@ -46,18 +46,6 @@
 
 	@matcher12 client_ip private_ranges
 	respond @matcher12 "client_ip matcher with private ranges"
-
-	@matcher13 {
-		remote_ip 1.1.1.1
-		remote_ip 2.2.2.2
-	}
-	respond @matcher13 "remote_ip merged"
-
-	@matcher14 {
-		client_ip 1.1.1.1
-		client_ip 2.2.2.2
-	}
-	respond @matcher14 "client_ip merged"
 }
 ----------
 {
@@ -291,42 +279,6 @@
 									"handler": "static_response"
 								}
 							]
-						},
-						{
-							"match": [
-								{
-									"remote_ip": {
-										"ranges": [
-											"1.1.1.1",
-											"2.2.2.2"
-										]
-									}
-								}
-							],
-							"handle": [
-								{
-									"body": "remote_ip merged",
-									"handler": "static_response"
-								}
-							]
-						},
-						{
-							"match": [
-								{
-									"client_ip": {
-										"ranges": [
-											"1.1.1.1",
-											"2.2.2.2"
-										]
-									}
-								}
-							],
-							"handle": [
-								{
-									"body": "client_ip merged",
-									"handler": "static_response"
-								}
-							]
 						}
 					]
 				}

caddytest/integration/caddyfile_adapt/metrics_merge_options.caddyfiletest

@@ -1,39 +0,0 @@
-{
-	metrics
-	servers :80 {
-		metrics {
-			per_host
-		}
-	}
-}
-:80 {
-	respond "Hello"
-}
-
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":80"
-					],
-					"routes": [
-						{
-							"handle": [
-								{
-									"body": "Hello",
-									"handler": "static_response"
-								}
-							]
-						}
-					]
-				}
-			},
-			"metrics": {
-				"per_host": true
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/metrics_perhost.caddyfiletest

@@ -1,37 +0,0 @@
-{
-	servers :80 {
-		metrics {
-			per_host
-		}
-	}
-}
-:80 {
-	respond "Hello"
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":80"
-					],
-					"routes": [
-						{
-							"handle": [
-								{
-									"body": "Hello",
-									"handler": "static_response"
-								}
-							]
-						}
-					]
-				}
-			},
-			"metrics": {
-				"per_host": true
-			}
-		}
-	}
-}