fix: unwrap adapter modules to get underlying modules

.editorconfig

@@ -1,5 +1,5 @@
 [*]
 end_of_line = lf
 
-[caddytest/integration/caddyfile_adapt/*.caddyfiletest]
+[caddytest/integration/caddyfile_adapt/*.txt]
 indent_style = tab

.github/CONTRIBUTING.md

@@ -25,7 +25,7 @@ Other menu items:
 
 You can have a huge impact on the project by helping with its code. To contribute code to Caddy, first submit or comment in an issue to discuss your contribution, then open a [pull request](https://github.com/caddyserver/caddy/pulls) (PR). If you're new to our community, that's okay: **we gladly welcome pull requests from anyone, regardless of your native language or coding experience.** You can get familiar with Caddy's code base by using [code search at Sourcegraph](https://sourcegraph.com/github.com/caddyserver/caddy).
 
-We hold contributions to a high standard for quality :bowtie:, so don't be surprised if we ask for revisions—even if it seems small or insignificant. Please don't take it personally. :blue_heart: If your change is on the right track, we can guide you to make it mergeable.
+We hold contributions to a high standard for quality :bowtie:, so don't be surprised if we ask for revisions—even if it seems small or insignificant. Please don't take it personally. :blue_heart: If your change is on the right track, we can guide you to make it mergable.
 
 Here are some of the expectations we have of contributors:
 

.github/SECURITY.md

@@ -5,11 +5,11 @@ The Caddy project would like to make sure that it stays on top of all practicall
 
 ## Supported Versions
 
-| Version  | Supported |
+| Version | Supported          |
-| -------- | ----------|
+| ------- | ------------------ |
-| 2.latest | ✔️        |
+| 2.x     | :white_check_mark: |
-| 1.x      | :x:       |
+| 1.x     | :x:                |
-| < 1.x    | :x:       |
+| < 1.x   | :x:                |
 
 
 ## Acceptable Scope
@@ -24,7 +24,7 @@ We do not accept reports if the steps imply or require a compromised system or t
 
 Client-side exploits are out of scope. In other words, it is not a bug in Caddy if the web browser does something unsafe, even if the downloaded content was served by Caddy. (Those kinds of exploits can generally be mitigated by proper configuration of HTTP headers.) As a general rule, the content served by Caddy is not considered in scope because content is configurable by the site owner or the associated web application.
 
-Security bugs in code dependencies (including Go's standard library) are out of scope. Instead, if a dependency has patched a relevant security bug, please feel free to open a public issue or pull request to update that dependency in our code.
+Security bugs in code dependencies are out of scope. Instead, if a dependency has patched a relevant security bug, please feel free to open a public issue or pull request to update that dependency in our code.
 
 
 ## Reporting a Vulnerability
@@ -42,7 +42,7 @@ We'll need enough information to verify the bug and make a patch. To speed thing
 - Specific minimal steps to reproduce the issue from scratch
 - A working patch
 
-Please DO NOT use containers, VMs, cloud instances or services, or any other complex infrastructure in your steps. Always prefer `curl -v` instead of web browsers.
+Please DO NOT use containers, VMs, cloud instances or services, or any other complex infrastructure in your steps. Always prefer `curl` instead of web browsers.
 
 We consider publicly-registered domain names to be public information. This necessary in order to maintain the integrity of certificate transparency, public DNS, and other public trust systems. Do not redact domain names from your reports. The actual content of your domain name affects Caddy's behavior, so we need the exact domain name(s) to reproduce with, or your report will be ignored.
 

.github/workflows/ci.yml

@@ -12,56 +12,47 @@ on:
       - master
       - 2.*
 
-env:
-  # https://github.com/actions/setup-go/issues/491
-  GOTOOLCHAIN: local
-
 jobs:
   test:
     strategy:
       # Default is true, cancels jobs for other platforms in the matrix if one fails
       fail-fast: false
       matrix:
-        os:
+        os: [ ubuntu-latest, macos-latest, windows-latest ]
-          - linux
+        go: [ '1.19', '1.20' ]
-          - mac
-          - windows
-        go:
-          - '1.24'
 
         include:
         # Set the minimum Go patch version for the given Go minor
         # Usable via ${{ matrix.GO_SEMVER }}
-        - go: '1.24'
+        - go: '1.19'
-          GO_SEMVER: '~1.24.1'
+          GO_SEMVER: '~1.19.6'
+
+        - go: '1.20'
+          GO_SEMVER: '~1.20.1'
 
         # Set some variables per OS, usable via ${{ matrix.VAR }}
-        # OS_LABEL: the VM label from GitHub Actions (see https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#standard-github-hosted-runners-for-public-repositories)
         # CADDY_BIN_PATH: the path to the compiled Caddy binary, for artifact publishing
         # SUCCESS: the typical value for $? per OS (Windows/pwsh returns 'True')
-        - os: linux
+        - os: ubuntu-latest
-          OS_LABEL: ubuntu-latest
           CADDY_BIN_PATH: ./cmd/caddy/caddy
           SUCCESS: 0
 
-        - os: mac
+        - os: macos-latest
-          OS_LABEL: macos-14
           CADDY_BIN_PATH: ./cmd/caddy/caddy
           SUCCESS: 0
 
-        - os: windows
+        - os: windows-latest
-          OS_LABEL: windows-latest
           CADDY_BIN_PATH: ./cmd/caddy/caddy.exe
           SUCCESS: 'True'
 
-    runs-on: ${{ matrix.OS_LABEL }}
+    runs-on: ${{ matrix.os }}
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v3
 
     - name: Install Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v4
       with:
         go-version: ${{ matrix.GO_SEMVER }}
         check-latest: true
@@ -77,7 +68,6 @@ jobs:
 
     - name: Print Go version and environment
       id: vars
-      shell: bash
       run: |
         printf "Using go at: $(which go)\n"
         printf "Go version: $(go version)\n"
@@ -99,20 +89,13 @@ jobs:
       env:
         CGO_ENABLED: 0
       run: |
-        go build -tags nobadger,nomysql,nopgx -trimpath -ldflags="-w -s" -v
+        go build -trimpath -ldflags="-w -s" -v
-
-    - name: Smoke test Caddy
-      working-directory: ./cmd/caddy
-      run: |
-        ./caddy start
-        ./caddy stop
 
     - name: Publish Build Artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v3
       with:
         name: caddy_${{ runner.os }}_go${{ matrix.go }}_${{ steps.vars.outputs.short_sha }}
         path: ${{ matrix.CADDY_BIN_PATH }}
-        compression-level: 0
 
     # Commented bits below were useful to allow the job to continue
     # even if the tests fail, so we can publish the report separately
@@ -122,7 +105,7 @@ jobs:
       # continue-on-error: true
       run: |
         # (go test -v -coverprofile=cover-profile.out -race ./... 2>&1) > test-results/test-result.out
-        go test -tags nobadger,nomysql,nopgx -v -coverprofile="cover-profile.out" -short -race ./...
+        go test -v -coverprofile="cover-profile.out" -short -race ./...
         # echo "status=$?" >> $GITHUB_OUTPUT
 
     # Relevant step if we reinvestigate publishing test/coverage reports
@@ -135,7 +118,7 @@ jobs:
 
     # To return the correct result even though we set 'continue-on-error: true'
     # - name: Coerce correct build result
-    #   if: matrix.os != 'windows' && steps.step_test.outputs.status != ${{ matrix.SUCCESS }}
+    #   if: matrix.os != 'windows-latest' && steps.step_test.outputs.status != ${{ matrix.SUCCESS }}
     #   run: |
     #     echo "step_test ${{ steps.step_test.outputs.status }}\n"
     #     exit 1
@@ -143,48 +126,25 @@ jobs:
   s390x-test:
     name: test (s390x on IBM Z)
     runs-on: ubuntu-latest
-    if: github.event.pull_request.head.repo.full_name == 'caddyserver/caddy' && github.actor != 'dependabot[bot]'
+    if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
     continue-on-error: true  # August 2020: s390x VM is down due to weather and power issues
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v3
       - name: Run Tests
         run: |
-          set +e
           mkdir -p ~/.ssh && echo -e "${SSH_KEY//_/\\n}" > ~/.ssh/id_ecdsa && chmod og-rwx ~/.ssh/id_ecdsa
 
           # short sha is enough?
           short_sha=$(git rev-parse --short HEAD)
 
-          # To shorten the following lines
-          ssh_opts="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
-          ssh_host="$CI_USER@ci-s390x.caddyserver.com"
-
           # The environment is fresh, so there's no point in keeping accepting and adding the key.
-          rsync -arz -e "ssh $ssh_opts" --progress --delete --exclude '.git' . "$ssh_host":/var/tmp/"$short_sha"
+          rsync -arz -e "ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" --progress --delete --exclude '.git' . "$CI_USER"@ci-s390x.caddyserver.com:/var/tmp/"$short_sha"
-          ssh $ssh_opts -t "$ssh_host" bash <<EOF
+          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -t "$CI_USER"@ci-s390x.caddyserver.com "cd /var/tmp/$short_sha; go version; go env; printf "\n\n";CGO_ENABLED=0 go test -v ./..."
-          cd /var/tmp/$short_sha
-          go version
-          go env
-          printf "\n\n"
-          retries=3
-          exit_code=0
-          while ((retries > 0)); do
-            CGO_ENABLED=0 go test -p 1 -tags nobadger,nomysql,nopgx -v ./...
-            exit_code=$?
-            if ((exit_code == 0)); then
-              break
-            fi
-            echo "\n\nTest failed: \$exit_code, retrying..."
-            ((retries--))
-          done
-          echo "Remote exit code: \$exit_code"
-          exit \$exit_code
-          EOF
           test_result=$?
 
           # There's no need leaving the files around
-          ssh $ssh_opts "$ssh_host" "rm -rf /var/tmp/'$short_sha'"
+          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null "$CI_USER"@ci-s390x.caddyserver.com "rm -rf /var/tmp/'$short_sha'"
 
           echo "Test exit code: $test_result"
           exit $test_result
@@ -194,27 +154,13 @@ jobs:
 
   goreleaser-check:
     runs-on: ubuntu-latest
-    if: github.event.pull_request.head.repo.full_name == 'caddyserver/caddy' && github.actor != 'dependabot[bot]'
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v3
       
-      - uses: goreleaser/goreleaser-action@v6
+      - uses: goreleaser/goreleaser-action@v4
         with:
           version: latest
           args: check
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: "~1.24"
-          check-latest: true
-      - name: Install xcaddy
-        run: |
-          go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
-          xcaddy version
-      - uses: goreleaser/goreleaser-action@v6
-        with:
-          version: latest
-          args: build --single-target --snapshot
         env:
-          TAG: ${{ github.head_ref || github.ref_name }}
+          TAG: ${{ steps.vars.outputs.version_tag }}

.github/workflows/cross-build.yml

@@ -10,43 +10,28 @@ on:
       - master
       - 2.*
 
-env:
-  # https://github.com/actions/setup-go/issues/491
-  GOTOOLCHAIN: local
-
 jobs:
-  build:
+  cross-build-test:
     strategy:
       fail-fast: false
       matrix:
-        goos:
+        goos: ['android', 'linux', 'solaris', 'illumos', 'dragonfly', 'freebsd', 'openbsd', 'plan9', 'windows', 'darwin', 'netbsd']
-          - 'aix'
+        go: [ '1.20' ]
-          - 'linux'
-          - 'solaris'
-          - 'illumos'
-          - 'dragonfly'
-          - 'freebsd'
-          - 'openbsd'
-          - 'windows'
-          - 'darwin'
-          - 'netbsd'
-        go:
-          - '1.24'
 
         include:
         # Set the minimum Go patch version for the given Go minor
         # Usable via ${{ matrix.GO_SEMVER }}
-        - go: '1.24'
+        - go: '1.20'
-          GO_SEMVER: '~1.24.1'
+          GO_SEMVER: '~1.20.1'
 
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v3
 
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v4
         with:
           go-version: ${{ matrix.GO_SEMVER }}
           check-latest: true
@@ -65,9 +50,12 @@ jobs:
         env:
           CGO_ENABLED: 0
           GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goos == 'aix' && 'ppc64' || 'amd64' }}
         shell: bash
         continue-on-error: true
         working-directory: ./cmd/caddy
         run: |
-          GOOS=$GOOS GOARCH=$GOARCH go build -tags=nobadger,nomysql,nopgx -trimpath -o caddy-"$GOOS"-$GOARCH 2> /dev/null
+          GOOS=$GOOS go build -trimpath -o caddy-"$GOOS"-amd64 2> /dev/null
+          if [ $? -ne 0 ]; then
+            echo "::warning ::$GOOS Build Failed"
+            exit 0
+          fi

.github/workflows/lint.yml

@@ -13,59 +13,29 @@ on:
 permissions:
   contents: read
 
-env:
-  # https://github.com/actions/setup-go/issues/491
-  GOTOOLCHAIN: local
-
 jobs:
   # From https://github.com/golangci/golangci-lint-action
   golangci:
     permissions:
-      contents: read # for actions/checkout to fetch code
+      contents: read  # for actions/checkout to fetch code
-      pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
+      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
     name: lint
     strategy:
       matrix:
-        os:
+        os: [ubuntu-latest, macos-latest, windows-latest]
-          - linux
+    runs-on: ${{ matrix.os }}
-          - mac
-          - windows
-
-        include:
-        - os: linux
-          OS_LABEL: ubuntu-latest
-
-        - os: mac
-          OS_LABEL: macos-14
-
-        - os: windows
-          OS_LABEL: windows-latest
-
-    runs-on: ${{ matrix.OS_LABEL }}
-
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
         with:
-          go-version: '~1.24'
+          go-version: '~1.19.6'
           check-latest: true
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v3
         with:
-          version: latest
+          version: v1.50
-
           # Windows times out frequently after about 5m50s if we don't set a longer timeout.
           args: --timeout 10m
-
           # Optional: show only new issues if it's a pull request. The default value is `false`.
           # only-new-issues: true
-
-  govulncheck:
-    runs-on: ubuntu-latest
-    steps:
-      - name: govulncheck
-        uses: golang/govulncheck-action@v1
-        with:
-          go-version-input: '~1.24.1'
-          check-latest: true

.github/workflows/release.yml

@@ -5,25 +5,19 @@ on:
     tags:
       - 'v*.*.*'
 
-env:
-  # https://github.com/actions/setup-go/issues/491
-  GOTOOLCHAIN: local
-
 jobs:
   release:
     name: Release
     strategy:
       matrix:
-        os: 
+        os: [ ubuntu-latest ]
-          - ubuntu-latest
+        go: [ '1.20' ]
-        go: 
-          - '1.24'
 
         include:
         # Set the minimum Go patch version for the given Go minor
         # Usable via ${{ matrix.GO_SEMVER }}
-        - go: '1.24'
+        - go: '1.20'
-          GO_SEMVER: '~1.24.1'
+          GO_SEMVER: '~1.20.1'
 
     runs-on: ${{ matrix.os }}
     # https://github.com/sigstore/cosign/issues/1258#issuecomment-1002251233
@@ -36,18 +30,18 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v3
       with:
         fetch-depth: 0
 
     - name: Install Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v4
       with:
         go-version: ${{ matrix.GO_SEMVER }}
         check-latest: true
 
     # Force fetch upstream tags -- because 65 minutes
-    # tl;dr: actions/checkout@v4 runs this line:
+    # tl;dr: actions/checkout@v3 runs this line:
     #   git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +ebc278ec98bb24f2852b61fde2a9bf2e3d83818b:refs/tags/
     # which makes its own local lightweight tag, losing all the annotations in the process. Our earlier script ran:
     #   git fetch --prune --unshallow
@@ -108,16 +102,12 @@ jobs:
       uses: anchore/sbom-action/download-syft@main
     - name: Syft version
       run: syft version
-    - name: Install xcaddy
-      run: |
-        go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
-        xcaddy version
     # GoReleaser will take care of publishing those artifacts into the release
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@v6
+      uses: goreleaser/goreleaser-action@v4
       with:
         version: latest
-        args: release --clean --timeout 60m
+        args: release --rm-dist --timeout 60m
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         TAG: ${{ steps.vars.outputs.version_tag }}

.github/workflows/release_published.yml

@@ -10,15 +10,14 @@ jobs:
     name: Release Published
     strategy:
       matrix:
-        os: 
+        os: [ ubuntu-latest ]
-          - ubuntu-latest
     runs-on: ${{ matrix.os }}
 
     steps:
 
     # See https://github.com/peter-evans/repository-dispatch
     - name: Trigger event on caddyserver/dist
-      uses: peter-evans/repository-dispatch@v3
+      uses: peter-evans/repository-dispatch@v2
       with:
         token: ${{ secrets.REPO_DISPATCH_TOKEN }}
         repository: caddyserver/dist
@@ -26,7 +25,7 @@ jobs:
         client-payload: '{"tag": "${{ github.event.release.tag_name }}"}'
 
     - name: Trigger event on caddyserver/caddy-docker
-      uses: peter-evans/repository-dispatch@v3
+      uses: peter-evans/repository-dispatch@v2
       with:
         token: ${{ secrets.REPO_DISPATCH_TOKEN }}
         repository: caddyserver/caddy-docker

.gitignore

@@ -3,7 +3,6 @@ _gitignore/
 Caddyfile
 Caddyfile.*
 !caddyfile/
-!caddyfile.go
 
 # artifacts from pprof tooling
 *.prof
@@ -13,7 +12,6 @@ Caddyfile.*
 cmd/caddy/caddy
 cmd/caddy/caddy.exe
 cmd/caddy/tmp/*.exe
-cmd/caddy/.env
 
 # mac specific
 .DS_Store

.golangci.yml

@@ -1,83 +1,36 @@
 linters-settings:
   errcheck:
-    exclude-functions:
+    ignore: fmt:.*,go.uber.org/zap/zapcore:^Add.*
-      - fmt.*
+    ignoretests: true
-      - (go.uber.org/zap/zapcore.ObjectEncoder).AddObject
-      - (go.uber.org/zap/zapcore.ObjectEncoder).AddArray
-  gci:
-    sections:
-      - standard # Standard section: captures all standard packages.
-      - default # Default section: contains all imports that could not be matched to another section type.
-      - prefix(github.com/caddyserver/caddy/v2/cmd) # ensure that this is always at the top and always has a line break.
-      - prefix(github.com/caddyserver/caddy) # Custom section: groups all imports with the specified Prefix.
-    # Skip generated files.
-    # Default: true
-    skip-generated: true
-    # Enable custom order of sections.
-    # If `true`, make the section order the same as the order of `sections`.
-    # Default: false
-    custom-order: true
-  exhaustive:
-    ignore-enum-types: reflect.Kind|svc.Cmd
 
 linters:
   disable-all: true
   enable:
-    - asasalint
-    - asciicheck
-    - bidichk
     - bodyclose
-    - decorder
-    - dogsled
-    - dupl
-    - dupword
-    - durationcheck
     - errcheck
-    - errname
-    - exhaustive
-    - gci
     - gofmt
     - goimports
-    - gofumpt
     - gosec
     - gosimple
     - govet
     - ineffassign
-    - importas
     - misspell
     - prealloc
-    - promlinter
-    - sloglint
-    - sqlclosecheck
     - staticcheck
-    - tenv
-    - testableexamples
-    - testifylint
-    - tparallel
     - typecheck
     - unconvert
     - unused
-    - wastedassign
-    - whitespace
-    - zerologlint
   # these are implicitly disabled:
-  # - containedctx
+  # - asciicheck
-  # - contextcheck
-  # - cyclop
   # - depguard
-  # - errchkjson
+  # - dogsled
-  # - errorlint
+  # - dupl
-  # - exhaustruct
+  # - exhaustive
-  # - execinquery
+  # - exportloopref
-  # - exhaustruct
-  # - forbidigo
-  # - forcetypeassert
   # - funlen
-  # - ginkgolinter
+  # - gci
-  # - gocheckcompilerdirectives
   # - gochecknoglobals
   # - gochecknoinits
-  # - gochecksumtype
   # - gocognit
   # - goconst
   # - gocritic
@@ -85,98 +38,62 @@ linters:
   # - godot
   # - godox
   # - goerr113
+  # - gofumpt
   # - goheader
+  # - golint
   # - gomnd
-  # - gomoddirectives
   # - gomodguard
   # - goprintffuncname
-  # - gosmopolitan
+  # - interfacer
-  # - grouper
-  # - inamedparam
-  # - interfacebloat
-  # - ireturn
   # - lll
-  # - loggercheck
+  # - maligned
-  # - maintidx
-  # - makezero
-  # - mirror
-  # - musttag
   # - nakedret
   # - nestif
-  # - nilerr
-  # - nilnil
   # - nlreturn
   # - noctx
   # - nolintlint
-  # - nonamedreturns
-  # - nosprintfhostport
-  # - paralleltest
-  # - perfsprint
-  # - predeclared
-  # - protogetter
-  # - reassign
-  # - revive
   # - rowserrcheck
+  # - scopelint
+  # - sqlclosecheck
   # - stylecheck
-  # - tagalign
-  # - tagliatelle
   # - testpackage
-  # - thelper
   # - unparam
-  # - usestdlibvars
+  # - whitespace
-  # - varnamelen
-  # - wrapcheck
   # - wsl
 
 run:
   # default concurrency is a available CPU number.
   # concurrency: 4 # explicitly omit this value to fully utilize available resources.
-  timeout: 5m
+  deadline: 5m
   issues-exit-code: 1
   tests: false
 
 # output configuration options
 output:
-  formats:
+  format: 'colored-line-number'
-    - format: 'colored-line-number'
   print-issued-lines: true
   print-linter-name: true
 
 issues:
   exclude-rules:
-    - text: 'G115' # TODO: Either we should fix the issues or nuke the linter if it's bad
-      linters:
-        - gosec
     # we aren't calling unknown URL
-    - text: 'G107' # G107: Url provided to HTTP request as taint input
+    - text: "G107" # G107: Url provided to HTTP request as taint input
       linters:
         - gosec
     # as a web server that's expected to handle any template, this is totally in the hands of the user.
-    - text: 'G203' # G203: Use of unescaped data in HTML templates
+    - text: "G203" # G203: Use of unescaped data in HTML templates
       linters:
         - gosec
     # we're shelling out to known commands, not relying on user-defined input.
-    - text: 'G204' # G204: Audit use of command execution
+    - text: "G204" # G204: Audit use of command execution
       linters:
         - gosec
     # the choice of weakrand is deliberate, hence the named import "weakrand"
     - path: modules/caddyhttp/reverseproxy/selectionpolicies.go
-      text: 'G404' # G404: Insecure random number source (rand)
+      text: "G404" # G404: Insecure random number source (rand)
       linters:
         - gosec
     - path: modules/caddyhttp/reverseproxy/streaming.go
-      text: 'G404' # G404: Insecure random number source (rand)
+      text: "G404" # G404: Insecure random number source (rand)
       linters:
         - gosec
-    - path: modules/logging/filters.go
-      linters:
-        - dupl
-    - path: modules/caddyhttp/matchers.go
-      linters:
-        - dupl
-    - path: modules/caddyhttp/vars.go
-      linters:
-        - dupl
-    - path: _test\.go
-      linters:
-        - errcheck

.goreleaser.yml

@@ -1,5 +1,3 @@
-version: 2
-
 before:
   hooks:
     # The build is done in this particular way to build Caddy in a designated directory named in .gitignore.
@@ -12,9 +10,6 @@ before:
     - mkdir -p caddy-build
     - cp cmd/caddy/main.go caddy-build/main.go
     - /bin/sh -c 'cd ./caddy-build && go mod init caddy'
-    # prepare syso files for windows embedding
-    - /bin/sh -c 'for a in amd64 arm arm64; do XCADDY_SKIP_BUILD=1 GOOS=windows GOARCH=$a xcaddy build {{.Env.TAG}}; done'
-    - /bin/sh -c 'mv /tmp/buildenv_*/*.syso caddy-build'
     # GoReleaser doesn't seem to offer {{.Tag}} at this stage, so we have to embed it into the env
     # so we run: TAG=$(git describe --abbrev=0) goreleaser release --rm-dist --skip-publish --skip-validate
     - go mod edit -require=github.com/caddyserver/caddy/v2@{{.Env.TAG}} ./caddy-build/go.mod
@@ -34,6 +29,7 @@ builds:
 - env:
   - CGO_ENABLED=0
   - GO111MODULE=on
+  main: main.go
   dir: ./caddy-build
   binary: caddy
   goos:
@@ -47,7 +43,6 @@ builds:
   - arm64
   - s390x
   - ppc64le
-  - riscv64
   goarm:
   - "5"
   - "6"
@@ -59,20 +54,14 @@ builds:
       goarch: ppc64le
     - goos: darwin
       goarch: s390x
-    - goos: darwin
-      goarch: riscv64
     - goos: windows
       goarch: ppc64le
     - goos: windows
       goarch: s390x
-    - goos: windows
-      goarch: riscv64
     - goos: freebsd
       goarch: ppc64le
     - goos: freebsd
       goarch: s390x
-    - goos: freebsd
-      goarch: riscv64
     - goos: freebsd
       goarch: arm
       goarm: "5"
@@ -81,10 +70,6 @@ builds:
   - -mod=readonly
   ldflags:
   - -s -w
-  tags:
-  - nobadger
-  - nomysql
-  - nopgx
 
 signs:
   - cmd: cosign
@@ -111,7 +96,7 @@ archives:
   - id: default
     format_overrides:
       - goos: windows
-        formats: zip
+        format: zip
     name_template: >-
       {{ .ProjectName }}_
       {{- .Version }}_
@@ -121,10 +106,11 @@ archives:
       {{- with .Mips }}_{{ . }}{{ end }}
       {{- if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}
   
-  # package the 'caddy-build' directory into a tarball,
+  # packge the 'caddy-build' directory into a tarball,
   # allowing users to build the exact same set of files as ours.
   - id: source
     meta: true
+    rlcp: true
     name_template: "{{ .ProjectName }}_{{ .Version }}_buildable-artifact"
     files:
       - src: LICENSE
@@ -141,6 +127,14 @@ source:
   name_template: '{{ .ProjectName }}_{{ .Version }}_src'
   format: 'tar.gz'
 
+  # This will make the destination paths be relative to the longest common
+  # path prefix between all the files matched and the source glob.
+  # Enabling this essentially mimic the behavior of nfpm's contents section.
+  # It will be the default by June 2023.
+  #
+  # Default: false
+  rlcp: true
+
   # Additional files/template/globs you want to add to the source archive.
   #
   # Default: empty.
@@ -192,9 +186,6 @@ nfpms:
       preremove: ./caddy-dist/scripts/preremove.sh
       postremove: ./caddy-dist/scripts/postremove.sh
 
-    provides:
-      - httpd
-
 release:
   github:
     owner: caddyserver

README.md

@@ -16,7 +16,7 @@
 	<a href="https://github.com/caddyserver/caddy/actions/workflows/ci.yml"><img src="https://github.com/caddyserver/caddy/actions/workflows/ci.yml/badge.svg"></a>
 	<a href="https://pkg.go.dev/github.com/caddyserver/caddy/v2"><img src="https://img.shields.io/badge/godoc-reference-%23007d9c.svg"></a>
 	<br>
-	<a href="https://x.com/caddyserver" title="@caddyserver on Twitter"><img src="https://img.shields.io/twitter/follow/caddyserver" alt="@caddyserver on Twitter"></a>
+	<a href="https://twitter.com/caddyserver" title="@caddyserver on Twitter"><img src="https://img.shields.io/badge/twitter-@caddyserver-55acee.svg" alt="@caddyserver on Twitter"></a>
 	<a href="https://caddy.community" title="Caddy Forum"><img src="https://img.shields.io/badge/community-forum-ff69b4.svg" alt="Caddy Forum"></a>
 	<br>
 	<a href="https://sourcegraph.com/github.com/caddyserver/caddy?badge" title="Caddy on Sourcegraph"><img src="https://sourcegraph.com/github.com/caddyserver/caddy/-/badge.svg" alt="Caddy on Sourcegraph"></a>
@@ -56,7 +56,7 @@
 </p>
 
 
-## [Features](https://caddyserver.com/features)
+## [Features](https://caddyserver.com/v2)
 
 - **Easy configuration** with the [Caddyfile](https://caddyserver.com/docs/caddyfile)
 - **Powerful configuration** with its [native JSON config](https://caddyserver.com/docs/json/)
@@ -67,7 +67,6 @@
 	- Fully-managed local CA for internal names & IPs
 	- Can coordinate with other Caddy instances in a cluster
 	- Multi-issuer fallback
-	- Encrypted ClientHello (ECH) support
 - **Stays up when other servers go down** due to TLS/OCSP/certificate-related issues
 - **Production-ready** after serving trillions of requests and managing millions of TLS certificates
 - **Scales to hundreds of thousands of sites** as proven in production
@@ -76,7 +75,7 @@
 - **Runs anywhere** with **no external dependencies** (not even libc)
 - Written in Go, a language with higher **memory safety guarantees** than other servers
 - Actually **fun to use**
-- So much more to [discover](https://caddyserver.com/features)
+- So much more to [discover](https://caddyserver.com/v2)
 
 ## Install
 
@@ -88,7 +87,7 @@ See [our online documentation](https://caddyserver.com/docs/install) for other i
 
 Requirements:
 
-- [Go 1.24.0 or newer](https://golang.org/dl/)
+- [Go 1.19 or newer](https://golang.org/dl/)
 
 ### For development
 
@@ -132,7 +131,7 @@ $ xcaddy build
 4. Initialize a Go module: `go mod init caddy`
 5. (Optional) Pin Caddy version: `go get github.com/caddyserver/caddy/v2@version` replacing `version` with a git tag, commit, or branch name.
 6. (Optional) Add plugins by adding their import: `_ "import/path/here"`
-7. Compile: `go build -tags=nobadger,nomysql,nopgx`
+7. Compile: `go build`
 
 
 
@@ -177,7 +176,7 @@ The docs are also open source. You can contribute to them here: https://github.c
 
 ## Getting help
 
-- We advise companies using Caddy to secure a support contract through [Ardan Labs](https://www.ardanlabs.com) before help is needed.
+- We advise companies using Caddy to secure a support contract through [Ardan Labs](https://www.ardanlabs.com/my/contact-us?dd=caddy) before help is needed.
 
 - A [sponsorship](https://github.com/sponsors/mholt) goes a long way! We can offer private help to sponsors. If Caddy is benefitting your company, please consider a sponsorship. This not only helps fund full-time work to ensure the longevity of the project, it provides your company the resources, support, and discounts you need; along with being a great look for your company to your customers and potential customers!
 
@@ -193,8 +192,8 @@ Matthew Holt began developing Caddy in 2014 while studying computer science at B
 
 **The name "Caddy" is trademarked.** The name of the software is "Caddy", not "Caddy Server" or "CaddyServer". Please call it "Caddy" or, if you wish to clarify, "the Caddy web server". Caddy is a registered trademark of Stack Holdings GmbH.
 
-- _Project on X: [@caddyserver](https://x.com/caddyserver)_
+- _Project on Twitter: [@caddyserver](https://twitter.com/caddyserver)_
-- _Author on X: [@mholt6](https://x.com/mholt6)_
+- _Author on Twitter: [@mholt6](https://twitter.com/mholt6)_
 
 Caddy is a project of [ZeroSSL](https://zerossl.com), a Stack Holdings company.
 

admin.go

@@ -26,6 +26,7 @@ import (
 	"expvar"
 	"fmt"
 	"hash"
+	"hash/fnv"
 	"io"
 	"net"
 	"net/http"
@@ -34,21 +35,19 @@ import (
 	"os"
 	"path"
 	"regexp"
-	"slices"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/caddyserver/certmagic"
-	"github.com/cespare/xxhash/v2"
 	"github.com/prometheus/client_golang/prometheus"
 	"go.uber.org/zap"
 	"go.uber.org/zap/zapcore"
 )
 
 func init() {
-	// The hard-coded default `DefaultAdminListen` can be overridden
+	// The hard-coded default `DefaultAdminListen` can be overidden
 	// by setting the `CADDY_ADMIN` environment variable.
 	// The environment variable may be used by packagers to change
 	// the default admin address to something more appropriate for
@@ -214,15 +213,14 @@ type AdminPermissions struct {
 
 // newAdminHandler reads admin's config and returns an http.Handler suitable
 // for use in an admin endpoint server, which will be listening on listenAddr.
-func (admin *AdminConfig) newAdminHandler(addr NetworkAddress, remote bool, _ Context) adminHandler {
+func (admin *AdminConfig) newAdminHandler(addr NetworkAddress, remote bool) adminHandler {
 	muxWrap := adminHandler{mux: http.NewServeMux()}
 
 	// secure the local or remote endpoint respectively
 	if remote {
 		muxWrap.remoteControl = admin.Remote
 	} else {
-		// see comment in allowedOrigins() as to why we disable the host check for unix/fd networks
+		muxWrap.enforceHost = !addr.isWildcardInterface()
-		muxWrap.enforceHost = !addr.isWildcardInterface() && !addr.IsUnixNetwork() && !addr.IsFdNetwork()
 		muxWrap.allowedOrigins = admin.allowedOrigins(addr)
 		muxWrap.enforceOrigin = admin.EnforceOrigin
 	}
@@ -271,6 +269,7 @@ func (admin *AdminConfig) newAdminHandler(addr NetworkAddress, remote bool, _ Co
 	// register third-party module endpoints
 	for _, m := range GetModules("admin.api") {
 		router := m.New().(AdminRouter)
+		handlerLabel := m.ID.Name()
 		for _, route := range router.Routes() {
 			addRoute(route.Pattern, handlerLabel, route.Handler)
 		}
@@ -311,43 +310,22 @@ func (admin AdminConfig) allowedOrigins(addr NetworkAddress) []*url.URL {
 	for _, o := range admin.Origins {
 		uniqueOrigins[o] = struct{}{}
 	}
-	// RFC 2616, Section 14.26:
+	if admin.Origins == nil {
-	// "A client MUST include a Host header field in all HTTP/1.1 request
-	// messages. If the requested URI does not include an Internet host
-	// name for the service being requested, then the Host header field MUST
-	// be given with an empty value."
-	//
-	// UPDATE July 2023: Go broke this by patching a minor security bug in 1.20.6.
-	// Understandable, but frustrating. See:
-	// https://github.com/golang/go/issues/60374
-	// See also the discussion here:
-	// https://github.com/golang/go/issues/61431
-	//
-	// We can no longer conform to RFC 2616 Section 14.26 from either Go or curl
-	// in purity. (Curl allowed no host between 7.40 and 7.50, but now requires a
-	// bogus host; see https://superuser.com/a/925610.) If we disable Host/Origin
-	// security checks, the infosec community assures me that it is secure to do
-	// so, because:
-	//
-	// 1) Browsers do not allow access to unix sockets
-	// 2) DNS is irrelevant to unix sockets
-	//
-	// If either of those two statements ever fail to hold true, it is not the
-	// fault of Caddy.
-	//
-	// Thus, we do not fill out allowed origins and do not enforce Host
-	// requirements for unix sockets. Enforcing it leads to confusion and
-	// frustration, when UDS have their own permissions from the OS.
-	// Enforcing host requirements here is effectively security theater,
-	// and a false sense of security.
-	//
-	// See also the discussion in #6832.
-	if admin.Origins == nil && !addr.IsUnixNetwork() && !addr.IsFdNetwork() {
 		if addr.isLoopback() {
-			uniqueOrigins[net.JoinHostPort("localhost", addr.port())] = struct{}{}
+			if addr.IsUnixNetwork() {
-			uniqueOrigins[net.JoinHostPort("::1", addr.port())] = struct{}{}
+				// RFC 2616, Section 14.26:
-			uniqueOrigins[net.JoinHostPort("127.0.0.1", addr.port())] = struct{}{}
+				// "A client MUST include a Host header field in all HTTP/1.1 request
-		} else {
+				// messages. If the requested URI does not include an Internet host
+				// name for the service being requested, then the Host header field MUST
+				// be given with an empty value."
+				uniqueOrigins[""] = struct{}{}
+			} else {
+				uniqueOrigins[net.JoinHostPort("localhost", addr.port())] = struct{}{}
+				uniqueOrigins[net.JoinHostPort("::1", addr.port())] = struct{}{}
+				uniqueOrigins[net.JoinHostPort("127.0.0.1", addr.port())] = struct{}{}
+			}
+		}
+		if !addr.IsUnixNetwork() {
 			uniqueOrigins[addr.JoinHostPort(0)] = struct{}{}
 		}
 	}
@@ -378,9 +356,7 @@ func (admin AdminConfig) allowedOrigins(addr NetworkAddress) []*url.URL {
 // for the admin endpoint exists in cfg, a default one is used, so
 // that there is always an admin server (unless it is explicitly
 // configured to be disabled).
-// Critically note that some elements and functionality of the context
+func replaceLocalAdminServer(cfg *Config) error {
-// may not be ready, e.g. storage. Tread carefully.
-func replaceLocalAdminServer(cfg *Config, ctx Context) error {
 	// always* be sure to close down the old admin endpoint
 	// as gracefully as possible, even if the new one is
 	// disabled -- careful to use reference to the current
@@ -422,14 +398,7 @@ func replaceLocalAdminServer(cfg *Config, ctx Context) error {
 		return err
 	}
 
-	handler := cfg.Admin.newAdminHandler(addr, false, ctx)
+	handler := cfg.Admin.newAdminHandler(addr, false)
-
-	// run the provisioners for loaded modules to make sure local
-	// state is properly re-initialized in the new admin server
-	err = cfg.Admin.provisionAdminRouters(ctx)
-	if err != nil {
-		return err
-	}
 
 	ln, err := addr.Listen(context.TODO(), 0, net.ListenConfig{})
 	if err != nil {
@@ -480,6 +449,7 @@ func manageIdentity(ctx Context, cfg *Config) error {
 	// import the caddytls package -- but it works
 	if cfg.Admin.Identity.IssuersRaw == nil {
 		cfg.Admin.Identity.IssuersRaw = []json.RawMessage{
+			json.RawMessage(`{"module": "zerossl"}`),
 			json.RawMessage(`{"module": "acme"}`),
 		}
 	}
@@ -550,14 +520,7 @@ func replaceRemoteAdminServer(ctx Context, cfg *Config) error {
 
 	// make the HTTP handler but disable Host/Origin enforcement
 	// because we are using TLS authentication instead
-	handler := cfg.Admin.newAdminHandler(addr, true, ctx)
+	handler := cfg.Admin.newAdminHandler(addr, true)
-
-	// run the provisioners for loaded modules to make sure local
-	// state is properly re-initialized in the new admin server
-	err = cfg.Admin.provisionAdminRouters(ctx)
-	if err != nil {
-		return err
-	}
 
 	// create client certificate pool for TLS mutual auth, and extract public keys
 	// so that we can enforce access controls at the application layer
@@ -688,7 +651,13 @@ func (remote RemoteAdmin) enforceAccessControls(r *http.Request) error {
 					// key recognized; make sure its HTTP request is permitted
 					for _, accessPerm := range adminAccess.Permissions {
 						// verify method
-						methodFound := accessPerm.Methods == nil || slices.Contains(accessPerm.Methods, r.Method)
+						methodFound := accessPerm.Methods == nil
+						for _, method := range accessPerm.Methods {
+							if method == r.Method {
+								methodFound = true
+								break
+							}
+						}
 						if !methodFound {
 							return APIError{
 								HTTPStatus: http.StatusForbidden,
@@ -884,9 +853,13 @@ func (h adminHandler) handleError(w http.ResponseWriter, r *http.Request, err er
 // a trustworthy/expected value. This helps to mitigate DNS
 // rebinding attacks.
 func (h adminHandler) checkHost(r *http.Request) error {
-	allowed := slices.ContainsFunc(h.allowedOrigins, func(u *url.URL) bool {
+	var allowed bool
-		return r.Host == u.Host
+	for _, allowedOrigin := range h.allowedOrigins {
-	})
+		if r.Host == allowedOrigin.Host {
+			allowed = true
+			break
+		}
+	}
 	if !allowed {
 		return APIError{
 			HTTPStatus: http.StatusForbidden,
@@ -948,7 +921,7 @@ func (h adminHandler) originAllowed(origin *url.URL) bool {
 
 // etagHasher returns a the hasher we used on the config to both
 // produce and verify ETags.
-func etagHasher() hash.Hash { return xxhash.New() }
+func etagHasher() hash.Hash32 { return fnv.New32a() }
 
 // makeEtag returns an Etag header value (including quotes) for
 // the given config path and hash of contents at that path.
@@ -956,28 +929,17 @@ func makeEtag(path string, hash hash.Hash) string {
 	return fmt.Sprintf(`"%s %x"`, path, hash.Sum(nil))
 }
 
-// This buffer pool is used to keep buffers for
-// reading the config file during eTag header generation
-var bufferPool = sync.Pool{
-	New: func() any {
-		return new(bytes.Buffer)
-	},
-}
-
 func handleConfig(w http.ResponseWriter, r *http.Request) error {
 	switch r.Method {
 	case http.MethodGet:
 		w.Header().Set("Content-Type", "application/json")
+		// Set the ETag as a trailer header.
+		// The alternative is to write the config to a buffer, and
+		// then hash that.
+		w.Header().Set("Trailer", "ETag")
+
 		hash := etagHasher()
-
+		configWriter := io.MultiWriter(w, hash)
-		// Read the config into a buffer instead of writing directly to
-		// the response writer, as we want to set the ETag as the header,
-		// not the trailer.
-		buf := bufferPool.Get().(*bytes.Buffer)
-		buf.Reset()
-		defer bufferPool.Put(buf)
-
-		configWriter := io.MultiWriter(buf, hash)
 		err := readConfig(r.URL.Path, configWriter)
 		if err != nil {
 			return APIError{HTTPStatus: http.StatusBadRequest, Err: err}
@@ -986,10 +948,6 @@ func handleConfig(w http.ResponseWriter, r *http.Request) error {
 		// we could consider setting up a sync.Pool for the summed
 		// hashes to reduce GC pressure.
 		w.Header().Set("Etag", makeEtag(r.URL.Path, hash))
-		_, err = w.Write(buf.Bytes())
-		if err != nil {
-			return APIError{HTTPStatus: http.StatusInternalServerError, Err: err}
-		}
 
 		return nil
 
@@ -1058,9 +1016,9 @@ func handleConfigID(w http.ResponseWriter, r *http.Request) error {
 	id := parts[2]
 
 	// map the ID to the expanded path
-	rawCfgMu.RLock()
+	currentCtxMu.RLock()
 	expanded, ok := rawCfgIndex[id]
-	rawCfgMu.RUnlock()
+	defer currentCtxMu.RUnlock()
 	if !ok {
 		return APIError{
 			HTTPStatus: http.StatusNotFound,
@@ -1150,7 +1108,7 @@ traverseLoop:
 						return fmt.Errorf("[%s] invalid array index '%s': %v",
 							path, idxStr, err)
 					}
-					if idx < 0 || (method != http.MethodPut && idx >= len(arr)) || idx > len(arr) {
+					if idx < 0 || idx >= len(arr) {
 						return fmt.Errorf("[%s] array index out of bounds: %s", path, idxStr)
 					}
 				}
@@ -1213,27 +1171,15 @@ traverseLoop:
 					}
 				case http.MethodPut:
 					if _, ok := v[part]; ok {
-						return APIError{
+						return fmt.Errorf("[%s] key already exists: %s", path, part)
-							HTTPStatus: http.StatusConflict,
-							Err:        fmt.Errorf("[%s] key already exists: %s", path, part),
-						}
 					}
 					v[part] = val
 				case http.MethodPatch:
 					if _, ok := v[part]; !ok {
-						return APIError{
+						return fmt.Errorf("[%s] key does not exist: %s", path, part)
-							HTTPStatus: http.StatusNotFound,
-							Err:        fmt.Errorf("[%s] key does not exist: %s", path, part),
-						}
 					}
 					v[part] = val
 				case http.MethodDelete:
-					if _, ok := v[part]; !ok {
-						return APIError{
-							HTTPStatus: http.StatusNotFound,
-							Err:        fmt.Errorf("[%s] key does not exist: %s", path, part),
-						}
-					}
 					delete(v, part)
 				default:
 					return fmt.Errorf("unrecognized method %s", method)
@@ -1375,7 +1321,7 @@ var (
 // will get deleted before the process gracefully exits.
 func PIDFile(filename string) error {
 	pid := []byte(strconv.Itoa(os.Getpid()) + "\n")
-	err := os.WriteFile(filename, pid, 0o600)
+	err := os.WriteFile(filename, pid, 0600)
 	if err != nil {
 		return err
 	}

admin_test.go

@@ -15,19 +15,12 @@
 package caddy
 
 import (
-	"context"
-	"crypto/x509"
 	"encoding/json"
 	"fmt"
 	"net/http"
-	"net/http/httptest"
 	"reflect"
 	"sync"
 	"testing"
-
-	"github.com/caddyserver/certmagic"
-	"github.com/prometheus/client_golang/prometheus"
-	dto "github.com/prometheus/client_model/go"
 )
 
 var testCfg = []byte(`{
@@ -82,12 +75,6 @@ func TestUnsyncedConfigAccess(t *testing.T) {
 			path:   "/bar/qq",
 			expect: `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c"]}`,
 		},
-		{
-			method:    "DELETE",
-			path:      "/bar/qq",
-			expect:    `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c"]}`,
-			shouldErr: true,
-		},
 		{
 			method:  "POST",
 			path:    "/list",
@@ -210,727 +197,3 @@ func BenchmarkLoad(b *testing.B) {
 		Load(testCfg, true)
 	}
 }
-
-func TestAdminHandlerErrorHandling(t *testing.T) {
-	initAdminMetrics()
-
-	handler := adminHandler{
-		mux: http.NewServeMux(),
-	}
-
-	handler.mux.Handle("/error", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		err := fmt.Errorf("test error")
-		handler.handleError(w, r, err)
-	}))
-
-	req := httptest.NewRequest(http.MethodGet, "/error", nil)
-	rr := httptest.NewRecorder()
-
-	handler.ServeHTTP(rr, req)
-
-	if rr.Code == http.StatusOK {
-		t.Error("expected error response, got success")
-	}
-
-	var apiErr APIError
-	if err := json.NewDecoder(rr.Body).Decode(&apiErr); err != nil {
-		t.Fatalf("decoding response: %v", err)
-	}
-	if apiErr.Message != "test error" {
-		t.Errorf("expected error message 'test error', got '%s'", apiErr.Message)
-	}
-}
-
-func initAdminMetrics() {
-	if adminMetrics.requestErrors != nil {
-		prometheus.Unregister(adminMetrics.requestErrors)
-	}
-	if adminMetrics.requestCount != nil {
-		prometheus.Unregister(adminMetrics.requestCount)
-	}
-
-	adminMetrics.requestErrors = prometheus.NewCounterVec(prometheus.CounterOpts{
-		Namespace: "caddy",
-		Subsystem: "admin_http",
-		Name:      "request_errors_total",
-		Help:      "Number of errors that occurred handling admin endpoint requests",
-	}, []string{"handler", "path", "method"})
-
-	adminMetrics.requestCount = prometheus.NewCounterVec(prometheus.CounterOpts{
-		Namespace: "caddy",
-		Subsystem: "admin_http",
-		Name:      "requests_total",
-		Help:      "Count of requests to the admin endpoint",
-	}, []string{"handler", "path", "code", "method"}) // Added code and method labels
-
-	prometheus.MustRegister(adminMetrics.requestErrors)
-	prometheus.MustRegister(adminMetrics.requestCount)
-}
-
-func TestAdminHandlerBuiltinRouteErrors(t *testing.T) {
-	initAdminMetrics()
-
-	cfg := &Config{
-		Admin: &AdminConfig{
-			Listen: "localhost:2019",
-		},
-	}
-
-	err := replaceLocalAdminServer(cfg, Context{})
-	if err != nil {
-		t.Fatalf("setting up admin server: %v", err)
-	}
-	defer func() {
-		stopAdminServer(localAdminServer)
-	}()
-
-	tests := []struct {
-		name           string
-		path           string
-		method         string
-		expectedStatus int
-	}{
-		{
-			name:           "stop endpoint wrong method",
-			path:           "/stop",
-			method:         http.MethodGet,
-			expectedStatus: http.StatusMethodNotAllowed,
-		},
-		{
-			name:           "config endpoint wrong content-type",
-			path:           "/config/",
-			method:         http.MethodPost,
-			expectedStatus: http.StatusBadRequest,
-		},
-		{
-			name:           "config ID missing ID",
-			path:           "/id/",
-			method:         http.MethodGet,
-			expectedStatus: http.StatusBadRequest,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			req := httptest.NewRequest(test.method, fmt.Sprintf("http://localhost:2019%s", test.path), nil)
-			rr := httptest.NewRecorder()
-
-			localAdminServer.Handler.ServeHTTP(rr, req)
-
-			if rr.Code != test.expectedStatus {
-				t.Errorf("expected status %d but got %d", test.expectedStatus, rr.Code)
-			}
-
-			metricValue := testGetMetricValue(map[string]string{
-				"path":    test.path,
-				"handler": "admin",
-				"method":  test.method,
-			})
-			if metricValue != 1 {
-				t.Errorf("expected error metric to be incremented once, got %v", metricValue)
-			}
-		})
-	}
-}
-
-func testGetMetricValue(labels map[string]string) float64 {
-	promLabels := prometheus.Labels{}
-	for k, v := range labels {
-		promLabels[k] = v
-	}
-
-	metric, err := adminMetrics.requestErrors.GetMetricWith(promLabels)
-	if err != nil {
-		return 0
-	}
-
-	pb := &dto.Metric{}
-	metric.Write(pb)
-	return pb.GetCounter().GetValue()
-}
-
-type mockRouter struct {
-	routes []AdminRoute
-}
-
-func (m mockRouter) Routes() []AdminRoute {
-	return m.routes
-}
-
-type mockModule struct {
-	mockRouter
-}
-
-func (m *mockModule) CaddyModule() ModuleInfo {
-	return ModuleInfo{
-		ID: "admin.api.mock",
-		New: func() Module {
-			mm := &mockModule{
-				mockRouter: mockRouter{
-					routes: m.routes,
-				},
-			}
-			return mm
-		},
-	}
-}
-
-func TestNewAdminHandlerRouterRegistration(t *testing.T) {
-	originalModules := make(map[string]ModuleInfo)
-	for k, v := range modules {
-		originalModules[k] = v
-	}
-	defer func() {
-		modules = originalModules
-	}()
-
-	mockRoute := AdminRoute{
-		Pattern: "/mock",
-		Handler: AdminHandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
-			w.WriteHeader(http.StatusOK)
-			return nil
-		}),
-	}
-
-	mock := &mockModule{
-		mockRouter: mockRouter{
-			routes: []AdminRoute{mockRoute},
-		},
-	}
-	RegisterModule(mock)
-
-	addr, err := ParseNetworkAddress("localhost:2019")
-	if err != nil {
-		t.Fatalf("Failed to parse address: %v", err)
-	}
-
-	admin := &AdminConfig{
-		EnforceOrigin: false,
-	}
-	handler := admin.newAdminHandler(addr, false, Context{})
-
-	req := httptest.NewRequest("GET", "/mock", nil)
-	req.Host = "localhost:2019"
-	rr := httptest.NewRecorder()
-
-	handler.ServeHTTP(rr, req)
-
-	if rr.Code != http.StatusOK {
-		t.Errorf("Expected status code %d but got %d", http.StatusOK, rr.Code)
-		t.Logf("Response body: %s", rr.Body.String())
-	}
-
-	if len(admin.routers) != 1 {
-		t.Errorf("Expected 1 router to be stored, got %d", len(admin.routers))
-	}
-}
-
-type mockProvisionableRouter struct {
-	mockRouter
-	provisionErr error
-	provisioned  bool
-}
-
-func (m *mockProvisionableRouter) Provision(Context) error {
-	m.provisioned = true
-	return m.provisionErr
-}
-
-type mockProvisionableModule struct {
-	*mockProvisionableRouter
-}
-
-func (m *mockProvisionableModule) CaddyModule() ModuleInfo {
-	return ModuleInfo{
-		ID: "admin.api.mock_provision",
-		New: func() Module {
-			mm := &mockProvisionableModule{
-				mockProvisionableRouter: &mockProvisionableRouter{
-					mockRouter:   m.mockRouter,
-					provisionErr: m.provisionErr,
-				},
-			}
-			return mm
-		},
-	}
-}
-
-func TestAdminRouterProvisioning(t *testing.T) {
-	tests := []struct {
-		name         string
-		provisionErr error
-		wantErr      bool
-		routersAfter int // expected number of routers after provisioning
-	}{
-		{
-			name:         "successful provisioning",
-			provisionErr: nil,
-			wantErr:      false,
-			routersAfter: 0,
-		},
-		{
-			name:         "provisioning error",
-			provisionErr: fmt.Errorf("provision failed"),
-			wantErr:      true,
-			routersAfter: 1,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			originalModules := make(map[string]ModuleInfo)
-			for k, v := range modules {
-				originalModules[k] = v
-			}
-			defer func() {
-				modules = originalModules
-			}()
-
-			mockRoute := AdminRoute{
-				Pattern: "/mock",
-				Handler: AdminHandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
-					return nil
-				}),
-			}
-
-			// Create provisionable module
-			mock := &mockProvisionableModule{
-				mockProvisionableRouter: &mockProvisionableRouter{
-					mockRouter: mockRouter{
-						routes: []AdminRoute{mockRoute},
-					},
-					provisionErr: test.provisionErr,
-				},
-			}
-			RegisterModule(mock)
-
-			admin := &AdminConfig{}
-			addr, err := ParseNetworkAddress("localhost:2019")
-			if err != nil {
-				t.Fatalf("Failed to parse address: %v", err)
-			}
-
-			_ = admin.newAdminHandler(addr, false, Context{})
-			err = admin.provisionAdminRouters(Context{})
-
-			if test.wantErr {
-				if err == nil {
-					t.Error("Expected error but got nil")
-				}
-			} else {
-				if err != nil {
-					t.Errorf("Expected no error but got: %v", err)
-				}
-			}
-
-			if len(admin.routers) != test.routersAfter {
-				t.Errorf("Expected %d routers after provisioning, got %d", test.routersAfter, len(admin.routers))
-			}
-		})
-	}
-}
-
-func TestAllowedOriginsUnixSocket(t *testing.T) {
-	// see comment in allowedOrigins() as to why we do not fill out allowed origins for UDS
-	tests := []struct {
-		name          string
-		addr          NetworkAddress
-		origins       []string
-		expectOrigins []string
-	}{
-		{
-			name: "unix socket with default origins",
-			addr: NetworkAddress{
-				Network: "unix",
-				Host:    "/tmp/caddy.sock",
-			},
-			origins:       nil, // default origins
-			expectOrigins: []string{},
-		},
-		{
-			name: "unix socket with custom origins",
-			addr: NetworkAddress{
-				Network: "unix",
-				Host:    "/tmp/caddy.sock",
-			},
-			origins: []string{"example.com"},
-			expectOrigins: []string{
-				"example.com",
-			},
-		},
-		{
-			name: "tcp socket on localhost gets all loopback addresses",
-			addr: NetworkAddress{
-				Network:   "tcp",
-				Host:      "localhost",
-				StartPort: 2019,
-				EndPort:   2019,
-			},
-			origins: nil,
-			expectOrigins: []string{
-				"localhost:2019",
-				"[::1]:2019",
-				"127.0.0.1:2019",
-			},
-		},
-	}
-
-	for i, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			admin := AdminConfig{
-				Origins: test.origins,
-			}
-
-			got := admin.allowedOrigins(test.addr)
-
-			var gotOrigins []string
-			for _, u := range got {
-				gotOrigins = append(gotOrigins, u.Host)
-			}
-
-			if len(gotOrigins) != len(test.expectOrigins) {
-				t.Errorf("%d: Expected %d origins but got %d", i, len(test.expectOrigins), len(gotOrigins))
-				return
-			}
-
-			expectMap := make(map[string]struct{})
-			for _, origin := range test.expectOrigins {
-				expectMap[origin] = struct{}{}
-			}
-
-			gotMap := make(map[string]struct{})
-			for _, origin := range gotOrigins {
-				gotMap[origin] = struct{}{}
-			}
-
-			if !reflect.DeepEqual(expectMap, gotMap) {
-				t.Errorf("%d: Origins mismatch.\nExpected: %v\nGot: %v", i, test.expectOrigins, gotOrigins)
-			}
-		})
-	}
-}
-
-func TestReplaceRemoteAdminServer(t *testing.T) {
-	const testCert = `MIIDCTCCAfGgAwIBAgIUXsqJ1mY8pKlHQtI3HJ23x2eZPqwwDQYJKoZIhvcNAQEL
-BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTIzMDEwMTAwMDAwMFoXDTI0MDEw
-MTAwMDAwMFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEA4O4S6BSoYcoxvRqI+h7yPOjF6KjntjzVVm9M+uHK4lzX
-F1L3pSxJ2nDD4wZEV3FJ5yFOHVFqkG2vXG3BIczOlYG7UeNmKbQnKc5kZj3HGUrS
-VGEktA4OJbeZhhWP15gcXN5eDM2eH3g9BFXVX6AURxLiUXzhNBUEZuj/OEyH9yEF
-/qPCE+EjzVvWxvBXwgz/io4r4yok/Vq/bxJ6FlV6R7DX5oJSXyO0VEHZPi9DIyNU
-kK3F/r4U1sWiJGWOs8i3YQWZ2ejh1C0aLFZpPcCGGgMNpoF31gyYP6ZuPDUyCXsE
-g36UUw1JHNtIXYcLhnXuqj4A8TybTDpgXLqvwA9DBQIDAQABo1MwUTAdBgNVHQ4E
-FgQUc13z30pFC63rr/HGKOE7E82vjXwwHwYDVR0jBBgwFoAUc13z30pFC63rr/HG
-KOE7E82vjXwwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAHO3j
-oeiUXXJ7xD4P8Wj5t9d+E8lE1Xv1Dk3Z+EdG5+dan+RcToE42JJp9zB7FIh5Qz8g
-W77LAjqh5oyqz3A2VJcyVgfE3uJP1R1mJM7JfGHf84QH4TZF2Q1RZY4SZs0VQ6+q
-5wSlIZ4NXDy4Q4XkIJBGS61wT8IzYFXYBpx4PCP1Qj0PIE4sevEGwjsBIgxK307o
-BxF8AWe6N6e4YZmQLGjQ+SeH0iwZb6vpkHyAY8Kj2hvK+cq2P7vU3VGi0t3r1F8L
-IvrXHCvO2BMNJ/1UK1M4YNX8LYJqQhg9hEsIROe1OE/m3VhxIYMJI+qZXk9yHfgJ
-vq+SH04xKhtFudVBAQ==`
-
-	tests := []struct {
-		name    string
-		cfg     *Config
-		wantErr bool
-	}{
-		{
-			name:    "nil config",
-			cfg:     nil,
-			wantErr: false,
-		},
-		{
-			name: "nil admin config",
-			cfg: &Config{
-				Admin: nil,
-			},
-			wantErr: false,
-		},
-		{
-			name: "nil remote config",
-			cfg: &Config{
-				Admin: &AdminConfig{},
-			},
-			wantErr: false,
-		},
-		{
-			name: "invalid listen address",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Remote: &RemoteAdmin{
-						Listen: "invalid:address",
-					},
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name: "valid config",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{},
-					Remote: &RemoteAdmin{
-						Listen: "localhost:2021",
-						AccessControl: []*AdminAccess{
-							{
-								PublicKeys:  []string{testCert},
-								Permissions: []AdminPermissions{{Methods: []string{"GET"}, Paths: []string{"/test"}}},
-							},
-						},
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "invalid certificate",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{},
-					Remote: &RemoteAdmin{
-						Listen: "localhost:2021",
-						AccessControl: []*AdminAccess{
-							{
-								PublicKeys:  []string{"invalid-cert-data"},
-								Permissions: []AdminPermissions{{Methods: []string{"GET"}, Paths: []string{"/test"}}},
-							},
-						},
-					},
-				},
-			},
-			wantErr: true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			ctx := Context{
-				Context: context.Background(),
-				cfg:     test.cfg,
-			}
-
-			if test.cfg != nil {
-				test.cfg.storage = &certmagic.FileStorage{Path: t.TempDir()}
-			}
-
-			if test.cfg != nil && test.cfg.Admin != nil && test.cfg.Admin.Identity != nil {
-				identityCertCache = certmagic.NewCache(certmagic.CacheOptions{
-					GetConfigForCert: func(certmagic.Certificate) (*certmagic.Config, error) {
-						return &certmagic.Config{}, nil
-					},
-				})
-			}
-
-			err := replaceRemoteAdminServer(ctx, test.cfg)
-
-			if test.wantErr {
-				if err == nil {
-					t.Error("Expected error but got nil")
-				}
-			} else {
-				if err != nil {
-					t.Errorf("Expected no error but got: %v", err)
-				}
-			}
-
-			// Clean up
-			if remoteAdminServer != nil {
-				_ = stopAdminServer(remoteAdminServer)
-			}
-		})
-	}
-}
-
-type mockIssuer struct {
-	configSet *certmagic.Config
-}
-
-func (m *mockIssuer) Issue(ctx context.Context, csr *x509.CertificateRequest) (*certmagic.IssuedCertificate, error) {
-	return &certmagic.IssuedCertificate{
-		Certificate: []byte(csr.Raw),
-	}, nil
-}
-
-func (m *mockIssuer) SetConfig(cfg *certmagic.Config) {
-	m.configSet = cfg
-}
-
-func (m *mockIssuer) IssuerKey() string {
-	return "mock"
-}
-
-type mockIssuerModule struct {
-	*mockIssuer
-}
-
-func (m *mockIssuerModule) CaddyModule() ModuleInfo {
-	return ModuleInfo{
-		ID: "tls.issuance.acme",
-		New: func() Module {
-			return &mockIssuerModule{mockIssuer: new(mockIssuer)}
-		},
-	}
-}
-
-func TestManageIdentity(t *testing.T) {
-	originalModules := make(map[string]ModuleInfo)
-	for k, v := range modules {
-		originalModules[k] = v
-	}
-	defer func() {
-		modules = originalModules
-	}()
-
-	RegisterModule(&mockIssuerModule{})
-
-	certPEM := []byte(`-----BEGIN CERTIFICATE-----
-MIIDujCCAqKgAwIBAgIIE31FZVaPXTUwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE
-BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
-cm5ldCBBdXRob3JpdHkgRzIwHhcNMTQwMTI5MTMyNzQzWhcNMTQwNTI5MDAwMDAw
-WjBpMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
-TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEYMBYGA1UEAwwPbWFp
-bC5nb29nbGUuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3lcub2pUwkjC
-5GJQA2ZZfJJi6d1QHhEmkX9VxKYGp6gagZuRqJWy9TXP6++1ZzQQxqZLD0TkuxZ9
-8i9Nz00000CCBjCCAQQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGgG
-CCsGAQUFBwEBBFwwWjArBggrBgEFBQcwAoYfaHR0cDovL3BraS5nb29nbGUuY29t
-L0dJQUcyLmNydDArBggrBgEFBQcwAYYfaHR0cDovL2NsaWVudHMxLmdvb2dsZS5j
-b20vb2NzcDAdBgNVHQ4EFgQUiJxtimAuTfwb+aUtBn5UYKreKvMwDAYDVR0TAQH/
-BAIwADAfBgNVHSMEGDAWgBRK3QYWG7z2aLV29YG2u2IaulqBLzAXBgNVHREEEDAO
-ggxtYWlsLmdvb2dsZTANBgkqhkiG9w0BAQUFAAOCAQEAMP6IWgNGZE8wP9TjFjSZ
-3mmW3A1eIr0CuPwNZ2LJ5ZD1i70ojzcj4I9IdP5yPg9CAEV4hNASbM1LzfC7GmJE
-tPzW5tRmpKVWZGRgTgZI8Hp/xZXMwLh9ZmXV4kESFAGj5G5FNvJyUV7R5Eh+7OZX
-7G4jJ4ZGJh+5jzN9HdJJHQHGYNIYOzC7+HH9UMwCjX9vhQ4RjwFZJThS2Yb+y7pb
-9yxTJZoXC6J0H5JpnZb7kZEJ+Xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
------END CERTIFICATE-----`)
-
-	keyPEM := []byte(`-----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRS0LmTwUT0iwP
-...
------END PRIVATE KEY-----`)
-
-	testStorage := certmagic.FileStorage{Path: t.TempDir()}
-	err := testStorage.Store(context.Background(), "localhost/localhost.crt", certPEM)
-	if err != nil {
-		t.Fatal(err)
-	}
-	err = testStorage.Store(context.Background(), "localhost/localhost.key", keyPEM)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	tests := []struct {
-		name       string
-		cfg        *Config
-		wantErr    bool
-		checkState func(*testing.T, *Config)
-	}{
-		{
-			name: "nil config",
-			cfg:  nil,
-		},
-		{
-			name: "nil admin config",
-			cfg: &Config{
-				Admin: nil,
-			},
-		},
-		{
-			name: "nil identity config",
-			cfg: &Config{
-				Admin: &AdminConfig{},
-			},
-		},
-		{
-			name: "default issuer when none specified",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{
-						Identifiers: []string{"localhost"},
-					},
-				},
-				storage: &testStorage,
-			},
-			checkState: func(t *testing.T, cfg *Config) {
-				if len(cfg.Admin.Identity.issuers) == 0 {
-					t.Error("Expected at least 1 issuer to be configured")
-					return
-				}
-				if _, ok := cfg.Admin.Identity.issuers[0].(*mockIssuerModule); !ok {
-					t.Error("Expected mock issuer to be configured")
-				}
-			},
-		},
-		{
-			name: "custom issuer",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{
-						Identifiers: []string{"localhost"},
-						IssuersRaw: []json.RawMessage{
-							json.RawMessage(`{"module": "acme"}`),
-						},
-					},
-				},
-				storage: &certmagic.FileStorage{Path: "testdata"},
-			},
-			checkState: func(t *testing.T, cfg *Config) {
-				if len(cfg.Admin.Identity.issuers) != 1 {
-					t.Fatalf("Expected 1 issuer, got %d", len(cfg.Admin.Identity.issuers))
-				}
-				mockIss, ok := cfg.Admin.Identity.issuers[0].(*mockIssuerModule)
-				if !ok {
-					t.Fatal("Expected mock issuer")
-				}
-				if mockIss.configSet == nil {
-					t.Error("Issuer config was not set")
-				}
-			},
-		},
-		{
-			name: "invalid issuer module",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{
-						Identifiers: []string{"localhost"},
-						IssuersRaw: []json.RawMessage{
-							json.RawMessage(`{"module": "doesnt_exist"}`),
-						},
-					},
-				},
-			},
-			wantErr: true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			if identityCertCache != nil {
-				// Reset the cert cache before each test
-				identityCertCache.Stop()
-				identityCertCache = nil
-			}
-
-			ctx := Context{
-				Context:         context.Background(),
-				cfg:             test.cfg,
-				moduleInstances: make(map[string][]Module),
-			}
-
-			err := manageIdentity(ctx, test.cfg)
-
-			if test.wantErr {
-				if err == nil {
-					t.Error("Expected error but got nil")
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("Expected no error but got: %v", err)
-			}
-
-			if test.checkState != nil {
-				test.checkState(t, test.cfg)
-			}
-		})
-	}
-}

caddy.go

@@ -22,7 +22,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/fs"
 	"log"
 	"net/http"
 	"os"
@@ -35,12 +34,10 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/caddyserver/caddy/v2/notify"
 	"github.com/caddyserver/certmagic"
 	"github.com/google/uuid"
 	"go.uber.org/zap"
-
-	"github.com/caddyserver/caddy/v2/internal/filesystems"
-	"github.com/caddyserver/caddy/v2/notify"
 )
 
 // Config is the top (or beginning) of the Caddy configuration structure.
@@ -81,14 +78,10 @@ type Config struct {
 	// associated value.
 	AppsRaw ModuleMap `json:"apps,omitempty" caddy:"namespace="`
 
-	apps         map[string]App
+	apps    map[string]App
-	storage      certmagic.Storage
+	storage certmagic.Storage
-	eventEmitter eventEmitter
 
 	cancelFunc context.CancelFunc
-
-	// fileSystems is a dict of fileSystems that will later be loaded from and added to.
-	fileSystems FileSystems
 }
 
 // App is a thing that Caddy runs.
@@ -163,8 +156,8 @@ func changeConfig(method, path string, input []byte, ifMatchHeader string, force
 		return fmt.Errorf("method not allowed")
 	}
 
-	rawCfgMu.Lock()
+	currentCtxMu.Lock()
-	defer rawCfgMu.Unlock()
+	defer currentCtxMu.Unlock()
 
 	if ifMatchHeader != "" {
 		// expect the first and last character to be quotes
@@ -264,8 +257,8 @@ func changeConfig(method, path string, input []byte, ifMatchHeader string, force
 // readConfig traverses the current config to path
 // and writes its JSON encoding to out.
 func readConfig(path string, out io.Writer) error {
-	rawCfgMu.RLock()
+	currentCtxMu.RLock()
-	defer rawCfgMu.RUnlock()
+	defer currentCtxMu.RUnlock()
 	return unsyncedConfigAccess(http.MethodGet, path, nil, out)
 }
 
@@ -312,7 +305,7 @@ func indexConfigObjects(ptr any, configPath string, index map[string]string) err
 // it as the new config, replacing any other current config.
 // It does NOT update the raw config state, as this is a
 // lower-level function; most callers will want to use Load
-// instead. A write lock on rawCfgMu is required! If
+// instead. A write lock on currentCtxMu is required! If
 // allowPersist is false, it will not be persisted to disk,
 // even if it is configured to.
 func unsyncedDecodeAndRun(cfgJSON []byte, allowPersist bool) error {
@@ -347,10 +340,8 @@ func unsyncedDecodeAndRun(cfgJSON []byte, allowPersist bool) error {
 	}
 
 	// swap old context (including its config) with the new one
-	currentCtxMu.Lock()
 	oldCtx := currentCtx
 	currentCtx = ctx
-	currentCtxMu.Unlock()
 
 	// Stop, Cleanup each old app
 	unsyncedStop(oldCtx)
@@ -363,13 +354,13 @@ func unsyncedDecodeAndRun(cfgJSON []byte, allowPersist bool) error {
 			newCfg.Admin.Config.Persist == nil ||
 			*newCfg.Admin.Config.Persist) {
 		dir := filepath.Dir(ConfigAutosavePath)
-		err := os.MkdirAll(dir, 0o700)
+		err := os.MkdirAll(dir, 0700)
 		if err != nil {
 			Log().Error("unable to create folder for config autosave",
 				zap.String("dir", dir),
 				zap.Error(err))
 		} else {
-			err := os.WriteFile(ConfigAutosavePath, cfgJSON, 0o600)
+			err := os.WriteFile(ConfigAutosavePath, cfgJSON, 0600)
 			if err == nil {
 				Log().Info("autosaved config (load with --resume flag)", zap.String("file", ConfigAutosavePath))
 			} else {
@@ -398,66 +389,6 @@ func unsyncedDecodeAndRun(cfgJSON []byte, allowPersist bool) error {
 // will want to use Run instead, which also
 // updates the config's raw state.
 func run(newCfg *Config, start bool) (Context, error) {
-	ctx, err := provisionContext(newCfg, start)
-	if err != nil {
-		globalMetrics.configSuccess.Set(0)
-		return ctx, err
-	}
-
-	if !start {
-		return ctx, nil
-	}
-
-	// Provision any admin routers which may need to access
-	// some of the other apps at runtime
-	err = ctx.cfg.Admin.provisionAdminRouters(ctx)
-	if err != nil {
-		globalMetrics.configSuccess.Set(0)
-		return ctx, err
-	}
-
-	// Start
-	err = func() error {
-		started := make([]string, 0, len(ctx.cfg.apps))
-		for name, a := range ctx.cfg.apps {
-			err := a.Start()
-			if err != nil {
-				// an app failed to start, so we need to stop
-				// all other apps that were already started
-				for _, otherAppName := range started {
-					err2 := ctx.cfg.apps[otherAppName].Stop()
-					if err2 != nil {
-						err = fmt.Errorf("%v; additionally, aborting app %s: %v",
-							err, otherAppName, err2)
-					}
-				}
-				return fmt.Errorf("%s app module: start: %v", name, err)
-			}
-			started = append(started, name)
-		}
-		return nil
-	}()
-	if err != nil {
-		globalMetrics.configSuccess.Set(0)
-		return ctx, err
-	}
-	globalMetrics.configSuccess.Set(1)
-	globalMetrics.configSuccessTime.SetToCurrentTime()
-
-	// TODO: This event is experimental and subject to change.
-	ctx.emitEvent("started", nil)
-
-	// now that the user's config is running, finish setting up anything else,
-	// such as remote admin endpoint, config loader, etc.
-	return ctx, finishSettingUp(ctx, ctx.cfg)
-}
-
-// provisionContext creates a new context from the given configuration and provisions
-// storage and apps.
-// If `newCfg` is nil a new empty configuration will be created.
-// If `replaceAdminServer` is true any currently active admin server will be replaced
-// with a new admin server based on the provided configuration.
-func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error) {
 	// because we will need to roll back any state
 	// modifications if this function errors, we
 	// keep a single error value and scope all
@@ -480,7 +411,6 @@ func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error)
 	ctx, cancel := NewContext(Context{Context: context.Background(), cfg: newCfg})
 	defer func() {
 		if err != nil {
-			globalMetrics.configSuccess.Set(0)
 			// if there were any errors during startup,
 			// we should cancel the new context we created
 			// since the associated config won't be used;
@@ -505,8 +435,13 @@ func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error)
 		return ctx, err
 	}
 
-	// create the new filesystem map
+	// start the admin endpoint (and stop any prior one)
-	newCfg.fileSystems = &filesystems.FileSystemMap{}
+	if start {
+		err = replaceLocalAdminServer(newCfg)
+		if err != nil {
+			return ctx, fmt.Errorf("starting caddy administration endpoint: %v", err)
+		}
+	}
 
 	// prepare the new config for use
 	newCfg.apps = make(map[string]App)
@@ -536,14 +471,6 @@ func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error)
 		return ctx, err
 	}
 
-	// start the admin endpoint (and stop any prior one)
-	if replaceAdminServer {
-		err = replaceLocalAdminServer(newCfg, ctx)
-		if err != nil {
-			return ctx, fmt.Errorf("starting caddy administration endpoint: %v", err)
-		}
-	}
-
 	// Load and Provision each app and their submodules
 	err = func() error {
 		for appName := range newCfg.AppsRaw {
@@ -553,16 +480,49 @@ func provisionContext(newCfg *Config, replaceAdminServer bool) (Context, error)
 		}
 		return nil
 	}()
-	return ctx, err
+	if err != nil {
-}
+		return ctx, err
+	}
 
-// ProvisionContext creates a new context from the configuration and provisions storage
+	if !start {
-// and app modules.
+		return ctx, nil
-// The function is intended for testing and advanced use cases only, typically `Run` should be
+	}
-// use to ensure a fully functional caddy instance.
+
-// EXPERIMENTAL: While this is public the interface and implementation details of this function may change.
+	// Provision any admin routers which may need to access
-func ProvisionContext(newCfg *Config) (Context, error) {
+	// some of the other apps at runtime
-	return provisionContext(newCfg, false)
+	err = newCfg.Admin.provisionAdminRouters(ctx)
+	if err != nil {
+		return ctx, err
+	}
+
+	// Start
+	err = func() error {
+		started := make([]string, 0, len(newCfg.apps))
+		for name, a := range newCfg.apps {
+			err := a.Start()
+			if err != nil {
+				// an app failed to start, so we need to stop
+				// all other apps that were already started
+				for _, otherAppName := range started {
+					err2 := newCfg.apps[otherAppName].Stop()
+					if err2 != nil {
+						err = fmt.Errorf("%v; additionally, aborting app %s: %v",
+							err, otherAppName, err2)
+					}
+				}
+				return fmt.Errorf("%s app module: start: %v", name, err)
+			}
+			started = append(started, name)
+		}
+		return nil
+	}()
+	if err != nil {
+		return ctx, err
+	}
+
+	// now that the user's config is running, finish setting up anything else,
+	// such as remote admin endpoint, config loader, etc.
+	return ctx, finishSettingUp(ctx, newCfg)
 }
 
 // finishSettingUp should be run after all apps have successfully started.
@@ -667,43 +627,27 @@ type ConfigLoader interface {
 // stop the others. Stop should only be called
 // if not replacing with a new config.
 func Stop() error {
-	currentCtxMu.RLock()
-	ctx := currentCtx
-	currentCtxMu.RUnlock()
-
-	rawCfgMu.Lock()
-	unsyncedStop(ctx)
-
 	currentCtxMu.Lock()
+	defer currentCtxMu.Unlock()
+	unsyncedStop(currentCtx)
 	currentCtx = Context{}
-	currentCtxMu.Unlock()
-
 	rawCfgJSON = nil
 	rawCfgIndex = nil
 	rawCfg[rawConfigKey] = nil
-	rawCfgMu.Unlock()
-
 	return nil
 }
 
-// unsyncedStop stops ctx from running, but has
+// unsyncedStop stops cfg from running, but has
-// no locking around ctx. It is a no-op if ctx has a
+// no locking around cfg. It is a no-op if cfg is
-// nil cfg. If any app returns an error when stopping,
+// nil. If any app returns an error when stopping,
 // it is logged and the function continues stopping
 // the next app. This function assumes all apps in
-// ctx were successfully started first.
+// cfg were successfully started first.
-//
-// A lock on rawCfgMu is required, even though this
-// function does not access rawCfg, that lock
-// synchronizes the stop/start of apps.
 func unsyncedStop(ctx Context) {
 	if ctx.cfg == nil {
 		return
 	}
 
-	// TODO: This event is experimental and subject to change.
-	ctx.emitEvent("stopping", nil)
-
 	// stop each app
 	for name, a := range ctx.cfg.apps {
 		err := a.Stop()
@@ -733,10 +677,8 @@ func Validate(cfg *Config) error {
 // Errors are logged along the way, and an appropriate exit
 // code is emitted.
 func exitProcess(ctx context.Context, logger *zap.Logger) {
-	// let the rest of the program know we're quitting; only do it once
+	// let the rest of the program know we're quitting
-	if !atomic.CompareAndSwapInt32(exiting, 0, 1) {
+	atomic.StoreInt32(exiting, 1)
-		return
-	}
 
 	// give the OS or service/process manager our 2 weeks' notice: we quit
 	if err := notify.Stopping(); err != nil {
@@ -749,7 +691,6 @@ func exitProcess(ctx context.Context, logger *zap.Logger) {
 	logger.Warn("exiting; byeee!! 👋")
 
 	exitCode := ExitCodeSuccess
-	lastContext := ActiveContext()
 
 	// stop all apps
 	if err := Stop(); err != nil {
@@ -771,16 +712,6 @@ func exitProcess(ctx context.Context, logger *zap.Logger) {
 		}
 	}
 
-	// execute any process-exit callbacks
-	for _, exitFunc := range lastContext.exitFuncs {
-		exitFunc(ctx)
-	}
-	exitFuncsMu.Lock()
-	for _, exitFunc := range exitFuncs {
-		exitFunc(ctx)
-	}
-	exitFuncsMu.Unlock()
-
 	// shut down admin endpoint(s) in goroutines so that
 	// if this function was called from an admin handler,
 	// it has a chance to return gracefully
@@ -819,23 +750,6 @@ var exiting = new(int32) // accessed atomically
 // EXPERIMENTAL API: subject to change or removal.
 func Exiting() bool { return atomic.LoadInt32(exiting) == 1 }
 
-// OnExit registers a callback to invoke during process exit.
-// This registration is PROCESS-GLOBAL, meaning that each
-// function should only be registered once forever, NOT once
-// per config load (etc).
-//
-// EXPERIMENTAL API: subject to change or removal.
-func OnExit(f func(context.Context)) {
-	exitFuncsMu.Lock()
-	exitFuncs = append(exitFuncs, f)
-	exitFuncsMu.Unlock()
-}
-
-var (
-	exitFuncs   []func(context.Context)
-	exitFuncsMu sync.Mutex
-)
-
 // Duration can be an integer or a string. An integer is
 // interpreted as nanoseconds. If a string, it is a Go
 // time.Duration value such as `300ms`, `1.5h`, or `2h45m`;
@@ -895,19 +809,14 @@ func ParseDuration(s string) (time.Duration, error) {
 // regardless of storage configuration, since each instance is intended to
 // have its own unique ID.
 func InstanceID() (uuid.UUID, error) {
-	appDataDir := AppDataDir()
+	uuidFilePath := filepath.Join(AppDataDir(), "instance.uuid")
-	uuidFilePath := filepath.Join(appDataDir, "instance.uuid")
 	uuidFileBytes, err := os.ReadFile(uuidFilePath)
-	if errors.Is(err, fs.ErrNotExist) {
+	if os.IsNotExist(err) {
 		uuid, err := uuid.NewRandom()
 		if err != nil {
 			return uuid, err
 		}
-		err = os.MkdirAll(appDataDir, 0o700)
+		err = os.WriteFile(uuidFilePath, []byte(uuid.String()), 0600)
-		if err != nil {
-			return uuid, err
-		}
-		err = os.WriteFile(uuidFilePath, []byte(uuid.String()), 0o600)
 		return uuid, err
 	} else if err != nil {
 		return [16]byte{}, err
@@ -1046,92 +955,6 @@ func Version() (simple, full string) {
 	return
 }
 
-// Event represents something that has happened or is happening.
-// An Event value is not synchronized, so it should be copied if
-// being used in goroutines.
-//
-// EXPERIMENTAL: Events are subject to change.
-type Event struct {
-	// If non-nil, the event has been aborted, meaning
-	// propagation has stopped to other handlers and
-	// the code should stop what it was doing. Emitters
-	// may choose to use this as a signal to adjust their
-	// code path appropriately.
-	Aborted error
-
-	// The data associated with the event. Usually the
-	// original emitter will be the only one to set or
-	// change these values, but the field is exported
-	// so handlers can have full access if needed.
-	// However, this map is not synchronized, so
-	// handlers must not use this map directly in new
-	// goroutines; instead, copy the map to use it in a
-	// goroutine. Data may be nil.
-	Data map[string]any
-
-	id     uuid.UUID
-	ts     time.Time
-	name   string
-	origin Module
-}
-
-// NewEvent creates a new event, but does not emit the event. To emit an
-// event, call Emit() on the current instance of the caddyevents app insteaad.
-//
-// EXPERIMENTAL: Subject to change.
-func NewEvent(ctx Context, name string, data map[string]any) (Event, error) {
-	id, err := uuid.NewRandom()
-	if err != nil {
-		return Event{}, fmt.Errorf("generating new event ID: %v", err)
-	}
-	name = strings.ToLower(name)
-	return Event{
-		Data:   data,
-		id:     id,
-		ts:     time.Now(),
-		name:   name,
-		origin: ctx.Module(),
-	}, nil
-}
-
-func (e Event) ID() uuid.UUID        { return e.id }
-func (e Event) Timestamp() time.Time { return e.ts }
-func (e Event) Name() string         { return e.name }
-func (e Event) Origin() Module       { return e.origin } // Returns the module that originated the event. May be nil, usually if caddy core emits the event.
-
-// CloudEvent exports event e as a structure that, when
-// serialized as JSON, is compatible with the
-// CloudEvents spec.
-func (e Event) CloudEvent() CloudEvent {
-	dataJSON, _ := json.Marshal(e.Data)
-	return CloudEvent{
-		ID:              e.id.String(),
-		Source:          e.origin.CaddyModule().String(),
-		SpecVersion:     "1.0",
-		Type:            e.name,
-		Time:            e.ts,
-		DataContentType: "application/json",
-		Data:            dataJSON,
-	}
-}
-
-// CloudEvent is a JSON-serializable structure that
-// is compatible with the CloudEvents specification.
-// See https://cloudevents.io.
-// EXPERIMENTAL: Subject to change.
-type CloudEvent struct {
-	ID              string          `json:"id"`
-	Source          string          `json:"source"`
-	SpecVersion     string          `json:"specversion"`
-	Type            string          `json:"type"`
-	Time            time.Time       `json:"time"`
-	DataContentType string          `json:"datacontenttype,omitempty"`
-	Data            json.RawMessage `json:"data,omitempty"`
-}
-
-// ErrEventAborted cancels an event.
-var ErrEventAborted = errors.New("event aborted")
-
 // ActiveContext returns the currently-active context.
 // This function is experimental and might be changed
 // or removed in the future.
@@ -1146,12 +969,14 @@ type CtxKey string
 
 // This group of variables pertains to the current configuration.
 var (
+	// currentCtxMu protects everything in this var block.
+	currentCtxMu sync.RWMutex
+
 	// currentCtx is the root context for the currently-running
 	// configuration, which can be accessed through this value.
 	// If the Config contained in this value is not nil, then
 	// a config is currently active/running.
-	currentCtx   Context
+	currentCtx Context
-	currentCtxMu sync.RWMutex
 
 	// rawCfg is the current, generic-decoded configuration;
 	// we initialize it as a map with one field ("config")
@@ -1169,10 +994,6 @@ var (
 	// rawCfgIndex is the map of user-assigned ID to expanded
 	// path, for converting /id/ paths to /config/ paths.
 	rawCfgIndex map[string]string
-
-	// rawCfgMu protects all the rawCfg fields and also
-	// essentially synchronizes config changes/reloads.
-	rawCfgMu sync.RWMutex
 )
 
 // errSameConfig is returned if the new config is the same

caddyconfig/caddyfile/adapter.go

@@ -52,7 +52,7 @@ func (a Adapter) Adapt(body []byte, options map[string]any) ([]byte, []caddyconf
 		return nil, warnings, err
 	}
 
-	// lint check: see if input was properly formatted; sometimes messy files parse
+	// lint check: see if input was properly formatted; sometimes messy files files parse
 	// successfully but result in logical errors (the Caddyfile is a bad format, I'm sorry)
 	if warning, different := FormattingDifference(filename, body); different {
 		warnings = append(warnings, warning)
@@ -92,26 +92,30 @@ func FormattingDifference(filename string, body []byte) (caddyconfig.Warning, bo
 	}, true
 }
 
-// Unmarshaler is a type that can unmarshal Caddyfile tokens to
+// Unmarshaler is a type that can unmarshal
-// set itself up for a JSON encoding. The goal of an unmarshaler
+// Caddyfile tokens to set itself up for a
-// is not to set itself up for actual use, but to set itself up for
+// JSON encoding. The goal of an unmarshaler
-// being marshaled into JSON. Caddyfile-unmarshaled values will not
+// is not to set itself up for actual use,
-// be used directly; they will be encoded as JSON and then used from
+// but to set itself up for being marshaled
-// that. Implementations _may_ be able to support multiple segments
+// into JSON. Caddyfile-unmarshaled values
-// (instances of their directive or batch of tokens); typically this
+// will not be used directly; they will be
-// means wrapping parsing logic in a loop: `for d.Next() { ... }`.
+// encoded as JSON and then used from that.
-// More commonly, only a single segment is supported, so a simple
+// Implementations must be able to support
-// `d.Next()` at the start should be used to consume the module
+// multiple segments (instances of their
-// identifier token (directive name, etc).
+// directive or batch of tokens); typically
+// this means wrapping all token logic in
+// a loop: `for d.Next() { ... }`.
 type Unmarshaler interface {
 	UnmarshalCaddyfile(d *Dispenser) error
 }
 
 // ServerType is a type that can evaluate a Caddyfile and set up a caddy config.
 type ServerType interface {
-	// Setup takes the server blocks which contain tokens,
+	// Setup takes the server blocks which
-	// as well as options (e.g. CLI flags) and creates a
+	// contain tokens, as well as options
-	// Caddy config, along with any warnings or an error.
+	// (e.g. CLI flags) and creates a Caddy
+	// config, along with any warnings or
+	// an error.
 	Setup([]ServerBlock, map[string]any) (*caddy.Config, []caddyconfig.Warning, error)
 }
 

caddyconfig/caddyfile/dispenser.go

@@ -30,10 +30,6 @@ type Dispenser struct {
 	tokens  []Token
 	cursor  int
 	nesting int
-
-	// A map of arbitrary context data that can be used
-	// to pass through some information to unmarshalers.
-	context map[string]any
 }
 
 // NewDispenser returns a Dispenser filled with the given tokens.
@@ -110,7 +106,7 @@ func (d *Dispenser) nextOnSameLine() bool {
 	}
 	curr := d.tokens[d.cursor]
 	next := d.tokens[d.cursor+1]
-	if !isNextOnNewLine(curr, next) {
+	if curr.File == next.File && curr.Line+curr.NumLineBreaks() == next.Line {
 		d.cursor++
 		return true
 	}
@@ -131,7 +127,7 @@ func (d *Dispenser) NextLine() bool {
 	}
 	curr := d.tokens[d.cursor]
 	next := d.tokens[d.cursor+1]
-	if isNextOnNewLine(curr, next) {
+	if curr.File != next.File || curr.Line+curr.NumLineBreaks() < next.Line {
 		d.cursor++
 		return true
 	}
@@ -395,27 +391,27 @@ func (d *Dispenser) Reset() {
 // an argument.
 func (d *Dispenser) ArgErr() error {
 	if d.Val() == "{" {
-		return d.Err("unexpected token '{', expecting argument")
+		return d.Err("Unexpected token '{', expecting argument")
 	}
-	return d.Errf("wrong argument count or unexpected line ending after '%s'", d.Val())
+	return d.Errf("Wrong argument count or unexpected line ending after '%s'", d.Val())
 }
 
 // SyntaxErr creates a generic syntax error which explains what was
 // found and what was expected.
 func (d *Dispenser) SyntaxErr(expected string) error {
-	msg := fmt.Sprintf("syntax error: unexpected token '%s', expecting '%s', at %s:%d import chain: ['%s']", d.Val(), expected, d.File(), d.Line(), strings.Join(d.Token().imports, "','"))
+	msg := fmt.Sprintf("%s:%d - Syntax error: Unexpected token '%s', expecting '%s', import chain: ['%s']", d.File(), d.Line(), d.Val(), expected, strings.Join(d.Token().imports, "','"))
 	return errors.New(msg)
 }
 
 // EOFErr returns an error indicating that the dispenser reached
 // the end of the input when searching for the next token.
 func (d *Dispenser) EOFErr() error {
-	return d.Errf("unexpected EOF")
+	return d.Errf("Unexpected EOF")
 }
 
 // Err generates a custom parse-time error with a message of msg.
 func (d *Dispenser) Err(msg string) error {
-	return d.WrapErr(errors.New(msg))
+	return d.Errf(msg)
 }
 
 // Errf is like Err, but for formatted error messages
@@ -425,10 +421,7 @@ func (d *Dispenser) Errf(format string, args ...any) error {
 
 // WrapErr takes an existing error and adds the Caddyfile file and line number.
 func (d *Dispenser) WrapErr(err error) error {
-	if len(d.Token().imports) > 0 {
+	return fmt.Errorf("%s:%d - Error during parsing: %w, import chain: ['%s']", d.File(), d.Line(), err, strings.Join(d.Token().imports, "','"))
-		return fmt.Errorf("%w, at %s:%d import chain ['%s']", err, d.File(), d.Line(), strings.Join(d.Token().imports, "','"))
-	}
-	return fmt.Errorf("%w, at %s:%d", err, d.File(), d.Line())
 }
 
 // Delete deletes the current token and returns the updated slice
@@ -458,34 +451,6 @@ func (d *Dispenser) DeleteN(amount int) []Token {
 	return d.tokens
 }
 
-// SetContext sets a key-value pair in the context map.
-func (d *Dispenser) SetContext(key string, value any) {
-	if d.context == nil {
-		d.context = make(map[string]any)
-	}
-	d.context[key] = value
-}
-
-// GetContext gets the value of a key in the context map.
-func (d *Dispenser) GetContext(key string) any {
-	if d.context == nil {
-		return nil
-	}
-	return d.context[key]
-}
-
-// GetContextString gets the value of a key in the context map
-// as a string, or an empty string if the key does not exist.
-func (d *Dispenser) GetContextString(key string) string {
-	if d.context == nil {
-		return ""
-	}
-	if val, ok := d.context[key].(string); ok {
-		return val
-	}
-	return ""
-}
-
 // isNewLine determines whether the current token is on a different
 // line (higher line number) than the previous token. It handles imported
 // tokens correctly. If there isn't a previous token, it returns true.
@@ -499,7 +464,17 @@ func (d *Dispenser) isNewLine() bool {
 
 	prev := d.tokens[d.cursor-1]
 	curr := d.tokens[d.cursor]
-	return isNextOnNewLine(prev, curr)
+
+	// If the previous token is from a different file,
+	// we can assume it's from a different line
+	if prev.File != curr.File {
+		return true
+	}
+
+	// If the previous token (incl line breaks) ends
+	// on a line earlier than the current token,
+	// then the current token is on a new line
+	return prev.Line+prev.NumLineBreaks() < curr.Line
 }
 
 // isNextOnNewLine determines whether the current token is on a different
@@ -515,7 +490,15 @@ func (d *Dispenser) isNextOnNewLine() bool {
 
 	curr := d.tokens[d.cursor]
 	next := d.tokens[d.cursor+1]
-	return isNextOnNewLine(curr, next)
-}
 
-const MatcherNameCtxKey = "matcher_name"
+	// If the next token is from a different file,
+	// we can assume it's from a different line
+	if curr.File != next.File {
+		return true
+	}
+
+	// If the current token (incl line breaks) ends
+	// on a line earlier than the next token,
+	// then the next token is on a new line
+	return curr.Line+curr.NumLineBreaks() < next.Line
+}

caddyconfig/caddyfile/dispenser_test.go

@@ -305,7 +305,7 @@ func TestDispenser_ArgErr_Err(t *testing.T) {
 		t.Errorf("Expected error message with custom message in it ('foobar'); got '%v'", err)
 	}
 
-	ErrBarIsFull := errors.New("bar is full")
+	var ErrBarIsFull = errors.New("bar is full")
 	bookingError := d.Errf("unable to reserve: %w", ErrBarIsFull)
 	if !errors.Is(bookingError, ErrBarIsFull) {
 		t.Errorf("Errf(): should be able to unwrap the error chain")

caddyconfig/caddyfile/formatter.go

@@ -17,7 +17,6 @@ package caddyfile
 import (
 	"bytes"
 	"io"
-	"slices"
 	"unicode"
 )
 
@@ -32,14 +31,6 @@ func Format(input []byte) []byte {
 	out := new(bytes.Buffer)
 	rdr := bytes.NewReader(input)
 
-	type heredocState int
-
-	const (
-		heredocClosed  heredocState = 0
-		heredocOpening heredocState = 1
-		heredocOpened  heredocState = 2
-	)
-
 	var (
 		last rune // the last character that was written to the result
 
@@ -56,13 +47,7 @@ func Format(input []byte) []byte {
 		quoted  bool // whether we're in a quoted segment
 		escaped bool // whether current char is escaped
 
-		heredoc              heredocState // whether we're in a heredoc
+		nesting int // indentation level
-		heredocEscaped       bool         // whether heredoc is escaped
-		heredocMarker        []rune
-		heredocClosingMarker []rune
-
-		nesting         int // indentation level
-		withinBackquote bool
 	)
 
 	write := func(ch rune) {
@@ -89,65 +74,6 @@ func Format(input []byte) []byte {
 			}
 			panic(err)
 		}
-		if ch == '`' {
-			withinBackquote = !withinBackquote
-		}
-
-		// detect whether we have the start of a heredoc
-		if !quoted && !(heredoc != heredocClosed || heredocEscaped) &&
-			space && last == '<' && ch == '<' {
-			write(ch)
-			heredoc = heredocOpening
-			space = false
-			continue
-		}
-
-		if heredoc == heredocOpening {
-			if ch == '\n' {
-				if len(heredocMarker) > 0 && heredocMarkerRegexp.MatchString(string(heredocMarker)) {
-					heredoc = heredocOpened
-				} else {
-					heredocMarker = nil
-					heredoc = heredocClosed
-					nextLine()
-					continue
-				}
-				write(ch)
-				continue
-			}
-			if unicode.IsSpace(ch) {
-				// a space means it's just a regular token and not a heredoc
-				heredocMarker = nil
-				heredoc = heredocClosed
-			} else {
-				heredocMarker = append(heredocMarker, ch)
-				write(ch)
-				continue
-			}
-		}
-		// if we're in a heredoc, all characters are read&write as-is
-		if heredoc == heredocOpened {
-			heredocClosingMarker = append(heredocClosingMarker, ch)
-			if len(heredocClosingMarker) > len(heredocMarker)+1 { // We assert that the heredocClosingMarker is followed by a unicode.Space
-				heredocClosingMarker = heredocClosingMarker[1:]
-			}
-			// check if we're done
-			if unicode.IsSpace(ch) && slices.Equal(heredocClosingMarker[:len(heredocClosingMarker)-1], heredocMarker) {
-				heredocMarker = nil
-				heredocClosingMarker = nil
-				heredoc = heredocClosed
-			} else {
-				write(ch)
-				if ch == '\n' {
-					heredocClosingMarker = heredocClosingMarker[:0]
-				}
-				continue
-			}
-		}
-
-		if last == '<' && space {
-			space = false
-		}
 
 		if comment {
 			if ch == '\n' {
@@ -172,9 +98,6 @@ func Format(input []byte) []byte {
 		}
 
 		if escaped {
-			if ch == '<' {
-				heredocEscaped = true
-			}
 			write(ch)
 			escaped = false
 			continue
@@ -194,7 +117,6 @@ func Format(input []byte) []byte {
 
 		if unicode.IsSpace(ch) {
 			space = true
-			heredocEscaped = false
 			if ch == '\n' {
 				newLines++
 			}
@@ -240,23 +162,14 @@ func Format(input []byte) []byte {
 		switch {
 		case ch == '{':
 			openBrace = true
+			openBraceWritten = false
 			openBraceSpace = spacePrior && !beginningOfLine
 			if openBraceSpace {
 				write(' ')
 			}
-			openBraceWritten = false
-			if withinBackquote {
-				write('{')
-				openBraceWritten = true
-				continue
-			}
 			continue
 
 		case ch == '}' && (spacePrior || !openBrace):
-			if withinBackquote {
-				write('}')
-				continue
-			}
 			if last != '\n' {
 				nextLine()
 			}
@@ -292,11 +205,6 @@ func Format(input []byte) []byte {
 			write('{')
 			openBraceWritten = true
 		}
-
-		if spacePrior && ch == '<' {
-			space = true
-		}
-
 		write(ch)
 
 		beginningOfLine = false

caddyconfig/caddyfile/formatter_test.go

@@ -364,86 +364,6 @@ block {
 }
 `,
 		},
-		{
-			description: "keep heredoc as-is",
-			input: `block {
-	heredoc <<HEREDOC
-	Here's more than one space       Here's more than one space
-	HEREDOC
-}
-`,
-			expect: `block {
-	heredoc <<HEREDOC
-	Here's more than one space       Here's more than one space
-	HEREDOC
-}
-`,
-		},
-		{
-			description: "Mixing heredoc with regular part",
-			input: `block {
-	heredoc <<HEREDOC
-	Here's more than one space       Here's more than one space
-	HEREDOC
-	respond "More than one space will be eaten"     200
-}
-
-block2 {
-	heredoc <<HEREDOC
-	Here's more than one space       Here's more than one space
-	HEREDOC
-	respond "More than one space will be eaten" 200
-}
-`,
-			expect: `block {
-	heredoc <<HEREDOC
-	Here's more than one space       Here's more than one space
-	HEREDOC
-	respond "More than one space will be eaten" 200
-}
-
-block2 {
-	heredoc <<HEREDOC
-	Here's more than one space       Here's more than one space
-	HEREDOC
-	respond "More than one space will be eaten" 200
-}
-`,
-		},
-		{
-			description: "Heredoc as regular token",
-			input: `block {
-	heredoc <<HEREDOC                                 "More than one space will be eaten"
-}
-`,
-			expect: `block {
-	heredoc <<HEREDOC "More than one space will be eaten"
-}
-`,
-		},
-		{
-			description: "Escape heredoc",
-			input: `block {
-	heredoc \<<HEREDOC
-	respond "More than one space will be eaten"                           200
-}
-`,
-			expect: `block {
-	heredoc \<<HEREDOC
-	respond "More than one space will be eaten" 200
-}
-`,
-		},
-		{
-			description: "Preserve braces wrapped by backquotes",
-			input:       "block {respond `All braces should remain: {{now | date \"2006\"}}`}",
-			expect:      "block {respond `All braces should remain: {{now | date \"2006\"}}`}",
-		},
-		{
-			description: "Preserve braces wrapped by quotes",
-			input:       "block {respond \"All braces should remain: {{now | date `2006`}}\"}",
-			expect:      "block {respond \"All braces should remain: {{now | date `2006`}}\"}",
-		},
 	} {
 		// the formatter should output a trailing newline,
 		// even if the tests aren't written to expect that

caddyconfig/caddyfile/importargs.go

@@ -19,9 +19,8 @@ import (
 	"strconv"
 	"strings"
 
-	"go.uber.org/zap"
-
 	"github.com/caddyserver/caddy/v2"
+	"go.uber.org/zap"
 )
 
 // parseVariadic determines if the token is a variadic placeholder,
@@ -52,13 +51,6 @@ func parseVariadic(token Token, argCount int) (bool, int, int) {
 		return false, 0, 0
 	}
 
-	// A valid token may contain several placeholders, and
-	// they may be separated by ":". It's not variadic.
-	// https://github.com/caddyserver/caddy/issues/5716
-	if strings.Contains(start, "}") || strings.Contains(end, "{") {
-		return false, 0, 0
-	}
-
 	var (
 		startIndex = 0
 		endIndex   = argCount
@@ -101,11 +93,6 @@ func makeArgsReplacer(args []string) *caddy.Replacer {
 		// TODO: Remove the deprecated {args.*} placeholder
 		// support at some point in the future
 		if matches := argsRegexpIndexDeprecated.FindStringSubmatch(key); len(matches) > 0 {
-			// What's matched may be a substring of the key
-			if matches[0] != key {
-				return nil, false
-			}
-
 			value, err := strconv.Atoi(matches[1])
 			if err != nil {
 				caddy.Log().Named("caddyfile").Warn(
@@ -124,11 +111,6 @@ func makeArgsReplacer(args []string) *caddy.Replacer {
 
 		// Handle args[*] form
 		if matches := argsRegexpIndex.FindStringSubmatch(key); len(matches) > 0 {
-			// What's matched may be a substring of the key
-			if matches[0] != key {
-				return nil, false
-			}
-
 			if strings.Contains(matches[1], ":") {
 				caddy.Log().Named("caddyfile").Warn(
 					"Variadic placeholder {args[" + matches[1] + "]} must be a token on its own")

caddyconfig/caddyfile/importgraph.go

@@ -16,26 +16,24 @@ package caddyfile
 
 import (
 	"fmt"
-	"slices"
 )
 
 type adjacency map[string][]string
 
 type importGraph struct {
-	nodes map[string]struct{}
+	nodes map[string]bool
 	edges adjacency
 }
 
 func (i *importGraph) addNode(name string) {
 	if i.nodes == nil {
-		i.nodes = make(map[string]struct{})
+		i.nodes = make(map[string]bool)
 	}
 	if _, exists := i.nodes[name]; exists {
 		return
 	}
-	i.nodes[name] = struct{}{}
+	i.nodes[name] = true
 }
-
 func (i *importGraph) addNodes(names []string) {
 	for _, name := range names {
 		i.addNode(name)
@@ -45,7 +43,6 @@ func (i *importGraph) addNodes(names []string) {
 func (i *importGraph) removeNode(name string) {
 	delete(i.nodes, name)
 }
-
 func (i *importGraph) removeNodes(names []string) {
 	for _, name := range names {
 		i.removeNode(name)
@@ -67,7 +64,7 @@ func (i *importGraph) addEdge(from, to string) error {
 	}
 
 	if i.nodes == nil {
-		i.nodes = make(map[string]struct{})
+		i.nodes = make(map[string]bool)
 	}
 	if i.edges == nil {
 		i.edges = make(adjacency)
@@ -76,7 +73,6 @@ func (i *importGraph) addEdge(from, to string) error {
 	i.edges[from] = append(i.edges[from], to)
 	return nil
 }
-
 func (i *importGraph) addEdges(from string, tos []string) error {
 	for _, to := range tos {
 		err := i.addEdge(from, to)
@@ -92,7 +88,12 @@ func (i *importGraph) areConnected(from, to string) bool {
 	if !ok {
 		return false
 	}
-	return slices.Contains(al, to)
+	for _, v := range al {
+		if v == to {
+			return true
+		}
+	}
+	return false
 }
 
 func (i *importGraph) willCycle(from, to string) bool {

caddyconfig/caddyfile/lexer.go

@@ -137,32 +137,18 @@ func (l *lexer) next() (bool, error) {
 		}
 
 		// detect whether we have the start of a heredoc
-		if !(quoted || btQuoted) && !(inHeredoc || heredocEscaped) &&
+		if !inHeredoc && !heredocEscaped && len(val) > 1 && string(val[:2]) == "<<" {
-			len(val) > 1 && string(val[:2]) == "<<" {
+			if ch == '<' {
-			// a space means it's just a regular token and not a heredoc
+				return false, fmt.Errorf("too many '<' for heredoc on line #%d; only use two, for example <<END", l.line)
-			if ch == ' ' {
-				return makeToken(0), nil
 			}
-
-			// skip CR, we only care about LF
 			if ch == '\r' {
 				continue
 			}
-
 			// after hitting a newline, we know that the heredoc marker
 			// is the characters after the two << and the newline.
 			// we reset the val because the heredoc is syntax we don't
 			// want to keep.
 			if ch == '\n' {
-				if len(val) == 2 {
-					return false, fmt.Errorf("missing opening heredoc marker on line #%d; must contain only alpha-numeric characters, dashes and underscores; got empty string", l.line)
-				}
-
-				// check if there's too many <
-				if string(val[:3]) == "<<<" {
-					return false, fmt.Errorf("too many '<' for heredoc on line #%d; only use two, for example <<END", l.line)
-				}
-
 				heredocMarker = string(val[2:])
 				if !heredocMarkerRegexp.Match([]byte(heredocMarker)) {
 					return false, fmt.Errorf("heredoc marker on line #%d must contain only alpha-numeric characters, dashes and underscores; got '%s'", l.line, heredocMarker)
@@ -186,7 +172,7 @@ func (l *lexer) next() (bool, error) {
 			}
 
 			// check if we're done, i.e. that the last few characters are the marker
-			if len(val) >= len(heredocMarker) && heredocMarker == string(val[len(val)-len(heredocMarker):]) {
+			if len(val) > len(heredocMarker) && heredocMarker == string(val[len(val)-len(heredocMarker):]) {
 				// set the final value
 				val, err = l.finalizeHeredoc(val, heredocMarker)
 				if err != nil {
@@ -313,11 +299,6 @@ func (l *lexer) finalizeHeredoc(val []rune, marker string) ([]rune, error) {
 	// iterate over each line and strip the whitespace from the front
 	var out string
 	for lineNum, lineText := range lines[:len(lines)-1] {
-		if lineText == "" || lineText == "\r" {
-			out += "\n"
-			continue
-		}
-
 		// find an exact match for the padding
 		index := strings.Index(lineText, paddingToStrip)
 
@@ -340,8 +321,6 @@ func (l *lexer) finalizeHeredoc(val []rune, marker string) ([]rune, error) {
 	return []rune(out), nil
 }
 
-// Quoted returns true if the token was enclosed in quotes
-// (i.e. double quotes, backticks, or heredoc).
 func (t Token) Quoted() bool {
 	return t.wasQuoted > 0
 }
@@ -358,42 +337,4 @@ func (t Token) NumLineBreaks() int {
 	return lineBreaks
 }
 
-// Clone returns a deep copy of the token.
-func (t Token) Clone() Token {
-	return Token{
-		File:          t.File,
-		imports:       append([]string{}, t.imports...),
-		Line:          t.Line,
-		Text:          t.Text,
-		wasQuoted:     t.wasQuoted,
-		heredocMarker: t.heredocMarker,
-		snippetName:   t.snippetName,
-	}
-}
-
 var heredocMarkerRegexp = regexp.MustCompile("^[A-Za-z0-9_-]+$")
-
-// isNextOnNewLine tests whether t2 is on a different line from t1
-func isNextOnNewLine(t1, t2 Token) bool {
-	// If the second token is from a different file,
-	// we can assume it's from a different line
-	if t1.File != t2.File {
-		return true
-	}
-
-	// If the second token is from a different import chain,
-	// we can assume it's from a different line
-	if len(t1.imports) != len(t2.imports) {
-		return true
-	}
-	for i, im := range t1.imports {
-		if im != t2.imports[i] {
-			return true
-		}
-	}
-
-	// If the first token (incl line breaks) ends
-	// on a line earlier than the next token,
-	// then the second token is on a new line
-	return t1.Line+t1.NumLineBreaks() < t2.Line
-}

caddyconfig/caddyfile/lexer_test.go

@@ -285,18 +285,6 @@ EOF same-line-arg
 		},
 		{
 			input: []byte(`heredoc <<EOF
-EOF
-	HERE same-line-arg
-	`),
-			expected: []Token{
-				{Line: 1, Text: `heredoc`},
-				{Line: 1, Text: ``},
-				{Line: 3, Text: `HERE`},
-				{Line: 3, Text: `same-line-arg`},
-			},
-		},
-		{
-			input: []byte(`heredoc <<EOF
 		EOF same-line-arg
 	`),
 			expected: []Token{
@@ -334,59 +322,15 @@ EOF
 			},
 		},
 		{
-			input: []byte(`escaped-heredoc \<< >>`),
+			input: []byte(`heredoc <EOF
-			expected: []Token{
-				{Line: 1, Text: `escaped-heredoc`},
-				{Line: 1, Text: `<<`},
-				{Line: 1, Text: `>>`},
-			},
-		},
-		{
-			input: []byte(`not-a-heredoc <EOF
 	content
+	EOF same-line-arg
 	`),
 			expected: []Token{
-				{Line: 1, Text: `not-a-heredoc`},
+				{Line: 1, Text: `heredoc`},
 				{Line: 1, Text: `<EOF`},
 				{Line: 2, Text: `content`},
-			},
+				{Line: 3, Text: `EOF`},
-		},
-		{
-			input: []byte(`not-a-heredoc <<<EOF content`),
-			expected: []Token{
-				{Line: 1, Text: `not-a-heredoc`},
-				{Line: 1, Text: `<<<EOF`},
-				{Line: 1, Text: `content`},
-			},
-		},
-		{
-			input: []byte(`not-a-heredoc "<<" ">>"`),
-			expected: []Token{
-				{Line: 1, Text: `not-a-heredoc`},
-				{Line: 1, Text: `<<`},
-				{Line: 1, Text: `>>`},
-			},
-		},
-		{
-			input: []byte(`not-a-heredoc << >>`),
-			expected: []Token{
-				{Line: 1, Text: `not-a-heredoc`},
-				{Line: 1, Text: `<<`},
-				{Line: 1, Text: `>>`},
-			},
-		},
-		{
-			input: []byte(`not-a-heredoc <<HERE SAME LINE
-	content
-	HERE same-line-arg
-	`),
-			expected: []Token{
-				{Line: 1, Text: `not-a-heredoc`},
-				{Line: 1, Text: `<<HERE`},
-				{Line: 1, Text: `SAME`},
-				{Line: 1, Text: `LINE`},
-				{Line: 2, Text: `content`},
-				{Line: 3, Text: `HERE`},
 				{Line: 3, Text: `same-line-arg`},
 			},
 		},
@@ -422,9 +366,12 @@ EOF
 			},
 		},
 		{
-			input:        []byte("not-a-heredoc <<\n"),
+			input: []byte(`heredoc <<HERE SAME LINE
+	content
+	HERE same-line-arg
+	`),
 			expectErr:    true,
-			errorMessage: "missing opening heredoc marker on line #1; must contain only alpha-numeric characters, dashes and underscores; got empty string",
+			errorMessage: "heredoc marker on line #1 must contain only alpha-numeric characters, dashes and underscores; got 'HERE SAME LINE'",
 		},
 		{
 			input: []byte(`heredoc <<<EOF
@@ -457,48 +404,6 @@ EOF
 			expectErr:    true,
 			errorMessage: "mismatched leading whitespace in heredoc <<EOF on line #2 [        content], expected whitespace [\t\t] to match the closing marker",
 		},
-		{
-			input: []byte(`heredoc <<EOF
-The next line is a blank line
-
-The previous line is a blank line
-EOF`),
-			expected: []Token{
-				{Line: 1, Text: "heredoc"},
-				{Line: 1, Text: "The next line is a blank line\n\nThe previous line is a blank line"},
-			},
-		},
-		{
-			input: []byte(`heredoc <<EOF
-	One tab indented heredoc with blank next line
-
-	One tab indented heredoc with blank previous line
-	EOF`),
-			expected: []Token{
-				{Line: 1, Text: "heredoc"},
-				{Line: 1, Text: "One tab indented heredoc with blank next line\n\nOne tab indented heredoc with blank previous line"},
-			},
-		},
-		{
-			input: []byte(`heredoc <<EOF
-The next line is a blank line with one tab
-	
-The previous line is a blank line with one tab
-EOF`),
-			expected: []Token{
-				{Line: 1, Text: "heredoc"},
-				{Line: 1, Text: "The next line is a blank line with one tab\n\t\nThe previous line is a blank line with one tab"},
-			},
-		},
-		{
-			input: []byte(`heredoc <<EOF
-		The next line is a blank line with one tab less than the correct indentation
-	
-		The previous line is a blank line with one tab less than the correct indentation
-		EOF`),
-			expectErr:    true,
-			errorMessage: "mismatched leading whitespace in heredoc <<EOF on line #3 [\t], expected whitespace [\t\t] to match the closing marker",
-		},
 	}
 
 	for i, testCase := range testCases {

caddyconfig/caddyfile/parse.go

@@ -22,9 +22,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"go.uber.org/zap"
-
 	"github.com/caddyserver/caddy/v2"
+	"go.uber.org/zap"
 )
 
 // Parse parses the input just enough to group tokens, in
@@ -50,7 +49,7 @@ func Parse(filename string, input []byte) ([]ServerBlock, error) {
 	p := parser{
 		Dispenser: NewDispenser(tokens),
 		importGraph: importGraph{
-			nodes: make(map[string]struct{}),
+			nodes: make(map[string]bool),
 			edges: make(adjacency),
 		},
 	}
@@ -160,14 +159,14 @@ func (p *parser) begin() error {
 	}
 
 	if ok, name := p.isNamedRoute(); ok {
+		// named routes only have one key, the route name
+		p.block.Keys = []string{name}
+		p.block.IsNamedRoute = true
+
 		// we just need a dummy leading token to ease parsing later
 		nameToken := p.Token()
 		nameToken.Text = name
 
-		// named routes only have one key, the route name
-		p.block.Keys = []Token{nameToken}
-		p.block.IsNamedRoute = true
-
 		// get all the tokens from the block, including the braces
 		tokens, err := p.blockTokens(true)
 		if err != nil {
@@ -211,16 +210,10 @@ func (p *parser) addresses() error {
 	var expectingAnother bool
 
 	for {
-		value := p.Val()
+		tkn := p.Val()
-		token := p.Token()
 
-		// Reject request matchers if trying to define them globally
+		// special case: import directive replaces tokens during parse-time
-		if strings.HasPrefix(value, "@") {
+		if tkn == "import" && p.isNewLine() {
-			return p.Errf("request matchers may not be defined globally, they must be in a site block; found %s", value)
-		}
-
-		// Special case: import directive replaces tokens during parse-time
-		if value == "import" && p.isNewLine() {
 			err := p.doImport(0)
 			if err != nil {
 				return err
@@ -229,9 +222,9 @@ func (p *parser) addresses() error {
 		}
 
 		// Open brace definitely indicates end of addresses
-		if value == "{" {
+		if tkn == "{" {
 			if expectingAnother {
-				return p.Errf("Expected another address but had '%s' - check for extra comma", value)
+				return p.Errf("Expected another address but had '%s' - check for extra comma", tkn)
 			}
 			// Mark this server block as being defined with braces.
 			// This is used to provide a better error message when
@@ -243,15 +236,15 @@ func (p *parser) addresses() error {
 		}
 
 		// Users commonly forget to place a space between the address and the '{'
-		if strings.HasSuffix(value, "{") {
+		if strings.HasSuffix(tkn, "{") {
-			return p.Errf("Site addresses cannot end with a curly brace: '%s' - put a space between the token and the brace", value)
+			return p.Errf("Site addresses cannot end with a curly brace: '%s' - put a space between the token and the brace", tkn)
 		}
 
-		if value != "" { // empty token possible if user typed ""
+		if tkn != "" { // empty token possible if user typed ""
 			// Trailing comma indicates another address will follow, which
 			// may possibly be on the next line
-			if value[len(value)-1] == ',' {
+			if tkn[len(tkn)-1] == ',' {
-				value = value[:len(value)-1]
+				tkn = tkn[:len(tkn)-1]
 				expectingAnother = true
 			} else {
 				expectingAnother = false // but we may still see another one on this line
@@ -260,17 +253,11 @@ func (p *parser) addresses() error {
 			// If there's a comma here, it's probably because they didn't use a space
 			// between their two domains, e.g. "foo.com,bar.com", which would not be
 			// parsed as two separate site addresses.
-			if strings.Contains(value, ",") {
+			if strings.Contains(tkn, ",") {
-				return p.Errf("Site addresses cannot contain a comma ',': '%s' - put a space after the comma to separate site addresses", value)
+				return p.Errf("Site addresses cannot contain a comma ',': '%s' - put a space after the comma to separate site addresses", tkn)
 			}
 
-			// After the above, a comma surrounded by spaces would result
+			p.block.Keys = append(p.block.Keys, tkn)
-			// in an empty token which we should ignore
-			if value != "" {
-				// Add the token as a site address
-				token.Text = value
-				p.block.Keys = append(p.block.Keys, token)
-			}
 		}
 
 		// Advance token and possibly break out of loop or return error
@@ -369,45 +356,9 @@ func (p *parser) doImport(nesting int) error {
 	// set up a replacer for non-variadic args replacement
 	repl := makeArgsReplacer(args)
 
-	// grab all the tokens (if it exists) from within a block that follows the import
-	var blockTokens []Token
-	for currentNesting := p.Nesting(); p.NextBlock(currentNesting); {
-		blockTokens = append(blockTokens, p.Token())
-	}
-	// initialize with size 1
-	blockMapping := make(map[string][]Token, 1)
-	if len(blockTokens) > 0 {
-		// use such tokens to create a new dispenser, and then use it to parse each block
-		bd := NewDispenser(blockTokens)
-		for bd.Next() {
-			// see if we can grab a key
-			var currentMappingKey string
-			if bd.Val() == "{" {
-				return p.Err("anonymous blocks are not supported")
-			}
-			currentMappingKey = bd.Val()
-			currentMappingTokens := []Token{}
-			// read all args until end of line / {
-			if bd.NextArg() {
-				currentMappingTokens = append(currentMappingTokens, bd.Token())
-				for bd.NextArg() {
-					currentMappingTokens = append(currentMappingTokens, bd.Token())
-				}
-				// TODO(elee1766): we don't enter another mapping here because it's annoying to extract the { and } properly.
-				// maybe someone can do that in the future
-			} else {
-				// attempt to enter a block and add tokens to the currentMappingTokens
-				for mappingNesting := bd.Nesting(); bd.NextBlock(mappingNesting); {
-					currentMappingTokens = append(currentMappingTokens, bd.Token())
-				}
-			}
-			blockMapping[currentMappingKey] = currentMappingTokens
-		}
-	}
-
 	// splice out the import directive and its arguments
 	// (2 tokens, plus the length of args)
-	tokensBefore := p.tokens[:p.cursor-1-len(args)-len(blockTokens)]
+	tokensBefore := p.tokens[:p.cursor-1-len(args)]
 	tokensAfter := p.tokens[p.cursor+1:]
 	var importedTokens []Token
 	var nodes []string
@@ -423,7 +374,7 @@ func (p *parser) doImport(nesting int) error {
 		// make path relative to the file of the _token_ being processed rather
 		// than current working directory (issue #867) and then use glob to get
 		// list of matching filenames
-		absFile, err := caddy.FastAbs(p.Dispenser.File())
+		absFile, err := filepath.Abs(p.Dispenser.File())
 		if err != nil {
 			return p.Errf("Failed to get absolute path of file: %s: %v", p.Dispenser.File(), err)
 		}
@@ -441,6 +392,7 @@ func (p *parser) doImport(nesting int) error {
 			return p.Errf("Glob pattern may only contain one wildcard (*), but has others: %s", globPattern)
 		}
 		matches, err = filepath.Glob(globPattern)
+
 		if err != nil {
 			return p.Errf("Failed to use import pattern %s: %v", importPattern, err)
 		}
@@ -512,7 +464,7 @@ func (p *parser) doImport(nesting int) error {
 		// format, won't check for nesting correctness or any other error, that's what parser does.
 		if !maybeSnippet && nesting == 0 {
 			// first of the line
-			if i == 0 || isNextOnNewLine(tokensCopy[i-1], token) {
+			if i == 0 || importedTokens[i-1].File != token.File || importedTokens[i-1].Line+importedTokens[i-1].NumLineBreaks() < token.Line {
 				index = 0
 			} else {
 				index++
@@ -536,33 +488,6 @@ func (p *parser) doImport(nesting int) error {
 				maybeSnippet = false
 			}
 		}
-		// if it is {block}, we substitute with all tokens in the block
-		// if it is {blocks.*}, we substitute with the tokens in the mapping for the *
-		var skip bool
-		var tokensToAdd []Token
-		switch {
-		case token.Text == "{block}":
-			tokensToAdd = blockTokens
-		case strings.HasPrefix(token.Text, "{blocks.") && strings.HasSuffix(token.Text, "}"):
-			// {blocks.foo.bar} will be extracted to key `foo.bar`
-			blockKey := strings.TrimPrefix(strings.TrimSuffix(token.Text, "}"), "{blocks.")
-			val, ok := blockMapping[blockKey]
-			if ok {
-				tokensToAdd = val
-			}
-		default:
-			skip = true
-		}
-		if !skip {
-			if len(tokensToAdd) == 0 {
-				// if there is no content in the snippet block, don't do any replacement
-				// this allows snippets which contained {block}/{block.*} before this change to continue functioning as normal
-				tokensCopy = append(tokensCopy, token)
-			} else {
-				tokensCopy = append(tokensCopy, tokensToAdd...)
-			}
-			continue
-		}
 
 		if maybeSnippet {
 			tokensCopy = append(tokensCopy, token)
@@ -584,7 +509,7 @@ func (p *parser) doImport(nesting int) error {
 	// splice the imported tokens in the place of the import statement
 	// and rewind cursor so Next() will land on first imported token
 	p.tokens = append(tokensBefore, append(tokensCopy, tokensAfter...)...)
-	p.cursor -= len(args) + len(blockTokens) + 1
+	p.cursor -= len(args) + 1
 
 	return nil
 }
@@ -622,7 +547,7 @@ func (p *parser) doSingleImport(importFile string) ([]Token, error) {
 
 	// Tack the file path onto these tokens so errors show the imported file's name
 	// (we use full, absolute path to avoid bugs: issue #1892)
-	filename, err := caddy.FastAbs(importFile)
+	filename, err := filepath.Abs(importFile)
 	if err != nil {
 		return nil, p.Errf("Failed to get absolute path of file: %s: %v", importFile, err)
 	}
@@ -640,6 +565,7 @@ func (p *parser) doSingleImport(importFile string) ([]Token, error) {
 // are loaded into the current server block for later use
 // by directive setup functions.
 func (p *parser) directive() error {
+
 	// a segment is a list of tokens associated with this directive
 	var segment Segment
 
@@ -711,8 +637,8 @@ func (p *parser) closeCurlyBrace() error {
 func (p *parser) isNamedRoute() (bool, string) {
 	keys := p.block.Keys
 	// A named route block is a single key with parens, prefixed with &.
-	if len(keys) == 1 && strings.HasPrefix(keys[0].Text, "&(") && strings.HasSuffix(keys[0].Text, ")") {
+	if len(keys) == 1 && strings.HasPrefix(keys[0], "&(") && strings.HasSuffix(keys[0], ")") {
-		return true, strings.TrimSuffix(keys[0].Text[2:], ")")
+		return true, strings.TrimSuffix(keys[0][2:], ")")
 	}
 	return false, ""
 }
@@ -720,8 +646,8 @@ func (p *parser) isNamedRoute() (bool, string) {
 func (p *parser) isSnippet() (bool, string) {
 	keys := p.block.Keys
 	// A snippet block is a single key with parens. Nothing else qualifies.
-	if len(keys) == 1 && strings.HasPrefix(keys[0].Text, "(") && strings.HasSuffix(keys[0].Text, ")") {
+	if len(keys) == 1 && strings.HasPrefix(keys[0], "(") && strings.HasSuffix(keys[0], ")") {
-		return true, strings.TrimSuffix(keys[0].Text[1:], ")")
+		return true, strings.TrimSuffix(keys[0][1:], ")")
 	}
 	return false, ""
 }
@@ -765,19 +691,11 @@ func (p *parser) blockTokens(retainCurlies bool) ([]Token, error) {
 // grouped by segments.
 type ServerBlock struct {
 	HasBraces    bool
-	Keys         []Token
+	Keys         []string
 	Segments     []Segment
 	IsNamedRoute bool
 }
 
-func (sb ServerBlock) GetKeysText() []string {
-	res := []string{}
-	for _, k := range sb.Keys {
-		res = append(res, k.Text)
-	}
-	return res
-}
-
 // DispenseDirective returns a dispenser that contains
 // all the tokens in the server block.
 func (sb ServerBlock) DispenseDirective(dir string) *Dispenser {

caddyconfig/caddyfile/parse_test.go

@@ -22,7 +22,7 @@ import (
 )
 
 func TestParseVariadic(t *testing.T) {
-	args := make([]string, 10)
+	var args = make([]string, 10)
 	for i, tc := range []struct {
 		input  string
 		result bool
@@ -91,10 +91,6 @@ func TestParseVariadic(t *testing.T) {
 			input:  "{args[0:10]}",
 			result: true,
 		},
-		{
-			input:  "{args[0]}:{args[1]}:{args[2]}",
-			result: false,
-		},
 	} {
 		token := Token{
 			File: "test",
@@ -111,6 +107,7 @@ func TestAllTokens(t *testing.T) {
 	input := []byte("a b c\nd e")
 	expected := []string{"a", "b", "c", "d", "e"}
 	tokens, err := allTokens("TestAllTokens", input)
+
 	if err != nil {
 		t.Fatalf("Expected no error, got %v", err)
 	}
@@ -148,11 +145,10 @@ func TestParseOneAndImport(t *testing.T) {
 			"localhost",
 		}, []int{1}},
 
-		{
+		{`localhost:1234
-			`localhost:1234
 		  dir1 foo bar`, false, []string{
-				"localhost:1234",
+			"localhost:1234",
-			}, []int{3},
+		}, []int{3},
 		},
 
 		{`localhost {
@@ -347,7 +343,7 @@ func TestParseOneAndImport(t *testing.T) {
 				i, len(test.keys), len(result.Keys))
 			continue
 		}
-		for j, addr := range result.GetKeysText() {
+		for j, addr := range result.Keys {
 			if addr != test.keys[j] {
 				t.Errorf("Test %d, key %d: Expected '%s', but was '%s'",
 					i, j, test.keys[j], addr)
@@ -379,9 +375,8 @@ func TestRecursiveImport(t *testing.T) {
 	}
 
 	isExpected := func(got ServerBlock) bool {
-		textKeys := got.GetKeysText()
+		if len(got.Keys) != 1 || got.Keys[0] != "localhost" {
-		if len(textKeys) != 1 || textKeys[0] != "localhost" {
+			t.Errorf("got keys unexpected: expect localhost, got %v", got.Keys)
-			t.Errorf("got keys unexpected: expect localhost, got %v", textKeys)
 			return false
 		}
 		if len(got.Segments) != 2 {
@@ -408,13 +403,13 @@ func TestRecursiveImport(t *testing.T) {
 	err = os.WriteFile(recursiveFile1, []byte(
 		`localhost
 		dir1
-		import recursive_import_test2`), 0o644)
+		import recursive_import_test2`), 0644)
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer os.Remove(recursiveFile1)
 
-	err = os.WriteFile(recursiveFile2, []byte("dir2 1"), 0o644)
+	err = os.WriteFile(recursiveFile2, []byte("dir2 1"), 0644)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -442,7 +437,7 @@ func TestRecursiveImport(t *testing.T) {
 	err = os.WriteFile(recursiveFile1, []byte(
 		`localhost
 		dir1
-		import `+recursiveFile2), 0o644)
+		import `+recursiveFile2), 0644)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -475,9 +470,8 @@ func TestDirectiveImport(t *testing.T) {
 	}
 
 	isExpected := func(got ServerBlock) bool {
-		textKeys := got.GetKeysText()
+		if len(got.Keys) != 1 || got.Keys[0] != "localhost" {
-		if len(textKeys) != 1 || textKeys[0] != "localhost" {
+			t.Errorf("got keys unexpected: expect localhost, got %v", got.Keys)
-			t.Errorf("got keys unexpected: expect localhost, got %v", textKeys)
 			return false
 		}
 		if len(got.Segments) != 2 {
@@ -497,7 +491,7 @@ func TestDirectiveImport(t *testing.T) {
 	}
 
 	err = os.WriteFile(directiveFile, []byte(`prop1 1
-	prop2 2`), 0o644)
+	prop2 2`), 0644)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -555,10 +549,6 @@ func TestParseAll(t *testing.T) {
 			{"localhost:1234", "http://host2"},
 		}},
 
-		{`foo.example.com   ,   example.com`, false, [][]string{
-			{"foo.example.com", "example.com"},
-		}},
-
 		{`localhost:1234, http://host2,`, true, [][]string{}},
 
 		{`http://host1.com, http://host2.com {
@@ -618,11 +608,11 @@ func TestParseAll(t *testing.T) {
 		}
 		for j, block := range blocks {
 			if len(block.Keys) != len(test.keys[j]) {
-				t.Errorf("Test %d: Expected %d keys in block %d, got %d: %v",
+				t.Errorf("Test %d: Expected %d keys in block %d, got %d",
-					i, len(test.keys[j]), j, len(block.Keys), block.Keys)
+					i, len(test.keys[j]), j, len(block.Keys))
 				continue
 			}
-			for k, addr := range block.GetKeysText() {
+			for k, addr := range block.Keys {
 				if addr != test.keys[j][k] {
 					t.Errorf("Test %d, block %d, key %d: Expected '%s', but got '%s'",
 						i, j, k, test.keys[j][k], addr)
@@ -728,36 +718,6 @@ func TestEnvironmentReplacement(t *testing.T) {
 	}
 }
 
-func TestImportReplacementInJSONWithBrace(t *testing.T) {
-	for i, test := range []struct {
-		args   []string
-		input  string
-		expect string
-	}{
-		{
-			args:   []string{"123"},
-			input:  "{args[0]}",
-			expect: "123",
-		},
-		{
-			args:   []string{"123"},
-			input:  `{"key":"{args[0]}"}`,
-			expect: `{"key":"123"}`,
-		},
-		{
-			args:   []string{"123", "123"},
-			input:  `{"key":[{args[0]},{args[1]}]}`,
-			expect: `{"key":[123,123]}`,
-		},
-	} {
-		repl := makeArgsReplacer(test.args)
-		actual := repl.ReplaceKnown(test.input, "")
-		if actual != test.expect {
-			t.Errorf("Test %d: Expected: '%s' but got '%s'", i, test.expect, actual)
-		}
-	}
-}
-
 func TestSnippets(t *testing.T) {
 	p := testParser(`
 		(common) {
@@ -775,7 +735,7 @@ func TestSnippets(t *testing.T) {
 	if len(blocks) != 1 {
 		t.Fatalf("Expect exactly one server block. Got %d.", len(blocks))
 	}
-	if actual, expected := blocks[0].GetKeysText()[0], "http://example.com"; expected != actual {
+	if actual, expected := blocks[0].Keys[0], "http://example.com"; expected != actual {
 		t.Errorf("Expected server name to be '%s' but was '%s'", expected, actual)
 	}
 	if len(blocks[0].Segments) != 2 {
@@ -807,7 +767,7 @@ func TestImportedFilesIgnoreNonDirectiveImportTokens(t *testing.T) {
 	fileName := writeStringToTempFileOrDie(t, `
 		http://example.com {
 			# This isn't an import directive, it's just an arg with value 'import'
-			basic_auth / import password
+			basicauth / import password
 		}
 	`)
 	// Parse the root file that imports the other one.
@@ -818,12 +778,12 @@ func TestImportedFilesIgnoreNonDirectiveImportTokens(t *testing.T) {
 	}
 	auth := blocks[0].Segments[0]
 	line := auth[0].Text + " " + auth[1].Text + " " + auth[2].Text + " " + auth[3].Text
-	if line != "basic_auth / import password" {
+	if line != "basicauth / import password" {
 		// Previously, it would be changed to:
-		//   basic_auth / import /path/to/test/dir/password
+		//   basicauth / import /path/to/test/dir/password
 		// referencing a file that (probably) doesn't exist and changing the
 		// password!
-		t.Errorf("Expected basic_auth tokens to be 'basic_auth / import password' but got %#q", line)
+		t.Errorf("Expected basicauth tokens to be 'basicauth / import password' but got %#q", line)
 	}
 }
 
@@ -850,7 +810,7 @@ func TestSnippetAcrossMultipleFiles(t *testing.T) {
 	if len(blocks) != 1 {
 		t.Fatalf("Expect exactly one server block. Got %d.", len(blocks))
 	}
-	if actual, expected := blocks[0].GetKeysText()[0], "http://example.com"; expected != actual {
+	if actual, expected := blocks[0].Keys[0], "http://example.com"; expected != actual {
 		t.Errorf("Expected server name to be '%s' but was '%s'", expected, actual)
 	}
 	if len(blocks[0].Segments) != 1 {
@@ -861,29 +821,6 @@ func TestSnippetAcrossMultipleFiles(t *testing.T) {
 	}
 }
 
-func TestRejectsGlobalMatcher(t *testing.T) {
-	p := testParser(`
-		@rejected path /foo
-
-		(common) {
-			gzip foo
-			errors stderr
-		}
-
-		http://example.com {
-			import common
-		}
-	`)
-	_, err := p.parseAll()
-	if err == nil {
-		t.Fatal("Expected an error, but got nil")
-	}
-	expected := "request matchers may not be defined globally, they must be in a site block; found @rejected, at Testfile:2"
-	if err.Error() != expected {
-		t.Errorf("Expected error to be '%s' but got '%v'", expected, err)
-	}
-}
-
 func testParser(input string) parser {
 	return parser{Dispenser: NewTestDispenser(input)}
 }

caddyconfig/configadapters.go

@@ -135,4 +135,11 @@ func (am adapterModule) CaddyModule() caddy.ModuleInfo {
 	}
 }
 
+// UnwrapAdapter return the original Adapter, this method must be exported
+// to be type-assertable 🤷
+// hack, https://github.com/caddyserver/caddy/issues/5621
+func (am adapterModule) UnwrapAdapter() any {
+	return am.Adapter
+}
+
 var configAdapters = make(map[string]Adapter)

caddyconfig/httpcaddyfile/addresses.go

@@ -24,14 +24,13 @@ import (
 	"strings"
 	"unicode"
 
-	"github.com/caddyserver/certmagic"
-
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
 	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
+	"github.com/caddyserver/certmagic"
 )
 
-// mapAddressToProtocolToServerBlocks returns a map of listener address to list of server
+// mapAddressToServerBlocks returns a map of listener address to list of server
 // blocks that will be served on that address. To do this, each server block is
 // expanded so that each one is considered individually, although keys of a
 // server block that share the same address stay grouped together so the config
@@ -77,15 +76,9 @@ import (
 // repetition may be undesirable, so call consolidateAddrMappings() to map
 // multiple addresses to the same lists of server blocks (a many:many mapping).
 // (Doing this is essentially a map-reduce technique.)
-func (st *ServerType) mapAddressToProtocolToServerBlocks(originalServerBlocks []serverBlock,
+func (st *ServerType) mapAddressToServerBlocks(originalServerBlocks []serverBlock,
-	options map[string]any,
+	options map[string]any) (map[string][]serverBlock, error) {
-) (map[string]map[string][]serverBlock, error) {
+	sbmap := make(map[string][]serverBlock)
-	addrToProtocolToServerBlocks := map[string]map[string][]serverBlock{}
-
-	type keyWithParsedKey struct {
-		key       caddyfile.Token
-		parsedKey Address
-	}
 
 	for i, sblock := range originalServerBlocks {
 		// within a server block, we need to map all the listener addresses
@@ -93,48 +86,27 @@ func (st *ServerType) mapAddressToProtocolToServerBlocks(originalServerBlocks []
 		// will be served by them; this has the effect of treating each
 		// key of a server block as its own, but without having to repeat its
 		// contents in cases where multiple keys really can be served together
-		addrToProtocolToKeyWithParsedKeys := map[string]map[string][]keyWithParsedKey{}
+		addrToKeys := make(map[string][]string)
 		for j, key := range sblock.block.Keys {
-			parsedKey, err := ParseAddress(key.Text)
-			if err != nil {
-				return nil, fmt.Errorf("parsing key: %v", err)
-			}
-			parsedKey = parsedKey.Normalize()
-
 			// a key can have multiple listener addresses if there are multiple
 			// arguments to the 'bind' directive (although they will all have
 			// the same port, since the port is defined by the key or is implicit
 			// through automatic HTTPS)
-			listeners, err := st.listenersForServerBlockAddress(sblock, parsedKey, options)
+			addrs, err := st.listenerAddrsForServerBlockKey(sblock, key, options)
 			if err != nil {
-				return nil, fmt.Errorf("server block %d, key %d (%s): determining listener address: %v", i, j, key.Text, err)
+				return nil, fmt.Errorf("server block %d, key %d (%s): determining listener address: %v", i, j, key, err)
 			}
 
-			// associate this key with its protocols and each listener address served with them
+			// associate this key with each listener address it is served on
-			kwpk := keyWithParsedKey{key, parsedKey}
+			for _, addr := range addrs {
-			for addr, protocols := range listeners {
+				addrToKeys[addr] = append(addrToKeys[addr], key)
-				protocolToKeyWithParsedKeys, ok := addrToProtocolToKeyWithParsedKeys[addr]
-				if !ok {
-					protocolToKeyWithParsedKeys = map[string][]keyWithParsedKey{}
-					addrToProtocolToKeyWithParsedKeys[addr] = protocolToKeyWithParsedKeys
-				}
-
-				// an empty protocol indicates the default, a nil or empty value in the ListenProtocols array
-				if len(protocols) == 0 {
-					protocols[""] = struct{}{}
-				}
-				for prot := range protocols {
-					protocolToKeyWithParsedKeys[prot] = append(
-						protocolToKeyWithParsedKeys[prot],
-						kwpk)
-				}
 			}
 		}
 
 		// make a slice of the map keys so we can iterate in sorted order
-		addrs := make([]string, 0, len(addrToProtocolToKeyWithParsedKeys))
+		addrs := make([]string, 0, len(addrToKeys))
-		for addr := range addrToProtocolToKeyWithParsedKeys {
+		for k := range addrToKeys {
-			addrs = append(addrs, addr)
+			addrs = append(addrs, k)
 		}
 		sort.Strings(addrs)
 
@@ -144,142 +116,83 @@ func (st *ServerType) mapAddressToProtocolToServerBlocks(originalServerBlocks []
 		// server block are only the ones which use the address; but
 		// the contents (tokens) are of course the same
 		for _, addr := range addrs {
-			protocolToKeyWithParsedKeys := addrToProtocolToKeyWithParsedKeys[addr]
+			keys := addrToKeys[addr]
-
+			// parse keys so that we only have to do it once
-			prots := make([]string, 0, len(protocolToKeyWithParsedKeys))
+			parsedKeys := make([]Address, 0, len(keys))
-			for prot := range protocolToKeyWithParsedKeys {
+			for _, key := range keys {
-				prots = append(prots, prot)
+				addr, err := ParseAddress(key)
-			}
+				if err != nil {
-			sort.Strings(prots)
+					return nil, fmt.Errorf("parsing key '%s': %v", key, err)
-
-			protocolToServerBlocks, ok := addrToProtocolToServerBlocks[addr]
-			if !ok {
-				protocolToServerBlocks = map[string][]serverBlock{}
-				addrToProtocolToServerBlocks[addr] = protocolToServerBlocks
-			}
-
-			for _, prot := range prots {
-				keyWithParsedKeys := protocolToKeyWithParsedKeys[prot]
-
-				keys := make([]caddyfile.Token, len(keyWithParsedKeys))
-				parsedKeys := make([]Address, len(keyWithParsedKeys))
-
-				for k, keyWithParsedKey := range keyWithParsedKeys {
-					keys[k] = keyWithParsedKey.key
-					parsedKeys[k] = keyWithParsedKey.parsedKey
 				}
-
+				parsedKeys = append(parsedKeys, addr.Normalize())
-				protocolToServerBlocks[prot] = append(protocolToServerBlocks[prot], serverBlock{
-					block: caddyfile.ServerBlock{
-						Keys:     keys,
-						Segments: sblock.block.Segments,
-					},
-					pile:       sblock.pile,
-					parsedKeys: parsedKeys,
-				})
 			}
-		}
+			sbmap[addr] = append(sbmap[addr], serverBlock{
-	}
+				block: caddyfile.ServerBlock{
-
+					Keys:     keys,
-	return addrToProtocolToServerBlocks, nil
+					Segments: sblock.block.Segments,
-}
+				},
-
+				pile: sblock.pile,
-// consolidateAddrMappings eliminates repetition of identical server blocks in a mapping of
+				keys: parsedKeys,
-// single listener addresses to protocols to lists of server blocks. Since multiple addresses
-// may serve multiple protocols to identical sites (server block contents), this function turns
-// a 1:many mapping into a many:many mapping. Server block contents (tokens) must be
-// exactly identical so that reflect.DeepEqual returns true in order for the addresses to be combined.
-// Identical entries are deleted from the addrToServerBlocks map. Essentially, each pairing (each
-// association from multiple addresses to multiple server blocks; i.e. each element of
-// the returned slice) becomes a server definition in the output JSON.
-func (st *ServerType) consolidateAddrMappings(addrToProtocolToServerBlocks map[string]map[string][]serverBlock) []sbAddrAssociation {
-	sbaddrs := make([]sbAddrAssociation, 0, len(addrToProtocolToServerBlocks))
-
-	addrs := make([]string, 0, len(addrToProtocolToServerBlocks))
-	for addr := range addrToProtocolToServerBlocks {
-		addrs = append(addrs, addr)
-	}
-	sort.Strings(addrs)
-
-	for _, addr := range addrs {
-		protocolToServerBlocks := addrToProtocolToServerBlocks[addr]
-
-		prots := make([]string, 0, len(protocolToServerBlocks))
-		for prot := range protocolToServerBlocks {
-			prots = append(prots, prot)
-		}
-		sort.Strings(prots)
-
-		for _, prot := range prots {
-			serverBlocks := protocolToServerBlocks[prot]
-
-			// now find other addresses that map to identical
-			// server blocks and add them to our map of listener
-			// addresses and protocols, while removing them from
-			// the original map
-			listeners := map[string]map[string]struct{}{}
-
-			for otherAddr, otherProtocolToServerBlocks := range addrToProtocolToServerBlocks {
-				for otherProt, otherServerBlocks := range otherProtocolToServerBlocks {
-					if addr == otherAddr && prot == otherProt || reflect.DeepEqual(serverBlocks, otherServerBlocks) {
-						listener, ok := listeners[otherAddr]
-						if !ok {
-							listener = map[string]struct{}{}
-							listeners[otherAddr] = listener
-						}
-						listener[otherProt] = struct{}{}
-						delete(otherProtocolToServerBlocks, otherProt)
-					}
-				}
-			}
-
-			addresses := make([]string, 0, len(listeners))
-			for lnAddr := range listeners {
-				addresses = append(addresses, lnAddr)
-			}
-			sort.Strings(addresses)
-
-			addressesWithProtocols := make([]addressWithProtocols, 0, len(listeners))
-
-			for _, lnAddr := range addresses {
-				lnProts := listeners[lnAddr]
-				prots := make([]string, 0, len(lnProts))
-				for prot := range lnProts {
-					prots = append(prots, prot)
-				}
-				sort.Strings(prots)
-
-				addressesWithProtocols = append(addressesWithProtocols, addressWithProtocols{
-					address:   lnAddr,
-					protocols: prots,
-				})
-			}
-
-			sbaddrs = append(sbaddrs, sbAddrAssociation{
-				addressesWithProtocols: addressesWithProtocols,
-				serverBlocks:           serverBlocks,
 			})
 		}
 	}
 
+	return sbmap, nil
+}
+
+// consolidateAddrMappings eliminates repetition of identical server blocks in a mapping of
+// single listener addresses to lists of server blocks. Since multiple addresses may serve
+// identical sites (server block contents), this function turns a 1:many mapping into a
+// many:many mapping. Server block contents (tokens) must be exactly identical so that
+// reflect.DeepEqual returns true in order for the addresses to be combined. Identical
+// entries are deleted from the addrToServerBlocks map. Essentially, each pairing (each
+// association from multiple addresses to multiple server blocks; i.e. each element of
+// the returned slice) becomes a server definition in the output JSON.
+func (st *ServerType) consolidateAddrMappings(addrToServerBlocks map[string][]serverBlock) []sbAddrAssociation {
+	sbaddrs := make([]sbAddrAssociation, 0, len(addrToServerBlocks))
+	for addr, sblocks := range addrToServerBlocks {
+		// we start with knowing that at least this address
+		// maps to these server blocks
+		a := sbAddrAssociation{
+			addresses:    []string{addr},
+			serverBlocks: sblocks,
+		}
+
+		// now find other addresses that map to identical
+		// server blocks and add them to our list of
+		// addresses, while removing them from the map
+		for otherAddr, otherSblocks := range addrToServerBlocks {
+			if addr == otherAddr {
+				continue
+			}
+			if reflect.DeepEqual(sblocks, otherSblocks) {
+				a.addresses = append(a.addresses, otherAddr)
+				delete(addrToServerBlocks, otherAddr)
+			}
+		}
+		sort.Strings(a.addresses)
+
+		sbaddrs = append(sbaddrs, a)
+	}
+
+	// sort them by their first address (we know there will always be at least one)
+	// to avoid problems with non-deterministic ordering (makes tests flaky)
+	sort.Slice(sbaddrs, func(i, j int) bool {
+		return sbaddrs[i].addresses[0] < sbaddrs[j].addresses[0]
+	})
+
 	return sbaddrs
 }
 
-// listenersForServerBlockAddress essentially converts the Caddyfile site addresses to a map from
+// listenerAddrsForServerBlockKey essentially converts the Caddyfile
-// Caddy listener addresses and the protocols to serve them with to the parsed address for each server block.
+// site addresses to Caddy listener addresses for each server block.
-func (st *ServerType) listenersForServerBlockAddress(sblock serverBlock, addr Address,
+func (st *ServerType) listenerAddrsForServerBlockKey(sblock serverBlock, key string,
-	options map[string]any,
+	options map[string]any) ([]string, error) {
-) (map[string]map[string]struct{}, error) {
+	addr, err := ParseAddress(key)
-	switch addr.Scheme {
+	if err != nil {
-	case "wss":
+		return nil, fmt.Errorf("parsing key: %v", err)
-		return nil, fmt.Errorf("the scheme wss:// is only supported in browsers; use https:// instead")
-	case "ws":
-		return nil, fmt.Errorf("the scheme ws:// is only supported in browsers; use http:// instead")
-	case "https", "http", "":
-		// Do nothing or handle the valid schemes
-	default:
-		return nil, fmt.Errorf("unsupported URL scheme %s://", addr.Scheme)
 	}
+	addr = addr.Normalize()
 
 	// figure out the HTTP and HTTPS ports; either
 	// use defaults, or override with user config
@@ -303,58 +216,55 @@ func (st *ServerType) listenersForServerBlockAddress(sblock serverBlock, addr Ad
 
 	// error if scheme and port combination violate convention
 	if (addr.Scheme == "http" && lnPort == httpsPort) || (addr.Scheme == "https" && lnPort == httpPort) {
-		return nil, fmt.Errorf("[%s] scheme and port violate convention", addr.String())
+		return nil, fmt.Errorf("[%s] scheme and port violate convention", key)
 	}
 
-	// the bind directive specifies hosts (and potentially network), and the protocols to serve them with, but is optional
+	// the bind directive specifies hosts (and potentially network), but is optional
-	lnCfgVals := make([]addressesWithProtocols, 0, len(sblock.pile["bind"]))
+	lnHosts := make([]string, 0, len(sblock.pile["bind"]))
 	for _, cfgVal := range sblock.pile["bind"] {
-		if val, ok := cfgVal.Value.(addressesWithProtocols); ok {
+		lnHosts = append(lnHosts, cfgVal.Value.([]string)...)
-			lnCfgVals = append(lnCfgVals, val)
-		}
 	}
-	if len(lnCfgVals) == 0 {
+	if len(lnHosts) == 0 {
-		if defaultBindValues, ok := options["default_bind"].([]ConfigValue); ok {
+		if defaultBind, ok := options["default_bind"].([]string); ok {
-			for _, defaultBindValue := range defaultBindValues {
+			lnHosts = defaultBind
-				lnCfgVals = append(lnCfgVals, defaultBindValue.Value.(addressesWithProtocols))
-			}
 		} else {
-			lnCfgVals = []addressesWithProtocols{{
+			lnHosts = []string{""}
-				addresses: []string{""},
-				protocols: nil,
-			}}
 		}
 	}
 
 	// use a map to prevent duplication
-	listeners := map[string]map[string]struct{}{}
+	listeners := make(map[string]struct{})
-	for _, lnCfgVal := range lnCfgVals {
+	for _, lnHost := range lnHosts {
-		for _, lnAddr := range lnCfgVal.addresses {
+		// normally we would simply append the port,
-			lnNetw, lnHost, _, err := caddy.SplitNetworkAddress(lnAddr)
+		// but if lnHost is IPv6, we need to ensure it
-			if err != nil {
+		// is enclosed in [ ]; net.JoinHostPort does
-				return nil, fmt.Errorf("splitting listener address: %v", err)
+		// this for us, but lnHost might also have a
-			}
+		// network type in front (e.g. "tcp/") leading
-			networkAddr, err := caddy.ParseNetworkAddress(caddy.JoinNetworkAddress(lnNetw, lnHost, lnPort))
+		// to "[tcp/::1]" which causes parsing failures
-			if err != nil {
+		// later; what we need is "tcp/[::1]", so we have
-				return nil, fmt.Errorf("parsing network address: %v", err)
+		// to split the network and host, then re-combine
-			}
+		network, host, ok := strings.Cut(lnHost, "/")
-			if _, ok := listeners[addr.String()]; !ok {
+		if !ok {
-				listeners[networkAddr.String()] = map[string]struct{}{}
+			host = network
-			}
+			network = ""
-			for _, protocol := range lnCfgVal.protocols {
-				listeners[networkAddr.String()][protocol] = struct{}{}
-			}
 		}
+		host = strings.Trim(host, "[]") // IPv6
+		networkAddr := caddy.JoinNetworkAddress(network, host, lnPort)
+		addr, err := caddy.ParseNetworkAddress(networkAddr)
+		if err != nil {
+			return nil, fmt.Errorf("parsing network address: %v", err)
+		}
+		listeners[addr.String()] = struct{}{}
 	}
 
-	return listeners, nil
+	// now turn map into list
-}
+	listenersList := make([]string, 0, len(listeners))
+	for lnStr := range listeners {
+		listenersList = append(listenersList, lnStr)
+	}
+	sort.Strings(listenersList)
 
-// addressesWithProtocols associates a list of listen addresses
+	return listenersList, nil
-// with a list of protocols to serve them with
-type addressesWithProtocols struct {
-	addresses []string
-	protocols []string
 }
 
 // Address represents a site address. It contains

caddyconfig/httpcaddyfile/builtins_test.go

@@ -25,12 +25,11 @@ func TestLogDirectiveSyntax(t *testing.T) {
 		{
 			input: `:8080 {
 				log {
-					core mock
 					output file foo.log
 				}
 			}
 			`,
-			output:      `{"logging":{"logs":{"default":{"exclude":["http.log.access.log0"]},"log0":{"writer":{"filename":"foo.log","output":"file"},"core":{"module":"mock"},"include":["http.log.access.log0"]}}},"apps":{"http":{"servers":{"srv0":{"listen":[":8080"],"logs":{"default_logger_name":"log0"}}}}}}`,
+			output:      `{"logging":{"logs":{"default":{"exclude":["http.log.access.log0"]},"log0":{"writer":{"filename":"foo.log","output":"file"},"include":["http.log.access.log0"]}}},"apps":{"http":{"servers":{"srv0":{"listen":[":8080"],"logs":{"default_logger_name":"log0"}}}}}}`,
 			expectError: false,
 		},
 		{
@@ -53,28 +52,12 @@ func TestLogDirectiveSyntax(t *testing.T) {
 		},
 		{
 			input: `:8080 {
-				log name-override {
+				log invalid {
-					core mock
 					output file foo.log
 				}
 			}
 			`,
-			output:      `{"logging":{"logs":{"default":{"exclude":["http.log.access.name-override"]},"name-override":{"writer":{"filename":"foo.log","output":"file"},"core":{"module":"mock"},"include":["http.log.access.name-override"]}}},"apps":{"http":{"servers":{"srv0":{"listen":[":8080"],"logs":{"default_logger_name":"name-override"}}}}}}`,
+			expectError: true,
-			expectError: false,
-		},
-		{
-			input: `:8080 {
-				log {
-					sampling {
-						interval 2
-						first 3
-						thereafter 4
-					}
-				}
-			}
-			`,
-			output:      `{"logging":{"logs":{"default":{"exclude":["http.log.access.log0"]},"log0":{"sampling":{"interval":2,"first":3,"thereafter":4},"include":["http.log.access.log0"]}}},"apps":{"http":{"servers":{"srv0":{"listen":[":8080"],"logs":{"default_logger_name":"log0"}}}}}}`,
-			expectError: false,
 		},
 	} {
 
@@ -294,76 +277,3 @@ func TestImportErrorLine(t *testing.T) {
 		}
 	}
 }
-
-func TestNestedImport(t *testing.T) {
-	for i, tc := range []struct {
-		input     string
-		errorFunc func(err error) bool
-	}{
-		{
-			input: `(t1) {
-						respond {args[0]} {args[1]}
-					}
-					
-					(t2) {
-						import t1 {args[0]} 202
-					}
-					
-					:8080 {
-						handle {
-							import t2 "foobar"
-						}
-					}`,
-			errorFunc: func(err error) bool {
-				return err == nil
-			},
-		},
-		{
-			input: `(t1) {
-						respond {args[:]}
-					}
-					
-					(t2) {
-						import t1 {args[0]} {args[1]}
-					}
-					
-					:8080 {
-						handle {
-							import t2 "foobar" 202
-						}
-					}`,
-			errorFunc: func(err error) bool {
-				return err == nil
-			},
-		},
-		{
-			input: `(t1) {
-						respond {args[0]} {args[1]}
-					}
-					
-					(t2) {
-						import t1 {args[:]}
-					}
-					
-					:8080 {
-						handle {
-							import t2 "foobar" 202
-						}
-					}`,
-			errorFunc: func(err error) bool {
-				return err == nil
-			},
-		},
-	} {
-		adapter := caddyfile.Adapter{
-			ServerType: ServerType{},
-		}
-
-		_, _, err := adapter.Adapt([]byte(tc.input), nil)
-
-		if !tc.errorFunc(err) {
-			t.Errorf("Test %d error expectation failed, got %s", i, err)
-			continue
-		}
-	}
-}

caddyconfig/httpcaddyfile/directives.go

@@ -17,7 +17,6 @@ package httpcaddyfile
 import (
 	"encoding/json"
 	"net"
-	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -28,33 +27,22 @@ import (
 	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
 )
 
-// defaultDirectiveOrder specifies the default order
+// directiveOrder specifies the order
-// to apply directives in HTTP routes. This must only
+// to apply directives in HTTP routes.
-// consist of directives that are included in Caddy's
-// standard distribution.
 //
-// e.g. The 'root' directive goes near the start in
+// The root directive goes first in case rewrites or
-// case rewrites or redirects depend on existence of
+// redirects depend on existence of files, i.e. the
-// files, i.e. the file matcher, which must know the
+// file matcher, which must know the root first.
-// root first.
 //
-// e.g. The 'header' directive goes before 'redir' so
+// The header directive goes second so that headers
-// that headers can be manipulated before doing redirects.
+// can be manipulated before doing redirects.
-//
+var directiveOrder = []string{
-// e.g. The 'respond' directive is near the end because it
-// writes a response and terminates the middleware chain.
-var defaultDirectiveOrder = []string{
 	"tracing",
 
-	// set variables that may be used by other directives
 	"map",
 	"vars",
-	"fs",
 	"root",
-	"log_append",
+	"skip_log",
-	"skip_log", // TODO: deprecated, renamed to log_skip
-	"log_skip",
-	"log_name",
 
 	"header",
 	"copy_response_headers", // only in reverse_proxy's handle_response
@@ -69,13 +57,11 @@ var defaultDirectiveOrder = []string{
 	"try_files",
 
 	// middleware handlers; some wrap responses
-	"basicauth", // TODO: deprecated, renamed to basic_auth
+	"basicauth",
-	"basic_auth",
 	"forward_auth",
 	"request_header",
 	"encode",
 	"push",
-	"intercept",
 	"templates",
 
 	// special routing & dispatching directives
@@ -96,10 +82,16 @@ var defaultDirectiveOrder = []string{
 	"acme_server",
 }
 
-// directiveOrder specifies the order to apply directives
+// directiveIsOrdered returns true if dir is
-// in HTTP routes, after being modified by either the
+// a known, ordered (sorted) directive.
-// plugins or by the user via the "order" global option.
+func directiveIsOrdered(dir string) bool {
-var directiveOrder = defaultDirectiveOrder
+	for _, d := range directiveOrder {
+		if d == dir {
+			return true
+		}
+	}
+	return false
+}
 
 // RegisterDirective registers a unique directive dir with an
 // associated unmarshaling (setup) function. When directive dir
@@ -136,53 +128,6 @@ func RegisterHandlerDirective(dir string, setupFunc UnmarshalHandlerFunc) {
 	})
 }
 
-// RegisterDirectiveOrder registers the default order for a
-// directive from a plugin.
-//
-// This is useful when a plugin has a well-understood place
-// it should run in the middleware pipeline, and it allows
-// users to avoid having to define the order themselves.
-//
-// The directive dir may be placed in the position relative
-// to ('before' or 'after') a directive included in Caddy's
-// standard distribution. It cannot be relative to another
-// plugin's directive.
-//
-// EXPERIMENTAL: This API may change or be removed.
-func RegisterDirectiveOrder(dir string, position Positional, standardDir string) {
-	// check if directive was already ordered
-	if slices.Contains(directiveOrder, dir) {
-		panic("directive '" + dir + "' already ordered")
-	}
-
-	if position != Before && position != After {
-		panic("the 2nd argument must be either 'before' or 'after', got '" + position + "'")
-	}
-
-	// check if directive exists in standard distribution, since
-	// we can't allow plugins to depend on one another; we can't
-	// guarantee the order that plugins are loaded in.
-	foundStandardDir := slices.Contains(defaultDirectiveOrder, standardDir)
-	if !foundStandardDir {
-		panic("the 3rd argument '" + standardDir + "' must be a directive that exists in the standard distribution of Caddy")
-	}
-
-	// insert directive into proper position
-	newOrder := directiveOrder
-	for i, d := range newOrder {
-		if d != standardDir {
-			continue
-		}
-		if position == Before {
-			newOrder = append(newOrder[:i], append([]string{dir}, newOrder[i:]...)...)
-		} else if position == After {
-			newOrder = append(newOrder[:i+1], append([]string{dir}, newOrder[i+1:]...)...)
-		}
-		break
-	}
-	directiveOrder = newOrder
-}
-
 // RegisterGlobalOption registers a unique global option opt with
 // an associated unmarshaling (setup) function. When the global
 // option opt is encountered in a Caddyfile, setupFunc will be
@@ -272,8 +217,7 @@ func (h Helper) ExtractMatcherSet() (caddy.ModuleMap, error) {
 
 // NewRoute returns config values relevant to creating a new HTTP route.
 func (h Helper) NewRoute(matcherSet caddy.ModuleMap,
-	handler caddyhttp.MiddlewareHandler,
+	handler caddyhttp.MiddlewareHandler) []ConfigValue {
-) []ConfigValue {
 	mod, err := caddy.GetModule(caddy.GetModuleID(handler))
 	if err != nil {
 		*h.warnings = append(*h.warnings, caddyconfig.Warning{
@@ -325,6 +269,12 @@ func (h Helper) GroupRoutes(vals []ConfigValue) {
 	}
 }
 
+// NewBindAddresses returns config values relevant to adding
+// listener bind addresses to the config.
+func (h Helper) NewBindAddresses(addrs []string) []ConfigValue {
+	return []ConfigValue{{Class: "bind", Value: addrs}}
+}
+
 // WithDispenser returns a new instance based on d. All others Helper
 // fields are copied, so typically maps are shared with this new instance.
 func (h Helper) WithDispenser(d *caddyfile.Dispenser) Helper {
@@ -516,9 +466,9 @@ func sortRoutes(routes []ConfigValue) {
 // a "pile" of config values, keyed by class name,
 // as well as its parsed keys for convenience.
 type serverBlock struct {
-	block      caddyfile.ServerBlock
+	block caddyfile.ServerBlock
-	pile       map[string][]ConfigValue // config values obtained from directives
+	pile  map[string][]ConfigValue // config values obtained from directives
-	parsedKeys []Address
+	keys  []Address
 }
 
 // hostsFromKeys returns a list of all the non-empty hostnames found in
@@ -535,7 +485,7 @@ type serverBlock struct {
 func (sb serverBlock) hostsFromKeys(loggerMode bool) []string {
 	// ensure each entry in our list is unique
 	hostMap := make(map[string]struct{})
-	for _, addr := range sb.parsedKeys {
+	for _, addr := range sb.keys {
 		if addr.Host == "" {
 			if !loggerMode {
 				// server block contains a key like ":443", i.e. the host portion
@@ -567,7 +517,7 @@ func (sb serverBlock) hostsFromKeys(loggerMode bool) []string {
 func (sb serverBlock) hostsFromKeysNotHTTP(httpPort string) []string {
 	// ensure each entry in our list is unique
 	hostMap := make(map[string]struct{})
-	for _, addr := range sb.parsedKeys {
+	for _, addr := range sb.keys {
 		if addr.Host == "" {
 			continue
 		}
@@ -588,29 +538,25 @@ func (sb serverBlock) hostsFromKeysNotHTTP(httpPort string) []string {
 // hasHostCatchAllKey returns true if sb has a key that
 // omits a host portion, i.e. it "catches all" hosts.
 func (sb serverBlock) hasHostCatchAllKey() bool {
-	return slices.ContainsFunc(sb.parsedKeys, func(addr Address) bool {
+	for _, addr := range sb.keys {
-		return addr.Host == ""
+		if addr.Host == "" {
-	})
+			return true
+		}
+	}
+	return false
 }
 
 // isAllHTTP returns true if all sb keys explicitly specify
 // the http:// scheme
 func (sb serverBlock) isAllHTTP() bool {
-	return !slices.ContainsFunc(sb.parsedKeys, func(addr Address) bool {
+	for _, addr := range sb.keys {
-		return addr.Scheme != "http"
+		if addr.Scheme != "http" {
-	})
+			return false
+		}
+	}
+	return true
 }
 
-// Positional are the supported modes for ordering directives.
-type Positional string
-
-const (
-	Before Positional = "before"
-	After  Positional = "after"
-	First  Positional = "first"
-	Last   Positional = "last"
-)
-
 type (
 	// UnmarshalFunc is a function which can unmarshal Caddyfile
 	// tokens into zero or more config values using a Helper type.

caddyconfig/httpcaddyfile/directives_test.go

@@ -31,23 +31,20 @@ func TestHostsFromKeys(t *testing.T) {
 			[]Address{
 				{Original: ":2015", Port: "2015"},
 			},
-			[]string{},
+			[]string{}, []string{},
-			[]string{},
 		},
 		{
 			[]Address{
 				{Original: ":443", Port: "443"},
 			},
-			[]string{},
+			[]string{}, []string{},
-			[]string{},
 		},
 		{
 			[]Address{
 				{Original: "foo", Host: "foo"},
 				{Original: ":2015", Port: "2015"},
 			},
-			[]string{},
+			[]string{}, []string{"foo"},
-			[]string{"foo"},
 		},
 		{
 			[]Address{
@@ -78,7 +75,7 @@ func TestHostsFromKeys(t *testing.T) {
 			[]string{"example.com:2015"},
 		},
 	} {
-		sb := serverBlock{parsedKeys: tc.keys}
+		sb := serverBlock{keys: tc.keys}
 
 		// test in normal mode
 		actual := sb.hostsFromKeys(false)

caddyconfig/httpcaddyfile/httptype.go

@@ -15,24 +15,21 @@
 package httpcaddyfile
 
 import (
-	"cmp"
 	"encoding/json"
 	"fmt"
-	"net"
 	"reflect"
-	"slices"
+	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 
-	"go.uber.org/zap"
-
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
 	"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
 	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
 	"github.com/caddyserver/caddy/v2/modules/caddypki"
 	"github.com/caddyserver/caddy/v2/modules/caddytls"
+	"go.uber.org/zap"
 )
 
 func init() {
@@ -51,7 +48,8 @@ type App struct {
 }
 
 // ServerType can set up a config from an HTTP Caddyfile.
-type ServerType struct{}
+type ServerType struct {
+}
 
 // Setup makes a config from the tokens.
 func (st ServerType) Setup(
@@ -66,11 +64,8 @@ func (st ServerType) Setup(
 	originalServerBlocks := make([]serverBlock, 0, len(inputServerBlocks))
 	for _, sblock := range inputServerBlocks {
 		for j, k := range sblock.Keys {
-			if j == 0 && strings.HasPrefix(k.Text, "@") {
+			if j == 0 && strings.HasPrefix(k, "@") {
-				return nil, warnings, fmt.Errorf("%s:%d: cannot define a matcher outside of a site block: '%s'", k.File, k.Line, k.Text)
+				return nil, warnings, fmt.Errorf("cannot define a matcher outside of a site block: '%s'", k)
-			}
-			if _, ok := registeredDirectives[k.Text]; ok {
-				return nil, warnings, fmt.Errorf("%s:%d: parsed '%s' as a site address, but it is a known directive; directives must appear in a site block", k.File, k.Line, k.Text)
 			}
 		}
 		originalServerBlocks = append(originalServerBlocks, serverBlock{
@@ -86,18 +81,46 @@ func (st ServerType) Setup(
 		return nil, warnings, err
 	}
 
-	// this will replace both static and user-defined placeholder shorthands
+	originalServerBlocks, err = st.extractNamedRoutes(originalServerBlocks, options, &warnings)
-	// with actual identifiers used by Caddy
-	replacer := NewShorthandReplacer()
-
-	originalServerBlocks, err = st.extractNamedRoutes(originalServerBlocks, options, &warnings, replacer)
 	if err != nil {
 		return nil, warnings, err
 	}
 
+	// replace shorthand placeholders (which are convenient
+	// when writing a Caddyfile) with their actual placeholder
+	// identifiers or variable names
+	replacer := strings.NewReplacer(placeholderShorthands()...)
+
+	// these are placeholders that allow a user-defined final
+	// parameters, but we still want to provide a shorthand
+	// for those, so we use a regexp to replace
+	regexpReplacements := []struct {
+		search  *regexp.Regexp
+		replace string
+	}{
+		{regexp.MustCompile(`{header\.([\w-]*)}`), "{http.request.header.$1}"},
+		{regexp.MustCompile(`{cookie\.([\w-]*)}`), "{http.request.cookie.$1}"},
+		{regexp.MustCompile(`{labels\.([\w-]*)}`), "{http.request.host.labels.$1}"},
+		{regexp.MustCompile(`{path\.([\w-]*)}`), "{http.request.uri.path.$1}"},
+		{regexp.MustCompile(`{file\.([\w-]*)}`), "{http.request.uri.path.file.$1}"},
+		{regexp.MustCompile(`{query\.([\w-]*)}`), "{http.request.uri.query.$1}"},
+		{regexp.MustCompile(`{re\.([\w-]*)\.([\w-]*)}`), "{http.regexp.$1.$2}"},
+		{regexp.MustCompile(`{vars\.([\w-]*)}`), "{http.vars.$1}"},
+		{regexp.MustCompile(`{rp\.([\w-\.]*)}`), "{http.reverse_proxy.$1}"},
+		{regexp.MustCompile(`{err\.([\w-\.]*)}`), "{http.error.$1}"},
+		{regexp.MustCompile(`{file_match\.([\w-]*)}`), "{http.matchers.file.$1}"},
+	}
+
 	for _, sb := range originalServerBlocks {
-		for i := range sb.block.Segments {
+		for _, segment := range sb.block.Segments {
-			replacer.ApplyToSegment(&sb.block.Segments[i])
+			for i := 0; i < len(segment); i++ {
+				// simple string replacements
+				segment[i].Text = replacer.Replace(segment[i].Text)
+				// complex regexp replacements
+				for _, r := range regexpReplacements {
+					segment[i].Text = r.search.ReplaceAllString(segment[i].Text, r.replace)
+				}
+			}
 		}
 
 		if len(sb.block.Keys) == 0 {
@@ -172,7 +195,7 @@ func (st ServerType) Setup(
 	}
 
 	// map
-	sbmap, err := st.mapAddressToProtocolToServerBlocks(originalServerBlocks, options)
+	sbmap, err := st.mapAddressToServerBlocks(originalServerBlocks, options)
 	if err != nil {
 		return nil, warnings, err
 	}
@@ -187,25 +210,12 @@ func (st ServerType) Setup(
 		return nil, warnings, err
 	}
 
-	// hoist the metrics config from per-server to global
-	metrics, _ := options["metrics"].(*caddyhttp.Metrics)
-	for _, s := range servers {
-		if s.Metrics != nil {
-			metrics = cmp.Or(metrics, &caddyhttp.Metrics{})
-			metrics = &caddyhttp.Metrics{
-				PerHost: metrics.PerHost || s.Metrics.PerHost,
-			}
-			s.Metrics = nil // we don't need it anymore
-		}
-	}
-
 	// now that each server is configured, make the HTTP app
 	httpApp := caddyhttp.App{
 		HTTPPort:      tryInt(options["http_port"], &warnings),
 		HTTPSPort:     tryInt(options["https_port"], &warnings),
 		GracePeriod:   tryDuration(options["grace_period"], &warnings),
 		ShutdownDelay: tryDuration(options["shutdown_delay"], &warnings),
-		Metrics:       metrics,
 		Servers:       servers,
 	}
 
@@ -231,7 +241,7 @@ func (st ServerType) Setup(
 		if ncl.name == caddy.DefaultLoggerName {
 			hasDefaultLog = true
 		}
-		if _, ok := options["debug"]; ok && ncl.log != nil && ncl.log.Level == "" {
+		if _, ok := options["debug"]; ok && ncl.log.Level == "" {
 			ncl.log.Level = zap.DebugLevel.CapitalString()
 		}
 		customLogs = append(customLogs, ncl)
@@ -288,12 +298,6 @@ func (st ServerType) Setup(
 	if !reflect.DeepEqual(pkiApp, &caddypki.PKI{CAs: make(map[string]*caddypki.CA)}) {
 		cfg.AppsRaw["pki"] = caddyconfig.JSON(pkiApp, &warnings)
 	}
-	if filesystems, ok := options["filesystem"].(caddy.Module); ok {
-		cfg.AppsRaw["caddy.filesystems"] = caddyconfig.JSON(
-			filesystems,
-			&warnings)
-	}
-
 	if storageCvtr, ok := options["storage"].(caddy.StorageConverter); ok {
 		cfg.StorageRaw = caddyconfig.JSONModuleObject(storageCvtr,
 			"module",
@@ -303,6 +307,7 @@ func (st ServerType) Setup(
 	if adminConfig, ok := options["admin"].(*caddy.AdminConfig); ok && adminConfig != nil {
 		cfg.Admin = adminConfig
 	}
+
 	if pc, ok := options["persist_config"].(string); ok && pc == "off" {
 		if cfg.Admin == nil {
 			cfg.Admin = new(caddy.AdminConfig)
@@ -319,21 +324,7 @@ func (st ServerType) Setup(
 				Logs: make(map[string]*caddy.CustomLog),
 			}
 		}
-
-		// Add the default log first if defined, so that it doesn't
-		// accidentally get re-created below due to the Exclude logic
 		for _, ncl := range customLogs {
-			if ncl.name == caddy.DefaultLoggerName && ncl.log != nil {
-				cfg.Logging.Logs[caddy.DefaultLoggerName] = ncl.log
-				break
-			}
-		}
-
-		// Add the rest of the custom logs
-		for _, ncl := range customLogs {
-			if ncl.log == nil || ncl.name == caddy.DefaultLoggerName {
-				continue
-			}
 			if ncl.name != "" {
 				cfg.Logging.Logs[ncl.name] = ncl.log
 			}
@@ -347,16 +338,8 @@ func (st ServerType) Setup(
 					cfg.Logging.Logs[caddy.DefaultLoggerName] = defaultLog
 				}
 				defaultLog.Exclude = append(defaultLog.Exclude, ncl.log.Include...)
-
-				// avoid duplicates by sorting + compacting
-				sort.Strings(defaultLog.Exclude)
-				defaultLog.Exclude = slices.Compact(defaultLog.Exclude)
 			}
 		}
-		// we may have not actually added anything, so remove if empty
-		if len(cfg.Logging.Logs) == 0 {
-			cfg.Logging = nil
-		}
 	}
 
 	return cfg, warnings, nil
@@ -416,20 +399,6 @@ func (ServerType) evaluateGlobalOptionsBlock(serverBlocks []serverBlock, options
 			options[opt] = append(existingOpts, logOpts...)
 			continue
 		}
-		// Also fold multiple "default_bind" options together into an
-		// array so that server blocks can have multiple binds by default.
-		if opt == "default_bind" {
-			existingOpts, ok := options[opt].([]ConfigValue)
-			if !ok {
-				existingOpts = []ConfigValue{}
-			}
-			defaultBindOpts, ok := val.([]ConfigValue)
-			if !ok {
-				return nil, fmt.Errorf("unexpected type from 'default_bind' global options: %T", val)
-			}
-			options[opt] = append(existingOpts, defaultBindOpts...)
-			continue
-		}
 
 		options[opt] = val
 	}
@@ -460,7 +429,6 @@ func (ServerType) extractNamedRoutes(
 	serverBlocks []serverBlock,
 	options map[string]any,
 	warnings *[]caddyconfig.Warning,
-	replacer ShorthandReplacer,
 ) ([]serverBlock, error) {
 	namedRoutes := map[string]*caddyhttp.Route{}
 
@@ -486,14 +454,11 @@ func (ServerType) extractNamedRoutes(
 			continue
 		}
 
+		// zip up all the segments since ParseSegmentAsSubroute
+		// was designed to take a directive+
 		wholeSegment := caddyfile.Segment{}
-		for i := range sb.block.Segments {
+		for _, segment := range sb.block.Segments {
-			// replace user-defined placeholder shorthands in extracted named routes
+			wholeSegment = append(wholeSegment, segment...)
-			replacer.ApplyToSegment(&sb.block.Segments[i])
-
-			// zip up all the segments since ParseSegmentAsSubroute
-			// was designed to take a directive+
-			wholeSegment = append(wholeSegment, sb.block.Segments[i]...)
 		}
 
 		h := Helper{
@@ -521,7 +486,7 @@ func (ServerType) extractNamedRoutes(
 			route.HandlersRaw = []json.RawMessage{caddyconfig.JSONModuleObject(handler, "handler", subroute.CaddyModule().ID.Name(), h.warnings)}
 		}
 
-		namedRoutes[sb.block.GetKeysText()[0]] = &route
+		namedRoutes[sb.block.Keys[0]] = &route
 	}
 	options["named_routes"] = namedRoutes
 
@@ -548,8 +513,8 @@ func (st *ServerType) serversFromPairings(
 	if hsp, ok := options["https_port"].(int); ok {
 		httpsPort = strconv.Itoa(hsp)
 	}
-	autoHTTPS := []string{}
+	autoHTTPS := "on"
-	if ah, ok := options["auto_https"].([]string); ok {
+	if ah, ok := options["auto_https"].(string); ok {
 		autoHTTPS = ah
 	}
 
@@ -559,79 +524,33 @@ func (st *ServerType) serversFromPairings(
 		// address), otherwise their routes will improperly be added
 		// to the same server (see issue #4635)
 		for j, sblock1 := range p.serverBlocks {
-			for _, key := range sblock1.block.GetKeysText() {
+			for _, key := range sblock1.block.Keys {
 				for k, sblock2 := range p.serverBlocks {
 					if k == j {
 						continue
 					}
-					if slices.Contains(sblock2.block.GetKeysText(), key) {
+					if sliceContains(sblock2.block.Keys, key) {
 						return nil, fmt.Errorf("ambiguous site definition: %s", key)
 					}
 				}
 			}
 		}
 
-		var (
-			addresses []string
-			protocols [][]string
-		)
-
-		for _, addressWithProtocols := range p.addressesWithProtocols {
-			addresses = append(addresses, addressWithProtocols.address)
-			protocols = append(protocols, addressWithProtocols.protocols)
-		}
-
 		srv := &caddyhttp.Server{
-			Listen:          addresses,
+			Listen: p.addresses,
-			ListenProtocols: protocols,
-		}
-
-		// remove srv.ListenProtocols[j] if it only contains the default protocols
-		for j, lnProtocols := range srv.ListenProtocols {
-			srv.ListenProtocols[j] = nil
-			for _, lnProtocol := range lnProtocols {
-				if lnProtocol != "" {
-					srv.ListenProtocols[j] = lnProtocols
-					break
-				}
-			}
-		}
-
-		// remove srv.ListenProtocols if it only contains the default protocols for all listen addresses
-		listenProtocols := srv.ListenProtocols
-		srv.ListenProtocols = nil
-		for _, lnProtocols := range listenProtocols {
-			if lnProtocols != nil {
-				srv.ListenProtocols = listenProtocols
-				break
-			}
 		}
 
 		// handle the auto_https global option
-		for _, val := range autoHTTPS {
+		if autoHTTPS != "on" {
-			switch val {
+			srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig)
+			switch autoHTTPS {
 			case "off":
-				if srv.AutoHTTPS == nil {
-					srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig)
-				}
 				srv.AutoHTTPS.Disabled = true
-
 			case "disable_redirects":
-				if srv.AutoHTTPS == nil {
-					srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig)
-				}
 				srv.AutoHTTPS.DisableRedir = true
-
 			case "disable_certs":
-				if srv.AutoHTTPS == nil {
-					srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig)
-				}
 				srv.AutoHTTPS.DisableCerts = true
-
 			case "ignore_loaded_certs":
-				if srv.AutoHTTPS == nil {
-					srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig)
-				}
 				srv.AutoHTTPS.IgnoreLoadedCerts = true
 			}
 		}
@@ -640,7 +559,7 @@ func (st *ServerType) serversFromPairings(
 		// See ParseAddress() where parsing should later reject paths
 		// See https://github.com/caddyserver/caddy/pull/4728 for a full explanation
 		for _, sblock := range p.serverBlocks {
-			for _, addr := range sblock.parsedKeys {
+			for _, addr := range sblock.keys {
 				if addr.Path != "" {
 					caddy.Log().Named("caddyfile").Warn("Using a path in a site address is deprecated; please use the 'handle' directive instead", zap.String("address", addr.String()))
 				}
@@ -658,7 +577,7 @@ func (st *ServerType) serversFromPairings(
 			var iLongestPath, jLongestPath string
 			var iLongestHost, jLongestHost string
 			var iWildcardHost, jWildcardHost bool
-			for _, addr := range p.serverBlocks[i].parsedKeys {
+			for _, addr := range p.serverBlocks[i].keys {
 				if strings.Contains(addr.Host, "*") || addr.Host == "" {
 					iWildcardHost = true
 				}
@@ -669,7 +588,7 @@ func (st *ServerType) serversFromPairings(
 					iLongestPath = addr.Path
 				}
 			}
-			for _, addr := range p.serverBlocks[j].parsedKeys {
+			for _, addr := range p.serverBlocks[j].keys {
 				if strings.Contains(addr.Host, "*") || addr.Host == "" {
 					jWildcardHost = true
 				}
@@ -701,7 +620,7 @@ func (st *ServerType) serversFromPairings(
 		})
 
 		var hasCatchAllTLSConnPolicy, addressQualifiesForTLS bool
-		autoHTTPSWillAddConnPolicy := srv.AutoHTTPS == nil || !srv.AutoHTTPS.Disabled
+		autoHTTPSWillAddConnPolicy := autoHTTPS != "off"
 
 		// if needed, the ServerLogConfig is initialized beforehand so
 		// that all server blocks can populate it with data, even when not
@@ -747,14 +666,6 @@ func (st *ServerType) serversFromPairings(
 				}
 			}
 
-			// collect hosts that are forced to be automated
-			forceAutomatedNames := make(map[string]struct{})
-			if _, ok := sblock.pile["tls.force_automate"]; ok {
-				for _, host := range hosts {
-					forceAutomatedNames[host] = struct{}{}
-				}
-			}
-
 			// tls: connection policies
 			if cpVals, ok := sblock.pile["tls.connection_policy"]; ok {
 				// tls connection policies
@@ -776,7 +687,6 @@ func (st *ServerType) serversFromPairings(
 					}
 
 					if len(hosts) > 0 {
-						slices.Sort(hosts) // for deterministic JSON output
 						cp.MatchersRaw = caddy.ModuleMap{
 							"sni": caddyconfig.JSON(hosts, warnings), // make sure to match all hosts, not just auto-HTTPS-qualified ones
 						}
@@ -785,21 +695,15 @@ func (st *ServerType) serversFromPairings(
 						cp.FallbackSNI = fallbackSNI
 					}
 
-					// only append this policy if it actually changes something,
+					// only append this policy if it actually changes something
-					// or if the configuration explicitly automates certs for
+					if !cp.SettingsEmpty() {
-					// these names (this is necessary to hoist a connection policy
-					// above one that may manually load a wildcard cert that would
-					// otherwise clobber the automated one; the code that appends
-					// policies that manually load certs comes later, so they're
-					// lower in the list)
-					if !cp.SettingsEmpty() || mapContains(forceAutomatedNames, hosts) {
 						srv.TLSConnPolicies = append(srv.TLSConnPolicies, cp)
 						hasCatchAllTLSConnPolicy = len(hosts) == 0
 					}
 				}
 			}
 
-			for _, addr := range sblock.parsedKeys {
+			for _, addr := range sblock.keys {
 				// if server only uses HTTP port, auto-HTTPS will not apply
 				if listenersUseAnyPortOtherThan(srv.Listen, httpPort) {
 					// exclude any hosts that were defined explicitly with "http://"
@@ -808,29 +712,18 @@ func (st *ServerType) serversFromPairings(
 						if srv.AutoHTTPS == nil {
 							srv.AutoHTTPS = new(caddyhttp.AutoHTTPSConfig)
 						}
-						if !slices.Contains(srv.AutoHTTPS.Skip, addr.Host) {
+						if !sliceContains(srv.AutoHTTPS.Skip, addr.Host) {
 							srv.AutoHTTPS.Skip = append(srv.AutoHTTPS.Skip, addr.Host)
 						}
 					}
 				}
 
-				// If TLS is specified as directive, it will also result in 1 or more connection policy being created
-				// Thus, catch-all address with non-standard port, e.g. :8443, can have TLS enabled without
-				// specifying prefix "https://"
-				// Second part of the condition is to allow creating TLS conn policy even though `auto_https` has been disabled
-				// ensuring compatibility with behavior described in below link
-				// https://caddy.community/t/making-sense-of-auto-https-and-why-disabling-it-still-serves-https-instead-of-http/9761
-				createdTLSConnPolicies, ok := sblock.pile["tls.connection_policy"]
-				hasTLSEnabled := (ok && len(createdTLSConnPolicies) > 0) ||
-					(addr.Host != "" && srv.AutoHTTPS != nil && !slices.Contains(srv.AutoHTTPS.Skip, addr.Host))
-
 				// we'll need to remember if the address qualifies for auto-HTTPS, so we
 				// can add a TLS conn policy if necessary
 				if addr.Scheme == "https" ||
-					(addr.Scheme != "http" && addr.Port != httpPort && hasTLSEnabled) {
+					(addr.Scheme != "http" && addr.Host != "" && addr.Port != httpPort) {
 					addressQualifiesForTLS = true
 				}
-
 				// predict whether auto-HTTPS will add the conn policy for us; if so, we
 				// may not need to add one for this server
 				autoHTTPSWillAddConnPolicy = autoHTTPSWillAddConnPolicy &&
@@ -866,19 +759,10 @@ func (st *ServerType) serversFromPairings(
 				if srv.Errors == nil {
 					srv.Errors = new(caddyhttp.HTTPErrorConfig)
 				}
-				sort.SliceStable(errorSubrouteVals, func(i, j int) bool {
-					sri, srj := errorSubrouteVals[i].Value.(*caddyhttp.Subroute), errorSubrouteVals[j].Value.(*caddyhttp.Subroute)
-					if len(sri.Routes[0].MatcherSetsRaw) == 0 && len(srj.Routes[0].MatcherSetsRaw) != 0 {
-						return false
-					}
-					return true
-				})
-				errorsSubroute := &caddyhttp.Subroute{}
 				for _, val := range errorSubrouteVals {
 					sr := val.Value.(*caddyhttp.Subroute)
-					errorsSubroute.Routes = append(errorsSubroute.Routes, sr.Routes...)
+					srv.Errors.Routes = appendSubrouteToRouteList(srv.Errors.Routes, sr, matcherSetsEnc, p, warnings)
 				}
-				srv.Errors.Routes = appendSubrouteToRouteList(srv.Errors.Routes, errorsSubroute, matcherSetsEnc, p, warnings)
 			}
 
 			// add log associations
@@ -886,39 +770,17 @@ func (st *ServerType) serversFromPairings(
 			sblockLogHosts := sblock.hostsFromKeys(true)
 			for _, cval := range sblock.pile["custom_log"] {
 				ncl := cval.Value.(namedCustomLog)
-
+				if sblock.hasHostCatchAllKey() {
-				// if `no_hostname` is set, then this logger will not
-				// be associated with any of the site block's hostnames,
-				// and only be usable via the `log_name` directive
-				// or the `access_logger_names` variable
-				if ncl.noHostname {
-					continue
-				}
-
-				if sblock.hasHostCatchAllKey() && len(ncl.hostnames) == 0 {
 					// all requests for hosts not able to be listed should use
 					// this log because it's a catch-all-hosts server block
 					srv.Logs.DefaultLoggerName = ncl.name
-				} else if len(ncl.hostnames) > 0 {
-					// if the logger overrides the hostnames, map that to the logger name
-					for _, h := range ncl.hostnames {
-						if srv.Logs.LoggerNames == nil {
-							srv.Logs.LoggerNames = make(map[string]caddyhttp.StringArray)
-						}
-						srv.Logs.LoggerNames[h] = append(srv.Logs.LoggerNames[h], ncl.name)
-					}
 				} else {
-					// otherwise, map each host to the logger name
+					// map each host to the user's desired logger name
 					for _, h := range sblockLogHosts {
-						// strip the port from the host, if any
-						host, _, err := net.SplitHostPort(h)
-						if err != nil {
-							host = h
-						}
 						if srv.Logs.LoggerNames == nil {
-							srv.Logs.LoggerNames = make(map[string]caddyhttp.StringArray)
+							srv.Logs.LoggerNames = make(map[string]string)
 						}
-						srv.Logs.LoggerNames[host] = append(srv.Logs.LoggerNames[host], ncl.name)
+						srv.Logs.LoggerNames[h] = ncl.name
 					}
 				}
 			}
@@ -935,11 +797,6 @@ func (st *ServerType) serversFromPairings(
 			}
 		}
 
-		// sort for deterministic JSON output
-		if srv.Logs != nil {
-			slices.Sort(srv.Logs.SkipHosts)
-		}
-
 		// a server cannot (natively) serve both HTTP and HTTPS at the
 		// same time, so make sure the configuration isn't in conflict
 		err := detectConflictingSchemes(srv, p.serverBlocks, options)
@@ -962,10 +819,7 @@ func (st *ServerType) serversFromPairings(
 		if addressQualifiesForTLS &&
 			!hasCatchAllTLSConnPolicy &&
 			(len(srv.TLSConnPolicies) > 0 || !autoHTTPSWillAddConnPolicy || defaultSNI != "" || fallbackSNI != "") {
-			srv.TLSConnPolicies = append(srv.TLSConnPolicies, &caddytls.ConnectionPolicy{
+			srv.TLSConnPolicies = append(srv.TLSConnPolicies, &caddytls.ConnectionPolicy{DefaultSNI: defaultSNI, FallbackSNI: fallbackSNI})
-				DefaultSNI:  defaultSNI,
-				FallbackSNI: fallbackSNI,
-			})
 		}
 
 		// tidy things up a bit
@@ -978,7 +832,8 @@ func (st *ServerType) serversFromPairings(
 		servers[fmt.Sprintf("srv%d", i)] = srv
 	}
 
-	if err := applyServerOptions(servers, options, warnings); err != nil {
+	err := applyServerOptions(servers, options, warnings)
+	if err != nil {
 		return nil, fmt.Errorf("applying global server options: %v", err)
 	}
 
@@ -1023,7 +878,7 @@ func detectConflictingSchemes(srv *caddyhttp.Server, serverBlocks []serverBlock,
 	}
 
 	for _, sblock := range serverBlocks {
-		for _, addr := range sblock.parsedKeys {
+		for _, addr := range sblock.keys {
 			if addr.Scheme == "http" || addr.Port == httpPort {
 				if err := checkAndSetHTTP(addr); err != nil {
 					return err
@@ -1061,40 +916,11 @@ func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.Connecti
 
 			// if they're exactly equal in every way, just keep one of them
 			if reflect.DeepEqual(cps[i], cps[j]) {
-				cps = slices.Delete(cps, j, j+1)
+				cps = append(cps[:j], cps[j+1:]...)
 				i--
 				break
 			}
 
-			// as a special case, if there are adjacent TLS conn policies that are identical except
-			// by their matchers, and the matchers are specifically just ServerName ("sni") matchers
-			// (by far the most common), we can combine them into a single policy
-			if i == j-1 && len(cps[i].MatchersRaw) == 1 && len(cps[j].MatchersRaw) == 1 {
-				if iSNIMatcherJSON, ok := cps[i].MatchersRaw["sni"]; ok {
-					if jSNIMatcherJSON, ok := cps[j].MatchersRaw["sni"]; ok {
-						// position of policies and the matcher criteria check out; if settings are
-						// the same, then we can combine the policies; we have to unmarshal and
-						// remarshal the matchers though
-						if cps[i].SettingsEqual(*cps[j]) {
-							var iSNIMatcher caddytls.MatchServerName
-							if err := json.Unmarshal(iSNIMatcherJSON, &iSNIMatcher); err == nil {
-								var jSNIMatcher caddytls.MatchServerName
-								if err := json.Unmarshal(jSNIMatcherJSON, &jSNIMatcher); err == nil {
-									iSNIMatcher = append(iSNIMatcher, jSNIMatcher...)
-									cps[i].MatchersRaw["sni"], err = json.Marshal(iSNIMatcher)
-									if err != nil {
-										return nil, fmt.Errorf("recombining SNI matchers: %v", err)
-									}
-									cps = slices.Delete(cps, j, j+1)
-									i--
-									break
-								}
-							}
-						}
-					}
-				}
-			}
-
 			// if they have the same matcher, try to reconcile each field: either they must
 			// be identical, or we have to be able to combine them safely
 			if reflect.DeepEqual(cps[i].MatchersRaw, cps[j].MatchersRaw) {
@@ -1128,12 +954,6 @@ func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.Connecti
 					return nil, fmt.Errorf("two policies with same match criteria have conflicting default SNI: %s vs. %s",
 						cps[i].DefaultSNI, cps[j].DefaultSNI)
 				}
-				if cps[i].FallbackSNI != "" &&
-					cps[j].FallbackSNI != "" &&
-					cps[i].FallbackSNI != cps[j].FallbackSNI {
-					return nil, fmt.Errorf("two policies with same match criteria have conflicting fallback SNI: %s vs. %s",
-						cps[i].FallbackSNI, cps[j].FallbackSNI)
-				}
 				if cps[i].ProtocolMin != "" &&
 					cps[j].ProtocolMin != "" &&
 					cps[i].ProtocolMin != cps[j].ProtocolMin {
@@ -1174,9 +994,6 @@ func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.Connecti
 				if cps[i].DefaultSNI == "" && cps[j].DefaultSNI != "" {
 					cps[i].DefaultSNI = cps[j].DefaultSNI
 				}
-				if cps[i].FallbackSNI == "" && cps[j].FallbackSNI != "" {
-					cps[i].FallbackSNI = cps[j].FallbackSNI
-				}
 				if cps[i].ProtocolMin == "" && cps[j].ProtocolMin != "" {
 					cps[i].ProtocolMin = cps[j].ProtocolMin
 				}
@@ -1190,19 +1007,18 @@ func consolidateConnPolicies(cps caddytls.ConnectionPolicies) (caddytls.Connecti
 				} else if cps[i].CertSelection != nil && cps[j].CertSelection != nil {
 					// if both have one, then combine AnyTag
 					for _, tag := range cps[j].CertSelection.AnyTag {
-						if !slices.Contains(cps[i].CertSelection.AnyTag, tag) {
+						if !sliceContains(cps[i].CertSelection.AnyTag, tag) {
 							cps[i].CertSelection.AnyTag = append(cps[i].CertSelection.AnyTag, tag)
 						}
 					}
 				}
 
-				cps = slices.Delete(cps, j, j+1)
+				cps = append(cps[:j], cps[j+1:]...)
 				i--
 				break
 			}
 		}
 	}
-
 	return cps, nil
 }
 
@@ -1212,8 +1028,8 @@ func appendSubrouteToRouteList(routeList caddyhttp.RouteList,
 	subroute *caddyhttp.Subroute,
 	matcherSetsEnc []caddy.ModuleMap,
 	p sbAddrAssociation,
-	warnings *[]caddyconfig.Warning,
+	warnings *[]caddyconfig.Warning) caddyhttp.RouteList {
-) caddyhttp.RouteList {
+
 	// nothing to do if... there's nothing to do
 	if len(matcherSetsEnc) == 0 && len(subroute.Routes) == 0 && subroute.Errors == nil {
 		return routeList
@@ -1274,7 +1090,7 @@ func appendSubrouteToRouteList(routeList caddyhttp.RouteList,
 func buildSubroute(routes []ConfigValue, groupCounter counter, needsSorting bool) (*caddyhttp.Subroute, error) {
 	if needsSorting {
 		for _, val := range routes {
-			if !slices.Contains(directiveOrder, val.directive) {
+			if !directiveIsOrdered(val.directive) {
 				return nil, fmt.Errorf("directive '%s' is not an ordered HTTP handler, so it cannot be used here - try placing within a route block or using the order global option", val.directive)
 			}
 		}
@@ -1421,24 +1237,19 @@ func matcherSetFromMatcherToken(
 	if tkn.Text == "*" {
 		// match all requests == no matchers, so nothing to do
 		return nil, true, nil
-	}
+	} else if strings.HasPrefix(tkn.Text, "/") {
-
+		// convenient way to specify a single path match
-	// convenient way to specify a single path match
-	if strings.HasPrefix(tkn.Text, "/") {
 		return caddy.ModuleMap{
 			"path": caddyconfig.JSON(caddyhttp.MatchPath{tkn.Text}, warnings),
 		}, true, nil
-	}
+	} else if strings.HasPrefix(tkn.Text, matcherPrefix) {
-
+		// pre-defined matcher
-	// pre-defined matcher
-	if strings.HasPrefix(tkn.Text, matcherPrefix) {
 		m, ok := matcherDefs[tkn.Text]
 		if !ok {
 			return nil, false, fmt.Errorf("unrecognized matcher name: %+v", tkn.Text)
 		}
 		return m, true, nil
 	}
-
 	return nil, false, nil
 }
 
@@ -1452,7 +1263,7 @@ func (st *ServerType) compileEncodedMatcherSets(sblock serverBlock) ([]caddy.Mod
 	var matcherPairs []*hostPathPair
 
 	var catchAllHosts bool
-	for _, addr := range sblock.parsedKeys {
+	for _, addr := range sblock.keys {
 		// choose a matcher pair that should be shared by this
 		// server block; if none exists yet, create one
 		var chosenMatcherPair *hostPathPair
@@ -1484,16 +1295,25 @@ func (st *ServerType) compileEncodedMatcherSets(sblock serverBlock) ([]caddy.Mod
 
 		// add this server block's keys to the matcher
 		// pair if it doesn't already exist
-		if addr.Host != "" && !slices.Contains(chosenMatcherPair.hostm, addr.Host) {
+		if addr.Host != "" {
-			chosenMatcherPair.hostm = append(chosenMatcherPair.hostm, addr.Host)
+			var found bool
+			for _, h := range chosenMatcherPair.hostm {
+				if h == addr.Host {
+					found = true
+					break
+				}
+			}
+			if !found {
+				chosenMatcherPair.hostm = append(chosenMatcherPair.hostm, addr.Host)
+			}
 		}
 	}
 
 	// iterate each pairing of host and path matchers and
 	// put them into a map for JSON encoding
-	var matcherSets []map[string]caddyhttp.RequestMatcherWithError
+	var matcherSets []map[string]caddyhttp.RequestMatcher
 	for _, mp := range matcherPairs {
-		matcherSet := make(map[string]caddyhttp.RequestMatcherWithError)
+		matcherSet := make(map[string]caddyhttp.RequestMatcher)
 		if len(mp.hostm) > 0 {
 			matcherSet["host"] = mp.hostm
 		}
@@ -1519,94 +1339,74 @@ func (st *ServerType) compileEncodedMatcherSets(sblock serverBlock) ([]caddy.Mod
 }
 
 func parseMatcherDefinitions(d *caddyfile.Dispenser, matchers map[string]caddy.ModuleMap) error {
-	d.Next() // advance to the first token
+	for d.Next() {
+		// this is the "name" for "named matchers"
+		definitionName := d.Val()
 
-	// this is the "name" for "named matchers"
+		if _, ok := matchers[definitionName]; ok {
-	definitionName := d.Val()
+			return fmt.Errorf("matcher is defined more than once: %s", definitionName)
-
-	if _, ok := matchers[definitionName]; ok {
-		return fmt.Errorf("matcher is defined more than once: %s", definitionName)
-	}
-	matchers[definitionName] = make(caddy.ModuleMap)
-
-	// given a matcher name and the tokens following it, parse
-	// the tokens as a matcher module and record it
-	makeMatcher := func(matcherName string, tokens []caddyfile.Token) error {
-		// create a new dispenser from the tokens
-		dispenser := caddyfile.NewDispenser(tokens)
-
-		// set the matcher name (without @) in the dispenser context so
-		// that matcher modules can access it to use it as their name
-		// (e.g. regexp matchers which use the name for capture groups)
-		dispenser.SetContext(caddyfile.MatcherNameCtxKey, definitionName[1:])
-
-		mod, err := caddy.GetModule("http.matchers." + matcherName)
-		if err != nil {
-			return fmt.Errorf("getting matcher module '%s': %v", matcherName, err)
-		}
-		unm, ok := mod.New().(caddyfile.Unmarshaler)
-		if !ok {
-			return fmt.Errorf("matcher module '%s' is not a Caddyfile unmarshaler", matcherName)
-		}
-		err = unm.UnmarshalCaddyfile(dispenser)
-		if err != nil {
-			return err
 		}
+		matchers[definitionName] = make(caddy.ModuleMap)
 
-		if rm, ok := unm.(caddyhttp.RequestMatcherWithError); ok {
+		// given a matcher name and the tokens following it, parse
-			matchers[definitionName][matcherName] = caddyconfig.JSON(rm, nil)
+		// the tokens as a matcher module and record it
-			return nil
+		makeMatcher := func(matcherName string, tokens []caddyfile.Token) error {
-		}
+			mod, err := caddy.GetModule("http.matchers." + matcherName)
-		// nolint:staticcheck
+			if err != nil {
-		if rm, ok := unm.(caddyhttp.RequestMatcher); ok {
+				return fmt.Errorf("getting matcher module '%s': %v", matcherName, err)
-			matchers[definitionName][matcherName] = caddyconfig.JSON(rm, nil)
+			}
-			return nil
+			unm, ok := mod.New().(caddyfile.Unmarshaler)
-		}
+			if !ok {
-		return fmt.Errorf("matcher module '%s' is not a request matcher", matcherName)
+				return fmt.Errorf("matcher module '%s' is not a Caddyfile unmarshaler", matcherName)
-	}
+			}
-
+			err = unm.UnmarshalCaddyfile(caddyfile.NewDispenser(tokens))
-	// if the next token is quoted, we can assume it's not a matcher name
-	// and that it's probably an 'expression' matcher
-	if d.NextArg() {
-		if d.Token().Quoted() {
-			// since it was missing the matcher name, we insert a token
-			// in front of the expression token itself; we use Clone() to
-			// make the new token to keep the same the import location as
-			// the next token, if this is within a snippet or imported file.
-			// see https://github.com/caddyserver/caddy/issues/6287
-			expressionToken := d.Token().Clone()
-			expressionToken.Text = "expression"
-			err := makeMatcher("expression", []caddyfile.Token{expressionToken, d.Token()})
 			if err != nil {
 				return err
 			}
+			rm, ok := unm.(caddyhttp.RequestMatcher)
+			if !ok {
+				return fmt.Errorf("matcher module '%s' is not a request matcher", matcherName)
+			}
+			matchers[definitionName][matcherName] = caddyconfig.JSON(rm, nil)
 			return nil
 		}
 
-		// if it wasn't quoted, then we need to rewind after calling
+		// if the next token is quoted, we can assume it's not a matcher name
-		// d.NextArg() so the below properly grabs the matcher name
+		// and that it's probably an 'expression' matcher
-		d.Prev()
+		if d.NextArg() {
-	}
+			if d.Token().Quoted() {
+				err := makeMatcher("expression", []caddyfile.Token{d.Token()})
+				if err != nil {
+					return err
+				}
+				continue
+			}
 
-	// in case there are multiple instances of the same matcher, concatenate
+			// if it wasn't quoted, then we need to rewind after calling
-	// their tokens (we expect that UnmarshalCaddyfile should be able to
+			// d.NextArg() so the below properly grabs the matcher name
-	// handle more than one segment); otherwise, we'd overwrite other
+			d.Prev()
-	// instances of the matcher in this set
+		}
-	tokensByMatcherName := make(map[string][]caddyfile.Token)
+
-	for nesting := d.Nesting(); d.NextArg() || d.NextBlock(nesting); {
+		// in case there are multiple instances of the same matcher, concatenate
-		matcherName := d.Val()
+		// their tokens (we expect that UnmarshalCaddyfile should be able to
-		tokensByMatcherName[matcherName] = append(tokensByMatcherName[matcherName], d.NextSegment()...)
+		// handle more than one segment); otherwise, we'd overwrite other
-	}
+		// instances of the matcher in this set
-	for matcherName, tokens := range tokensByMatcherName {
+		tokensByMatcherName := make(map[string][]caddyfile.Token)
-		err := makeMatcher(matcherName, tokens)
+		for nesting := d.Nesting(); d.NextArg() || d.NextBlock(nesting); {
-		if err != nil {
+			matcherName := d.Val()
-			return err
+			tokensByMatcherName[matcherName] = append(tokensByMatcherName[matcherName], d.NextSegment()...)
+		}
+		for matcherName, tokens := range tokensByMatcherName {
+			err := makeMatcher(matcherName, tokens)
+			if err != nil {
+				return err
+			}
 		}
 	}
 	return nil
 }
 
-func encodeMatcherSet(matchers map[string]caddyhttp.RequestMatcherWithError) (caddy.ModuleMap, error) {
+func encodeMatcherSet(matchers map[string]caddyhttp.RequestMatcher) (caddy.ModuleMap, error) {
 	msEncoded := make(caddy.ModuleMap)
 	for matcherName, val := range matchers {
 		jsonBytes, err := json.Marshal(val)
@@ -1618,6 +1418,37 @@ func encodeMatcherSet(matchers map[string]caddyhttp.RequestMatcherWithError) (ca
 	return msEncoded, nil
 }
 
+// placeholderShorthands returns a slice of old-new string pairs,
+// where the left of the pair is a placeholder shorthand that may
+// be used in the Caddyfile, and the right is the replacement.
+func placeholderShorthands() []string {
+	return []string{
+		"{dir}", "{http.request.uri.path.dir}",
+		"{file}", "{http.request.uri.path.file}",
+		"{host}", "{http.request.host}",
+		"{hostport}", "{http.request.hostport}",
+		"{port}", "{http.request.port}",
+		"{method}", "{http.request.method}",
+		"{path}", "{http.request.uri.path}",
+		"{query}", "{http.request.uri.query}",
+		"{remote}", "{http.request.remote}",
+		"{remote_host}", "{http.request.remote.host}",
+		"{remote_port}", "{http.request.remote.port}",
+		"{scheme}", "{http.request.scheme}",
+		"{uri}", "{http.request.uri}",
+		"{tls_cipher}", "{http.request.tls.cipher_suite}",
+		"{tls_version}", "{http.request.tls.version}",
+		"{tls_client_fingerprint}", "{http.request.tls.client.fingerprint}",
+		"{tls_client_issuer}", "{http.request.tls.client.issuer}",
+		"{tls_client_serial}", "{http.request.tls.client.serial}",
+		"{tls_client_subject}", "{http.request.tls.client.subject}",
+		"{tls_client_certificate_pem}", "{http.request.tls.client.certificate_pem}",
+		"{tls_client_certificate_der_base64}", "{http.request.tls.client.certificate_der_base64}",
+		"{upstream_hostport}", "{http.reverse_proxy.upstream.hostport}",
+		"{client_ip}", "{http.vars.client_ip}",
+	}
+}
+
 // WasReplacedPlaceholderShorthand checks if a token string was
 // likely a replaced shorthand of the known Caddyfile placeholder
 // replacement outputs. Useful to prevent some user-defined map
@@ -1666,6 +1497,16 @@ func tryDuration(val any, warnings *[]caddyconfig.Warning) caddy.Duration {
 	return durationVal
 }
 
+// sliceContains returns true if needle is in haystack.
+func sliceContains(haystack []string, needle string) bool {
+	for _, s := range haystack {
+		if s == needle {
+			return true
+		}
+	}
+	return false
+}
+
 // listenersUseAnyPortOtherThan returns true if there are any
 // listeners in addresses that use a port which is not otherPort.
 // Mostly borrowed from unexported method in caddyhttp package.
@@ -1686,18 +1527,6 @@ func listenersUseAnyPortOtherThan(addresses []string, otherPort string) bool {
 	return false
 }
 
-func mapContains[K comparable, V any](m map[K]V, keys []K) bool {
-	if len(m) == 0 || len(keys) == 0 {
-		return false
-	}
-	for _, key := range keys {
-		if _, ok := m[key]; ok {
-			return true
-		}
-	}
-	return false
-}
-
 // specificity returns len(s) minus any wildcards (*) and
 // placeholders ({...}). Basically, it's a length count
 // that penalizes the use of wildcards and placeholders.
@@ -1735,31 +1564,20 @@ func (c counter) nextGroup() string {
 }
 
 type namedCustomLog struct {
-	name       string
+	name string
-	hostnames  []string
+	log  *caddy.CustomLog
-	log        *caddy.CustomLog
-	noHostname bool
-}
-
-// addressWithProtocols associates a listen address with
-// the protocols to serve it with
-type addressWithProtocols struct {
-	address   string
-	protocols []string
 }
 
 // sbAddrAssociation is a mapping from a list of
-// addresses with protocols, and a list of server
+// addresses to a list of server blocks that are
-// blocks that are served on those addresses.
+// served on those addresses.
 type sbAddrAssociation struct {
-	addressesWithProtocols []addressWithProtocols
+	addresses    []string
-	serverBlocks           []serverBlock
+	serverBlocks []serverBlock
 }
 
-const (
+const matcherPrefix = "@"
-	matcherPrefix = "@"
+const namedRouteKey = "named_route"
-	namedRouteKey = "named_route"
-)
 
 // Interface guard
 var _ caddyfile.ServerType = (*ServerType)(nil)

caddyconfig/httpcaddyfile/options.go

@@ -15,38 +15,33 @@
 package httpcaddyfile
 
 import (
-	"slices"
 	"strconv"
 
-	"github.com/caddyserver/certmagic"
-	"github.com/libdns/libdns"
-	"github.com/mholt/acmez/v3/acme"
-
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
 	"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
-	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
 	"github.com/caddyserver/caddy/v2/modules/caddytls"
+	"github.com/caddyserver/certmagic"
+	"github.com/mholt/acmez/acme"
 )
 
 func init() {
 	RegisterGlobalOption("debug", parseOptTrue)
 	RegisterGlobalOption("http_port", parseOptHTTPPort)
 	RegisterGlobalOption("https_port", parseOptHTTPSPort)
-	RegisterGlobalOption("default_bind", parseOptDefaultBind)
+	RegisterGlobalOption("default_bind", parseOptStringList)
 	RegisterGlobalOption("grace_period", parseOptDuration)
 	RegisterGlobalOption("shutdown_delay", parseOptDuration)
 	RegisterGlobalOption("default_sni", parseOptSingleString)
 	RegisterGlobalOption("fallback_sni", parseOptSingleString)
 	RegisterGlobalOption("order", parseOptOrder)
 	RegisterGlobalOption("storage", parseOptStorage)
-	RegisterGlobalOption("storage_check", parseStorageCheck)
+	RegisterGlobalOption("storage_clean_interval", parseOptDuration)
-	RegisterGlobalOption("storage_clean_interval", parseStorageCleanInterval)
 	RegisterGlobalOption("renew_interval", parseOptDuration)
 	RegisterGlobalOption("ocsp_interval", parseOptDuration)
 	RegisterGlobalOption("acme_ca", parseOptSingleString)
 	RegisterGlobalOption("acme_ca_root", parseOptSingleString)
-	RegisterGlobalOption("acme_dns", parseOptDNS)
+	RegisterGlobalOption("acme_dns", parseOptACMEDNS)
 	RegisterGlobalOption("acme_eab", parseOptACMEEAB)
 	RegisterGlobalOption("cert_issuer", parseOptCertIssuer)
 	RegisterGlobalOption("skip_install_trust", parseOptTrue)
@@ -56,119 +51,118 @@ func init() {
 	RegisterGlobalOption("local_certs", parseOptTrue)
 	RegisterGlobalOption("key_type", parseOptSingleString)
 	RegisterGlobalOption("auto_https", parseOptAutoHTTPS)
-	RegisterGlobalOption("metrics", parseMetricsOptions)
 	RegisterGlobalOption("servers", parseServerOptions)
 	RegisterGlobalOption("ocsp_stapling", parseOCSPStaplingOptions)
-	RegisterGlobalOption("cert_lifetime", parseOptDuration)
 	RegisterGlobalOption("log", parseLogOptions)
 	RegisterGlobalOption("preferred_chains", parseOptPreferredChains)
 	RegisterGlobalOption("persist_config", parseOptPersistConfig)
-	RegisterGlobalOption("dns", parseOptDNS)
-	RegisterGlobalOption("ech", parseOptECH)
 }
 
 func parseOptTrue(d *caddyfile.Dispenser, _ any) (any, error) { return true, nil }
 
 func parseOptHTTPPort(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
 	var httpPort int
-	var httpPortStr string
+	for d.Next() {
-	if !d.AllArgs(&httpPortStr) {
+		var httpPortStr string
-		return 0, d.ArgErr()
+		if !d.AllArgs(&httpPortStr) {
-	}
+			return 0, d.ArgErr()
-	var err error
+		}
-	httpPort, err = strconv.Atoi(httpPortStr)
+		var err error
-	if err != nil {
+		httpPort, err = strconv.Atoi(httpPortStr)
-		return 0, d.Errf("converting port '%s' to integer value: %v", httpPortStr, err)
+		if err != nil {
+			return 0, d.Errf("converting port '%s' to integer value: %v", httpPortStr, err)
+		}
 	}
 	return httpPort, nil
 }
 
 func parseOptHTTPSPort(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
 	var httpsPort int
-	var httpsPortStr string
+	for d.Next() {
-	if !d.AllArgs(&httpsPortStr) {
+		var httpsPortStr string
-		return 0, d.ArgErr()
+		if !d.AllArgs(&httpsPortStr) {
-	}
+			return 0, d.ArgErr()
-	var err error
+		}
-	httpsPort, err = strconv.Atoi(httpsPortStr)
+		var err error
-	if err != nil {
+		httpsPort, err = strconv.Atoi(httpsPortStr)
-		return 0, d.Errf("converting port '%s' to integer value: %v", httpsPortStr, err)
+		if err != nil {
+			return 0, d.Errf("converting port '%s' to integer value: %v", httpsPortStr, err)
+		}
 	}
 	return httpsPort, nil
 }
 
 func parseOptOrder(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
+	newOrder := directiveOrder
 
-	// get directive name
+	for d.Next() {
-	if !d.Next() {
+		// get directive name
-		return nil, d.ArgErr()
+		if !d.Next() {
-	}
+			return nil, d.ArgErr()
-	dirName := d.Val()
+		}
-	if _, ok := registeredDirectives[dirName]; !ok {
+		dirName := d.Val()
-		return nil, d.Errf("%s is not a registered directive", dirName)
+		if _, ok := registeredDirectives[dirName]; !ok {
-	}
+			return nil, d.Errf("%s is not a registered directive", dirName)
+		}
 
-	// get positional token
+		// get positional token
-	if !d.Next() {
+		if !d.Next() {
-		return nil, d.ArgErr()
+			return nil, d.ArgErr()
-	}
+		}
-	pos := Positional(d.Val())
+		pos := d.Val()
 
-	// if directive already had an order, drop it
+		// if directive exists, first remove it
-	newOrder := slices.DeleteFunc(directiveOrder, func(d string) bool {
+		for i, d := range newOrder {
-		return d == dirName
+			if d == dirName {
-	})
+				newOrder = append(newOrder[:i], newOrder[i+1:]...)
+				break
+			}
+		}
 
-	// act on the positional; if it's First or Last, we're done right away
+		// act on the positional
-	switch pos {
+		switch pos {
-	case First:
+		case "first":
-		newOrder = append([]string{dirName}, newOrder...)
+			newOrder = append([]string{dirName}, newOrder...)
+			if d.NextArg() {
+				return nil, d.ArgErr()
+			}
+			directiveOrder = newOrder
+			return newOrder, nil
+		case "last":
+			newOrder = append(newOrder, dirName)
+			if d.NextArg() {
+				return nil, d.ArgErr()
+			}
+			directiveOrder = newOrder
+			return newOrder, nil
+		case "before":
+		case "after":
+		default:
+			return nil, d.Errf("unknown positional '%s'", pos)
+		}
+
+		// get name of other directive
+		if !d.NextArg() {
+			return nil, d.ArgErr()
+		}
+		otherDir := d.Val()
 		if d.NextArg() {
 			return nil, d.ArgErr()
 		}
-		directiveOrder = newOrder
-		return newOrder, nil
 
-	case Last:
+		// insert directive into proper position
-		newOrder = append(newOrder, dirName)
+		for i, d := range newOrder {
-		if d.NextArg() {
+			if d == otherDir {
-			return nil, d.ArgErr()
+				if pos == "before" {
+					newOrder = append(newOrder[:i], append([]string{dirName}, newOrder[i:]...)...)
+				} else if pos == "after" {
+					newOrder = append(newOrder[:i+1], append([]string{dirName}, newOrder[i+1:]...)...)
+				}
+				break
+			}
 		}
-		directiveOrder = newOrder
-		return newOrder, nil
-
-	// if it's Before or After, continue
-	case Before:
-	case After:
-
-	default:
-		return nil, d.Errf("unknown positional '%s'", pos)
 	}
 
-	// get name of other directive
-	if !d.NextArg() {
-		return nil, d.ArgErr()
-	}
-	otherDir := d.Val()
-	if d.NextArg() {
-		return nil, d.ArgErr()
-	}
-
-	// get the position of the target directive
-	targetIndex := slices.Index(newOrder, otherDir)
-	if targetIndex == -1 {
-		return nil, d.Errf("directive '%s' not found", otherDir)
-	}
-	// if we're inserting after, we need to increment the index to go after
-	if pos == After {
-		targetIndex++
-	}
-	// insert the directive into the new order
-	newOrder = slices.Insert(newOrder, targetIndex, dirName)
-
 	directiveOrder = newOrder
 
 	return newOrder, nil
@@ -193,40 +187,6 @@ func parseOptStorage(d *caddyfile.Dispenser, _ any) (any, error) {
 	return storage, nil
 }
 
-func parseStorageCheck(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
-	if !d.Next() {
-		return "", d.ArgErr()
-	}
-	val := d.Val()
-	if d.Next() {
-		return "", d.ArgErr()
-	}
-	if val != "off" {
-		return "", d.Errf("storage_check must be 'off'")
-	}
-	return val, nil
-}
-
-func parseStorageCleanInterval(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
-	if !d.Next() {
-		return "", d.ArgErr()
-	}
-	val := d.Val()
-	if d.Next() {
-		return "", d.ArgErr()
-	}
-	if val == "off" {
-		return false, nil
-	}
-	dur, err := caddy.ParseDuration(d.Val())
-	if err != nil {
-		return nil, d.Errf("failed to parse storage_clean_interval, must be a duration or 'off' %w", err)
-	}
-	return caddy.Duration(dur), nil
-}
-
 func parseOptDuration(d *caddyfile.Dispenser, _ any) (any, error) {
 	if !d.Next() { // consume option name
 		return nil, d.ArgErr()
@@ -241,60 +201,78 @@ func parseOptDuration(d *caddyfile.Dispenser, _ any) (any, error) {
 	return caddy.Duration(dur), nil
 }
 
-func parseOptACMEEAB(d *caddyfile.Dispenser, _ any) (any, error) {
+func parseOptACMEDNS(d *caddyfile.Dispenser, _ any) (any, error) {
-	eab := new(acme.EAB)
+	if !d.Next() { // consume option name
-	d.Next() // consume option name
-	if d.NextArg() {
 		return nil, d.ArgErr()
 	}
-	for d.NextBlock(0) {
+	if !d.Next() { // get DNS module name
-		switch d.Val() {
+		return nil, d.ArgErr()
-		case "key_id":
+	}
-			if !d.NextArg() {
+	modID := "dns.providers." + d.Val()
-				return nil, d.ArgErr()
+	unm, err := caddyfile.UnmarshalModule(d, modID)
-			}
+	if err != nil {
-			eab.KeyID = d.Val()
+		return nil, err
+	}
+	prov, ok := unm.(certmagic.ACMEDNSProvider)
+	if !ok {
+		return nil, d.Errf("module %s (%T) is not a certmagic.ACMEDNSProvider", modID, unm)
+	}
+	return prov, nil
+}
 
-		case "mac_key":
+func parseOptACMEEAB(d *caddyfile.Dispenser, _ any) (any, error) {
-			if !d.NextArg() {
+	eab := new(acme.EAB)
-				return nil, d.ArgErr()
+	for d.Next() {
-			}
+		if d.NextArg() {
-			eab.MACKey = d.Val()
+			return nil, d.ArgErr()
+		}
+		for nesting := d.Nesting(); d.NextBlock(nesting); {
+			switch d.Val() {
+			case "key_id":
+				if !d.NextArg() {
+					return nil, d.ArgErr()
+				}
+				eab.KeyID = d.Val()
 
-		default:
+			case "mac_key":
-			return nil, d.Errf("unrecognized parameter '%s'", d.Val())
+				if !d.NextArg() {
+					return nil, d.ArgErr()
+				}
+				eab.MACKey = d.Val()
+
+			default:
+				return nil, d.Errf("unrecognized parameter '%s'", d.Val())
+			}
 		}
 	}
 	return eab, nil
 }
 
 func parseOptCertIssuer(d *caddyfile.Dispenser, existing any) (any, error) {
-	d.Next() // consume option name
-
 	var issuers []certmagic.Issuer
 	if existing != nil {
 		issuers = existing.([]certmagic.Issuer)
 	}
-
+	for d.Next() { // consume option name
-	// get issuer module name
+		if !d.Next() { // get issuer module name
-	if !d.Next() {
+			return nil, d.ArgErr()
-		return nil, d.ArgErr()
+		}
+		modID := "tls.issuance." + d.Val()
+		unm, err := caddyfile.UnmarshalModule(d, modID)
+		if err != nil {
+			return nil, err
+		}
+		iss, ok := unm.(certmagic.Issuer)
+		if !ok {
+			return nil, d.Errf("module %s (%T) is not a certmagic.Issuer", modID, unm)
+		}
+		issuers = append(issuers, iss)
 	}
-	modID := "tls.issuance." + d.Val()
-	unm, err := caddyfile.UnmarshalModule(d, modID)
-	if err != nil {
-		return nil, err
-	}
-	iss, ok := unm.(certmagic.Issuer)
-	if !ok {
-		return nil, d.Errf("module %s (%T) is not a certmagic.Issuer", modID, unm)
-	}
-	issuers = append(issuers, iss)
 	return issuers, nil
 }
 
 func parseOptSingleString(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
+	d.Next() // consume parameter name
 	if !d.Next() {
 		return "", d.ArgErr()
 	}
@@ -305,62 +283,43 @@ func parseOptSingleString(d *caddyfile.Dispenser, _ any) (any, error) {
 	return val, nil
 }
 
-func parseOptDefaultBind(d *caddyfile.Dispenser, _ any) (any, error) {
+func parseOptStringList(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
+	d.Next() // consume parameter name
-
+	val := d.RemainingArgs()
-	var addresses, protocols []string
+	if len(val) == 0 {
-	addresses = d.RemainingArgs()
+		return "", d.ArgErr()
-
-	if len(addresses) == 0 {
-		addresses = append(addresses, "")
 	}
-
+	return val, nil
-	for d.NextBlock(0) {
-		switch d.Val() {
-		case "protocols":
-			protocols = d.RemainingArgs()
-			if len(protocols) == 0 {
-				return nil, d.Errf("protocols requires one or more arguments")
-			}
-		default:
-			return nil, d.Errf("unknown subdirective: %s", d.Val())
-		}
-	}
-
-	return []ConfigValue{{Class: "bind", Value: addressesWithProtocols{
-		addresses: addresses,
-		protocols: protocols,
-	}}}, nil
 }
 
 func parseOptAdmin(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
-
 	adminCfg := new(caddy.AdminConfig)
-	if d.NextArg() {
+	for d.Next() {
-		listenAddress := d.Val()
+		if d.NextArg() {
-		if listenAddress == "off" {
+			listenAddress := d.Val()
-			adminCfg.Disabled = true
+			if listenAddress == "off" {
-			if d.Next() { // Do not accept any remaining options including block
+				adminCfg.Disabled = true
-				return nil, d.Err("No more option is allowed after turning off admin config")
+				if d.Next() { // Do not accept any remaining options including block
-			}
+					return nil, d.Err("No more option is allowed after turning off admin config")
-		} else {
+				}
-			adminCfg.Listen = listenAddress
+			} else {
-			if d.NextArg() { // At most 1 arg is allowed
+				adminCfg.Listen = listenAddress
-				return nil, d.ArgErr()
+				if d.NextArg() { // At most 1 arg is allowed
+					return nil, d.ArgErr()
+				}
 			}
 		}
-	}
+		for nesting := d.Nesting(); d.NextBlock(nesting); {
-	for d.NextBlock(0) {
+			switch d.Val() {
-		switch d.Val() {
+			case "enforce_origin":
-		case "enforce_origin":
+				adminCfg.EnforceOrigin = true
-			adminCfg.EnforceOrigin = true
 
-		case "origins":
+			case "origins":
-			adminCfg.Origins = d.RemainingArgs()
+				adminCfg.Origins = d.RemainingArgs()
 
-		default:
+			default:
-			return nil, d.Errf("unrecognized parameter '%s'", d.Val())
+				return nil, d.Errf("unrecognized parameter '%s'", d.Val())
+			}
 		}
 	}
 	if adminCfg.Listen == "" && !adminCfg.Disabled {
@@ -370,58 +329,57 @@ func parseOptAdmin(d *caddyfile.Dispenser, _ any) (any, error) {
 }
 
 func parseOptOnDemand(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
-	if d.NextArg() {
-		return nil, d.ArgErr()
-	}
-
 	var ond *caddytls.OnDemandConfig
+	for d.Next() {
+		if d.NextArg() {
+			return nil, d.ArgErr()
+		}
+		for nesting := d.Nesting(); d.NextBlock(nesting); {
+			switch d.Val() {
+			case "ask":
+				if !d.NextArg() {
+					return nil, d.ArgErr()
+				}
+				if ond == nil {
+					ond = new(caddytls.OnDemandConfig)
+				}
+				ond.Ask = d.Val()
 
-	for nesting := d.Nesting(); d.NextBlock(nesting); {
+			case "interval":
-		switch d.Val() {
+				if !d.NextArg() {
-		case "ask":
+					return nil, d.ArgErr()
-			if !d.NextArg() {
+				}
-				return nil, d.ArgErr()
+				dur, err := caddy.ParseDuration(d.Val())
-			}
+				if err != nil {
-			if ond == nil {
+					return nil, err
-				ond = new(caddytls.OnDemandConfig)
+				}
-			}
+				if ond == nil {
-			if ond.PermissionRaw != nil {
+					ond = new(caddytls.OnDemandConfig)
-				return nil, d.Err("on-demand TLS permission module (or 'ask') already specified")
+				}
-			}
+				if ond.RateLimit == nil {
-			perm := caddytls.PermissionByHTTP{Endpoint: d.Val()}
+					ond.RateLimit = new(caddytls.RateLimit)
-			ond.PermissionRaw = caddyconfig.JSONModuleObject(perm, "module", "http", nil)
+				}
+				ond.RateLimit.Interval = caddy.Duration(dur)
 
-		case "permission":
+			case "burst":
-			if !d.NextArg() {
+				if !d.NextArg() {
-				return nil, d.ArgErr()
+					return nil, d.ArgErr()
-			}
+				}
-			if ond == nil {
+				burst, err := strconv.Atoi(d.Val())
-				ond = new(caddytls.OnDemandConfig)
+				if err != nil {
-			}
+					return nil, err
-			if ond.PermissionRaw != nil {
+				}
-				return nil, d.Err("on-demand TLS permission module (or 'ask') already specified")
+				if ond == nil {
-			}
+					ond = new(caddytls.OnDemandConfig)
-			modName := d.Val()
+				}
-			modID := "tls.permission." + modName
+				if ond.RateLimit == nil {
-			unm, err := caddyfile.UnmarshalModule(d, modID)
+					ond.RateLimit = new(caddytls.RateLimit)
-			if err != nil {
+				}
-				return nil, err
+				ond.RateLimit.Burst = burst
-			}
-			perm, ok := unm.(caddytls.OnDemandPermission)
-			if !ok {
-				return nil, d.Errf("module %s (%T) is not an on-demand TLS permission module", modID, unm)
-			}
-			ond.PermissionRaw = caddyconfig.JSONModuleObject(perm, "module", modName, nil)
 
-		case "interval":
+			default:
-			return nil, d.Errf("the on_demand_tls 'interval' option is no longer supported, remove it from your config")
+				return nil, d.Errf("unrecognized parameter '%s'", d.Val())
-
+			}
-		case "burst":
-			return nil, d.Errf("the on_demand_tls 'burst' option is no longer supported, remove it from your config")
-
-		default:
-			return nil, d.Errf("unrecognized parameter '%s'", d.Val())
 		}
 	}
 	if ond == nil {
@@ -431,7 +389,7 @@ func parseOptOnDemand(d *caddyfile.Dispenser, _ any) (any, error) {
 }
 
 func parseOptPersistConfig(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
+	d.Next() // consume parameter name
 	if !d.Next() {
 		return "", d.ArgErr()
 	}
@@ -446,45 +404,20 @@ func parseOptPersistConfig(d *caddyfile.Dispenser, _ any) (any, error) {
 }
 
 func parseOptAutoHTTPS(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
+	d.Next() // consume parameter name
-	val := d.RemainingArgs()
+	if !d.Next() {
-	if len(val) == 0 {
 		return "", d.ArgErr()
 	}
-	for _, v := range val {
+	val := d.Val()
-		switch v {
+	if d.Next() {
-		case "off":
+		return "", d.ArgErr()
-		case "disable_redirects":
+	}
-		case "disable_certs":
+	if val != "off" && val != "disable_redirects" && val != "disable_certs" && val != "ignore_loaded_certs" {
-		case "ignore_loaded_certs":
+		return "", d.Errf("auto_https must be one of 'off', 'disable_redirects', 'disable_certs', or 'ignore_loaded_certs'")
-		case "prefer_wildcard":
-			break
-
-		default:
-			return "", d.Errf("auto_https must be one of 'off', 'disable_redirects', 'disable_certs', 'ignore_loaded_certs', or 'prefer_wildcard'")
-		}
 	}
 	return val, nil
 }
 
-func unmarshalCaddyfileMetricsOptions(d *caddyfile.Dispenser) (any, error) {
-	d.Next() // consume option name
-	metrics := new(caddyhttp.Metrics)
-	for d.NextBlock(0) {
-		switch d.Val() {
-		case "per_host":
-			metrics.PerHost = true
-		default:
-			return nil, d.Errf("unrecognized servers option '%s'", d.Val())
-		}
-	}
-	return metrics, nil
-}
-
-func parseMetricsOptions(d *caddyfile.Dispenser, _ any) (any, error) {
-	return unmarshalCaddyfileMetricsOptions(d)
-}
-
 func parseServerOptions(d *caddyfile.Dispenser, _ any) (any, error) {
 	return unmarshalCaddyfileServerOptions(d)
 }
@@ -554,68 +487,3 @@ func parseOptPreferredChains(d *caddyfile.Dispenser, _ any) (any, error) {
 	d.Next()
 	return caddytls.ParseCaddyfilePreferredChainsOptions(d)
 }
-
-func parseOptDNS(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
-
-	if !d.Next() { // get DNS module name
-		return nil, d.ArgErr()
-	}
-	modID := "dns.providers." + d.Val()
-	unm, err := caddyfile.UnmarshalModule(d, modID)
-	if err != nil {
-		return nil, err
-	}
-	switch unm.(type) {
-	case libdns.RecordGetter,
-		libdns.RecordSetter,
-		libdns.RecordAppender,
-		libdns.RecordDeleter:
-	default:
-		return nil, d.Errf("module %s (%T) is not a libdns provider", modID, unm)
-	}
-	return unm, nil
-}
-
-func parseOptECH(d *caddyfile.Dispenser, _ any) (any, error) {
-	d.Next() // consume option name
-
-	ech := new(caddytls.ECH)
-
-	publicNames := d.RemainingArgs()
-	for _, publicName := range publicNames {
-		ech.Configs = append(ech.Configs, caddytls.ECHConfiguration{
-			PublicName: publicName,
-		})
-	}
-	if len(ech.Configs) == 0 {
-		return nil, d.ArgErr()
-	}
-
-	for nesting := d.Nesting(); d.NextBlock(nesting); {
-		switch d.Val() {
-		case "dns":
-			if !d.Next() {
-				return nil, d.ArgErr()
-			}
-			providerName := d.Val()
-			modID := "dns.providers." + providerName
-			unm, err := caddyfile.UnmarshalModule(d, modID)
-			if err != nil {
-				return nil, err
-			}
-			ech.Publication = append(ech.Publication, &caddytls.ECHPublication{
-				Configs: publicNames,
-				PublishersRaw: caddy.ModuleMap{
-					"dns": caddyconfig.JSON(caddytls.ECHDNSPublisher{
-						ProviderRaw: caddyconfig.JSONModuleObject(unm, "name", providerName, nil),
-					}, nil),
-				},
-			})
-		default:
-			return nil, d.Errf("ech: unrecognized subdirective '%s'", d.Val())
-		}
-	}
-
-	return ech, nil
-}

caddyconfig/httpcaddyfile/pkiapp.go

@@ -48,124 +48,124 @@ func init() {
 //
 // When the CA ID is unspecified, 'local' is assumed.
 func parsePKIApp(d *caddyfile.Dispenser, existingVal any) (any, error) {
-	d.Next() // consume app name
+	pki := &caddypki.PKI{CAs: make(map[string]*caddypki.CA)}
 
-	pki := &caddypki.PKI{
+	for d.Next() {
-		CAs: make(map[string]*caddypki.CA),
+		for nesting := d.Nesting(); d.NextBlock(nesting); {
-	}
+			switch d.Val() {
-	for d.NextBlock(0) {
+			case "ca":
-		switch d.Val() {
+				pkiCa := new(caddypki.CA)
-		case "ca":
-			pkiCa := new(caddypki.CA)
-			if d.NextArg() {
-				pkiCa.ID = d.Val()
 				if d.NextArg() {
-					return nil, d.ArgErr()
+					pkiCa.ID = d.Val()
+					if d.NextArg() {
+						return nil, d.ArgErr()
+					}
 				}
-			}
+				if pkiCa.ID == "" {
-			if pkiCa.ID == "" {
+					pkiCa.ID = caddypki.DefaultCAID
-				pkiCa.ID = caddypki.DefaultCAID
-			}
-
-			for nesting := d.Nesting(); d.NextBlock(nesting); {
-				switch d.Val() {
-				case "name":
-					if !d.NextArg() {
-						return nil, d.ArgErr()
-					}
-					pkiCa.Name = d.Val()
-
-				case "root_cn":
-					if !d.NextArg() {
-						return nil, d.ArgErr()
-					}
-					pkiCa.RootCommonName = d.Val()
-
-				case "intermediate_cn":
-					if !d.NextArg() {
-						return nil, d.ArgErr()
-					}
-					pkiCa.IntermediateCommonName = d.Val()
-
-				case "intermediate_lifetime":
-					if !d.NextArg() {
-						return nil, d.ArgErr()
-					}
-					dur, err := caddy.ParseDuration(d.Val())
-					if err != nil {
-						return nil, err
-					}
-					pkiCa.IntermediateLifetime = caddy.Duration(dur)
-
-				case "root":
-					if pkiCa.Root == nil {
-						pkiCa.Root = new(caddypki.KeyPair)
-					}
-					for nesting := d.Nesting(); d.NextBlock(nesting); {
-						switch d.Val() {
-						case "cert":
-							if !d.NextArg() {
-								return nil, d.ArgErr()
-							}
-							pkiCa.Root.Certificate = d.Val()
-
-						case "key":
-							if !d.NextArg() {
-								return nil, d.ArgErr()
-							}
-							pkiCa.Root.PrivateKey = d.Val()
-
-						case "format":
-							if !d.NextArg() {
-								return nil, d.ArgErr()
-							}
-							pkiCa.Root.Format = d.Val()
-
-						default:
-							return nil, d.Errf("unrecognized pki ca root option '%s'", d.Val())
-						}
-					}
-
-				case "intermediate":
-					if pkiCa.Intermediate == nil {
-						pkiCa.Intermediate = new(caddypki.KeyPair)
-					}
-					for nesting := d.Nesting(); d.NextBlock(nesting); {
-						switch d.Val() {
-						case "cert":
-							if !d.NextArg() {
-								return nil, d.ArgErr()
-							}
-							pkiCa.Intermediate.Certificate = d.Val()
-
-						case "key":
-							if !d.NextArg() {
-								return nil, d.ArgErr()
-							}
-							pkiCa.Intermediate.PrivateKey = d.Val()
-
-						case "format":
-							if !d.NextArg() {
-								return nil, d.ArgErr()
-							}
-							pkiCa.Intermediate.Format = d.Val()
-
-						default:
-							return nil, d.Errf("unrecognized pki ca intermediate option '%s'", d.Val())
-						}
-					}
-
-				default:
-					return nil, d.Errf("unrecognized pki ca option '%s'", d.Val())
 				}
+
+				for nesting := d.Nesting(); d.NextBlock(nesting); {
+					switch d.Val() {
+					case "name":
+						if !d.NextArg() {
+							return nil, d.ArgErr()
+						}
+						pkiCa.Name = d.Val()
+
+					case "root_cn":
+						if !d.NextArg() {
+							return nil, d.ArgErr()
+						}
+						pkiCa.RootCommonName = d.Val()
+
+					case "intermediate_cn":
+						if !d.NextArg() {
+							return nil, d.ArgErr()
+						}
+						pkiCa.IntermediateCommonName = d.Val()
+
+					case "intermediate_lifetime":
+						if !d.NextArg() {
+							return nil, d.ArgErr()
+						}
+						dur, err := caddy.ParseDuration(d.Val())
+						if err != nil {
+							return nil, err
+						}
+						pkiCa.IntermediateLifetime = caddy.Duration(dur)
+
+					case "root":
+						if pkiCa.Root == nil {
+							pkiCa.Root = new(caddypki.KeyPair)
+						}
+						for nesting := d.Nesting(); d.NextBlock(nesting); {
+							switch d.Val() {
+							case "cert":
+								if !d.NextArg() {
+									return nil, d.ArgErr()
+								}
+								pkiCa.Root.Certificate = d.Val()
+
+							case "key":
+								if !d.NextArg() {
+									return nil, d.ArgErr()
+								}
+								pkiCa.Root.PrivateKey = d.Val()
+
+							case "format":
+								if !d.NextArg() {
+									return nil, d.ArgErr()
+								}
+								pkiCa.Root.Format = d.Val()
+
+							default:
+								return nil, d.Errf("unrecognized pki ca root option '%s'", d.Val())
+							}
+						}
+
+					case "intermediate":
+						if pkiCa.Intermediate == nil {
+							pkiCa.Intermediate = new(caddypki.KeyPair)
+						}
+						for nesting := d.Nesting(); d.NextBlock(nesting); {
+							switch d.Val() {
+							case "cert":
+								if !d.NextArg() {
+									return nil, d.ArgErr()
+								}
+								pkiCa.Intermediate.Certificate = d.Val()
+
+							case "key":
+								if !d.NextArg() {
+									return nil, d.ArgErr()
+								}
+								pkiCa.Intermediate.PrivateKey = d.Val()
+
+							case "format":
+								if !d.NextArg() {
+									return nil, d.ArgErr()
+								}
+								pkiCa.Intermediate.Format = d.Val()
+
+							default:
+								return nil, d.Errf("unrecognized pki ca intermediate option '%s'", d.Val())
+							}
+						}
+
+					default:
+						return nil, d.Errf("unrecognized pki ca option '%s'", d.Val())
+					}
+				}
+
+				pki.CAs[pkiCa.ID] = pkiCa
+
+			default:
+				return nil, d.Errf("unrecognized pki option '%s'", d.Val())
 			}
-
-			pki.CAs[pkiCa.ID] = pkiCa
-
-		default:
-			return nil, d.Errf("unrecognized pki option '%s'", d.Val())
 		}
 	}
+
 	return pki, nil
 }
 
@@ -174,6 +174,7 @@ func (st ServerType) buildPKIApp(
 	options map[string]any,
 	warnings []caddyconfig.Warning,
 ) (*caddypki.PKI, []caddyconfig.Warning, error) {
+
 	skipInstallTrust := false
 	if _, ok := options["skip_install_trust"]; ok {
 		skipInstallTrust = true

caddyconfig/httpcaddyfile/serveroptions.go

@@ -17,14 +17,12 @@ package httpcaddyfile
 import (
 	"encoding/json"
 	"fmt"
-	"slices"
-
-	"github.com/dustin/go-humanize"
 
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
 	"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
 	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
+	"github.com/dustin/go-humanize"
 )
 
 // serverOptions collects server config overrides parsed from Caddyfile global options
@@ -43,222 +41,232 @@ type serverOptions struct {
 	IdleTimeout          caddy.Duration
 	KeepAliveInterval    caddy.Duration
 	MaxHeaderBytes       int
-	EnableFullDuplex     bool
 	Protocols            []string
 	StrictSNIHost        *bool
 	TrustedProxiesRaw    json.RawMessage
-	TrustedProxiesStrict int
 	ClientIPHeaders      []string
 	ShouldLogCredentials bool
 	Metrics              *caddyhttp.Metrics
-	Trace                bool // TODO: EXPERIMENTAL
 }
 
 func unmarshalCaddyfileServerOptions(d *caddyfile.Dispenser) (any, error) {
-	d.Next() // consume option name
-
 	serverOpts := serverOptions{}
-	if d.NextArg() {
+	for d.Next() {
-		serverOpts.ListenerAddress = d.Val()
 		if d.NextArg() {
-			return nil, d.ArgErr()
+			serverOpts.ListenerAddress = d.Val()
-		}
+			if d.NextArg() {
-	}
-	for d.NextBlock(0) {
-		switch d.Val() {
-		case "name":
-			if serverOpts.ListenerAddress == "" {
-				return nil, d.Errf("cannot set a name for a server without a listener address")
-			}
-			if !d.NextArg() {
 				return nil, d.ArgErr()
 			}
-			serverOpts.Name = d.Val()
+		}
+		for nesting := d.Nesting(); d.NextBlock(nesting); {
+			switch d.Val() {
+			case "name":
+				if serverOpts.ListenerAddress == "" {
+					return nil, d.Errf("cannot set a name for a server without a listener address")
+				}
+				if !d.NextArg() {
+					return nil, d.ArgErr()
+				}
+				serverOpts.Name = d.Val()
 
-		case "listener_wrappers":
+			case "listener_wrappers":
-			for nesting := d.Nesting(); d.NextBlock(nesting); {
+				for nesting := d.Nesting(); d.NextBlock(nesting); {
-				modID := "caddy.listeners." + d.Val()
+					modID := "caddy.listeners." + d.Val()
+					unm, err := caddyfile.UnmarshalModule(d, modID)
+					if err != nil {
+						return nil, err
+					}
+					listenerWrapper, ok := unm.(caddy.ListenerWrapper)
+					if !ok {
+						return nil, fmt.Errorf("module %s (%T) is not a listener wrapper", modID, unm)
+					}
+					jsonListenerWrapper := caddyconfig.JSONModuleObject(
+						listenerWrapper,
+						"wrapper",
+						listenerWrapper.(caddy.Module).CaddyModule().ID.Name(),
+						nil,
+					)
+					serverOpts.ListenerWrappersRaw = append(serverOpts.ListenerWrappersRaw, jsonListenerWrapper)
+				}
+
+			case "timeouts":
+				for nesting := d.Nesting(); d.NextBlock(nesting); {
+					switch d.Val() {
+					case "read_body":
+						if !d.NextArg() {
+							return nil, d.ArgErr()
+						}
+						dur, err := caddy.ParseDuration(d.Val())
+						if err != nil {
+							return nil, d.Errf("parsing read_body timeout duration: %v", err)
+						}
+						serverOpts.ReadTimeout = caddy.Duration(dur)
+
+					case "read_header":
+						if !d.NextArg() {
+							return nil, d.ArgErr()
+						}
+						dur, err := caddy.ParseDuration(d.Val())
+						if err != nil {
+							return nil, d.Errf("parsing read_header timeout duration: %v", err)
+						}
+						serverOpts.ReadHeaderTimeout = caddy.Duration(dur)
+
+					case "write":
+						if !d.NextArg() {
+							return nil, d.ArgErr()
+						}
+						dur, err := caddy.ParseDuration(d.Val())
+						if err != nil {
+							return nil, d.Errf("parsing write timeout duration: %v", err)
+						}
+						serverOpts.WriteTimeout = caddy.Duration(dur)
+
+					case "idle":
+						if !d.NextArg() {
+							return nil, d.ArgErr()
+						}
+						dur, err := caddy.ParseDuration(d.Val())
+						if err != nil {
+							return nil, d.Errf("parsing idle timeout duration: %v", err)
+						}
+						serverOpts.IdleTimeout = caddy.Duration(dur)
+
+					default:
+						return nil, d.Errf("unrecognized timeouts option '%s'", d.Val())
+					}
+				}
+			case "keepalive_interval":
+				if !d.NextArg() {
+					return nil, d.ArgErr()
+				}
+				dur, err := caddy.ParseDuration(d.Val())
+				if err != nil {
+					return nil, d.Errf("parsing keepalive interval duration: %v", err)
+				}
+				serverOpts.KeepAliveInterval = caddy.Duration(dur)
+
+			case "max_header_size":
+				var sizeStr string
+				if !d.AllArgs(&sizeStr) {
+					return nil, d.ArgErr()
+				}
+				size, err := humanize.ParseBytes(sizeStr)
+				if err != nil {
+					return nil, d.Errf("parsing max_header_size: %v", err)
+				}
+				serverOpts.MaxHeaderBytes = int(size)
+
+			case "log_credentials":
+				if d.NextArg() {
+					return nil, d.ArgErr()
+				}
+				serverOpts.ShouldLogCredentials = true
+
+			case "protocols":
+				protos := d.RemainingArgs()
+				for _, proto := range protos {
+					if proto != "h1" && proto != "h2" && proto != "h2c" && proto != "h3" {
+						return nil, d.Errf("unknown protocol '%s': expected h1, h2, h2c, or h3", proto)
+					}
+					if sliceContains(serverOpts.Protocols, proto) {
+						return nil, d.Errf("protocol %s specified more than once", proto)
+					}
+					serverOpts.Protocols = append(serverOpts.Protocols, proto)
+				}
+				if nesting := d.Nesting(); d.NextBlock(nesting) {
+					return nil, d.ArgErr()
+				}
+
+			case "strict_sni_host":
+				if d.NextArg() && d.Val() != "insecure_off" && d.Val() != "on" {
+					return nil, d.Errf("strict_sni_host only supports 'on' or 'insecure_off', got '%s'", d.Val())
+				}
+				boolVal := true
+				if d.Val() == "insecure_off" {
+					boolVal = false
+				}
+				serverOpts.StrictSNIHost = &boolVal
+
+			case "trusted_proxies":
+				if !d.NextArg() {
+					return nil, d.Err("trusted_proxies expects an IP range source module name as its first argument")
+				}
+				modID := "http.ip_sources." + d.Val()
 				unm, err := caddyfile.UnmarshalModule(d, modID)
 				if err != nil {
 					return nil, err
 				}
-				listenerWrapper, ok := unm.(caddy.ListenerWrapper)
+				source, ok := unm.(caddyhttp.IPRangeSource)
 				if !ok {
-					return nil, fmt.Errorf("module %s (%T) is not a listener wrapper", modID, unm)
+					return nil, fmt.Errorf("module %s (%T) is not an IP range source", modID, unm)
 				}
-				jsonListenerWrapper := caddyconfig.JSONModuleObject(
+				jsonSource := caddyconfig.JSONModuleObject(
-					listenerWrapper,
+					source,
-					"wrapper",
+					"source",
-					listenerWrapper.(caddy.Module).CaddyModule().ID.Name(),
+					source.(caddy.Module).CaddyModule().ID.Name(),
 					nil,
 				)
-				serverOpts.ListenerWrappersRaw = append(serverOpts.ListenerWrappersRaw, jsonListenerWrapper)
+				serverOpts.TrustedProxiesRaw = jsonSource
-			}
 
-		case "timeouts":
+			case "client_ip_headers":
-			for nesting := d.Nesting(); d.NextBlock(nesting); {
+				headers := d.RemainingArgs()
-				switch d.Val() {
+				for _, header := range headers {
-				case "read_body":
+					if sliceContains(serverOpts.ClientIPHeaders, header) {
-					if !d.NextArg() {
+						return nil, d.Errf("client IP header %s specified more than once", header)
-						return nil, d.ArgErr()
 					}
-					dur, err := caddy.ParseDuration(d.Val())
+					serverOpts.ClientIPHeaders = append(serverOpts.ClientIPHeaders, header)
-					if err != nil {
-						return nil, d.Errf("parsing read_body timeout duration: %v", err)
-					}
-					serverOpts.ReadTimeout = caddy.Duration(dur)
-
-				case "read_header":
-					if !d.NextArg() {
-						return nil, d.ArgErr()
-					}
-					dur, err := caddy.ParseDuration(d.Val())
-					if err != nil {
-						return nil, d.Errf("parsing read_header timeout duration: %v", err)
-					}
-					serverOpts.ReadHeaderTimeout = caddy.Duration(dur)
-
-				case "write":
-					if !d.NextArg() {
-						return nil, d.ArgErr()
-					}
-					dur, err := caddy.ParseDuration(d.Val())
-					if err != nil {
-						return nil, d.Errf("parsing write timeout duration: %v", err)
-					}
-					serverOpts.WriteTimeout = caddy.Duration(dur)
-
-				case "idle":
-					if !d.NextArg() {
-						return nil, d.ArgErr()
-					}
-					dur, err := caddy.ParseDuration(d.Val())
-					if err != nil {
-						return nil, d.Errf("parsing idle timeout duration: %v", err)
-					}
-					serverOpts.IdleTimeout = caddy.Duration(dur)
-
-				default:
-					return nil, d.Errf("unrecognized timeouts option '%s'", d.Val())
 				}
-			}
+				if nesting := d.Nesting(); d.NextBlock(nesting) {
-		case "keepalive_interval":
+					return nil, d.ArgErr()
-			if !d.NextArg() {
-				return nil, d.ArgErr()
-			}
-			dur, err := caddy.ParseDuration(d.Val())
-			if err != nil {
-				return nil, d.Errf("parsing keepalive interval duration: %v", err)
-			}
-			serverOpts.KeepAliveInterval = caddy.Duration(dur)
-
-		case "max_header_size":
-			var sizeStr string
-			if !d.AllArgs(&sizeStr) {
-				return nil, d.ArgErr()
-			}
-			size, err := humanize.ParseBytes(sizeStr)
-			if err != nil {
-				return nil, d.Errf("parsing max_header_size: %v", err)
-			}
-			serverOpts.MaxHeaderBytes = int(size)
-
-		case "enable_full_duplex":
-			if d.NextArg() {
-				return nil, d.ArgErr()
-			}
-			serverOpts.EnableFullDuplex = true
-
-		case "log_credentials":
-			if d.NextArg() {
-				return nil, d.ArgErr()
-			}
-			serverOpts.ShouldLogCredentials = true
-
-		case "protocols":
-			protos := d.RemainingArgs()
-			for _, proto := range protos {
-				if proto != "h1" && proto != "h2" && proto != "h2c" && proto != "h3" {
-					return nil, d.Errf("unknown protocol '%s': expected h1, h2, h2c, or h3", proto)
 				}
-				if slices.Contains(serverOpts.Protocols, proto) {
+
-					return nil, d.Errf("protocol %s specified more than once", proto)
+			case "metrics":
+				if d.NextArg() {
+					return nil, d.ArgErr()
 				}
-				serverOpts.Protocols = append(serverOpts.Protocols, proto)
+				if nesting := d.Nesting(); d.NextBlock(nesting) {
-			}
+					return nil, d.ArgErr()
-			if nesting := d.Nesting(); d.NextBlock(nesting) {
-				return nil, d.ArgErr()
-			}
-
-		case "strict_sni_host":
-			if d.NextArg() && d.Val() != "insecure_off" && d.Val() != "on" {
-				return nil, d.Errf("strict_sni_host only supports 'on' or 'insecure_off', got '%s'", d.Val())
-			}
-			boolVal := true
-			if d.Val() == "insecure_off" {
-				boolVal = false
-			}
-			serverOpts.StrictSNIHost = &boolVal
-
-		case "trusted_proxies":
-			if !d.NextArg() {
-				return nil, d.Err("trusted_proxies expects an IP range source module name as its first argument")
-			}
-			modID := "http.ip_sources." + d.Val()
-			unm, err := caddyfile.UnmarshalModule(d, modID)
-			if err != nil {
-				return nil, err
-			}
-			source, ok := unm.(caddyhttp.IPRangeSource)
-			if !ok {
-				return nil, fmt.Errorf("module %s (%T) is not an IP range source", modID, unm)
-			}
-			jsonSource := caddyconfig.JSONModuleObject(
-				source,
-				"source",
-				source.(caddy.Module).CaddyModule().ID.Name(),
-				nil,
-			)
-			serverOpts.TrustedProxiesRaw = jsonSource
-
-		case "trusted_proxies_strict":
-			if d.NextArg() {
-				return nil, d.ArgErr()
-			}
-			serverOpts.TrustedProxiesStrict = 1
-
-		case "client_ip_headers":
-			headers := d.RemainingArgs()
-			for _, header := range headers {
-				if slices.Contains(serverOpts.ClientIPHeaders, header) {
-					return nil, d.Errf("client IP header %s specified more than once", header)
 				}
-				serverOpts.ClientIPHeaders = append(serverOpts.ClientIPHeaders, header)
+				serverOpts.Metrics = new(caddyhttp.Metrics)
-			}
-			if nesting := d.Nesting(); d.NextBlock(nesting) {
-				return nil, d.ArgErr()
-			}
 
-		case "metrics":
+			// TODO: DEPRECATED. (August 2022)
-			caddy.Log().Warn("The nested 'metrics' option inside `servers` is deprecated and will be removed in the next major version. Use the global 'metrics' option instead.")
+			case "protocol":
-			serverOpts.Metrics = new(caddyhttp.Metrics)
+				caddy.Log().Named("caddyfile").Warn("DEPRECATED: protocol sub-option will be removed soon")
-			for nesting := d.Nesting(); d.NextBlock(nesting); {
+
-				switch d.Val() {
+				for nesting := d.Nesting(); d.NextBlock(nesting); {
-				case "per_host":
+					switch d.Val() {
-					serverOpts.Metrics.PerHost = true
+					case "allow_h2c":
-				default:
+						caddy.Log().Named("caddyfile").Warn("DEPRECATED: allow_h2c will be removed soon; use protocols option instead")
-					return nil, d.Errf("unrecognized metrics option '%s'", d.Val())
+
+						if d.NextArg() {
+							return nil, d.ArgErr()
+						}
+						if sliceContains(serverOpts.Protocols, "h2c") {
+							return nil, d.Errf("protocol h2c already specified")
+						}
+						serverOpts.Protocols = append(serverOpts.Protocols, "h2c")
+
+					case "strict_sni_host":
+						caddy.Log().Named("caddyfile").Warn("DEPRECATED: protocol > strict_sni_host in this position will be removed soon; move up to the servers block instead")
+
+						if d.NextArg() && d.Val() != "insecure_off" && d.Val() != "on" {
+							return nil, d.Errf("strict_sni_host only supports 'on' or 'insecure_off', got '%s'", d.Val())
+						}
+						boolVal := true
+						if d.Val() == "insecure_off" {
+							boolVal = false
+						}
+						serverOpts.StrictSNIHost = &boolVal
+
+					default:
+						return nil, d.Errf("unrecognized protocol option '%s'", d.Val())
+					}
 				}
-			}
 
-		case "trace":
+			default:
-			if d.NextArg() {
+				return nil, d.Errf("unrecognized servers option '%s'", d.Val())
-				return nil, d.ArgErr()
 			}
-			serverOpts.Trace = true
-
-		default:
-			return nil, d.Errf("unrecognized servers option '%s'", d.Val())
 		}
 	}
 	return serverOpts, nil
@@ -268,7 +276,7 @@ func unmarshalCaddyfileServerOptions(d *caddyfile.Dispenser) (any, error) {
 func applyServerOptions(
 	servers map[string]*caddyhttp.Server,
 	options map[string]any,
-	_ *[]caddyconfig.Warning,
+	warnings *[]caddyconfig.Warning,
 ) error {
 	serverOpts, ok := options["servers"].([]serverOptions)
 	if !ok {
@@ -292,15 +300,24 @@ func applyServerOptions(
 
 	for key, server := range servers {
 		// find the options that apply to this server
-		optsIndex := slices.IndexFunc(serverOpts, func(s serverOptions) bool {
+		opts := func() *serverOptions {
-			return s.ListenerAddress == "" || slices.Contains(server.Listen, s.ListenerAddress)
+			for _, entry := range serverOpts {
-		})
+				if entry.ListenerAddress == "" {
+					return &entry
+				}
+				for _, listener := range server.Listen {
+					if entry.ListenerAddress == listener {
+						return &entry
+					}
+				}
+			}
+			return nil
+		}()
 
 		// if none apply, then move to the next server
-		if optsIndex == -1 {
+		if opts == nil {
 			continue
 		}
-		opts := serverOpts[optsIndex]
 
 		// set all the options
 		server.ListenerWrappersRaw = opts.ListenerWrappersRaw
@@ -310,26 +327,17 @@ func applyServerOptions(
 		server.IdleTimeout = opts.IdleTimeout
 		server.KeepAliveInterval = opts.KeepAliveInterval
 		server.MaxHeaderBytes = opts.MaxHeaderBytes
-		server.EnableFullDuplex = opts.EnableFullDuplex
 		server.Protocols = opts.Protocols
 		server.StrictSNIHost = opts.StrictSNIHost
 		server.TrustedProxiesRaw = opts.TrustedProxiesRaw
 		server.ClientIPHeaders = opts.ClientIPHeaders
-		server.TrustedProxiesStrict = opts.TrustedProxiesStrict
 		server.Metrics = opts.Metrics
 		if opts.ShouldLogCredentials {
 			if server.Logs == nil {
-				server.Logs = new(caddyhttp.ServerLogConfig)
+				server.Logs = &caddyhttp.ServerLogConfig{}
 			}
 			server.Logs.ShouldLogCredentials = opts.ShouldLogCredentials
 		}
-		if opts.Trace {
-			// TODO: THIS IS EXPERIMENTAL (MAY 2024)
-			if server.Logs == nil {
-				server.Logs = new(caddyhttp.ServerLogConfig)
-			}
-			server.Logs.Trace = opts.Trace
-		}
 
 		if opts.Name != "" {
 			nameReplacements[key] = opts.Name

caddyconfig/httpcaddyfile/shorthands.go

@@ -1,102 +0,0 @@
-package httpcaddyfile
-
-import (
-	"regexp"
-	"strings"
-
-	"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
-)
-
-type ComplexShorthandReplacer struct {
-	search  *regexp.Regexp
-	replace string
-}
-
-type ShorthandReplacer struct {
-	complex []ComplexShorthandReplacer
-	simple  *strings.Replacer
-}
-
-func NewShorthandReplacer() ShorthandReplacer {
-	// replace shorthand placeholders (which are convenient
-	// when writing a Caddyfile) with their actual placeholder
-	// identifiers or variable names
-	replacer := strings.NewReplacer(placeholderShorthands()...)
-
-	// these are placeholders that allow a user-defined final
-	// parameters, but we still want to provide a shorthand
-	// for those, so we use a regexp to replace
-	regexpReplacements := []ComplexShorthandReplacer{
-		{regexp.MustCompile(`{header\.([\w-]*)}`), "{http.request.header.$1}"},
-		{regexp.MustCompile(`{cookie\.([\w-]*)}`), "{http.request.cookie.$1}"},
-		{regexp.MustCompile(`{labels\.([\w-]*)}`), "{http.request.host.labels.$1}"},
-		{regexp.MustCompile(`{path\.([\w-]*)}`), "{http.request.uri.path.$1}"},
-		{regexp.MustCompile(`{file\.([\w-]*)}`), "{http.request.uri.path.file.$1}"},
-		{regexp.MustCompile(`{query\.([\w-]*)}`), "{http.request.uri.query.$1}"},
-		{regexp.MustCompile(`{re\.([\w-\.]*)}`), "{http.regexp.$1}"},
-		{regexp.MustCompile(`{vars\.([\w-]*)}`), "{http.vars.$1}"},
-		{regexp.MustCompile(`{rp\.([\w-\.]*)}`), "{http.reverse_proxy.$1}"},
-		{regexp.MustCompile(`{resp\.([\w-\.]*)}`), "{http.intercept.$1}"},
-		{regexp.MustCompile(`{err\.([\w-\.]*)}`), "{http.error.$1}"},
-		{regexp.MustCompile(`{file_match\.([\w-]*)}`), "{http.matchers.file.$1}"},
-	}
-
-	return ShorthandReplacer{
-		complex: regexpReplacements,
-		simple:  replacer,
-	}
-}
-
-// placeholderShorthands returns a slice of old-new string pairs,
-// where the left of the pair is a placeholder shorthand that may
-// be used in the Caddyfile, and the right is the replacement.
-func placeholderShorthands() []string {
-	return []string{
-		"{host}", "{http.request.host}",
-		"{hostport}", "{http.request.hostport}",
-		"{port}", "{http.request.port}",
-		"{orig_method}", "{http.request.orig_method}",
-		"{orig_uri}", "{http.request.orig_uri}",
-		"{orig_path}", "{http.request.orig_uri.path}",
-		"{orig_dir}", "{http.request.orig_uri.path.dir}",
-		"{orig_file}", "{http.request.orig_uri.path.file}",
-		"{orig_query}", "{http.request.orig_uri.query}",
-		"{orig_?query}", "{http.request.orig_uri.prefixed_query}",
-		"{method}", "{http.request.method}",
-		"{uri}", "{http.request.uri}",
-		"{path}", "{http.request.uri.path}",
-		"{dir}", "{http.request.uri.path.dir}",
-		"{file}", "{http.request.uri.path.file}",
-		"{query}", "{http.request.uri.query}",
-		"{?query}", "{http.request.uri.prefixed_query}",
-		"{remote}", "{http.request.remote}",
-		"{remote_host}", "{http.request.remote.host}",
-		"{remote_port}", "{http.request.remote.port}",
-		"{scheme}", "{http.request.scheme}",
-		"{uuid}", "{http.request.uuid}",
-		"{tls_cipher}", "{http.request.tls.cipher_suite}",
-		"{tls_version}", "{http.request.tls.version}",
-		"{tls_client_fingerprint}", "{http.request.tls.client.fingerprint}",
-		"{tls_client_issuer}", "{http.request.tls.client.issuer}",
-		"{tls_client_serial}", "{http.request.tls.client.serial}",
-		"{tls_client_subject}", "{http.request.tls.client.subject}",
-		"{tls_client_certificate_pem}", "{http.request.tls.client.certificate_pem}",
-		"{tls_client_certificate_der_base64}", "{http.request.tls.client.certificate_der_base64}",
-		"{upstream_hostport}", "{http.reverse_proxy.upstream.hostport}",
-		"{client_ip}", "{http.vars.client_ip}",
-	}
-}
-
-// ApplyToSegment replaces shorthand placeholder to its full placeholder, understandable by Caddy.
-func (s ShorthandReplacer) ApplyToSegment(segment *caddyfile.Segment) {
-	if segment != nil {
-		for i := 0; i < len(*segment); i++ {
-			// simple string replacements
-			(*segment)[i].Text = s.simple.Replace((*segment)[i].Text)
-			// complex regexp replacements
-			for _, r := range s.complex {
-				(*segment)[i].Text = r.search.ReplaceAllString((*segment)[i].Text, r.replace)
-			}
-		}
-	}
-}

caddyconfig/httpcaddyfile/tlsapp.go

@@ -19,18 +19,16 @@ import (
 	"encoding/json"
 	"fmt"
 	"reflect"
-	"slices"
 	"sort"
 	"strconv"
 	"strings"
 
-	"github.com/caddyserver/certmagic"
-	"github.com/mholt/acmez/v3/acme"
-
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
 	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
 	"github.com/caddyserver/caddy/v2/modules/caddytls"
+	"github.com/caddyserver/certmagic"
+	"github.com/mholt/acmez/acme"
 )
 
 func (st ServerType) buildTLSApp(
@@ -38,6 +36,7 @@ func (st ServerType) buildTLSApp(
 	options map[string]any,
 	warnings []caddyconfig.Warning,
 ) (*caddytls.TLS, []caddyconfig.Warning, error) {
+
 	tlsApp := &caddytls.TLS{CertificatesRaw: make(caddy.ModuleMap)}
 	var certLoaders []caddytls.CertificateLoader
 
@@ -45,8 +44,8 @@ func (st ServerType) buildTLSApp(
 	if hp, ok := options["http_port"].(int); ok {
 		httpPort = strconv.Itoa(hp)
 	}
-	autoHTTPS := []string{}
+	autoHTTPS := "on"
-	if ah, ok := options["auto_https"].([]string); ok {
+	if ah, ok := options["auto_https"].(string); ok {
 		autoHTTPS = ah
 	}
 
@@ -54,25 +53,23 @@ func (st ServerType) buildTLSApp(
 	// key, so that they don't get forgotten/omitted by auto-HTTPS
 	// (since they won't appear in route matchers)
 	httpsHostsSharedWithHostlessKey := make(map[string]struct{})
-	if !slices.Contains(autoHTTPS, "off") {
+	if autoHTTPS != "off" {
 		for _, pair := range pairings {
 			for _, sb := range pair.serverBlocks {
-				for _, addr := range sb.parsedKeys {
+				for _, addr := range sb.keys {
-					if addr.Host != "" {
+					if addr.Host == "" {
-						continue
+						// this server block has a hostless key, now
-					}
+						// go through and add all the hosts to the set
-
+						for _, otherAddr := range sb.keys {
-					// this server block has a hostless key, now
+							if otherAddr.Original == addr.Original {
-					// go through and add all the hosts to the set
+								continue
-					for _, otherAddr := range sb.parsedKeys {
+							}
-						if otherAddr.Original == addr.Original {
+							if otherAddr.Host != "" && otherAddr.Scheme != "http" && otherAddr.Port != httpPort {
-							continue
+								httpsHostsSharedWithHostlessKey[otherAddr.Host] = struct{}{}
-						}
+							}
-						if otherAddr.Host != "" && otherAddr.Scheme != "http" && otherAddr.Port != httpPort {
-							httpsHostsSharedWithHostlessKey[otherAddr.Host] = struct{}{}
 						}
+						break
 					}
-					break
 				}
 			}
 		}
@@ -92,33 +89,9 @@ func (st ServerType) buildTLSApp(
 		tlsApp.Automation.Policies = append(tlsApp.Automation.Policies, catchAllAP)
 	}
 
-	var wildcardHosts []string                        // collect all hosts that have a wildcard in them, and aren't HTTP
-	forcedAutomatedNames := make(map[string]struct{}) // explicitly configured to be automated, even if covered by a wildcard
-
-	for _, p := range pairings {
-		var addresses []string
-		for _, addressWithProtocols := range p.addressesWithProtocols {
-			addresses = append(addresses, addressWithProtocols.address)
-		}
-		if !listenersUseAnyPortOtherThan(addresses, httpPort) {
-			continue
-		}
-		for _, sblock := range p.serverBlocks {
-			for _, addr := range sblock.parsedKeys {
-				if strings.HasPrefix(addr.Host, "*.") {
-					wildcardHosts = append(wildcardHosts, addr.Host[2:])
-				}
-			}
-		}
-	}
-
 	for _, p := range pairings {
 		// avoid setting up TLS automation policies for a server that is HTTP-only
-		var addresses []string
+		if !listenersUseAnyPortOtherThan(p.addresses, httpPort) {
-		for _, addressWithProtocols := range p.addressesWithProtocols {
-			addresses = append(addresses, addressWithProtocols.address)
-		}
-		if !listenersUseAnyPortOtherThan(addresses, httpPort) {
 			continue
 		}
 
@@ -135,12 +108,6 @@ func (st ServerType) buildTLSApp(
 				return nil, warnings, err
 			}
 
-			// make a plain copy so we can compare whether we made any changes
-			apCopy, err := newBaseAutomationPolicy(options, warnings, true)
-			if err != nil {
-				return nil, warnings, err
-			}
-
 			sblockHosts := sblock.hostsFromKeys(false)
 			if len(sblockHosts) == 0 && catchAllAP != nil {
 				ap = catchAllAP
@@ -151,18 +118,6 @@ func (st ServerType) buildTLSApp(
 				ap.OnDemand = true
 			}
 
-			// collect hosts that are forced to have certs automated for their specific name
-			if _, ok := sblock.pile["tls.force_automate"]; ok {
-				for _, host := range sblockHosts {
-					forcedAutomatedNames[host] = struct{}{}
-				}
-			}
-
-			// reuse private keys tls
-			if _, ok := sblock.pile["tls.reuse_private_keys"]; ok {
-				ap.ReusePrivateKeys = true
-			}
-
 			if keyTypeVals, ok := sblock.pile["tls.key_type"]; ok {
 				ap.KeyType = keyTypeVals[0].Value.(string)
 			}
@@ -221,8 +176,8 @@ func (st ServerType) buildTLSApp(
 					if acmeIssuer.Challenges.BindHost == "" {
 						// only binding to one host is supported
 						var bindHost string
-						if asserted, ok := cfgVal.Value.(addressesWithProtocols); ok && len(asserted.addresses) > 0 {
+						if bindHosts, ok := cfgVal.Value.([]string); ok && len(bindHosts) > 0 {
-							bindHost = asserted.addresses[0]
+							bindHost = bindHosts[0]
 						}
 						acmeIssuer.Challenges.BindHost = bindHost
 					}
@@ -250,21 +205,9 @@ func (st ServerType) buildTLSApp(
 				catchAllAP = ap
 			}
 
-			hostsNotHTTP := sblock.hostsFromKeysNotHTTP(httpPort)
-			sort.Strings(hostsNotHTTP) // solely for deterministic test results
-
-			// if the we prefer wildcards and the AP is unchanged,
-			// then we can skip this AP because it should be covered
-			// by an AP with a wildcard
-			if slices.Contains(autoHTTPS, "prefer_wildcard") {
-				if hostsCoveredByWildcard(hostsNotHTTP, wildcardHosts) &&
-					reflect.DeepEqual(ap, apCopy) {
-					continue
-				}
-			}
-
 			// associate our new automation policy with this server block's hosts
-			ap.SubjectsRaw = hostsNotHTTP
+			ap.SubjectsRaw = sblock.hostsFromKeysNotHTTP(httpPort)
+			sort.Strings(ap.SubjectsRaw) // solely for deterministic test results
 
 			// if a combination of public and internal names were given
 			// for this same server block and no issuer was specified, we
@@ -276,7 +219,7 @@ func (st ServerType) buildTLSApp(
 				var internal, external []string
 				for _, s := range ap.SubjectsRaw {
 					// do not create Issuers for Tailscale domains; they will be given a Manager instead
-					if isTailscaleDomain(s) {
+					if strings.HasSuffix(strings.ToLower(s), ".ts.net") {
 						continue
 					}
 					if !certmagic.SubjectQualifiesForCert(s) {
@@ -303,7 +246,6 @@ func (st ServerType) buildTLSApp(
 					ap2.IssuersRaw = []json.RawMessage{caddyconfig.JSONModuleObject(caddytls.InternalIssuer{}, "module", "internal", &warnings)}
 				}
 			}
-
 			if tlsApp.Automation == nil {
 				tlsApp.Automation = new(caddytls.AutomationConfig)
 			}
@@ -338,7 +280,7 @@ func (st ServerType) buildTLSApp(
 					combined = reflect.New(reflect.TypeOf(cl)).Elem()
 				}
 				clVal := reflect.ValueOf(cl)
-				for i := range clVal.Len() {
+				for i := 0; i < clVal.Len(); i++ {
 					combined = reflect.Append(combined, clVal.Index(i))
 				}
 				loadersByName[name] = combined.Interface().(caddytls.CertificateLoader)
@@ -357,42 +299,6 @@ func (st ServerType) buildTLSApp(
 		tlsApp.Automation.OnDemand = onDemand
 	}
 
-	// set up "global" (to the TLS app) DNS provider config
-	if globalDNS, ok := options["dns"]; ok && globalDNS != nil {
-		tlsApp.DNSRaw = caddyconfig.JSONModuleObject(globalDNS, "name", globalDNS.(caddy.Module).CaddyModule().ID.Name(), nil)
-	}
-
-	// set up ECH from Caddyfile options
-	if ech, ok := options["ech"].(*caddytls.ECH); ok {
-		tlsApp.EncryptedClientHello = ech
-
-		// outer server names will need certificates, so make sure they're included
-		// in an automation policy for them that applies any global options
-		ap, err := newBaseAutomationPolicy(options, warnings, true)
-		if err != nil {
-			return nil, warnings, err
-		}
-		for _, cfg := range ech.Configs {
-			if cfg.PublicName != "" {
-				ap.SubjectsRaw = append(ap.SubjectsRaw, cfg.PublicName)
-			}
-		}
-		if tlsApp.Automation == nil {
-			tlsApp.Automation = new(caddytls.AutomationConfig)
-		}
-		tlsApp.Automation.Policies = append(tlsApp.Automation.Policies, ap)
-	}
-
-	// if the storage clean interval is a boolean, then it's "off" to disable cleaning
-	if sc, ok := options["storage_check"].(string); ok && sc == "off" {
-		tlsApp.DisableStorageCheck = true
-	}
-
-	// if the storage clean interval is a boolean, then it's "off" to disable cleaning
-	if sci, ok := options["storage_clean_interval"].(bool); ok && !sci {
-		tlsApp.DisableStorageClean = true
-	}
-
 	// set the storage clean interval if configured
 	if storageCleanInterval, ok := options["storage_clean_interval"].(caddy.Duration); ok {
 		if tlsApp.Automation == nil {
@@ -433,7 +339,7 @@ func (st ServerType) buildTLSApp(
 	internalAP := &caddytls.AutomationPolicy{
 		IssuersRaw: []json.RawMessage{json.RawMessage(`{"module":"internal"}`)},
 	}
-	if !slices.Contains(autoHTTPS, "off") && !slices.Contains(autoHTTPS, "disable_certs") {
+	if autoHTTPS != "off" {
 		for h := range httpsHostsSharedWithHostlessKey {
 			al = append(al, h)
 			if !certmagic.SubjectQualifiesForPublicCert(h) {
@@ -441,13 +347,6 @@ func (st ServerType) buildTLSApp(
 			}
 		}
 	}
-	for name := range forcedAutomatedNames {
-		if slices.Contains(al, name) {
-			continue
-		}
-		al = append(al, name)
-	}
-	slices.Sort(al) // to stabilize the adapt output
 	if len(al) > 0 {
 		tlsApp.CertificatesRaw["automate"] = caddyconfig.JSON(al, &warnings)
 	}
@@ -469,17 +368,20 @@ func (st ServerType) buildTLSApp(
 		globalPreferredChains := options["preferred_chains"]
 		hasGlobalACMEDefaults := globalEmail != nil || globalACMECA != nil || globalACMECARoot != nil || globalACMEDNS != nil || globalACMEEAB != nil || globalPreferredChains != nil
 		if hasGlobalACMEDefaults {
-			for i := range tlsApp.Automation.Policies {
+			for i := 0; i < len(tlsApp.Automation.Policies); i++ {
 				ap := tlsApp.Automation.Policies[i]
 				if len(ap.Issuers) == 0 && automationPolicyHasAllPublicNames(ap) {
 					// for public names, create default issuers which will later be filled in with configured global defaults
 					// (internal names will implicitly use the internal issuer at auto-https time)
-					emailStr, _ := globalEmail.(string)
+					ap.Issuers = caddytls.DefaultIssuers()
-					ap.Issuers = caddytls.DefaultIssuers(emailStr)
 
 					// if a specific endpoint is configured, can't use multiple default issuers
 					if globalACMECA != nil {
-						ap.Issuers = []certmagic.Issuer{new(caddytls.ACMEIssuer)}
+						if strings.Contains(globalACMECA.(string), "zerossl") {
+							ap.Issuers = []certmagic.Issuer{&caddytls.ZeroSSLIssuer{ACMEIssuer: new(caddytls.ACMEIssuer)}}
+						} else {
+							ap.Issuers = []certmagic.Issuer{new(caddytls.ACMEIssuer)}
+						}
 					}
 				}
 			}
@@ -552,8 +454,6 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
 	globalACMEDNS := options["acme_dns"]
 	globalACMEEAB := options["acme_eab"]
 	globalPreferredChains := options["preferred_chains"]
-	globalCertLifetime := options["cert_lifetime"]
-	globalHTTPPort, globalHTTPSPort := options["http_port"], options["https_port"]
 
 	if globalEmail != nil && acmeIssuer.Email == "" {
 		acmeIssuer.Email = globalEmail.(string)
@@ -561,7 +461,7 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
 	if globalACMECA != nil && acmeIssuer.CA == "" {
 		acmeIssuer.CA = globalACMECA.(string)
 	}
-	if globalACMECARoot != nil && !slices.Contains(acmeIssuer.TrustedRootsPEMFiles, globalACMECARoot.(string)) {
+	if globalACMECARoot != nil && !sliceContains(acmeIssuer.TrustedRootsPEMFiles, globalACMECARoot.(string)) {
 		acmeIssuer.TrustedRootsPEMFiles = append(acmeIssuer.TrustedRootsPEMFiles, globalACMECARoot.(string))
 	}
 	if globalACMEDNS != nil && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.DNS == nil) {
@@ -577,28 +477,6 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
 	if globalPreferredChains != nil && acmeIssuer.PreferredChains == nil {
 		acmeIssuer.PreferredChains = globalPreferredChains.(*caddytls.ChainPreference)
 	}
-	// only configure alt HTTP and TLS-ALPN ports if the DNS challenge is not enabled (wouldn't hurt, but isn't necessary since the DNS challenge is exclusive of others)
-	if globalHTTPPort != nil && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.DNS == nil) && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.HTTP == nil || acmeIssuer.Challenges.HTTP.AlternatePort == 0) {
-		if acmeIssuer.Challenges == nil {
-			acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
-		}
-		if acmeIssuer.Challenges.HTTP == nil {
-			acmeIssuer.Challenges.HTTP = new(caddytls.HTTPChallengeConfig)
-		}
-		acmeIssuer.Challenges.HTTP.AlternatePort = globalHTTPPort.(int)
-	}
-	if globalHTTPSPort != nil && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.DNS == nil) && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.TLSALPN == nil || acmeIssuer.Challenges.TLSALPN.AlternatePort == 0) {
-		if acmeIssuer.Challenges == nil {
-			acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
-		}
-		if acmeIssuer.Challenges.TLSALPN == nil {
-			acmeIssuer.Challenges.TLSALPN = new(caddytls.TLSALPNChallengeConfig)
-		}
-		acmeIssuer.Challenges.TLSALPN.AlternatePort = globalHTTPSPort.(int)
-	}
-	if globalCertLifetime != nil && acmeIssuer.CertificateLifetime == 0 {
-		acmeIssuer.CertificateLifetime = globalCertLifetime.(caddy.Duration)
-	}
 	return nil
 }
 
@@ -607,11 +485,7 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
 // for any other automation policies. A nil policy (and no error) will be
 // returned if there are no default/global options. However, if always is
 // true, a non-nil value will always be returned (unless there is an error).
-func newBaseAutomationPolicy(
+func newBaseAutomationPolicy(options map[string]any, warnings []caddyconfig.Warning, always bool) (*caddytls.AutomationPolicy, error) {
-	options map[string]any,
-	_ []caddyconfig.Warning,
-	always bool,
-) (*caddytls.AutomationPolicy, error) {
 	issuers, hasIssuers := options["cert_issuer"]
 	_, hasLocalCerts := options["local_certs"]
 	keyType, hasKeyType := options["key_type"]
@@ -677,7 +551,7 @@ func consolidateAutomationPolicies(aps []*caddytls.AutomationPolicy) []*caddytls
 			if !automationPolicyHasAllPublicNames(aps[i]) {
 				// if this automation policy has internal names, we might as well remove it
 				// so auto-https can implicitly use the internal issuer
-				aps = slices.Delete(aps, i, i+1)
+				aps = append(aps[:i], aps[i+1:]...)
 				i--
 			}
 		}
@@ -694,7 +568,7 @@ outer:
 		for j := i + 1; j < len(aps); j++ {
 			// if they're exactly equal in every way, just keep one of them
 			if reflect.DeepEqual(aps[i], aps[j]) {
-				aps = slices.Delete(aps, j, j+1)
+				aps = append(aps[:j], aps[j+1:]...)
 				// must re-evaluate current i against next j; can't skip it!
 				// even if i decrements to -1, will be incremented to 0 immediately
 				i--
@@ -708,12 +582,10 @@ outer:
 			// eaten up by the one with subjects; and if both have subjects, we
 			// need to combine their lists
 			if reflect.DeepEqual(aps[i].IssuersRaw, aps[j].IssuersRaw) &&
-				reflect.DeepEqual(aps[i].ManagersRaw, aps[j].ManagersRaw) &&
 				bytes.Equal(aps[i].StorageRaw, aps[j].StorageRaw) &&
 				aps[i].MustStaple == aps[j].MustStaple &&
 				aps[i].KeyType == aps[j].KeyType &&
 				aps[i].OnDemand == aps[j].OnDemand &&
-				aps[i].ReusePrivateKeys == aps[j].ReusePrivateKeys &&
 				aps[i].RenewalWindowRatio == aps[j].RenewalWindowRatio {
 				if len(aps[i].SubjectsRaw) > 0 && len(aps[j].SubjectsRaw) == 0 {
 					// later policy (at j) has no subjects ("catch-all"), so we can
@@ -724,18 +596,18 @@ outer:
 					// cause example.com to be served by the less specific policy for
 					// '*.com', which might be different (yes we've seen this happen)
 					if automationPolicyShadows(i, aps) >= j {
-						aps = slices.Delete(aps, i, i+1)
+						aps = append(aps[:i], aps[i+1:]...)
 						i--
 						continue outer
 					}
 				} else {
 					// avoid repeated subjects
 					for _, subj := range aps[j].SubjectsRaw {
-						if !slices.Contains(aps[i].SubjectsRaw, subj) {
+						if !sliceContains(aps[i].SubjectsRaw, subj) {
 							aps[i].SubjectsRaw = append(aps[i].SubjectsRaw, subj)
 						}
 					}
-					aps = slices.Delete(aps, j, j+1)
+					aps = append(aps[:j], aps[j+1:]...)
 					j--
 				}
 			}
@@ -755,9 +627,13 @@ func automationPolicyIsSubset(a, b *caddytls.AutomationPolicy) bool {
 		return false
 	}
 	for _, aSubj := range a.SubjectsRaw {
-		inSuperset := slices.ContainsFunc(b.SubjectsRaw, func(bSubj string) bool {
+		var inSuperset bool
-			return certmagic.MatchWildcard(aSubj, bSubj)
+		for _, bSubj := range b.SubjectsRaw {
-		})
+			if certmagic.MatchWildcard(aSubj, bSubj) {
+				inSuperset = true
+				break
+			}
+		}
 		if !inSuperset {
 			return false
 		}
@@ -783,47 +659,17 @@ func automationPolicyShadows(i int, aps []*caddytls.AutomationPolicy) int {
 // subjectQualifiesForPublicCert is like certmagic.SubjectQualifiesForPublicCert() except
 // that this allows domains with multiple wildcard levels like '*.*.example.com' to qualify
 // if the automation policy has OnDemand enabled (i.e. this function is more lenient).
-//
-// IP subjects are considered as non-qualifying for public certs. Technically, there are
-// now public ACME CAs as well as non-ACME CAs that issue IP certificates. But this function
-// is used solely for implicit automation (defaults), where it gets really complicated to
-// keep track of which issuers support IP certificates in which circumstances. Currently,
-// issuers that support IP certificates are very few, and all require some sort of config
-// from the user anyway (such as an account credential). Since we cannot implicitly and
-// automatically get public IP certs without configuration from the user, we treat IPs as
-// not qualifying for public certificates. Users should expressly configure an issuer
-// that supports IP certs for that purpose.
 func subjectQualifiesForPublicCert(ap *caddytls.AutomationPolicy, subj string) bool {
 	return !certmagic.SubjectIsIP(subj) &&
 		!certmagic.SubjectIsInternal(subj) &&
 		(strings.Count(subj, "*.") < 2 || ap.OnDemand)
 }
 
-// automationPolicyHasAllPublicNames returns true if all the names on the policy
-// do NOT qualify for public certs OR are tailscale domains.
 func automationPolicyHasAllPublicNames(ap *caddytls.AutomationPolicy) bool {
-	return !slices.ContainsFunc(ap.SubjectsRaw, func(i string) bool {
+	for _, subj := range ap.SubjectsRaw {
-		return !subjectQualifiesForPublicCert(ap, i) || isTailscaleDomain(i)
+		if !subjectQualifiesForPublicCert(ap, subj) {
-	})
+			return false
-}
-
-func isTailscaleDomain(name string) bool {
-	return strings.HasSuffix(strings.ToLower(name), ".ts.net")
-}
-
-func hostsCoveredByWildcard(hosts []string, wildcards []string) bool {
-	if len(hosts) == 0 || len(wildcards) == 0 {
-		return false
-	}
-	for _, host := range hosts {
-		for _, wildcard := range wildcards {
-			if strings.HasPrefix(host, "*.") {
-				continue
-			}
-			if certmagic.MatchWildcard(host, "*."+wildcard) {
-				return true
-			}
 		}
 	}
-	return false
+	return true
 }

caddyconfig/httploader.go

@@ -30,14 +30,8 @@ func init() {
 	caddy.RegisterModule(HTTPLoader{})
 }
 
-// HTTPLoader can load Caddy configs over HTTP(S).
+// HTTPLoader can load Caddy configs over HTTP(S). It can adapt the config
-//
+// based on the Content-Type header of the HTTP response.
-// If the response is not a JSON config, a config adapter must be specified
-// either in the loader config (`adapter`), or in the Content-Type HTTP header
-// returned in the HTTP response from the server. The Content-Type header is
-// read just like the admin API's `/load` endpoint. If you don't have control
-// over the HTTP server (but can still trust its response), you can override
-// the Content-Type header by setting the `adapter` property in this config.
 type HTTPLoader struct {
 	// The method for the request. Default: GET
 	Method string `json:"method,omitempty"`
@@ -51,11 +45,6 @@ type HTTPLoader struct {
 	// Maximum time allowed for a complete connection and request.
 	Timeout caddy.Duration `json:"timeout,omitempty"`
 
-	// The name of the config adapter to use, if any. Only needed
-	// if the HTTP response is not a JSON config and if the server's
-	// Content-Type header is missing or incorrect.
-	Adapter string `json:"adapter,omitempty"`
-
 	TLS *struct {
 		// Present this instance's managed remote identity credentials to the server.
 		UseServerIdentity bool `json:"use_server_identity,omitempty"`
@@ -119,12 +108,7 @@ func (hl HTTPLoader) LoadConfig(ctx caddy.Context) ([]byte, error) {
 		return nil, err
 	}
 
-	// adapt the config based on either manually-configured adapter or server's response header
+	result, warnings, err := adaptByContentType(resp.Header.Get("Content-Type"), body)
-	ct := resp.Header.Get("Content-Type")
-	if hl.Adapter != "" {
-		ct = "text/" + hl.Adapter
-	}
-	result, warnings, err := adaptByContentType(ct, body)
 	if err != nil {
 		return nil, err
 	}
@@ -181,16 +165,19 @@ func (hl HTTPLoader) makeClient(ctx caddy.Context) (*http.Client, error) {
 			if err != nil {
 				return nil, fmt.Errorf("getting server identity credentials: %v", err)
 			}
-			// See https://github.com/securego/gosec/issues/1054#issuecomment-2072235199
+			if tlsConfig == nil {
-			//nolint:gosec
+				tlsConfig = new(tls.Config)
-			tlsConfig = &tls.Config{Certificates: certs}
+			}
+			tlsConfig.Certificates = certs
 		} else if hl.TLS.ClientCertificateFile != "" && hl.TLS.ClientCertificateKeyFile != "" {
 			cert, err := tls.LoadX509KeyPair(hl.TLS.ClientCertificateFile, hl.TLS.ClientCertificateKeyFile)
 			if err != nil {
 				return nil, err
 			}
-			//nolint:gosec
+			if tlsConfig == nil {
-			tlsConfig = &tls.Config{Certificates: []tls.Certificate{cert}}
+				tlsConfig = new(tls.Config)
+			}
+			tlsConfig.Certificates = []tls.Certificate{cert}
 		}
 
 		// trusted server certs

caddytest/caddytest.go

@@ -8,7 +8,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/fs"
 	"log"
 	"net"
 	"net/http"
@@ -23,20 +22,19 @@ import (
 	"time"
 
 	"github.com/aryann/difflib"
-
+	"github.com/caddyserver/caddy/v2/caddyconfig"
 	caddycmd "github.com/caddyserver/caddy/v2/cmd"
 
-	"github.com/caddyserver/caddy/v2/caddyconfig"
 	// plug in Caddy modules here
 	_ "github.com/caddyserver/caddy/v2/modules/standard"
 )
 
-// Config store any configuration required to make the tests run
+// Defaults store any configuration required to make the tests run
-type Config struct {
+type Defaults struct {
 	// Port we expect caddy to listening on
 	AdminPort int
 	// Certificates we expect to be loaded before attempting to run the tests
-	Certificates []string
+	Certifcates []string
 	// TestRequestTimeout is the time to wait for a http request to
 	TestRequestTimeout time.Duration
 	// LoadRequestTimeout is the time to wait for the config to be loaded against the caddy server
@@ -44,9 +42,9 @@ type Config struct {
 }
 
 // Default testing values
-var Default = Config{
+var Default = Defaults{
 	AdminPort:          2999, // different from what a real server also running on a developer's machine might be
-	Certificates:       []string{"/caddy.localhost.crt", "/caddy.localhost.key"},
+	Certifcates:        []string{"/caddy.localhost.crt", "/caddy.localhost.key"},
 	TestRequestTimeout: 5 * time.Second,
 	LoadRequestTimeout: 5 * time.Second,
 }
@@ -60,12 +58,12 @@ var (
 type Tester struct {
 	Client       *http.Client
 	configLoaded bool
-	t            testing.TB
+	t            *testing.T
-	config       Config
 }
 
 // NewTester will create a new testing client with an attached cookie jar
-func NewTester(t testing.TB) *Tester {
+func NewTester(t *testing.T) *Tester {
+
 	jar, err := cookiejar.New(nil)
 	if err != nil {
 		t.Fatalf("failed to create cookiejar: %s", err)
@@ -79,29 +77,9 @@ func NewTester(t testing.TB) *Tester {
 		},
 		configLoaded: false,
 		t:            t,
-		config:       Default,
 	}
 }
 
-// WithDefaultOverrides this will override the default test configuration with the provided values.
-func (tc *Tester) WithDefaultOverrides(overrides Config) *Tester {
-	if overrides.AdminPort != 0 {
-		tc.config.AdminPort = overrides.AdminPort
-	}
-	if len(overrides.Certificates) > 0 {
-		tc.config.Certificates = overrides.Certificates
-	}
-	if overrides.TestRequestTimeout != 0 {
-		tc.config.TestRequestTimeout = overrides.TestRequestTimeout
-		tc.Client.Timeout = overrides.TestRequestTimeout
-	}
-	if overrides.LoadRequestTimeout != 0 {
-		tc.config.LoadRequestTimeout = overrides.LoadRequestTimeout
-	}
-
-	return tc
-}
-
 type configLoadError struct {
 	Response string
 }
@@ -116,6 +94,7 @@ func timeElapsed(start time.Time, name string) {
 // InitServer this will configure the server with a configurion of a specific
 // type. The configType must be either "json" or the adapter type.
 func (tc *Tester) InitServer(rawConfig string, configType string) {
+
 	if err := tc.initServer(rawConfig, configType); err != nil {
 		tc.t.Logf("failed to load config: %s", err)
 		tc.t.Fail()
@@ -129,12 +108,13 @@ func (tc *Tester) InitServer(rawConfig string, configType string) {
 // InitServer this will configure the server with a configurion of a specific
 // type. The configType must be either "json" or the adapter type.
 func (tc *Tester) initServer(rawConfig string, configType string) error {
+
 	if testing.Short() {
 		tc.t.SkipNow()
 		return nil
 	}
 
-	err := validateTestPrerequisites(tc)
+	err := validateTestPrerequisites(tc.t)
 	if err != nil {
 		tc.t.Skipf("skipping tests as failed integration prerequisites. %s", err)
 		return nil
@@ -142,7 +122,8 @@ func (tc *Tester) initServer(rawConfig string, configType string) error {
 
 	tc.t.Cleanup(func() {
 		if tc.t.Failed() && tc.configLoaded {
-			res, err := http.Get(fmt.Sprintf("http://localhost:%d/config/", tc.config.AdminPort))
+
+			res, err := http.Get(fmt.Sprintf("http://localhost:%d/config/", Default.AdminPort))
 			if err != nil {
 				tc.t.Log("unable to read the current config")
 				return
@@ -157,25 +138,11 @@ func (tc *Tester) initServer(rawConfig string, configType string) error {
 	})
 
 	rawConfig = prependCaddyFilePath(rawConfig)
-	// normalize JSON config
-	if configType == "json" {
-		tc.t.Logf("Before: %s", rawConfig)
-		var conf any
-		if err := json.Unmarshal([]byte(rawConfig), &conf); err != nil {
-			return err
-		}
-		c, err := json.Marshal(conf)
-		if err != nil {
-			return err
-		}
-		rawConfig = string(c)
-		tc.t.Logf("After: %s", rawConfig)
-	}
 	client := &http.Client{
-		Timeout: tc.config.LoadRequestTimeout,
+		Timeout: Default.LoadRequestTimeout,
 	}
 	start := time.Now()
-	req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/load", tc.config.AdminPort), strings.NewReader(rawConfig))
+	req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d/load", Default.AdminPort), strings.NewReader(rawConfig))
 	if err != nil {
 		tc.t.Errorf("failed to create request. %s", err)
 		return err
@@ -226,11 +193,11 @@ func (tc *Tester) ensureConfigRunning(rawConfig string, configType string) error
 	}
 
 	client := &http.Client{
-		Timeout: tc.config.LoadRequestTimeout,
+		Timeout: Default.LoadRequestTimeout,
 	}
 
 	fetchConfig := func(client *http.Client) any {
-		resp, err := client.Get(fmt.Sprintf("http://localhost:%d/config/", tc.config.AdminPort))
+		resp, err := client.Get(fmt.Sprintf("http://localhost:%d/config/", Default.AdminPort))
 		if err != nil {
 			return nil
 		}
@@ -258,30 +225,31 @@ func (tc *Tester) ensureConfigRunning(rawConfig string, configType string) error
 }
 
 const initConfig = `{
-	admin localhost:%d
+	admin localhost:2999
 }
 `
 
 // validateTestPrerequisites ensures the certificates are available in the
 // designated path and Caddy sub-process is running.
-func validateTestPrerequisites(tc *Tester) error {
+func validateTestPrerequisites(t *testing.T) error {
+
 	// check certificates are found
-	for _, certName := range tc.config.Certificates {
+	for _, certName := range Default.Certifcates {
-		if _, err := os.Stat(getIntegrationDir() + certName); errors.Is(err, fs.ErrNotExist) {
+		if _, err := os.Stat(getIntegrationDir() + certName); os.IsNotExist(err) {
 			return fmt.Errorf("caddy integration test certificates (%s) not found", certName)
 		}
 	}
 
-	if isCaddyAdminRunning(tc) != nil {
+	if isCaddyAdminRunning() != nil {
 		// setup the init config file, and set the cleanup afterwards
 		f, err := os.CreateTemp("", "")
 		if err != nil {
 			return err
 		}
-		tc.t.Cleanup(func() {
+		t.Cleanup(func() {
 			os.Remove(f.Name())
 		})
-		if _, err := f.WriteString(fmt.Sprintf(initConfig, tc.config.AdminPort)); err != nil {
+		if _, err := f.WriteString(initConfig); err != nil {
 			return err
 		}
 
@@ -292,23 +260,23 @@ func validateTestPrerequisites(tc *Tester) error {
 		}()
 
 		// wait for caddy to start serving the initial config
-		for retries := 10; retries > 0 && isCaddyAdminRunning(tc) != nil; retries-- {
+		for retries := 10; retries > 0 && isCaddyAdminRunning() != nil; retries-- {
 			time.Sleep(1 * time.Second)
 		}
 	}
 
 	// one more time to return the error
-	return isCaddyAdminRunning(tc)
+	return isCaddyAdminRunning()
 }
 
-func isCaddyAdminRunning(tc *Tester) error {
+func isCaddyAdminRunning() error {
 	// assert that caddy is running
 	client := &http.Client{
-		Timeout: tc.config.LoadRequestTimeout,
+		Timeout: Default.LoadRequestTimeout,
 	}
-	resp, err := client.Get(fmt.Sprintf("http://localhost:%d/config/", tc.config.AdminPort))
+	resp, err := client.Get(fmt.Sprintf("http://localhost:%d/config/", Default.AdminPort))
 	if err != nil {
-		return fmt.Errorf("caddy integration test caddy server not running. Expected to be listening on localhost:%d", tc.config.AdminPort)
+		return fmt.Errorf("caddy integration test caddy server not running. Expected to be listening on localhost:%d", Default.AdminPort)
 	}
 	resp.Body.Close()
 
@@ -316,6 +284,7 @@ func isCaddyAdminRunning(tc *Tester) error {
 }
 
 func getIntegrationDir() string {
+
 	_, filename, _, ok := runtime.Caller(1)
 	if !ok {
 		panic("unable to determine the current file path")
@@ -335,6 +304,7 @@ func prependCaddyFilePath(rawConfig string) string {
 
 // CreateTestingTransport creates a testing transport that forces call dialing connections to happen locally
 func CreateTestingTransport() *http.Transport {
+
 	dialer := net.Dialer{
 		Timeout:   5 * time.Second,
 		KeepAlive: 5 * time.Second,
@@ -362,6 +332,7 @@ func CreateTestingTransport() *http.Transport {
 
 // AssertLoadError will load a config and expect an error
 func AssertLoadError(t *testing.T, rawConfig string, configType string, expectedError string) {
+
 	tc := NewTester(t)
 
 	err := tc.initServer(rawConfig, configType)
@@ -372,6 +343,7 @@ func AssertLoadError(t *testing.T, rawConfig string, configType string, expected
 
 // AssertRedirect makes a request and asserts the redirection happens
 func (tc *Tester) AssertRedirect(requestURI string, expectedToLocation string, expectedStatusCode int) *http.Response {
+
 	redirectPolicyFunc := func(req *http.Request, via []*http.Request) error {
 		return http.ErrUseLastResponse
 	}
@@ -408,7 +380,8 @@ func (tc *Tester) AssertRedirect(requestURI string, expectedToLocation string, e
 }
 
 // CompareAdapt adapts a config and then compares it against an expected result
-func CompareAdapt(t testing.TB, filename, rawConfig string, adapterName string, expectedResponse string) bool {
+func CompareAdapt(t *testing.T, filename, rawConfig string, adapterName string, expectedResponse string) bool {
+
 	cfgAdapter := caddyconfig.GetAdapter(adapterName)
 	if cfgAdapter == nil {
 		t.Logf("unrecognized config adapter '%s'", adapterName)
@@ -467,7 +440,7 @@ func CompareAdapt(t testing.TB, filename, rawConfig string, adapterName string,
 }
 
 // AssertAdapt adapts a config and then tests it against an expected result
-func AssertAdapt(t testing.TB, rawConfig string, adapterName string, expectedResponse string) {
+func AssertAdapt(t *testing.T, rawConfig string, adapterName string, expectedResponse string) {
 	ok := CompareAdapt(t, "Caddyfile", rawConfig, adapterName, expectedResponse)
 	if !ok {
 		t.Fail()
@@ -476,7 +449,7 @@ func AssertAdapt(t testing.TB, rawConfig string, adapterName string, expectedRes
 
 // Generic request functions
 
-func applyHeaders(t testing.TB, req *http.Request, requestHeaders []string) {
+func applyHeaders(t *testing.T, req *http.Request, requestHeaders []string) {
 	requestContentType := ""
 	for _, requestHeader := range requestHeaders {
 		arr := strings.SplitAfterN(requestHeader, ":", 2)
@@ -496,13 +469,14 @@ func applyHeaders(t testing.TB, req *http.Request, requestHeaders []string) {
 
 // AssertResponseCode will execute the request and verify the status code, returns a response for additional assertions
 func (tc *Tester) AssertResponseCode(req *http.Request, expectedStatusCode int) *http.Response {
+
 	resp, err := tc.Client.Do(req)
 	if err != nil {
 		tc.t.Fatalf("failed to call server %s", err)
 	}
 
 	if expectedStatusCode != resp.StatusCode {
-		tc.t.Errorf("requesting \"%s\" expected status code: %d but got %d", req.URL.RequestURI(), expectedStatusCode, resp.StatusCode)
+		tc.t.Errorf("requesting \"%s\" expected status code: %d but got %d", req.RequestURI, expectedStatusCode, resp.StatusCode)
 	}
 
 	return resp
@@ -510,6 +484,7 @@ func (tc *Tester) AssertResponseCode(req *http.Request, expectedStatusCode int)
 
 // AssertResponse request a URI and assert the status code and the body contains a string
 func (tc *Tester) AssertResponse(req *http.Request, expectedStatusCode int, expectedBody string) (*http.Response, string) {
+
 	resp := tc.AssertResponseCode(req, expectedStatusCode)
 
 	defer resp.Body.Close()
@@ -531,6 +506,7 @@ func (tc *Tester) AssertResponse(req *http.Request, expectedStatusCode int, expe
 
 // AssertGetResponse GET a URI and expect a statusCode and body text
 func (tc *Tester) AssertGetResponse(requestURI string, expectedStatusCode int, expectedBody string) (*http.Response, string) {
+
 	req, err := http.NewRequest("GET", requestURI, nil)
 	if err != nil {
 		tc.t.Fatalf("unable to create request %s", err)
@@ -541,6 +517,7 @@ func (tc *Tester) AssertGetResponse(requestURI string, expectedStatusCode int, e
 
 // AssertDeleteResponse request a URI and expect a statusCode and body text
 func (tc *Tester) AssertDeleteResponse(requestURI string, expectedStatusCode int, expectedBody string) (*http.Response, string) {
+
 	req, err := http.NewRequest("DELETE", requestURI, nil)
 	if err != nil {
 		tc.t.Fatalf("unable to create request %s", err)
@@ -551,6 +528,7 @@ func (tc *Tester) AssertDeleteResponse(requestURI string, expectedStatusCode int
 
 // AssertPostResponseBody POST to a URI and assert the response code and body
 func (tc *Tester) AssertPostResponseBody(requestURI string, requestHeaders []string, requestBody *bytes.Buffer, expectedStatusCode int, expectedBody string) (*http.Response, string) {
+
 	req, err := http.NewRequest("POST", requestURI, requestBody)
 	if err != nil {
 		tc.t.Errorf("failed to create request %s", err)
@@ -564,6 +542,7 @@ func (tc *Tester) AssertPostResponseBody(requestURI string, requestHeaders []str
 
 // AssertPutResponseBody PUT to a URI and assert the response code and body
 func (tc *Tester) AssertPutResponseBody(requestURI string, requestHeaders []string, requestBody *bytes.Buffer, expectedStatusCode int, expectedBody string) (*http.Response, string) {
+
 	req, err := http.NewRequest("PUT", requestURI, requestBody)
 	if err != nil {
 		tc.t.Errorf("failed to create request %s", err)
@@ -577,6 +556,7 @@ func (tc *Tester) AssertPutResponseBody(requestURI string, requestHeaders []stri
 
 // AssertPatchResponseBody PATCH to a URI and assert the response code and body
 func (tc *Tester) AssertPatchResponseBody(requestURI string, requestHeaders []string, requestBody *bytes.Buffer, expectedStatusCode int, expectedBody string) (*http.Response, string) {
+
 	req, err := http.NewRequest("PATCH", requestURI, requestBody)
 	if err != nil {
 		tc.t.Errorf("failed to create request %s", err)

caddytest/caddytest_test.go

@@ -1,7 +1,6 @@
 package caddytest
 
 import (
-	"net/http"
 	"strings"
 	"testing"
 )
@@ -32,97 +31,3 @@ func TestReplaceCertificatePaths(t *testing.T) {
 		t.Error("expected redirect uri to be unchanged")
 	}
 }
-
-func TestLoadUnorderedJSON(t *testing.T) {
-	tester := NewTester(t)
-	tester.InitServer(`
-	{
-		"logging": {
-			"logs": {
-				"default": {
-					"level": "DEBUG",
-					"writer": {
-						"output": "stdout"
-					}
-				},
-				"sStdOutLogs": {
-					"level": "DEBUG",
-					"writer": {
-						"output": "stdout"
-					},
-					"include": [
-						"http.*",
-						"admin.*"
-					]
-				},
-				"sFileLogs": {
-					"level": "DEBUG",
-					"writer": {
-						"output": "stdout"
-					},
-					"include": [
-						"http.*",
-						"admin.*"
-					]
-				}
-			}
-		},
-		"admin": {
-			"listen": "localhost:2999"
-		},
-		"apps": {
-			"pki": {
-				"certificate_authorities" : {
-				  "local" : {
-					"install_trust": false
-				  }
-				}
-			},
-			"http": {
-				"http_port": 9080,
-				"https_port": 9443,
-				"servers": {
-					"s_server": {
-						"listen": [
-							":9080"
-						],
-						"routes": [
-							{
-								"handle": [
-									{
-										"handler": "static_response",
-										"body": "Hello"
-									}
-								]
-							},
-							{
-								"match": [
-									{
-										"host": [
-											"localhost",
-											"127.0.0.1"
-										]
-									}
-								]
-							}
-						],
-						"logs": {
-							"default_logger_name": "sStdOutLogs",
-							"logger_names": {
-								"localhost": "sStdOutLogs",
-								"127.0.0.1": "sFileLogs"
-							}
-						}
-					}
-				}
-			}
-		}
-	}
-  `, "json")
-	req, err := http.NewRequest(http.MethodGet, "http://localhost:9080/", nil)
-	if err != nil {
-		t.Fail()
-		return
-	}
-	tester.AssertResponseCode(req, 200)
-}

caddytest/integration/acme_test.go

@@ -1,208 +0,0 @@
-package integration
-
-import (
-	"context"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"fmt"
-	"log/slog"
-	"net"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/caddyserver/caddy/v2"
-	"github.com/caddyserver/caddy/v2/caddytest"
-	"github.com/mholt/acmez/v3"
-	"github.com/mholt/acmez/v3/acme"
-	smallstepacme "github.com/smallstep/certificates/acme"
-	"go.uber.org/zap"
-	"go.uber.org/zap/exp/zapslog"
-)
-
-const acmeChallengePort = 9081
-
-// Test the basic functionality of Caddy's ACME server
-func TestACMEServerWithDefaults(t *testing.T) {
-	ctx := context.Background()
-	logger, err := zap.NewDevelopment()
-	if err != nil {
-		t.Error(err)
-		return
-	}
-
-	tester := caddytest.NewTester(t)
-	tester.InitServer(`
-	{
-		skip_install_trust
-		admin localhost:2999
-		http_port     9080
-		https_port    9443
-		local_certs
-	}
-	acme.localhost {
-		acme_server
-	}
-  `, "caddyfile")
-
-	client := acmez.Client{
-		Client: &acme.Client{
-			Directory:  "https://acme.localhost:9443/acme/local/directory",
-			HTTPClient: tester.Client,
-			Logger:     slog.New(zapslog.NewHandler(logger.Core())),
-		},
-		ChallengeSolvers: map[string]acmez.Solver{
-			acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
-		},
-	}
-
-	accountPrivateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Errorf("generating account key: %v", err)
-	}
-	account := acme.Account{
-		Contact:              []string{"mailto:you@example.com"},
-		TermsOfServiceAgreed: true,
-		PrivateKey:           accountPrivateKey,
-	}
-	account, err = client.NewAccount(ctx, account)
-	if err != nil {
-		t.Errorf("new account: %v", err)
-		return
-	}
-
-	// Every certificate needs a key.
-	certPrivateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Errorf("generating certificate key: %v", err)
-		return
-	}
-
-	certs, err := client.ObtainCertificateForSANs(ctx, account, certPrivateKey, []string{"localhost"})
-	if err != nil {
-		t.Errorf("obtaining certificate: %v", err)
-		return
-	}
-
-	// ACME servers should usually give you the entire certificate chain
-	// in PEM format, and sometimes even alternate chains! It's up to you
-	// which one(s) to store and use, but whatever you do, be sure to
-	// store the certificate and key somewhere safe and secure, i.e. don't
-	// lose them!
-	for _, cert := range certs {
-		t.Logf("Certificate %q:\n%s\n\n", cert.URL, cert.ChainPEM)
-	}
-}
-
-func TestACMEServerWithMismatchedChallenges(t *testing.T) {
-	ctx := context.Background()
-	logger := caddy.Log().Named("acmez")
-
-	tester := caddytest.NewTester(t)
-	tester.InitServer(`
-	{
-		skip_install_trust
-		admin localhost:2999
-		http_port     9080
-		https_port    9443
-		local_certs
-	}
-	acme.localhost {
-		acme_server {
-			challenges tls-alpn-01
-		}
-	}
-  `, "caddyfile")
-
-	client := acmez.Client{
-		Client: &acme.Client{
-			Directory:  "https://acme.localhost:9443/acme/local/directory",
-			HTTPClient: tester.Client,
-			Logger:     slog.New(zapslog.NewHandler(logger.Core())),
-		},
-		ChallengeSolvers: map[string]acmez.Solver{
-			acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
-		},
-	}
-
-	accountPrivateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Errorf("generating account key: %v", err)
-	}
-	account := acme.Account{
-		Contact:              []string{"mailto:you@example.com"},
-		TermsOfServiceAgreed: true,
-		PrivateKey:           accountPrivateKey,
-	}
-	account, err = client.NewAccount(ctx, account)
-	if err != nil {
-		t.Errorf("new account: %v", err)
-		return
-	}
-
-	// Every certificate needs a key.
-	certPrivateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Errorf("generating certificate key: %v", err)
-		return
-	}
-
-	certs, err := client.ObtainCertificateForSANs(ctx, account, certPrivateKey, []string{"localhost"})
-	if len(certs) > 0 {
-		t.Errorf("expected '0' certificates, but received '%d'", len(certs))
-	}
-	if err == nil {
-		t.Error("expected errors, but received none")
-	}
-	const expectedErrMsg = "no solvers available for remaining challenges (configured=[http-01] offered=[tls-alpn-01] remaining=[tls-alpn-01])"
-	if !strings.Contains(err.Error(), expectedErrMsg) {
-		t.Errorf(`received error message does not match expectation: expected="%s" received="%s"`, expectedErrMsg, err.Error())
-	}
-}
-
-// naiveHTTPSolver is a no-op acmez.Solver for example purposes only.
-type naiveHTTPSolver struct {
-	srv    *http.Server
-	logger *zap.Logger
-}
-
-func (s *naiveHTTPSolver) Present(ctx context.Context, challenge acme.Challenge) error {
-	smallstepacme.InsecurePortHTTP01 = acmeChallengePort
-	s.srv = &http.Server{
-		Addr: fmt.Sprintf(":%d", acmeChallengePort),
-		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			host, _, err := net.SplitHostPort(r.Host)
-			if err != nil {
-				host = r.Host
-			}
-			s.logger.Info("received request on challenge server", zap.String("path", r.URL.Path))
-			if r.Method == "GET" && r.URL.Path == challenge.HTTP01ResourcePath() && strings.EqualFold(host, challenge.Identifier.Value) {
-				w.Header().Add("Content-Type", "text/plain")
-				w.Write([]byte(challenge.KeyAuthorization))
-				r.Close = true
-				s.logger.Info("served key authentication",
-					zap.String("identifier", challenge.Identifier.Value),
-					zap.String("challenge", "http-01"),
-					zap.String("remote", r.RemoteAddr),
-				)
-			}
-		}),
-	}
-	l, err := net.Listen("tcp", fmt.Sprintf(":%d", acmeChallengePort))
-	if err != nil {
-		return err
-	}
-	s.logger.Info("present challenge", zap.Any("challenge", challenge))
-	go s.srv.Serve(l)
-	return nil
-}
-
-func (s naiveHTTPSolver) CleanUp(ctx context.Context, challenge acme.Challenge) error {
-	smallstepacme.InsecurePortHTTP01 = 0
-	s.logger.Info("cleanup", zap.Any("challenge", challenge))
-	if s.srv != nil {
-		s.srv.Close()
-	}
-	return nil
-}

caddytest/integration/acmeserver_test.go

@@ -1,206 +0,0 @@
-package integration
-
-import (
-	"context"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"log/slog"
-	"strings"
-	"testing"
-
-	"github.com/caddyserver/caddy/v2/caddytest"
-	"github.com/mholt/acmez/v3"
-	"github.com/mholt/acmez/v3/acme"
-	"go.uber.org/zap"
-	"go.uber.org/zap/exp/zapslog"
-)
-
-func TestACMEServerDirectory(t *testing.T) {
-	tester := caddytest.NewTester(t)
-	tester.InitServer(`
-	{
-		skip_install_trust
-		local_certs
-		admin localhost:2999
-		http_port     9080
-		https_port    9443
-		pki {
-			ca local {
-				name "Caddy Local Authority"
-			}
-		}
-	}
-	acme.localhost:9443 {
-		acme_server
-	}
-  `, "caddyfile")
-	tester.AssertGetResponse(
-		"https://acme.localhost:9443/acme/local/directory",
-		200,
-		`{"newNonce":"https://acme.localhost:9443/acme/local/new-nonce","newAccount":"https://acme.localhost:9443/acme/local/new-account","newOrder":"https://acme.localhost:9443/acme/local/new-order","revokeCert":"https://acme.localhost:9443/acme/local/revoke-cert","keyChange":"https://acme.localhost:9443/acme/local/key-change"}
-`)
-}
-
-func TestACMEServerAllowPolicy(t *testing.T) {
-	tester := caddytest.NewTester(t)
-	tester.InitServer(`
-	{
-		skip_install_trust
-		local_certs
-		admin localhost:2999
-		http_port     9080
-		https_port    9443
-		pki {
-			ca local {
-				name "Caddy Local Authority"
-			}
-		}
-	}
-	acme.localhost {
-		acme_server {
-			challenges http-01
-			allow {
-				domains localhost
-			}
-		}
-	}
-  `, "caddyfile")
-
-	ctx := context.Background()
-	logger, err := zap.NewDevelopment()
-	if err != nil {
-		t.Error(err)
-		return
-	}
-
-	client := acmez.Client{
-		Client: &acme.Client{
-			Directory:  "https://acme.localhost:9443/acme/local/directory",
-			HTTPClient: tester.Client,
-			Logger:     slog.New(zapslog.NewHandler(logger.Core())),
-		},
-		ChallengeSolvers: map[string]acmez.Solver{
-			acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
-		},
-	}
-
-	accountPrivateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Errorf("generating account key: %v", err)
-	}
-	account := acme.Account{
-		Contact:              []string{"mailto:you@example.com"},
-		TermsOfServiceAgreed: true,
-		PrivateKey:           accountPrivateKey,
-	}
-	account, err = client.NewAccount(ctx, account)
-	if err != nil {
-		t.Errorf("new account: %v", err)
-		return
-	}
-
-	// Every certificate needs a key.
-	certPrivateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Errorf("generating certificate key: %v", err)
-		return
-	}
-	{
-		certs, err := client.ObtainCertificateForSANs(ctx, account, certPrivateKey, []string{"localhost"})
-		if err != nil {
-			t.Errorf("obtaining certificate for allowed domain: %v", err)
-			return
-		}
-
-		// ACME servers should usually give you the entire certificate chain
-		// in PEM format, and sometimes even alternate chains! It's up to you
-		// which one(s) to store and use, but whatever you do, be sure to
-		// store the certificate and key somewhere safe and secure, i.e. don't
-		// lose them!
-		for _, cert := range certs {
-			t.Logf("Certificate %q:\n%s\n\n", cert.URL, cert.ChainPEM)
-		}
-	}
-	{
-		_, err := client.ObtainCertificateForSANs(ctx, account, certPrivateKey, []string{"not-matching.localhost"})
-		if err == nil {
-			t.Errorf("obtaining certificate for 'not-matching.localhost' domain")
-		} else if err != nil && !strings.Contains(err.Error(), "urn:ietf:params:acme:error:rejectedIdentifier") {
-			t.Logf("unexpected error: %v", err)
-		}
-	}
-}
-
-func TestACMEServerDenyPolicy(t *testing.T) {
-	tester := caddytest.NewTester(t)
-	tester.InitServer(`
-	{
-		skip_install_trust
-		local_certs
-		admin localhost:2999
-		http_port     9080
-		https_port    9443
-		pki {
-			ca local {
-				name "Caddy Local Authority"
-			}
-		}
-	}
-	acme.localhost {
-		acme_server {
-			deny {
-				domains deny.localhost
-			}
-		}
-	}
-  `, "caddyfile")
-
-	ctx := context.Background()
-	logger, err := zap.NewDevelopment()
-	if err != nil {
-		t.Error(err)
-		return
-	}
-
-	client := acmez.Client{
-		Client: &acme.Client{
-			Directory:  "https://acme.localhost:9443/acme/local/directory",
-			HTTPClient: tester.Client,
-			Logger:     slog.New(zapslog.NewHandler(logger.Core())),
-		},
-		ChallengeSolvers: map[string]acmez.Solver{
-			acme.ChallengeTypeHTTP01: &naiveHTTPSolver{logger: logger},
-		},
-	}
-
-	accountPrivateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Errorf("generating account key: %v", err)
-	}
-	account := acme.Account{
-		Contact:              []string{"mailto:you@example.com"},
-		TermsOfServiceAgreed: true,
-		PrivateKey:           accountPrivateKey,
-	}
-	account, err = client.NewAccount(ctx, account)
-	if err != nil {
-		t.Errorf("new account: %v", err)
-		return
-	}
-
-	// Every certificate needs a key.
-	certPrivateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		t.Errorf("generating certificate key: %v", err)
-		return
-	}
-	{
-		_, err := client.ObtainCertificateForSANs(ctx, account, certPrivateKey, []string{"deny.localhost"})
-		if err == nil {
-			t.Errorf("obtaining certificate for 'deny.localhost' domain")
-		} else if err != nil && !strings.Contains(err.Error(), "urn:ietf:params:acme:error:rejectedIdentifier") {
-			t.Logf("unexpected error: %v", err)
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/acme_server_custom_challenges.caddyfiletest

@@ -1,65 +0,0 @@
-{
-	pki {
-		ca custom-ca {
-			name "Custom CA"
-		}
-	}
-}
-
-acme.example.com {
-	acme_server {
-		ca custom-ca
-		challenges dns-01
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"acme.example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"ca": "custom-ca",
-													"challenges": [
-														"dns-01"
-													],
-													"handler": "acme_server"
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"pki": {
-			"certificate_authorities": {
-				"custom-ca": {
-					"name": "Custom CA"
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/acme_server_default_challenges.caddyfiletest

@@ -1,62 +0,0 @@
-{
-	pki {
-		ca custom-ca {
-			name "Custom CA"
-		}
-	}
-}
-
-acme.example.com {
-	acme_server {
-		ca custom-ca
-		challenges
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"acme.example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"ca": "custom-ca",
-													"handler": "acme_server"
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"pki": {
-			"certificate_authorities": {
-				"custom-ca": {
-					"name": "Custom CA"
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/acme_server_multi_custom_challenges.caddyfiletest

@@ -1,66 +0,0 @@
-{
-	pki {
-		ca custom-ca {
-			name "Custom CA"
-		}
-	}
-}
-
-acme.example.com {
-	acme_server {
-		ca custom-ca
-		challenges dns-01 http-01
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"acme.example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"ca": "custom-ca",
-													"challenges": [
-														"dns-01",
-														"http-01"
-													],
-													"handler": "acme_server"
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"pki": {
-			"certificate_authorities": {
-				"custom-ca": {
-					"name": "Custom CA"
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/acme_server_policy-allow.caddyfiletest

@@ -1,72 +0,0 @@
-{
-	pki {
-		ca custom-ca {
-			name "Custom CA"
-		}
-	}
-}
-
-acme.example.com {
-	acme_server {
-		ca custom-ca
-		allow {
-			domains host-1.internal.example.com host-2.internal.example.com
-		}
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"acme.example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"ca": "custom-ca",
-													"handler": "acme_server",
-													"policy": {
-														"allow": {
-															"domains": [
-																"host-1.internal.example.com",
-																"host-2.internal.example.com"
-															]
-														}
-													}
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"pki": {
-			"certificate_authorities": {
-				"custom-ca": {
-					"name": "Custom CA"
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/acme_server_policy-both.caddyfiletest

@@ -1,80 +0,0 @@
-{
-	pki {
-		ca custom-ca {
-			name "Custom CA"
-		}
-	}
-}
-
-acme.example.com {
-	acme_server {
-		ca custom-ca
-		allow {
-			domains host-1.internal.example.com host-2.internal.example.com
-		}
-		deny {
-			domains dc.internal.example.com
-		}
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"acme.example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"ca": "custom-ca",
-													"handler": "acme_server",
-													"policy": {
-														"allow": {
-															"domains": [
-																"host-1.internal.example.com",
-																"host-2.internal.example.com"
-															]
-														},
-														"deny": {
-															"domains": [
-																"dc.internal.example.com"
-															]
-														}
-													}
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"pki": {
-			"certificate_authorities": {
-				"custom-ca": {
-					"name": "Custom CA"
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/acme_server_policy-deny.caddyfiletest

@@ -1,71 +0,0 @@
-{
-	pki {
-		ca custom-ca {
-			name "Custom CA"
-		}
-	}
-}
-
-acme.example.com {
-	acme_server {
-		ca custom-ca
-		deny {
-			domains dc.internal.example.com
-		}
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"acme.example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"ca": "custom-ca",
-													"handler": "acme_server",
-													"policy": {
-														"deny": {
-															"domains": [
-																"dc.internal.example.com"
-															]
-														}
-													}
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"pki": {
-			"certificate_authorities": {
-				"custom-ca": {
-					"name": "Custom CA"
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/acme_server_sign_with_root.caddyfiletest

@@ -1,67 +0,0 @@
-{
-	pki {
-		ca internal {
-			name "Internal"
-			root_cn "Internal Root Cert"
-			intermediate_cn "Internal Intermediate Cert"
-		}
-	}
-}
-acme.example.com {
-	acme_server {
-		ca internal
-		sign_with_root
-	}
-}
-
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"acme.example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"ca": "internal",
-													"handler": "acme_server",
-													"sign_with_root": true
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		},
-		"pki": {
-			"certificate_authorities": {
-				"internal": {
-					"name": "Internal",
-					"root_common_name": "Internal Root Cert",
-					"intermediate_common_name": "Internal Intermediate Cert"
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/bind_fd_fdgram_h123.caddyfiletest

@@ -1,142 +0,0 @@
-{
-	auto_https disable_redirects
-	admin off
-}
-
-http://localhost {
-	bind fd/{env.CADDY_HTTP_FD} {
-		protocols h1
-	}
-	log
-	respond "Hello, HTTP!"
-}
-
-https://localhost {
-	bind fd/{env.CADDY_HTTPS_FD} {
-		protocols h1 h2
-	}
-	bind fdgram/{env.CADDY_HTTP3_FD} {
-		protocols h3
-	}
-	log
-	respond "Hello, HTTPS!"
-}
-----------
-{
-	"admin": {
-		"disabled": true
-	},
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						"fd/{env.CADDY_HTTPS_FD}",
-						"fdgram/{env.CADDY_HTTP3_FD}"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"body": "Hello, HTTPS!",
-													"handler": "static_response"
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					],
-					"automatic_https": {
-						"disable_redirects": true
-					},
-					"logs": {
-						"logger_names": {
-							"localhost": [
-								""
-							]
-						}
-					},
-					"listen_protocols": [
-						[
-							"h1",
-							"h2"
-						],
-						[
-							"h3"
-						]
-					]
-				},
-				"srv1": {
-					"automatic_https": {
-						"disable_redirects": true
-					}
-				},
-				"srv2": {
-					"listen": [
-						"fd/{env.CADDY_HTTP_FD}"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"body": "Hello, HTTP!",
-													"handler": "static_response"
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					],
-					"automatic_https": {
-						"disable_redirects": true,
-						"skip": [
-							"localhost"
-						]
-					},
-					"logs": {
-						"logger_names": {
-							"localhost": [
-								""
-							]
-						}
-					},
-					"listen_protocols": [
-						[
-							"h1"
-						]
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/enable_tls_for_catch_all_site.caddyfiletest

@@ -1,37 +0,0 @@
-:8443 {
-	tls internal {
-		on_demand
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":8443"
-					],
-					"tls_connection_policies": [
-						{}
-					]
-				}
-			}
-		},
-		"tls": {
-			"automation": {
-				"policies": [
-					{
-						"issuers": [
-							{
-								"module": "internal"
-							}
-						],
-						"on_demand": true
-					}
-				]
-			}
-		}
-	}
-}
-

caddytest/integration/caddyfile_adapt/encode_options.txt

@@ -11,7 +11,6 @@ encode gzip zstd {
 		header Content-Type application/xhtml+xml*
 		header Content-Type application/atom+xml*
 		header Content-Type application/rss+xml*
-		header Content-Type application/wasm*
 		header Content-Type image/svg+xml*
 	}
 }
@@ -21,8 +20,6 @@ encode {
 	zstd
 	gzip 5
 }
-
-encode
 ----------
 {
 	"apps": {
@@ -50,7 +47,6 @@ encode
 												"application/xhtml+xml*",
 												"application/atom+xml*",
 												"application/rss+xml*",
-												"application/wasm*",
 												"image/svg+xml*"
 											]
 										},
@@ -78,17 +74,6 @@ encode
 										"zstd",
 										"gzip"
 									]
-								},
-								{
-									"encodings": {
-										"gzip": {},
-										"zstd": {}
-									},
-									"handler": "encode",
-									"prefer": [
-										"zstd",
-										"gzip"
-									]
 								}
 							]
 						}

caddytest/integration/caddyfile_adapt/error_multi_site_blocks.caddyfiletest

@@ -1,245 +0,0 @@
-foo.localhost {
-	root * /srv
-	error /private* "Unauthorized" 410
-	error /fivehundred* "Internal Server Error" 500
-
-	handle_errors 5xx {
-		respond "Error In range [500 .. 599]"
-	}
-	handle_errors 410 {
-		respond "404 or 410 error"
-	}
-}
-
-bar.localhost {
-	root * /srv
-	error /private* "Unauthorized" 410
-	error /fivehundred* "Internal Server Error" 500
-
-	handle_errors 5xx {
-		respond "Error In range [500 .. 599] from second site"
-	}
-	handle_errors 410 {
-		respond "404 or 410 error from second site"
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"foo.localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handler": "vars",
-													"root": "/srv"
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Internal Server Error",
-													"handler": "error",
-													"status_code": 500
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/fivehundred*"
-													]
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Unauthorized",
-													"handler": "error",
-													"status_code": 410
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/private*"
-													]
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						},
-						{
-							"match": [
-								{
-									"host": [
-										"bar.localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handler": "vars",
-													"root": "/srv"
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Internal Server Error",
-													"handler": "error",
-													"status_code": 500
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/fivehundred*"
-													]
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Unauthorized",
-													"handler": "error",
-													"status_code": 410
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/private*"
-													]
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					],
-					"errors": {
-						"routes": [
-							{
-								"match": [
-									{
-										"host": [
-											"foo.localhost"
-										]
-									}
-								],
-								"handle": [
-									{
-										"handler": "subroute",
-										"routes": [
-											{
-												"handle": [
-													{
-														"body": "404 or 410 error",
-														"handler": "static_response"
-													}
-												],
-												"match": [
-													{
-														"expression": "{http.error.status_code} in [410]"
-													}
-												]
-											},
-											{
-												"handle": [
-													{
-														"body": "Error In range [500 .. 599]",
-														"handler": "static_response"
-													}
-												],
-												"match": [
-													{
-														"expression": "{http.error.status_code} \u003e= 500 \u0026\u0026 {http.error.status_code} \u003c= 599"
-													}
-												]
-											}
-										]
-									}
-								],
-								"terminal": true
-							},
-							{
-								"match": [
-									{
-										"host": [
-											"bar.localhost"
-										]
-									}
-								],
-								"handle": [
-									{
-										"handler": "subroute",
-										"routes": [
-											{
-												"handle": [
-													{
-														"body": "404 or 410 error from second site",
-														"handler": "static_response"
-													}
-												],
-												"match": [
-													{
-														"expression": "{http.error.status_code} in [410]"
-													}
-												]
-											},
-											{
-												"handle": [
-													{
-														"body": "Error In range [500 .. 599] from second site",
-														"handler": "static_response"
-													}
-												],
-												"match": [
-													{
-														"expression": "{http.error.status_code} \u003e= 500 \u0026\u0026 {http.error.status_code} \u003c= 599"
-													}
-												]
-											}
-										]
-									}
-								],
-								"terminal": true
-							}
-						]
-					}
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/error_range_codes.caddyfiletest

@@ -1,120 +0,0 @@
-{
-	http_port 3010
-}
-localhost:3010 {
-	root * /srv
-	error /private* "Unauthorized" 410
-	error /hidden* "Not found" 404
-
-	handle_errors 4xx {
-		respond "Error in the [400 .. 499] range"
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"http_port": 3010,
-			"servers": {
-				"srv0": {
-					"listen": [
-						":3010"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handler": "vars",
-													"root": "/srv"
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Unauthorized",
-													"handler": "error",
-													"status_code": 410
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/private*"
-													]
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Not found",
-													"handler": "error",
-													"status_code": 404
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/hidden*"
-													]
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					],
-					"errors": {
-						"routes": [
-							{
-								"match": [
-									{
-										"host": [
-											"localhost"
-										]
-									}
-								],
-								"handle": [
-									{
-										"handler": "subroute",
-										"routes": [
-											{
-												"handle": [
-													{
-														"body": "Error in the [400 .. 499] range",
-														"handler": "static_response"
-													}
-												],
-												"match": [
-													{
-														"expression": "{http.error.status_code} \u003e= 400 \u0026\u0026 {http.error.status_code} \u003c= 499"
-													}
-												]
-											}
-										]
-									}
-								],
-								"terminal": true
-							}
-						]
-					}
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/error_range_simple_codes.caddyfiletest

@@ -1,153 +0,0 @@
-{
-	http_port 2099
-}
-localhost:2099 {
-	root * /srv
-	error /private* "Unauthorized" 410
-	error /threehundred* "Moved Permanently" 301
-	error /internalerr* "Internal Server Error" 500
-
-	handle_errors 500 3xx {
-		respond "Error code is equal to 500 or in the [300..399] range"
-	}
-	handle_errors 4xx {
-		respond "Error in the [400 .. 499] range"
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"http_port": 2099,
-			"servers": {
-				"srv0": {
-					"listen": [
-						":2099"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handler": "vars",
-													"root": "/srv"
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Moved Permanently",
-													"handler": "error",
-													"status_code": 301
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/threehundred*"
-													]
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Internal Server Error",
-													"handler": "error",
-													"status_code": 500
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/internalerr*"
-													]
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Unauthorized",
-													"handler": "error",
-													"status_code": 410
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/private*"
-													]
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					],
-					"errors": {
-						"routes": [
-							{
-								"match": [
-									{
-										"host": [
-											"localhost"
-										]
-									}
-								],
-								"handle": [
-									{
-										"handler": "subroute",
-										"routes": [
-											{
-												"handle": [
-													{
-														"body": "Error in the [400 .. 499] range",
-														"handler": "static_response"
-													}
-												],
-												"match": [
-													{
-														"expression": "{http.error.status_code} \u003e= 400 \u0026\u0026 {http.error.status_code} \u003c= 499"
-													}
-												]
-											},
-											{
-												"handle": [
-													{
-														"body": "Error code is equal to 500 or in the [300..399] range",
-														"handler": "static_response"
-													}
-												],
-												"match": [
-													{
-														"expression": "{http.error.status_code} \u003e= 300 \u0026\u0026 {http.error.status_code} \u003c= 399 || {http.error.status_code} in [500]"
-													}
-												]
-											}
-										]
-									}
-								],
-								"terminal": true
-							}
-						]
-					}
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/error_simple_codes.caddyfiletest

@@ -1,120 +0,0 @@
-{
-	http_port 3010
-}
-localhost:3010 {
-	root * /srv
-	error /private* "Unauthorized" 410
-	error /hidden* "Not found" 404
-
-	handle_errors 404 410 {
-		respond "404 or 410 error"
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"http_port": 3010,
-			"servers": {
-				"srv0": {
-					"listen": [
-						":3010"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handler": "vars",
-													"root": "/srv"
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Unauthorized",
-													"handler": "error",
-													"status_code": 410
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/private*"
-													]
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Not found",
-													"handler": "error",
-													"status_code": 404
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/hidden*"
-													]
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					],
-					"errors": {
-						"routes": [
-							{
-								"match": [
-									{
-										"host": [
-											"localhost"
-										]
-									}
-								],
-								"handle": [
-									{
-										"handler": "subroute",
-										"routes": [
-											{
-												"handle": [
-													{
-														"body": "404 or 410 error",
-														"handler": "static_response"
-													}
-												],
-												"match": [
-													{
-														"expression": "{http.error.status_code} in [404, 410]"
-													}
-												]
-											}
-										]
-									}
-								],
-								"terminal": true
-							}
-						]
-					}
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/error_sort.caddyfiletest

@@ -1,148 +0,0 @@
-{
-	http_port 2099
-}
-localhost:2099 {
-	root * /srv
-	error /private* "Unauthorized" 410
-	error /hidden* "Not found" 404
-	error /internalerr* "Internal Server Error" 500
-
-	handle_errors {
-		respond "Fallback route: code outside the [400..499] range"
-	}
-	handle_errors 4xx {
-		respond "Error in the [400 .. 499] range"
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"http_port": 2099,
-			"servers": {
-				"srv0": {
-					"listen": [
-						":2099"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"localhost"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handler": "vars",
-													"root": "/srv"
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Internal Server Error",
-													"handler": "error",
-													"status_code": 500
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/internalerr*"
-													]
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Unauthorized",
-													"handler": "error",
-													"status_code": 410
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/private*"
-													]
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"error": "Not found",
-													"handler": "error",
-													"status_code": 404
-												}
-											],
-											"match": [
-												{
-													"path": [
-														"/hidden*"
-													]
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					],
-					"errors": {
-						"routes": [
-							{
-								"match": [
-									{
-										"host": [
-											"localhost"
-										]
-									}
-								],
-								"handle": [
-									{
-										"handler": "subroute",
-										"routes": [
-											{
-												"handle": [
-													{
-														"body": "Error in the [400 .. 499] range",
-														"handler": "static_response"
-													}
-												],
-												"match": [
-													{
-														"expression": "{http.error.status_code} \u003e= 400 \u0026\u0026 {http.error.status_code} \u003c= 499"
-													}
-												]
-											},
-											{
-												"handle": [
-													{
-														"body": "Fallback route: code outside the [400..499] range",
-														"handler": "static_response"
-													}
-												]
-											}
-										]
-									}
-								],
-								"terminal": true
-							}
-						]
-					}
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/expression_quotes.txt

@@ -1,7 +1,3 @@
-(snippet) {
-	@g `{http.error.status_code} == 404`
-}
-
 example.com
 
 @a expression {http.error.status_code} == 400
@@ -18,12 +14,6 @@ abort @d
 
 @e expression `{http.error.status_code} == 404`
 abort @e
-
-@f `{http.error.status_code} == 404`
-abort @f
-
-import snippet
-abort @g
 ----------
 {
 	"apps": {
@@ -94,10 +84,7 @@ abort @g
 											],
 											"match": [
 												{
-													"expression": {
+													"expression": "{http.error.status_code} == 403"
-														"expr": "{http.error.status_code} == 403",
-														"name": "d"
-													}
 												}
 											]
 										},
@@ -110,42 +97,7 @@ abort @g
 											],
 											"match": [
 												{
-													"expression": {
+													"expression": "{http.error.status_code} == 404"
-														"expr": "{http.error.status_code} == 404",
-														"name": "e"
-													}
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"abort": true,
-													"handler": "static_response"
-												}
-											],
-											"match": [
-												{
-													"expression": {
-														"expr": "{http.error.status_code} == 404",
-														"name": "f"
-													}
-												}
-											]
-										},
-										{
-											"handle": [
-												{
-													"abort": true,
-													"handler": "static_response"
-												}
-											],
-											"match": [
-												{
-													"expression": {
-														"expr": "{http.error.status_code} == 404",
-														"name": "g"
-													}
 												}
 											]
 										}

caddytest/integration/caddyfile_adapt/file_server_etag_file_extensions.caddyfiletest

@@ -1,40 +0,0 @@
-:8080 {
-	root * ./
-	file_server {
-		etag_file_extensions .b3sum .sha256
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":8080"
-					],
-					"routes": [
-						{
-							"handle": [
-								{
-									"handler": "vars",
-									"root": "./"
-								},
-								{
-									"etag_file_extensions": [
-										".b3sum",
-										".sha256"
-									],
-									"handler": "file_server",
-									"hide": [
-										"./Caddyfile"
-									]
-								}
-							]
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/file_server_file_limit.caddyfiletest

@@ -1,36 +0,0 @@
-:80
-
-file_server {
-	browse {
-		file_limit 4000
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":80"
-					],
-					"routes": [
-						{
-							"handle": [
-								{
-									"browse": {
-										"file_limit": 4000
-									},
-									"handler": "file_server",
-									"hide": [
-										"./Caddyfile"
-									]
-								}
-							]
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/file_server_precompressed.txt

@@ -3,10 +3,6 @@
 file_server {
 	precompressed zstd br gzip
 }
-
-file_server {
-	precompressed
-}
 ----------
 {
 	"apps": {
@@ -34,22 +30,6 @@ file_server {
 										"br",
 										"gzip"
 									]
-								},
-								{
-									"handler": "file_server",
-									"hide": [
-										"./Caddyfile"
-									],
-									"precompressed": {
-										"br": {},
-										"gzip": {},
-										"zstd": {}
-									},
-									"precompressed_order": [
-										"br",
-										"zstd",
-										"gzip"
-									]
 								}
 							]
 						}

caddytest/integration/caddyfile_adapt/file_server_sort.caddyfiletest

@@ -1,39 +0,0 @@
-:80
-
-file_server {
-	browse {
-		sort size desc
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":80"
-					],
-					"routes": [
-						{
-							"handle": [
-								{
-									"browse": {
-										"sort": [
-											"size",
-											"desc"
-										]
-									},
-									"handler": "file_server",
-									"hide": [
-										"./Caddyfile"
-									]
-								}
-							]
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/forward_auth_authelia.caddyfiletest

@@ -1,203 +0,0 @@
-app.example.com {
-	forward_auth authelia:9091 {
-		uri /api/authz/forward-auth
-		copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
-	}
-
-	reverse_proxy backend:8080
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":443"
-					],
-					"routes": [
-						{
-							"match": [
-								{
-									"host": [
-										"app.example.com"
-									]
-								}
-							],
-							"handle": [
-								{
-									"handler": "subroute",
-									"routes": [
-										{
-											"handle": [
-												{
-													"handle_response": [
-														{
-															"match": {
-																"status_code": [
-																	2
-																]
-															},
-															"routes": [
-																{
-																	"handle": [
-																		{
-																			"handler": "vars"
-																		}
-																	]
-																},
-																{
-																	"handle": [
-																		{
-																			"handler": "headers",
-																			"request": {
-																				"set": {
-																					"Remote-Email": [
-																						"{http.reverse_proxy.header.Remote-Email}"
-																					]
-																				}
-																			}
-																		}
-																	],
-																	"match": [
-																		{
-																			"not": [
-																				{
-																					"vars": {
-																						"{http.reverse_proxy.header.Remote-Email}": [
-																							""
-																						]
-																					}
-																				}
-																			]
-																		}
-																	]
-																},
-																{
-																	"handle": [
-																		{
-																			"handler": "headers",
-																			"request": {
-																				"set": {
-																					"Remote-Groups": [
-																						"{http.reverse_proxy.header.Remote-Groups}"
-																					]
-																				}
-																			}
-																		}
-																	],
-																	"match": [
-																		{
-																			"not": [
-																				{
-																					"vars": {
-																						"{http.reverse_proxy.header.Remote-Groups}": [
-																							""
-																						]
-																					}
-																				}
-																			]
-																		}
-																	]
-																},
-																{
-																	"handle": [
-																		{
-																			"handler": "headers",
-																			"request": {
-																				"set": {
-																					"Remote-Name": [
-																						"{http.reverse_proxy.header.Remote-Name}"
-																					]
-																				}
-																			}
-																		}
-																	],
-																	"match": [
-																		{
-																			"not": [
-																				{
-																					"vars": {
-																						"{http.reverse_proxy.header.Remote-Name}": [
-																							""
-																						]
-																					}
-																				}
-																			]
-																		}
-																	]
-																},
-																{
-																	"handle": [
-																		{
-																			"handler": "headers",
-																			"request": {
-																				"set": {
-																					"Remote-User": [
-																						"{http.reverse_proxy.header.Remote-User}"
-																					]
-																				}
-																			}
-																		}
-																	],
-																	"match": [
-																		{
-																			"not": [
-																				{
-																					"vars": {
-																						"{http.reverse_proxy.header.Remote-User}": [
-																							""
-																						]
-																					}
-																				}
-																			]
-																		}
-																	]
-																}
-															]
-														}
-													],
-													"handler": "reverse_proxy",
-													"headers": {
-														"request": {
-															"set": {
-																"X-Forwarded-Method": [
-																	"{http.request.method}"
-																],
-																"X-Forwarded-Uri": [
-																	"{http.request.uri}"
-																]
-															}
-														}
-													},
-													"rewrite": {
-														"method": "GET",
-														"uri": "/api/authz/forward-auth"
-													},
-													"upstreams": [
-														{
-															"dial": "authelia:9091"
-														}
-													]
-												},
-												{
-													"handler": "reverse_proxy",
-													"upstreams": [
-														{
-															"dial": "backend:8080"
-														}
-													]
-												}
-											]
-										}
-									]
-								}
-							],
-							"terminal": true
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/forward_auth_authelia.txt

@@ -0,0 +1,111 @@
+app.example.com {
+	forward_auth authelia:9091 {
+		uri /api/verify?rd=https://authelia.example.com
+		copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
+	}
+
+	reverse_proxy backend:8080
+}
+----------
+{
+	"apps": {
+		"http": {
+			"servers": {
+				"srv0": {
+					"listen": [
+						":443"
+					],
+					"routes": [
+						{
+							"match": [
+								{
+									"host": [
+										"app.example.com"
+									]
+								}
+							],
+							"handle": [
+								{
+									"handler": "subroute",
+									"routes": [
+										{
+											"handle": [
+												{
+													"handle_response": [
+														{
+															"match": {
+																"status_code": [
+																	2
+																]
+															},
+															"routes": [
+																{
+																	"handle": [
+																		{
+																			"handler": "headers",
+																			"request": {
+																				"set": {
+																					"Remote-Email": [
+																						"{http.reverse_proxy.header.Remote-Email}"
+																					],
+																					"Remote-Groups": [
+																						"{http.reverse_proxy.header.Remote-Groups}"
+																					],
+																					"Remote-Name": [
+																						"{http.reverse_proxy.header.Remote-Name}"
+																					],
+																					"Remote-User": [
+																						"{http.reverse_proxy.header.Remote-User}"
+																					]
+																				}
+																			}
+																		}
+																	]
+																}
+															]
+														}
+													],
+													"handler": "reverse_proxy",
+													"headers": {
+														"request": {
+															"set": {
+																"X-Forwarded-Method": [
+																	"{http.request.method}"
+																],
+																"X-Forwarded-Uri": [
+																	"{http.request.uri}"
+																]
+															}
+														}
+													},
+													"rewrite": {
+														"method": "GET",
+														"uri": "/api/verify?rd=https://authelia.example.com"
+													},
+													"upstreams": [
+														{
+															"dial": "authelia:9091"
+														}
+													]
+												},
+												{
+													"handler": "reverse_proxy",
+													"upstreams": [
+														{
+															"dial": "backend:8080"
+														}
+													]
+												}
+											]
+										}
+									]
+								}
+							],
+							"terminal": true
+						}
+					]
+				}
+			}
+		}
+	}
+}

caddytest/integration/caddyfile_adapt/forward_auth_rename_headers.caddyfiletest

@@ -1,206 +0,0 @@
-:8881
-
-forward_auth localhost:9000 {
-	uri /auth
-	copy_headers A>1 B C>3 {
-		D
-		E>5
-	}
-}
-----------
-{
-	"apps": {
-		"http": {
-			"servers": {
-				"srv0": {
-					"listen": [
-						":8881"
-					],
-					"routes": [
-						{
-							"handle": [
-								{
-									"handle_response": [
-										{
-											"match": {
-												"status_code": [
-													2
-												]
-											},
-											"routes": [
-												{
-													"handle": [
-														{
-															"handler": "vars"
-														}
-													]
-												},
-												{
-													"handle": [
-														{
-															"handler": "headers",
-															"request": {
-																"set": {
-																	"1": [
-																		"{http.reverse_proxy.header.A}"
-																	]
-																}
-															}
-														}
-													],
-													"match": [
-														{
-															"not": [
-																{
-																	"vars": {
-																		"{http.reverse_proxy.header.A}": [
-																			""
-																		]
-																	}
-																}
-															]
-														}
-													]
-												},
-												{
-													"handle": [
-														{
-															"handler": "headers",
-															"request": {
-																"set": {
-																	"B": [
-																		"{http.reverse_proxy.header.B}"
-																	]
-																}
-															}
-														}
-													],
-													"match": [
-														{
-															"not": [
-																{
-																	"vars": {
-																		"{http.reverse_proxy.header.B}": [
-																			""
-																		]
-																	}
-																}
-															]
-														}
-													]
-												},
-												{
-													"handle": [
-														{
-															"handler": "headers",
-															"request": {
-																"set": {
-																	"3": [
-																		"{http.reverse_proxy.header.C}"
-																	]
-																}
-															}
-														}
-													],
-													"match": [
-														{
-															"not": [
-																{
-																	"vars": {
-																		"{http.reverse_proxy.header.C}": [
-																			""
-																		]
-																	}
-																}
-															]
-														}
-													]
-												},
-												{
-													"handle": [
-														{
-															"handler": "headers",
-															"request": {
-																"set": {
-																	"D": [
-																		"{http.reverse_proxy.header.D}"
-																	]
-																}
-															}
-														}
-													],
-													"match": [
-														{
-															"not": [
-																{
-																	"vars": {
-																		"{http.reverse_proxy.header.D}": [
-																			""
-																		]
-																	}
-																}
-															]
-														}
-													]
-												},
-												{
-													"handle": [
-														{
-															"handler": "headers",
-															"request": {
-																"set": {
-																	"5": [
-																		"{http.reverse_proxy.header.E}"
-																	]
-																}
-															}
-														}
-													],
-													"match": [
-														{
-															"not": [
-																{
-																	"vars": {
-																		"{http.reverse_proxy.header.E}": [
-																			""
-																		]
-																	}
-																}
-															]
-														}
-													]
-												}
-											]
-										}
-									],
-									"handler": "reverse_proxy",
-									"headers": {
-										"request": {
-											"set": {
-												"X-Forwarded-Method": [
-													"{http.request.method}"
-												],
-												"X-Forwarded-Uri": [
-													"{http.request.uri}"
-												]
-											}
-										}
-									},
-									"rewrite": {
-										"method": "GET",
-										"uri": "/auth"
-									},
-									"upstreams": [
-										{
-											"dial": "localhost:9000"
-										}
-									]
-								}
-							]
-						}
-					]
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/forward_auth_rename_headers.txt

@@ -0,0 +1,90 @@
+:8881
+
+forward_auth localhost:9000 {
+	uri /auth
+	copy_headers A>1 B C>3 {
+		D
+		E>5
+	}
+}
+----------
+{
+	"apps": {
+		"http": {
+			"servers": {
+				"srv0": {
+					"listen": [
+						":8881"
+					],
+					"routes": [
+						{
+							"handle": [
+								{
+									"handle_response": [
+										{
+											"match": {
+												"status_code": [
+													2
+												]
+											},
+											"routes": [
+												{
+													"handle": [
+														{
+															"handler": "headers",
+															"request": {
+																"set": {
+																	"1": [
+																		"{http.reverse_proxy.header.A}"
+																	],
+																	"3": [
+																		"{http.reverse_proxy.header.C}"
+																	],
+																	"5": [
+																		"{http.reverse_proxy.header.E}"
+																	],
+																	"B": [
+																		"{http.reverse_proxy.header.B}"
+																	],
+																	"D": [
+																		"{http.reverse_proxy.header.D}"
+																	]
+																}
+															}
+														}
+													]
+												}
+											]
+										}
+									],
+									"handler": "reverse_proxy",
+									"headers": {
+										"request": {
+											"set": {
+												"X-Forwarded-Method": [
+													"{http.request.method}"
+												],
+												"X-Forwarded-Uri": [
+													"{http.request.uri}"
+												]
+											}
+										}
+									},
+									"rewrite": {
+										"method": "GET",
+										"uri": "/auth"
+									},
+									"upstreams": [
+										{
+											"dial": "localhost:9000"
+										}
+									]
+								}
+							]
+						}
+					]
+				}
+			}
+		}
+	}
+}

caddytest/integration/caddyfile_adapt/global_options.txt

@@ -9,8 +9,6 @@
 	storage file_system {
 		root /data
 	}
-	storage_check off
-	storage_clean_interval off
 	acme_ca https://example.com
 	acme_ca_root /path/to/ca.crt
 	ocsp_stapling off
@@ -19,6 +17,8 @@
 	admin off
 	on_demand_tls {
 		ask https://example.com
+		interval 30s
+		burst 20
 	}
 	local_certs
 	key_type ed25519
@@ -69,15 +69,14 @@
 					}
 				],
 				"on_demand": {
-					"permission": {
+					"rate_limit": {
-						"endpoint": "https://example.com",
+						"interval": 30000000000,
-						"module": "http"
+						"burst": 20
-					}
+					},
+					"ask": "https://example.com"
 				}
 			},
-			"disable_ocsp_stapling": true,
+			"disable_ocsp_stapling": true
-			"disable_storage_check": true,
-			"disable_storage_clean": true
 		}
 	}
 }

caddytest/integration/caddyfile_adapt/global_options_acme.txt

@@ -17,6 +17,8 @@
 	admin off
 	on_demand_tls {
 		ask https://example.com
+		interval 30s
+		burst 20
 	}
 	storage_clean_interval 7d
 	renew_interval 1d
@@ -61,14 +63,6 @@
 						"issuers": [
 							{
 								"ca": "https://example.com",
-								"challenges": {
-									"http": {
-										"alternate_port": 8080
-									},
-									"tls-alpn": {
-										"alternate_port": 8443
-									}
-								},
 								"email": "test@example.com",
 								"external_account": {
 									"key_id": "4K2scIVbBpNd-78scadB2g",
@@ -84,10 +78,11 @@
 					}
 				],
 				"on_demand": {
-					"permission": {
+					"rate_limit": {
-						"endpoint": "https://example.com",
+						"interval": 30000000000,
-						"module": "http"
+						"burst": 20
-					}
+					},
+					"ask": "https://example.com"
 				},
 				"ocsp_interval": 172800000000000,
 				"renew_interval": 86400000000000,

caddytest/integration/caddyfile_adapt/global_options_admin.txt

@@ -16,6 +16,8 @@
 	}
 	on_demand_tls {
 		ask https://example.com
+		interval 30s
+		burst 20
 	}
 	local_certs
 	key_type ed25519
@@ -69,10 +71,11 @@
 					}
 				],
 				"on_demand": {
-					"permission": {
+					"rate_limit": {
-						"endpoint": "https://example.com",
+						"interval": 30000000000,
-						"module": "http"
+						"burst": 20
-					}
+					},
+					"ask": "https://example.com"
 				}
 			}
 		}

caddytest/integration/caddyfile_adapt/global_options_log_sampling.caddyfiletest

@@ -1,23 +0,0 @@
-{
-	log {
-		sampling {
-			interval 300
-			first 50
-			thereafter 40
-		}
-	}
-}
-----------
-{
-	"logging": {
-		"logs": {
-			"default": {
-				"sampling": {
-					"interval": 300,
-					"first": 50,
-					"thereafter": 40
-				}
-			}
-		}
-	}
-}

caddytest/integration/caddyfile_adapt/global_options_preferred_chains.txt

@@ -40,6 +40,12 @@ example.com
 								"preferred_chains": {
 									"smallest": true
 								}
+							},
+							{
+								"module": "zerossl",
+								"preferred_chains": {
+									"smallest": true
+								}
 							}
 						]
 					}

caddytest/integration/caddyfile_adapt/global_server_options_single.txt

@@ -11,7 +11,6 @@
 			idle 30s
 		}
 		max_header_size 100MB
-		enable_full_duplex
 		log_credentials
 		protocols h1 h2 h2c h3
 		strict_sni_host
@@ -46,7 +45,6 @@ foo.com {
 					"write_timeout": 30000000000,
 					"idle_timeout": 30000000000,
 					"max_header_bytes": 100000000,
-					"enable_full_duplex": true,
 					"routes": [
 						{
 							"match": [

caddytest/integration/caddyfile_adapt/header.txt

@@ -12,14 +12,10 @@
 	@images path /images/*
 	header @images {
 		Cache-Control "public, max-age=3600, stale-while-revalidate=86400"
-		match {
-			status 200
-		}
 	}
 	header {
 		+Link "Foo"
 		+Link "Bar"
-		match status 200
 	}
 	header >Set Defer
 	header >Replace Deferred Replacement
@@ -46,11 +42,6 @@
 								{
 									"handler": "headers",
 									"response": {
-										"require": {
-											"status_code": [
-												200
-											]
-										},
 										"set": {
 											"Cache-Control": [
 												"public, max-age=3600, stale-while-revalidate=86400"
@@ -145,11 +136,6 @@
 												"Foo",
 												"Bar"
 											]
-										},
-										"require": {
-											"status_code": [
-												200
-											]
 										}
 									}
 								},

caddytest/integration/caddyfile_adapt/heredoc.txt

@@ -1,12 +1,11 @@
 example.com {
-	respond <<EOF
+    respond <<EOF
     <html>
       <head><title>Foo</title>
       <body>Foo</body>
     </html>
     EOF 200
 }
-
 ----------
 {
 	"apps": {