Couple of minor fixes, update readme

Config auto-saving is on by default and can be disabled. The --environ
flag (or environ subcommand) now print more useful information from
Caddy and the runtime, including some nifty paths.

.gitattributes

@@ -1,14 +0,0 @@
-# shell scripts should not use tabs to indent!
-*.bash    text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-*.sh      text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-
-# files for systemd (shell-similar)
-*.path    text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-*.service text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-*.timer   text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-
-# go fmt will enforce this, but in case a user has not called "go fmt" allow GIT to catch this:
-*.go      text eol=lf core.whitespace whitespace=indent-with-non-tab,trailing-space,tabwidth=4
-
-*.yml     text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-.git*     text eol=auto core.whitespace whitespace=trailing-space

.gitignore

@@ -1,16 +1,18 @@
-.DS_Store
-Thumbs.db
 _gitignore/
-Vagrantfile
-.vagrant/
-
-dist/builds/
-dist/release/
-
-error.log
-access.log
-
-/*.conf
+*.log
 Caddyfile
+!caddyfile/
 
-og_static/
+# artifacts from pprof tooling
+*.prof
+*.test
+
+# build artifacts
+cmd/caddy/caddy
+cmd/caddy/caddy.exe
+
+# mac specific
+.DS_Store
+
+# go modules
+vendor

.golangci.yml

@@ -0,0 +1,49 @@
+linters-settings:
+  errcheck:
+    ignore: fmt:.*,io/ioutil:^Read.*,github.com/caddyserver/caddy/v2/caddyconfig:RegisterAdapter,github.com/caddyserver/caddy/v2:RegisterModule
+    ignoretests: true
+  misspell:
+    locale: US
+
+linters:
+  enable:
+    - bodyclose
+    - errcheck
+    - gofmt
+    - goimports
+    - gosec
+    - ineffassign
+    - misspell
+
+run:
+  # default concurrency is a available CPU number.
+  # concurrency: 4 # explicitly omit this value to fully utilize available resources.
+  deadline: 5m
+  issues-exit-code: 1
+  tests: false
+
+# output configuration options
+output:
+  format: 'colored-line-number'
+  print-issued-lines: true
+  print-linter-name: true
+
+issues:
+  exclude-rules:
+    # we aren't calling unknown URL
+    - text: "G107" # G107: Url provided to HTTP request as taint input
+      linters:
+        - gosec
+    # as a web server that's expected to handle any template, this is totally in the hands of the user.
+    - text: "G203" # G203: Use of unescaped data in HTML templates
+      linters:
+        - gosec
+    # we're shelling out to known commands, not relying on user-defined input.
+    - text: "G204" # G204: Audit use of command execution
+      linters:
+        - gosec
+    # the choice of weakrand is deliberate, hence the named import "weakrand"
+    - path: modules/caddyhttp/reverseproxy/selectionpolicies.go
+      text: "G404" # G404: Insecure random number source (rand)
+      linters:
+        - gosec

.travis.yml

@@ -1,30 +0,0 @@
-language: go
-
-go:
-  - 1.6
-  - tip
-
-env:
-  - CGO_ENABLED=0
-
-before_install:
-  # Decrypts a script that installs an authenticated cookie
-  # for git to use when cloning from googlesource.com.
-  # Bypasses "bandwidth limit exceeded" errors.
-  # See github.com/golang/go/issues/12933
- - if [ "$TRAVIS_PULL_REQUEST" = "false" ]; then openssl aes-256-cbc -K $encrypted_3df18f9af81d_key -iv $encrypted_3df18f9af81d_iv -in dist/gitcookie.sh.enc -out dist/gitcookie.sh -d; fi
-
-install:
-  - if [ "$TRAVIS_PULL_REQUEST" = "false" ]; then bash dist/gitcookie.sh; fi
-  - go get -t ./...
-  - go get github.com/golang/lint/golint
-  - go get github.com/gordonklaus/ineffassign
-
-script:
-  - diff <(echo -n) <(gofmt -s -d .)
-  - ineffassign .
-  - go vet ./...
-  - go test ./...
-
-after_script:
-  - golint ./...

AUTHORS

@@ -0,0 +1,10 @@
+# This is the official list of Caddy Authors for copyright purposes.
+# Authors may be either individual people or legal entities.
+#
+# Not all individual contributors are authors. For the full list of
+# contributors, refer to the project's page on GitHub or the repo's
+# commit history.
+
+Matthew Holt <Matthew.Holt@gmail.com>
+Light Code Labs <sales@lightcodelabs.com>
+Ardan Labs <info@ardanlabs.com>

CONTRIBUTING.md

@@ -1,88 +0,0 @@
-## Contributing to Caddy
-
-Welcome! Our community focuses on helping others and making Caddy the best it
-can be. We gladly accept contributions and encourage you to get involved!
-
-
-### Join us in chat
-
-Please direct your discussion to the correct room:
-
-- **Dev Chat:** [gitter.im/mholt/caddy](https://gitter.im/mholt/caddy) - to chat
-with other Caddy developers
-- **Support:**
-[gitter.im/caddyserver/support](https://gitter.im/caddyserver/support) - to give
-and get help
-- **General:**
-[gitter.im/caddyserver/general](https://gitter.im/caddyserver/general) - for
-anything about Web development
-
-
-### Bug reports
-
-First, please [search this repository](https://github.com/mholt/caddy/search?q=&type=Issues&utf8=%E2%9C%93)
-with a variety of keywords to ensure your bug is not already reported.
-
-If not, [open an issue](https://github.com/mholt/caddy/issues) and answer the
-questions so we can understand and reproduce the problematic behavior.
-
-The burden is on you to convince us that it is actually a bug in Caddy. This is
-easiest to do when you write clear, concise instructions so we can reproduce
-the behavior (even if it seems obvious). The more detailed and specific you are,
-the faster we will be able to help you. Check out
-[How to Report Bugs Effectively](http://www.chiark.greenend.org.uk/~sgtatham/bugs.html).
-
-Please be kind. :smile: Remember that Caddy comes at no cost to you, and you're
-getting free help. If we helped you, please consider
-[donating](https://caddyserver.com/donate) - it keeps us motivated!
-
-
-### Minor improvements and new tests
-
-Submit [pull requests](https://github.com/mholt/caddy/pulls) at any time. Make
-sure to write tests to assert your change is working properly and is thoroughly
-covered. We'll ask most pull requests to be
-[squashed](http://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html),
-especially with small commits.
-
-
-### Proposals, suggestions, ideas, new features
-
-First, please [search](https://github.com/mholt/caddy/search?q=&type=Issues&utf8=%E2%9C%93)
-with a variety of keywords to ensure your suggestion/proposal is new.
-
-If so, you may open either an issue or a pull request for discussion and
-feedback.
-
-The advantage of issues is that you don't have to spend time actually
-implementing your idea, but you should still describe it thoroughly. The
-advantage of a pull request is that we can immediately see the impact the change
-will have on the project, what the code will look like, and how to improve it.
-The disadvantage of pull requests is that they are unlikely to get accepted
-without significant changes, or it may be rejected entirely. Don't worry, that
-won't happen without an open discussion first.
-
-If you are going to spend significant time implementing code for a pull request,
-best to open an issue first and "claim" it and get feedback before you invest
-a lot of time.
-
-
-### Collaborator status
-
-If your pull request is merged, congratulations! You're technically a
-collaborator. We may also grant you "Collaborator status" which means you can
-push to the repository and merge other pull requests. We hope that you will
-stay involved by reviewing pull requests, submitting more of your own, and
-resolving issues as you are able to. Thanks for making Caddy amazing!
-
-
-### Vulnerabilities
-
-If you've found a vulnerability that is serious, please email me: Matthew dot 
-Holt at Gmail. If it's not a big deal, a pull request will probably be faster.
-
-
-## Thank you
-
-Thanks for your help! Caddy would not be what it is today without your
-contributions.

ISSUE_TEMPLATE

@@ -1,20 +0,0 @@
-*If you are filing a bug report, please answer these questions. If your issue is not a bug report, you do not need to use this template. Either way, please consider donating if we've helped you. Thanks!*
-
-#### 1. What version of Caddy are you running (`caddy -version`)?
-
-
-#### 2. What are you trying to do?
-
-
-#### 3. What is your entire Caddyfile?
-```text
-(Put Caddyfile here)
-```
-
-#### 4. How did you run Caddy (give the full command and describe the execution environment)?
-
-
-#### 5. What did you expect to see?
-
-
-#### 6. What did you see instead (give full error messages and/or log)?

LICENSE

@@ -1,3 +1,4 @@
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -178,7 +179,7 @@
    APPENDIX: How to apply the Apache License to your work.
 
       To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
+      boilerplate notice, with the fields enclosed by brackets "[]"
       replaced with your own identifying information. (Don't include
       the brackets!)  The text should be enclosed in the appropriate
       comment syntax for the file format. We also recommend that a
@@ -186,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright {yyyy} {name of copyright owner}
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

README.md

@@ -1,173 +1,384 @@
-[![Caddy](https://caddyserver.com/resources/images/caddy-boxed.png)](https://caddyserver.com)
+Caddy 2 Development Branch
+===========================
 
-[![Dev Chat](https://img.shields.io/badge/dev%20chat-gitter-ff69b4.svg?style=flat-square&label=dev+chat&color=ff69b4)](https://gitter.im/mholt/caddy) 
-[![Documentation](https://img.shields.io/badge/godoc-reference-blue.svg?style=flat-square)](https://godoc.org/github.com/mholt/caddy) 
-[![Linux Build Status](https://img.shields.io/travis/mholt/caddy.svg?style=flat-square&label=linux+build)](https://travis-ci.org/mholt/caddy) 
-[![Windows Build Status](https://img.shields.io/appveyor/ci/mholt/caddy.svg?style=flat-square&label=windows+build)](https://ci.appveyor.com/project/mholt/caddy)
+[![Build Status](https://dev.azure.com/mholt-dev/Caddy/_apis/build/status/Multiplatform%20Tests?branchName=v2)](https://dev.azure.com/mholt-dev/Caddy/_build/latest?definitionId=5&branchName=v2)
+[![fuzzit](https://app.fuzzit.dev/badge?org_id=caddyserver-gh)](https://app.fuzzit.dev/orgs/caddyserver-gh/dashboard)
 
-Caddy is a lightweight, general-purpose web server for Windows, Mac, Linux, BSD 
-and [Android](https://github.com/mholt/caddy/wiki/Running-Caddy-on-Android). 
-It is a capable alternative to other popular and easy to use web servers. 
-([@caddyserver](https://twitter.com/caddyserver) on Twitter)
+This is the development branch for Caddy 2. This code (version 2) is not yet feature-complete or production-ready, but is already being used in production, and we encourage you to deploy it today on sites that are not very visible or important so that it can obtain crucial experience in the field.
 
-The most notable features are HTTP/2, [Let's Encrypt](https://letsencrypt.org) 
-support, Virtual Hosts, TLS + SNI, and easy configuration with a 
-[Caddyfile](https://caddyserver.com/docs/caddyfile). In development, you usually 
-put one Caddyfile with each site. In production, Caddy serves HTTPS by default 
-and manages all cryptographic assets for you.
-
-[Download](https://github.com/mholt/caddy/releases) · 
-[User Guide](https://caddyserver.com/docs)
+Please file issues to propose new features and report bugs, and after the bug or feature has been discussed, submit a pull request! We need your help to build this web server into what you want it to be. (Caddy 2 issues and pull requests receive priority over Caddy 1 issues and pull requests.)
 
+**Caddy 2 is the web server of the Go community.** We are looking for maintainers to represent the community! Please become involved (issues, PRs, [our forum](https://caddy.community) etc.) and express interest if you are committed to being a collaborator on the Caddy project.
 
 
 ### Menu
 
-- [Getting Caddy](#getting-caddy)
+- [Build from source](#build-from-source)
 - [Quick Start](#quick-start)
-- [Running from Source](#running-from-source)
-- [Contributing](#contributing)
-- [About the Project](#about-the-project)
+- [Configuration](#configuration)
+- [Full Documentation](#full-documentation)
+- [List of Improvements](#list-of-improvements)
+- [FAQ](#faq)
 
 
+## Build from source
 
+Requirements:
 
-## Getting Caddy
+- [Go 1.13 or newer](https://golang.org/dl/)
+- Do NOT disable [Go modules](https://github.com/golang/go/wiki/Modules) (`export GO111MODULE=auto`)
 
-Caddy binaries have no dependencies and are available for nearly every platform.
+Download the `v2` source code:
 
-[Latest release](https://github.com/mholt/caddy/releases/latest)
+```bash
+$ git clone -b v2 "https://github.com/caddyserver/caddy.git"
+```
 
+Build:
+
+```bash
+$ cd caddy/cmd/caddy/
+$ go build
+```
+
+That will put a `caddy(.exe)` binary into the current directory. You can move it into your PATH or use `go install` to do that automatically (assuming `$GOPATH/bin` is already in your PATH). You can also use `go run main.go` for quick, temporary builds while developing.
+
+The initial build may be slow as dependencies are downloaded. Subsequent builds should be very fast. If you encounter any Go-module-related errors, try clearing your Go module cache (`$GOPATH/pkg/mod`) and Go package cache (`$GOPATH/pkg`) and read [the Go wiki page about modules for help](https://github.com/golang/go/wiki/Modules). If you have issues with Go modules, please consult the Go community for help. But if there is an actual error in Caddy, please report it to us.
 
 
 ## Quick Start
 
-The website has [full documentation](https://caddyserver.com/docs) but this will 
-get you started in about 30 seconds:
+(Until the stable 2.0 release, there may be breaking changes in v2, please be aware!)
 
-Place a file named "Caddyfile" with your site. Paste this into it and save:
+These instructions assume an executable build of Caddy 2 is named `caddy` in the current folder. If it's in your PATH, you may omit the path to the binary (`./`).
 
-```
-localhost
+Start Caddy:
 
-gzip
-browse
-ext .html
-websocket /echo cat
-log ../access.log
-header /api Access-Control-Allow-Origin *
+```bash
+$ ./caddy start
 ```
 
-Run `caddy` from that directory, and it will automatically use that Caddyfile to 
-configure itself.
-
-That simple file enables compression, allows directory browsing (for folders 
-without an index file), serves clean URLs, hosts a WebSocket echo server at 
-/echo, logs requests to access.log, and adds the coveted 
-`Access-Control-Allow-Origin: *` header for all responses from some API.
-
-Wow! Caddy can do a lot with just a few lines.
-
-
-#### Defining multiple sites
-
-You can run multiple sites from the same Caddyfile, too:
+There are no config files with Caddy 2. Instead, you POST configuration to it:
 
+```bash
+$ curl -X POST "http://localhost:2019/load" \
+    -H "Content-Type: application/json" \
+    -d @- << EOF
+    {
+        "apps": {
+            "http": {
+                "servers": {
+                    "example": {
+                        "listen": ["127.0.0.1:2080"],
+                        "routes": [
+                            {
+                                "handle": [{
+                                    "handler": "file_server",
+                                    "browse": {}
+                                }]
+                            }
+                        ]
+                    }
+                }
+            }
+        }
+    }
+EOF
 ```
-site1.com {
-	# ...
-}
 
-site2.com, sub.site2.com {
-	# ...
+Now visit http://localhost:2080 in your browser and you will see the contents of the current directory displayed.
+
+To change Caddy's configuration, simply POST a new payload to that endpoint. Config changes are extremely lightweight and efficient, and should be graceful on all platforms -- _even Windows_.
+
+Updating configuration using heredoc can be tedious, so you can still use a config file if you prefer. Put your configuration in any file (`caddy.json` for example) and then POST that instead:
+
+```bash
+$ curl -X POST "http://localhost:2019/load" \
+    -H "Content-Type: application/json" \
+    -d @caddy.json
+```
+
+Or you can tell Caddy to load its configuration from a file in the first place (this simply does the work of the above curl command for you):
+
+```bash
+$ ./caddy start --config caddy.json
+```
+
+To stop Caddy:
+
+```bash
+$ ./caddy stop
+```
+
+Note that this will stop any process named the same as `os.Args[0]`.
+
+For other commands, please see [the Caddy 2 documentation](https://caddyserver.com/docs/command-line).
+
+### Caddyfile
+
+Caddy 2 can be configured with a Caddyfile, much like in v1, for example:
+
+```plain
+example.com
+
+try_files {path}.html {path}
+encode gzip zstd
+reverse_proxy /api  localhost:9005
+php_fastcgi   /blog unix//path/to/socket
+file_server
+```
+
+Instead of being its primary mode of configuration, an internal _config adapter_ adapts the Caddyfile to Caddy's native JSON structure. You can see it in action with the [`adapt` command](https://caddyserver.com/docs/command-line#caddy-adapt):
+
+```bash
+$ ./caddy adapt --config path/to/Caddyfile --adapter caddyfile --pretty
+```
+
+If you just want to run Caddy with your Caddyfile directly, the CLI wraps this up for you nicely. Either of the following commands:
+
+```bash
+$ ./caddy start
+$ ./caddy run
+```
+
+will use your Caddyfile if it is called `Caddyfile` in the current directory.
+
+If your Caddyfile is somewhere else, you can still use it:
+
+```bash
+$ ./caddy start|run --config path/to/Caddyfile --adapter caddyfile
+```
+
+[Learn more about the Caddyfile in v2.](https://github.com/caddyserver/caddy/wiki/v2:-Documentation#caddyfile-adapter)
+
+
+## Configuration
+
+Caddy 2 exposes an unprecedented level of control compared to any web server in existence. In Caddy 2, you are usually setting the actual values of the initialized types in memory that power everything from your HTTP handlers and TLS handshakes to your storage medium. Caddy 2 is also ridiculously extensible, with a module system that makes vast improvements over Caddy 1's plugin system.
+
+Nearly all of Caddy 2's configuration is contained in a single config document, rather than being spread across CLI flags and env variables and a configuration file as with other web servers (and Caddy 1).
+
+To wield the power of this design, you need to know how the config document is structured. Please see the [the Caddy 2 documentation in our wiki](https://caddyserver.com/docs/json/) for details about Caddy's config structure.
+
+Configuration is normally given to Caddy through an API endpoint, which is likewise documented in the wiki pages. However, you can also use config files of various formats with [config adapters](https://caddyserver.com/docs/config-adapters).
+
+
+## Full Documentation
+
+Caddy 2 is very much in development, and so is its documentation. You can find it here:
+
+**https://caddyserver.com/docs/**
+
+Note that breaking changes are expected until the stable 2.0 release. The v2 Caddyfile will probably be the last thing documented, as it is rapidly changing.
+
+
+## List of Improvements
+
+The following is a non-comprehensive list of significant improvements over Caddy 1. Not everything in this list is finished yet, but they will be finished or at least will be possible with Caddy 2:
+
+- Centralized configuration. No more disparate use of environment variables, config files (potentially multiple!), CLI flags, etc.
+- REST API. Control Caddy with HTTP requests to an administration endpoint. Changes are applied immediately and efficiently.
+- Dynamic configuration. Any and all specific config values can be modified directly through the admin API with a REST endpoint.
+    - Change only specific configuration settings instead of needing to specify the whole config each time. This makes it safe and easy to change Caddy's config with manually-crafted curl commands, for example.
+- No configuration files. Except optionally to bootstrap its configuration at startup. You can still use config files if you wish, and we expect that most people will.
+- Export the current Caddy configuration with an API GET request.
+- Silky-smooth graceful reloads. Update the configuration up to dozens of times per second with no dropped requests and very little memory cost. Our unique graceful reload technology is lighter and faster **and works on all platforms, including Windows**.
+- An embedded scripting language! Caddy2 has native Starlark integration. Do things you never thought possible with higher performance than Lua, JavaScript, and other VMs. Starlark is expressive, familiar (dialect of Python), _almost_ Turing-complete, and highly efficient. (We're still improving performance here.)
+- Using [XDG standards](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html#variables) instead of dumping all assets in `$HOME/.caddy`.
+- Caddy plugins are now called "Caddy modules" (although the terms "plugin" and "module" may be used interchangeably). Caddy modules are a concept unrelated [Go modules](https://github.com/golang/go/wiki/Modules), except that Caddy modules may be implemented by Go modules. Caddy modules are centrally-registered, properly namespaced, and generically loaded & configured, as opposed to how scattered and unorganized Caddy 1-era plugins are.
+- Modules are easier to write, since they do not have to both deserialize their own configuration from a configuration DSL and provision themselves like plugins did. Modules are initialized pre-configured and have the ability to validate the configuration and perform provisioning steps if necessary.
+- Can specify different storage mechanisms in different parts of the configuration, if more than one is needed.
+- "Top-level" Caddy modules are simply called "apps" because literally any long-lived application can be served by Caddy 2.
+- Even more of Caddy is made of modules, allowing for unparalleled extensibility, flexibility, and control. Caddy 2 is arguably the most flexible, extensible, programmable web server ever made.
+- TLS improvements!
+	- TLS configuration is now centralized and decoupled from specific sites
+	- A single certificate cache is used process-wide, reducing duplication and improving memory use
+	- Customize how to manage each certificate ("automation policies") based on the hostname
+	- Automation policy doesn't have to be limited to just ACME - could be any way to manage certificates
+	- Fine-grained control over TLS handshakes
+	- If an ACME challenge fails, other enabled challenges will be tried (no other web server does this)
+    - TLS Session Ticket Ephemeral Keys (STEKs) can be rotated in a cluster for increased performance (no other web server does this either!)
+    - Ability to select a specific certificate per ClientHello given multiple qualifying certificates
+    - Provide TLS certificates without persisting them to disk; keep private keys entirely in memory
+	- Certificate management at startup is now asynchronous and much easier to use through machine reboots and in unsupervised settings
+- All-new HTTP server core
+	- Listeners can be configured for any network type, address, and port range
+	- Customizable TLS connection policies
+	- HTTP handlers are configured by "routes" which consist of matcher and handler components. Match matches an HTTP request, and handle defines the list of handlers to invoke as a result of the match.
+	- Some matchers are regular expressions, which expose capture groups to placeholders.
+	- New matchers include negation and matching based on remote IP address / CIDR ranges.
+    - Placeholders are vastly improved generally
+	- Placeholders (variables) are more properly namespaced.
+	- Multiple routes may match an HTTP request, creating a "composite route" quickly on the fly.
+	- The actual handler for any given request is its composite route.
+	- User defines the order of middlewares (careful! easy to break things).
+	- Adding middlewares no longer requires changes to Caddy's code base (there is no authoritative list).
+	- Routes may be marked as terminal, meaning no more routes will be matched.
+	- Routes may be grouped so that only the first matching route in a group is applied.
+	- Requests may be "re-handled" if they are modified and need to be sent through the chain again (internal redirect).
+	- Vastly more powerful static file server, with native content-negotiation abilities
+    - Done away with URL-rewriting hacks often needed in Caddy 1
+	- Highly descriptive/traceable errors
+	- Very flexible error handling, with the ability to specify a whole list of routes just for error cases
+	- The proxy has numerous improvements, including dynamic backends and more configurable health checks
+	- FastCGI support integrated with the reverse proxy
+	- More control over automatic HTTPS: disable entirely, disable only HTTP->HTTPS redirects, disable only cert management, and for certain names, etc.
+    - Use Starlark to build custom, dynamic HTTP handlers at request-time
+        - We are finding that -- on average -- Caddy 2's Starlark handlers are ~1.25-2x faster than NGINX+Lua.
+
+And a few major features still being worked on:
+
+- Logging
+- Kubernetes ingress controller (mostly done, just polishing it -- and it's amazing)
+- More config adapters. Caddy's native JSON config structure is powerful and complex. Config adapters upsample various formats to Caddy's native config. There are already adapters for Caddyfile, JSON 5, and JSON-C. Planned are NGINX config, YAML, and TOML. The community might be interested in building Traefik and Apache config adapters!
+
+
+
+## FAQ
+
+### How do I configure Caddy 2?
+
+Caddy's primary mode of configuration is a REST API, which accepts a JSON document. The JSON structure is described [interactively in the docs](https://caddyserver.com/docs/json/). The advantages of exposing this low-level structure are 1) it has near-parity with actual memory initialization, 2) it allows us to offer wrappers over this configuration to any degree of convenience that is needed, and 3) it performs very well under rapid config changes.
+
+Basically, you will [start Caddy](https://caddyserver.com/docs/command-line#caddy-run), then [POST a JSON config to its API endpoint](https://caddyserver.com/docs/api#post-load).
+
+Although this makes Caddy 2 highly programmable, not everyone will want to configure Caddy via JSON with an API. Sometimes we just want to give Caddy a simple, static config file and have it do its thing. That's what **[config adapters](https://caddyserver.com/docs/config-adapters)** are for! You can configure Caddy more ways than one, depending on your needs and preferences. See the next questions that explain this more.
+
+### Caddy 2 feels harder to use. How is this an improvement over Caddy 1?
+
+Caddy's ease of use is one of the main reasons it is special. We are not taking that away in Caddy 2, but first we had to be sure to tackle the fundamental design limitations with Caddy 1. Usability can then be layered on top. This approach has several advantages which we discuss in the next question.
+
+### What about the Caddyfile; are there easier ways to configure Caddy 2?
+
+Yes! Caddy's native JSON configuration via API is nice when you are automating config changes at scale, but if you just have a simple, static configuration in a file, you can do that too with the [Caddyfile](https://github.com/caddyserver/caddy/wiki/v2:-Documentation#caddyfile-adapter).
+
+The v2 Caddyfile is very similar to the v1 Caddyfile, but they are not compatible. Several improvements have been made to request matching and directives in v2, giving you more power with less complexity and fewer inconsistencies.
+
+Caddy's default _config adapter_ is the Caddyfile adapter. This takes a Caddyfile as input and [outputs the JSON config](https://caddyserver.com/docs/command-line#caddy-adapt). You can even run Caddy directly without having to see or think about the underlying JSON config.
+
+The following _config adapters_ are already being built or plan to be built:
+
+- Caddyfile
+- JSON 5
+- JSON-C
+- nginx
+- YAML
+- TOML
+- any others that the community would like to contribute
+
+Config adapters allow you to configure Caddy not just one way but _any_ of these ways. For example, you'll be able to bring your existing NGINX config to Caddy and it will spit out the Caddy config JSON you need (to the best of its ability). How cool is that! You can then easily tweak the resulting config by hand, if necessary.
+
+All config adapters vary in their theoretical expressiveness; that is, if you need more advanced configuration you'll have to drop down to the JSON config, because the Caddyfile or an nginx config may not be expressive enough.
+
+However, we expect that most users will be able to use the Caddyfile (or another easy config adapter) exclusively for their sites.
+
+### Why JSON for configuration? Why not _&lt;any other serialization format&gt;_?
+
+We know there might be strong opinions on this one. Regardless, for Caddy 2, we've decided to go with JSON. If that proves to be a fatal mistake, then Caddy 3 probably won't use JSON.
+
+JSON may not be the fastest, the most compact, the easiest to write, serialization format that exists. But those aren't our goals. It has withstood the test of time and checks all our boxes.
+
+- It is almost entirely ubiquitous. JSON works natively in web browsers and has mature libraries in pretty much every language.
+- It is human-readable (as opposed to a binary format).
+- It is easy to tweak by hand. Although composing raw JSON by hand is not awesome, this will not be mainstream once our config adapters are done.
+- It is generally easy to convert other serializations or config formats into JSON, as opposed to the other way around.
+- Even though JSON deserialization is not fast per-se, that kind of performance is not really a concern since config reloads are not the server's hottest path like HTTP request handling or TLS handshakes are. Even with JSON, Caddy 2 can handle dozens of config changes per second, which is probably plenty for now.
+- It maps almost 1:1 to the actual, in-memory values that power your HTTP handlers and other parts of the server (no need to parse a config file with some arbitrary DSL and do a bunch of extra pre-processing).
+
+Ultimately, we think all these properties are appropriate -- if not ideal -- for a web server configuration.
+
+If you're still not happy with the choice of JSON, feel free to contribute a config adapter of your own choice!
+
+Or just use YAML or TOML, which seamlessly translate to JSON.
+
+### JSON is declarative; what if I need more programmability (i.e. imperative syntax)?
+
+NGINX also realized the need for imperative logic in declarative configs, so they tried "if" statements, [but it was a bad idea](https://www.nginx.com/resources/wiki/start/topics/depth/ifisevil/).
+
+We have good news. Caddy 2 can give you the power of imperative logic without the perils of mixing declarative and imperative config such as befell NGINX. We do this by allowing embedded imperative syntax awithin the Caddy's declarative config.
+
+Caddy 2's configuration is declarative because configuration is very much declarative in nature. Configuration is a tricky medium, as it is read and written by both computers and humans. Computers use it, but humans constantly refer to it and update it. Declarative syntaxes are fairly straightforward to make sense of, whereas it is difficult to reason about imperative logic.
+
+However, sometimes computation is useful, and in some cases, the only way to express what you need. This can be illustrated really well in the simple case of trying to decide whether a particular HTTP middleware should be invoked as part of an HTTP request. A lot of the time, such logic is as simple as: "GET requests for any path starting with /foo/bar", which can be expressed declaratively in JSON:
+
+```json
+{
+	"method": "GET",
+	"path": "/foo/bar"
 }
 ```
 
-Note that all these sites will automatically be served over HTTPS using Let's 
-Encrypt as the CA. Caddy will manage the certificates (including renewals) for 
-you. You don't even have to think about it.
+But what if you need to match /foo/bar OR /topaz? How do you express that OR clause? Maybe an array:
 
-For more documentation, please view [the website](https://caddyserver.com/docs). 
-You may also be interested in the [developer guide]
-(https://github.com/mholt/caddy/wiki) on this project's GitHub wiki.
+```json
+{
+	"method": ["GET"],
+	"path": ["/foo/bar", "/topaz"]
+}
+```
 
+Now what if you need add a NOT or AND clause? JSON quickly tires out. As you learn about Caddy 2's request matching, you will see how we handled this. Caddy 2's JSON gives you the ability to express moderately-complex logic such as:
 
+```js
+// this is not actual Caddy config, just logic pseudocode
+IF (Host = "example.com")
+	OR (Host = "sub.example.com" AND Path != "/foo/bar")
+```
 
+Already, this is more expressive power than most web servers offer with their native config, yet Caddy 2 offers this in JSON.
 
-## Running from Source
+But in most web servers, to make logic this complex feasible, you'll generally call out to Lua or some extra DSL. For example, in NGINX you could use a Lua module to express this logic. Traefik 2.0 has [yet another kind of clunky-looking custom DSL](https://blog.containo.us/back-to-traefik-2-0-2f9aa17be305#d22e) just for this.
 
-Note: You will need **[Go 1.6](https://golang.org/dl/)** or newer.
+Caddy 2 solves this in a novel way with [Starlark expressions](https://godoc.org/go.starlark.net/starlark#Eval). Starlark is a familiar dialect of Python! So, no new DSLs to learn and no VMs to slow things down:
 
-1. `$ go get github.com/mholt/caddy`
-2. `cd` into your website's directory
-3. Run `caddy` (assumes `$GOPATH/bin` is in your `$PATH`)
+```python
+req.host == 'example.com' ||
+	(req.host == 'sub.example.com' && req.path != '/foo/bar')
+```
 
-If you're tinkering, you can also use `./build.bash && ./ecaddy`.
+Starlark performs at least as well as NGINX+Lua (more performance tests ongoing, as well as optimizations to make it even faster!) and because it's basically Python, it's familiar and easy to use.
 
-By default, Caddy serves the current directory at 
-[localhost:2015](http://localhost:2015). You can place a Caddyfile to configure 
-Caddy for serving your site.
+In summary: Caddy 2 config is declarative, but can be imperative where that is useful.
 
-Caddy accepts some flags from the command line. Run `caddy -h` to view the help
- for flags or see the [CLI documentation](https://caddyserver.com/docs/cli).
+### What is Caddy 2 licensed as?
 
-**Running as root:** We advise against this; use setcap instead, like so: 
-`setcap cap_net_bind_service=+ep ./caddy` This will allow you to listen on 
-ports < 1024 like 80 and 443.
+Caddy 2 is licensed under the Apache 2.0 open source license. There are no official Caddy 2 distributions that are proprietary.
 
+### Does Caddy 2 have telemetry?
 
+No. There was not enough academic interest to continue supporting it. If telemetry does get added later, it will not be on by default or will be vastly reduced in its scope.
 
-#### Docker Container
+## Does Caddy 2 use HTTPS by default?
 
-Caddy is available as a Docker container from any of these sources:
+Yes. HTTPS is automatic and enabled by default when possible, just like in Caddy 1. Basically, if your HTTP routes specify a `host` matcher with qualifying domain names, those names will be enabled for automatic HTTPS. Automatic HTTPS is disabled for domains which match certificates that are manually loaded by your config.
 
-- [abiosoft/caddy](https://hub.docker.com/r/abiosoft/caddy/)
-- [darron/caddy](https://hub.docker.com/r/darron/caddy/)
-- [joshix/caddy](https://hub.docker.com/r/joshix/caddy/)
-- [jumanjiman/caddy](https://hub.docker.com/r/jumanjiman/caddy/)
-- [zenithar/nano-caddy](https://hub.docker.com/r/zenithar/nano-caddy/)
-- [zzrot/alpine-caddy](https://hub.docker.com/r/zzrot/alpine-caddy/)
+## How do I avoid Let's Encrypt rate limits with Caddy 2?
 
+As you are testing and developing with Caddy 2, you should use test ("staging") certificates from Let's Encrypt to avoid rate limits. By default, Caddy 2 uses Let's Encrypt's production endpoint to get real certificates for your domains, but their [rate limits](https://letsencrypt.org/docs/rate-limits/) forbid testing and development use of this endpoint for good reasons. You can switch to their [staging endpoint](https://letsencrypt.org/docs/staging-environment/) by adding the staging CA to your automation policy in the `tls` app:
 
+```json
+"tls": {
+	"automation": {
+		"policies": [
+			{
+				"management": {
+					"module": "acme",
+					"ca": "https://acme-staging-v02.api.letsencrypt.org/directory"
+				}
+			}
+		]
+	}
+}
+```
 
-#### 3rd-party dependencies
+Or with the Caddyfile, using a global options block at the top:
 
-Although Caddy's binaries are completely static, Caddy relies on some excellent
-libraries. [Godoc.org](https://godoc.org/github.com/mholt/caddy) shows the
-packages that each Caddy package imports.
+```
+{
+	acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
+}
+```
 
+## Can we get some access controls on the admin endpoint?
 
-
-
-## Contributing
-
-**[Join our dev chat on Gitter](https://gitter.im/mholt/caddy)** to chat with
-other Caddy developers! (Dev chat only; try our
-[support room](https://gitter.im/caddyserver/support) for help or
-[general](https://gitter.im/caddyserver/general) for anything else.)
-
-This project would not be what it is without your help. Please see the
-[contributing guidelines](https://github.com/mholt/caddy/blob/master/CONTRIBUTING.md)
-if you haven't already.
-
-Thanks for making Caddy -- and the Web -- better!
-
-Special thanks to
-[![DigitalOcean](http://i.imgur.com/sfGr0eY.png)](https://www.digitalocean.com)
-for hosting the Caddy project.
-
-
-
-
-## About the project
-
-Caddy was born out of the need for a "batteries-included" web server that runs
-anywhere and doesn't have to take its configuration with it. Caddy took
-inspiration from [spark](https://github.com/rif/spark),
-[nginx](https://github.com/nginx/nginx), lighttpd,
-[Websocketd](https://github.com/joewalnes/websocketd)
-and [Vagrant](https://www.vagrantup.com/),
-which provides a pleasant mixture of features from each of them.
-
-
-*Twitter: [@mholt6](https://twitter.com/mholt6)*
+Yeah, that's coming. For now, you can use a permissioned unix socket for some basic security.

admin.go

@@ -0,0 +1,875 @@
+// Copyright 2015 Matthew Holt and The Caddy Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package caddy
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"expvar"
+	"fmt"
+	"io"
+	"mime"
+	"net/http"
+	"net/http/pprof"
+	"net/url"
+	"os"
+	"path"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/caddyserver/caddy/v2/caddyconfig"
+	"go.uber.org/zap"
+)
+
+// TODO: is there a way to make the admin endpoint so that it can be plugged into the HTTP app? see issue #2833
+
+// AdminConfig configures Caddy's API endpoint, which is used
+// to manage Caddy while it is running.
+type AdminConfig struct {
+	// If true, the admin endpoint will be completely disabled.
+	// Note that this makes any runtime changes to the config
+	// impossible, since the interface to do so is through the
+	// admin endpoint.
+	Disabled bool `json:"disabled,omitempty"`
+
+	// The address to which the admin endpoint's listener should
+	// bind itself. Can be any single network address that can be
+	// parsed by Caddy. Default: localhost:2019
+	Listen string `json:"listen,omitempty"`
+
+	// If true, CORS headers will be emitted, and requests to the
+	// API will be rejected if their `Host` and `Origin` headers
+	// do not match the expected value(s). Use `origins` to
+	// customize which origins/hosts are allowed.If `origins` is
+	// not set, the listen address is the only value allowed by
+	// default.
+	EnforceOrigin bool `json:"enforce_origin,omitempty"`
+
+	// The list of allowed origins for API requests. Only used if
+	// `enforce_origin` is true. If not set, the listener address
+	// will be the default value. If set but empty, no origins will
+	// be allowed.
+	Origins []string `json:"origins,omitempty"`
+
+	// Options related to configuration management.
+	Config *ConfigSettings `json:"config,omitempty"`
+}
+
+// ConfigSettings configures the, uh, configuration... and
+// management thereof.
+type ConfigSettings struct {
+	// Whether to keep a copy of the active config on disk. Default is true.
+	Persist *bool `json:"persist,omitempty"`
+}
+
+// listenAddr extracts a singular listen address from ac.Listen,
+// returning the network and the address of the listener.
+func (admin AdminConfig) listenAddr() (string, string, error) {
+	input := admin.Listen
+	if input == "" {
+		input = DefaultAdminListen
+	}
+	listenAddr, err := ParseNetworkAddress(input)
+	if err != nil {
+		return "", "", fmt.Errorf("parsing admin listener address: %v", err)
+	}
+	if listenAddr.PortRangeSize() != 1 {
+		return "", "", fmt.Errorf("admin endpoint must have exactly one address; cannot listen on %v", listenAddr)
+	}
+	return listenAddr.Network, listenAddr.JoinHostPort(0), nil
+}
+
+// newAdminHandler reads admin's config and returns an http.Handler suitable
+// for use in an admin endpoint server, which will be listening on listenAddr.
+func (admin AdminConfig) newAdminHandler(listenAddr string) adminHandler {
+	muxWrap := adminHandler{
+		enforceOrigin:  admin.EnforceOrigin,
+		allowedOrigins: admin.allowedOrigins(listenAddr),
+		mux:            http.NewServeMux(),
+	}
+
+	// addRoute just calls muxWrap.mux.Handle after
+	// wrapping the handler with error handling
+	addRoute := func(pattern string, h AdminHandler) {
+		wrapper := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			err := h.ServeHTTP(w, r)
+			muxWrap.handleError(w, r, err)
+		})
+		muxWrap.mux.Handle(pattern, wrapper)
+	}
+
+	// register standard config control endpoints
+	addRoute("/load", AdminHandlerFunc(handleLoad))
+	addRoute("/"+rawConfigKey+"/", AdminHandlerFunc(handleConfig))
+	addRoute("/id/", AdminHandlerFunc(handleConfigID))
+	addRoute("/stop", AdminHandlerFunc(handleStop))
+
+	// register debugging endpoints
+	muxWrap.mux.HandleFunc("/debug/pprof/", pprof.Index)
+	muxWrap.mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
+	muxWrap.mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
+	muxWrap.mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
+	muxWrap.mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+	muxWrap.mux.Handle("/debug/vars", expvar.Handler())
+
+	// register third-party module endpoints
+	for _, m := range GetModules("admin.api") {
+		router := m.New().(AdminRouter)
+		for _, route := range router.Routes() {
+			addRoute(route.Pattern, route.Handler)
+		}
+	}
+
+	return muxWrap
+}
+
+// allowedOrigins returns a list of origins that are allowed.
+// If admin.Origins is nil (null), the provided listen address
+// will be used as the default origin. If admin.Origins is
+// empty, no origins will be allowed, effectively bricking the
+// endpoint, but whatever.
+func (admin AdminConfig) allowedOrigins(listen string) []string {
+	uniqueOrigins := make(map[string]struct{})
+	for _, o := range admin.Origins {
+		uniqueOrigins[o] = struct{}{}
+	}
+	if admin.Origins == nil {
+		uniqueOrigins[listen] = struct{}{}
+	}
+	var allowed []string
+	for origin := range uniqueOrigins {
+		allowed = append(allowed, origin)
+	}
+	return allowed
+}
+
+// replaceAdmin replaces the running admin server according
+// to the relevant configuration in cfg. If no configuration
+// for the admin endpoint exists in cfg, a default one is
+// used, so that there is always an admin server (unless it
+// is explicitly configured to be disabled).
+func replaceAdmin(cfg *Config) error {
+	// always be sure to close down the old admin endpoint
+	// as gracefully as possible, even if the new one is
+	// disabled -- careful to use reference to the current
+	// (old) admin endpoint since it will be different
+	// when the function returns
+	oldAdminServer := adminServer
+	defer func() {
+		// do the shutdown asynchronously so that any
+		// current API request gets a response; this
+		// goroutine may last a few seconds
+		if oldAdminServer != nil {
+			go func(oldAdminServer *http.Server) {
+				err := stopAdminServer(oldAdminServer)
+				if err != nil {
+					Log().Named("admin").Error("stopping current admin endpoint", zap.Error(err))
+				}
+			}(oldAdminServer)
+		}
+	}()
+
+	// always get a valid admin config
+	adminConfig := DefaultAdminConfig
+	if cfg != nil && cfg.Admin != nil {
+		adminConfig = cfg.Admin
+	}
+
+	// if new admin endpoint is to be disabled, we're done
+	if adminConfig.Disabled {
+		Log().Named("admin").Warn("admin endpoint disabled")
+		return nil
+	}
+
+	// extract a singular listener address
+	netw, addr, err := adminConfig.listenAddr()
+	if err != nil {
+		return err
+	}
+
+	handler := adminConfig.newAdminHandler(addr)
+
+	ln, err := Listen(netw, addr)
+	if err != nil {
+		return err
+	}
+
+	adminServer = &http.Server{
+		Handler:           handler,
+		ReadTimeout:       10 * time.Second,
+		ReadHeaderTimeout: 5 * time.Second,
+		IdleTimeout:       60 * time.Second,
+		MaxHeaderBytes:    1024 * 64,
+	}
+
+	go adminServer.Serve(ln)
+
+	Log().Named("admin").Info(
+		"admin endpoint started",
+		zap.String("address", addr),
+		zap.Bool("enforce_origin", adminConfig.EnforceOrigin),
+		zap.Strings("origins", handler.allowedOrigins),
+	)
+
+	return nil
+}
+
+func stopAdminServer(srv *http.Server) error {
+	if srv == nil {
+		return fmt.Errorf("no admin server")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	err := srv.Shutdown(ctx)
+	if err != nil {
+		return fmt.Errorf("shutting down admin server: %v", err)
+	}
+	Log().Named("admin").Info("stopped previous server")
+	return nil
+}
+
+// AdminRouter is a type which can return routes for the admin API.
+type AdminRouter interface {
+	Routes() []AdminRoute
+}
+
+// AdminRoute represents a route for the admin endpoint.
+type AdminRoute struct {
+	Pattern string
+	Handler AdminHandler
+}
+
+type adminHandler struct {
+	enforceOrigin  bool
+	allowedOrigins []string
+	mux            *http.ServeMux
+}
+
+// ServeHTTP is the external entry point for API requests.
+// It will only be called once per request.
+func (h adminHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	Log().Named("admin.api").Info("received request",
+		zap.String("method", r.Method),
+		zap.String("uri", r.RequestURI),
+		zap.String("remote_addr", r.RemoteAddr),
+		zap.Reflect("headers", r.Header),
+	)
+	h.serveHTTP(w, r)
+}
+
+// serveHTTP is the internal entry point for API requests. It may
+// be called more than once per request, for example if a request
+// is rewritten (i.e. internal redirect).
+func (h adminHandler) serveHTTP(w http.ResponseWriter, r *http.Request) {
+	if h.enforceOrigin {
+		// DNS rebinding mitigation
+		err := h.checkHost(r)
+		if err != nil {
+			h.handleError(w, r, err)
+			return
+		}
+
+		// cross-site mitigation
+		origin, err := h.checkOrigin(r)
+		if err != nil {
+			h.handleError(w, r, err)
+			return
+		}
+
+		if r.Method == http.MethodOptions {
+			w.Header().Set("Access-Control-Allow-Methods", "OPTIONS, GET, POST, PUT, PATCH, DELETE")
+			w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Content-Length, Cache-Control")
+			w.Header().Set("Access-Control-Allow-Credentials", "true")
+		}
+		w.Header().Set("Access-Control-Allow-Origin", origin)
+	}
+
+	// TODO: authentication & authorization, if configured
+
+	h.mux.ServeHTTP(w, r)
+}
+
+func (h adminHandler) handleError(w http.ResponseWriter, r *http.Request, err error) {
+	if err == nil {
+		return
+	}
+	if err == ErrInternalRedir {
+		h.serveHTTP(w, r)
+		return
+	}
+
+	apiErr, ok := err.(APIError)
+	if !ok {
+		apiErr = APIError{
+			Code: http.StatusInternalServerError,
+			Err:  err,
+		}
+	}
+	if apiErr.Code == 0 {
+		apiErr.Code = http.StatusInternalServerError
+	}
+	if apiErr.Message == "" && apiErr.Err != nil {
+		apiErr.Message = apiErr.Err.Error()
+	}
+
+	Log().Named("admin.api").Error("request error",
+		zap.Error(err),
+		zap.Int("status_code", apiErr.Code),
+	)
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(apiErr.Code)
+	json.NewEncoder(w).Encode(apiErr)
+}
+
+// checkHost returns a handler that wraps next such that
+// it will only be called if the request's Host header matches
+// a trustworthy/expected value. This helps to mitigate DNS
+// rebinding attacks.
+func (h adminHandler) checkHost(r *http.Request) error {
+	var allowed bool
+	for _, allowedHost := range h.allowedOrigins {
+		if r.Host == allowedHost {
+			allowed = true
+			break
+		}
+	}
+	if !allowed {
+		return APIError{
+			Code: http.StatusForbidden,
+			Err:  fmt.Errorf("host not allowed: %s", r.Host),
+		}
+	}
+	return nil
+}
+
+// checkOrigin ensures that the Origin header, if
+// set, matches the intended target; prevents arbitrary
+// sites from issuing requests to our listener. It
+// returns the origin that was obtained from r.
+func (h adminHandler) checkOrigin(r *http.Request) (string, error) {
+	origin := h.getOriginHost(r)
+	if origin == "" {
+		return origin, APIError{
+			Code: http.StatusForbidden,
+			Err:  fmt.Errorf("missing required Origin header"),
+		}
+	}
+	if !h.originAllowed(origin) {
+		return origin, APIError{
+			Code: http.StatusForbidden,
+			Err:  fmt.Errorf("client is not allowed to access from origin %s", origin),
+		}
+	}
+	return origin, nil
+}
+
+func (h adminHandler) getOriginHost(r *http.Request) string {
+	origin := r.Header.Get("Origin")
+	if origin == "" {
+		origin = r.Header.Get("Referer")
+	}
+	originURL, err := url.Parse(origin)
+	if err == nil && originURL.Host != "" {
+		origin = originURL.Host
+	}
+	return origin
+}
+
+func (h adminHandler) originAllowed(origin string) bool {
+	for _, allowedOrigin := range h.allowedOrigins {
+		originCopy := origin
+		if !strings.Contains(allowedOrigin, "://") {
+			// no scheme specified, so allow both
+			originCopy = strings.TrimPrefix(originCopy, "http://")
+			originCopy = strings.TrimPrefix(originCopy, "https://")
+		}
+		if originCopy == allowedOrigin {
+			return true
+		}
+	}
+	return false
+}
+
+func handleLoad(w http.ResponseWriter, r *http.Request) error {
+	if r.Method != http.MethodPost {
+		return APIError{
+			Code: http.StatusMethodNotAllowed,
+			Err:  fmt.Errorf("method not allowed"),
+		}
+	}
+
+	buf := bufPool.Get().(*bytes.Buffer)
+	buf.Reset()
+	defer bufPool.Put(buf)
+
+	_, err := io.Copy(buf, r.Body)
+	if err != nil {
+		return APIError{
+			Code: http.StatusBadRequest,
+			Err:  fmt.Errorf("reading request body: %v", err),
+		}
+	}
+	body := buf.Bytes()
+
+	// if the config is formatted other than Caddy's native
+	// JSON, we need to adapt it before loading it
+	if ctHeader := r.Header.Get("Content-Type"); ctHeader != "" {
+		ct, _, err := mime.ParseMediaType(ctHeader)
+		if err != nil {
+			return APIError{
+				Code: http.StatusBadRequest,
+				Err:  fmt.Errorf("invalid Content-Type: %v", err),
+			}
+		}
+		if !strings.HasSuffix(ct, "/json") {
+			slashIdx := strings.Index(ct, "/")
+			if slashIdx < 0 {
+				return APIError{
+					Code: http.StatusBadRequest,
+					Err:  fmt.Errorf("malformed Content-Type"),
+				}
+			}
+			adapterName := ct[slashIdx+1:]
+			cfgAdapter := caddyconfig.GetAdapter(adapterName)
+			if cfgAdapter == nil {
+				return APIError{
+					Code: http.StatusBadRequest,
+					Err:  fmt.Errorf("unrecognized config adapter '%s'", adapterName),
+				}
+			}
+			result, warnings, err := cfgAdapter.Adapt(body, nil)
+			if err != nil {
+				return APIError{
+					Code: http.StatusBadRequest,
+					Err:  fmt.Errorf("adapting config using %s adapter: %v", adapterName, err),
+				}
+			}
+			if len(warnings) > 0 {
+				respBody, err := json.Marshal(warnings)
+				if err != nil {
+					Log().Named("admin.api.load").Error(err.Error())
+				}
+				w.Write(respBody)
+			}
+			body = result
+		}
+	}
+
+	forceReload := r.Header.Get("Cache-Control") == "must-revalidate"
+
+	err = Load(body, forceReload)
+	if err != nil {
+		return APIError{
+			Code: http.StatusBadRequest,
+			Err:  fmt.Errorf("loading config: %v", err),
+		}
+	}
+
+	Log().Named("admin.api").Info("load complete")
+
+	return nil
+}
+
+func handleConfig(w http.ResponseWriter, r *http.Request) error {
+	switch r.Method {
+	case http.MethodGet:
+		w.Header().Set("Content-Type", "application/json")
+
+		err := readConfig(r.URL.Path, w)
+		if err != nil {
+			return APIError{Code: http.StatusBadRequest, Err: err}
+		}
+
+		return nil
+
+	case http.MethodPost,
+		http.MethodPut,
+		http.MethodPatch,
+		http.MethodDelete:
+
+		// DELETE does not use a body, but the others do
+		var body []byte
+		if r.Method != http.MethodDelete {
+			if ct := r.Header.Get("Content-Type"); !strings.Contains(ct, "/json") {
+				return APIError{
+					Code: http.StatusBadRequest,
+					Err:  fmt.Errorf("unacceptable content-type: %v; 'application/json' required", ct),
+				}
+			}
+
+			buf := bufPool.Get().(*bytes.Buffer)
+			buf.Reset()
+			defer bufPool.Put(buf)
+
+			_, err := io.Copy(buf, r.Body)
+			if err != nil {
+				return APIError{
+					Code: http.StatusBadRequest,
+					Err:  fmt.Errorf("reading request body: %v", err),
+				}
+			}
+			body = buf.Bytes()
+		}
+
+		forceReload := r.Header.Get("Cache-Control") == "must-revalidate"
+
+		err := changeConfig(r.Method, r.URL.Path, body, forceReload)
+		if err != nil {
+			return err
+		}
+
+	default:
+		return APIError{
+			Code: http.StatusMethodNotAllowed,
+			Err:  fmt.Errorf("method %s not allowed", r.Method),
+		}
+	}
+
+	return nil
+}
+
+func handleConfigID(w http.ResponseWriter, r *http.Request) error {
+	idPath := r.URL.Path
+
+	parts := strings.Split(idPath, "/")
+	if len(parts) < 3 || parts[2] == "" {
+		return fmt.Errorf("request path is missing object ID")
+	}
+	if parts[0] != "" || parts[1] != "id" {
+		return fmt.Errorf("malformed object path")
+	}
+	id := parts[2]
+
+	// map the ID to the expanded path
+	currentCfgMu.RLock()
+	expanded, ok := rawCfgIndex[id]
+	defer currentCfgMu.RUnlock()
+	if !ok {
+		return fmt.Errorf("unknown object ID '%s'", id)
+	}
+
+	// piece the full URL path back together
+	parts = append([]string{expanded}, parts[3:]...)
+	r.URL.Path = path.Join(parts...)
+
+	return ErrInternalRedir
+}
+
+func handleStop(w http.ResponseWriter, r *http.Request) error {
+	err := handleUnload(w, r)
+	if err != nil {
+		Log().Named("admin.api").Error("unload error", zap.Error(err))
+	}
+	go func() {
+		err := stopAdminServer(adminServer)
+		var exitCode int
+		if err != nil {
+			exitCode = ExitCodeFailedQuit
+			Log().Named("admin.api").Error("failed to stop admin server gracefully", zap.Error(err))
+		}
+		Log().Named("admin.api").Info("stopping now, bye!! 👋")
+		os.Exit(exitCode)
+	}()
+	return nil
+}
+
+// handleUnload stops the current configuration that is running.
+// Note that doing this can also be accomplished with DELETE /config/
+// but we leave this function because handleStop uses it.
+func handleUnload(w http.ResponseWriter, r *http.Request) error {
+	if r.Method != http.MethodPost {
+		return APIError{
+			Code: http.StatusMethodNotAllowed,
+			Err:  fmt.Errorf("method not allowed"),
+		}
+	}
+	currentCfgMu.RLock()
+	hasCfg := currentCfg != nil
+	currentCfgMu.RUnlock()
+	if !hasCfg {
+		Log().Named("admin.api").Info("nothing to unload")
+		return nil
+	}
+	Log().Named("admin.api").Info("unloading")
+	if err := stopAndCleanup(); err != nil {
+		Log().Named("admin.api").Error("error unloading", zap.Error(err))
+	} else {
+		Log().Named("admin.api").Info("unloading completed")
+	}
+	return nil
+}
+
+// unsyncedConfigAccess traverses into the current config and performs
+// the operation at path according to method, using body and out as
+// needed. This is a low-level, unsynchronized function; most callers
+// will want to use changeConfig or readConfig instead. This requires a
+// read or write lock on currentCfgMu, depending on method (GET needs
+// only a read lock; all others need a write lock).
+func unsyncedConfigAccess(method, path string, body []byte, out io.Writer) error {
+	var err error
+	var val interface{}
+
+	// if there is a request body, decode it into the
+	// variable that will be set in the config according
+	// to method and path
+	if len(body) > 0 {
+		err = json.Unmarshal(body, &val)
+		if err != nil {
+			return fmt.Errorf("decoding request body: %v", err)
+		}
+	}
+
+	enc := json.NewEncoder(out)
+
+	cleanPath := strings.Trim(path, "/")
+	if cleanPath == "" {
+		return fmt.Errorf("no traversable path")
+	}
+
+	parts := strings.Split(cleanPath, "/")
+	if len(parts) == 0 {
+		return fmt.Errorf("path missing")
+	}
+
+	// A path that ends with "..." implies:
+	// 1) the part before it is an array
+	// 2) the payload is an array
+	// and means that the user wants to expand the elements
+	// in the payload array and append each one into the
+	// destination array, like so:
+	//     array = append(array, elems...)
+	// This special case is handled below.
+	ellipses := parts[len(parts)-1] == "..."
+	if ellipses {
+		parts = parts[:len(parts)-1]
+	}
+
+	var ptr interface{} = rawCfg
+
+traverseLoop:
+	for i, part := range parts {
+		switch v := ptr.(type) {
+		case map[string]interface{}:
+			// if the next part enters a slice, and the slice is our destination,
+			// handle it specially (because appending to the slice copies the slice
+			// header, which does not replace the original one like we want)
+			if arr, ok := v[part].([]interface{}); ok && i == len(parts)-2 {
+				var idx int
+				if method != http.MethodPost {
+					idxStr := parts[len(parts)-1]
+					idx, err = strconv.Atoi(idxStr)
+					if err != nil {
+						return fmt.Errorf("[%s] invalid array index '%s': %v",
+							path, idxStr, err)
+					}
+					if idx < 0 || idx >= len(arr) {
+						return fmt.Errorf("[%s] array index out of bounds: %s", path, idxStr)
+					}
+				}
+
+				switch method {
+				case http.MethodGet:
+					err = enc.Encode(arr[idx])
+					if err != nil {
+						return fmt.Errorf("encoding config: %v", err)
+					}
+				case http.MethodPost:
+					if ellipses {
+						valArray, ok := val.([]interface{})
+						if !ok {
+							return fmt.Errorf("final element is not an array")
+						}
+						v[part] = append(arr, valArray...)
+					} else {
+						v[part] = append(arr, val)
+					}
+				case http.MethodPut:
+					// avoid creation of new slice and a second copy (see
+					// https://github.com/golang/go/wiki/SliceTricks#insert)
+					arr = append(arr, nil)
+					copy(arr[idx+1:], arr[idx:])
+					arr[idx] = val
+					v[part] = arr
+				case http.MethodPatch:
+					arr[idx] = val
+				case http.MethodDelete:
+					v[part] = append(arr[:idx], arr[idx+1:]...)
+				default:
+					return fmt.Errorf("unrecognized method %s", method)
+				}
+				break traverseLoop
+			}
+
+			if i == len(parts)-1 {
+				switch method {
+				case http.MethodGet:
+					err = enc.Encode(v[part])
+					if err != nil {
+						return fmt.Errorf("encoding config: %v", err)
+					}
+				case http.MethodPost:
+					// if the part is an existing list, POST appends to
+					// it, otherwise it just sets or creates the value
+					if arr, ok := v[part].([]interface{}); ok {
+						if ellipses {
+							valArray, ok := val.([]interface{})
+							if !ok {
+								return fmt.Errorf("final element is not an array")
+							}
+							v[part] = append(arr, valArray...)
+						} else {
+							v[part] = append(arr, val)
+						}
+					} else {
+						v[part] = val
+					}
+				case http.MethodPut:
+					if _, ok := v[part]; ok {
+						return fmt.Errorf("[%s] key already exists: %s", path, part)
+					}
+					v[part] = val
+				case http.MethodPatch:
+					if _, ok := v[part]; !ok {
+						return fmt.Errorf("[%s] key does not exist: %s", path, part)
+					}
+					v[part] = val
+				case http.MethodDelete:
+					delete(v, part)
+				default:
+					return fmt.Errorf("unrecognized method %s", method)
+				}
+			} else {
+				// if we are "PUTting" a new resource, the key(s) in its path
+				// might not exist yet; that's OK but we need to make them as
+				// we go, while we still have a pointer from the level above
+				if v[part] == nil && method == http.MethodPut {
+					v[part] = make(map[string]interface{})
+				}
+				ptr = v[part]
+			}
+
+		case []interface{}:
+			partInt, err := strconv.Atoi(part)
+			if err != nil {
+				return fmt.Errorf("[/%s] invalid array index '%s': %v",
+					strings.Join(parts[:i+1], "/"), part, err)
+			}
+			if partInt < 0 || partInt >= len(v) {
+				return fmt.Errorf("[/%s] array index out of bounds: %s",
+					strings.Join(parts[:i+1], "/"), part)
+			}
+			ptr = v[partInt]
+
+		default:
+			return fmt.Errorf("invalid traversal path at: %s", strings.Join(parts[:i+1], "/"))
+		}
+	}
+
+	return nil
+}
+
+// RemoveMetaFields removes meta fields like "@id" from a JSON message
+// by using a simple regular expression. (An alternate way to do this
+// would be to delete them from the raw, map[string]interface{}
+// representation as they are indexed, then iterate the index we made
+// and add them back after encoding as JSON, but this is simpler.)
+func RemoveMetaFields(rawJSON []byte) []byte {
+	return idRegexp.ReplaceAllFunc(rawJSON, func(in []byte) []byte {
+		// matches with a comma on both sides (when "@id" property is
+		// not the first or last in the object) need to keep exactly
+		// one comma for correct JSON syntax
+		comma := []byte{','}
+		if bytes.HasPrefix(in, comma) && bytes.HasSuffix(in, comma) {
+			return comma
+		}
+		return []byte{}
+	})
+}
+
+// AdminHandler is like http.Handler except ServeHTTP may return an error.
+//
+// If any handler encounters an error, it should be returned for proper
+// handling.
+type AdminHandler interface {
+	ServeHTTP(http.ResponseWriter, *http.Request) error
+}
+
+// AdminHandlerFunc is a convenience type like http.HandlerFunc.
+type AdminHandlerFunc func(http.ResponseWriter, *http.Request) error
+
+// ServeHTTP implements the Handler interface.
+func (f AdminHandlerFunc) ServeHTTP(w http.ResponseWriter, r *http.Request) error {
+	return f(w, r)
+}
+
+// APIError is a structured error that every API
+// handler should return for consistency in logging
+// and client responses. If Message is unset, then
+// Err.Error() will be serialized in its place.
+type APIError struct {
+	Code    int    `json:"-"`
+	Err     error  `json:"-"`
+	Message string `json:"error"`
+}
+
+func (e APIError) Error() string {
+	if e.Err != nil {
+		return e.Err.Error()
+	}
+	return e.Message
+}
+
+var (
+	// DefaultAdminListen is the address for the admin
+	// listener, if none is specified at startup.
+	DefaultAdminListen = "localhost:2019"
+
+	// ErrInternalRedir indicates an internal redirect
+	// and is useful when admin API handlers rewrite
+	// the request; in that case, authentication and
+	// authorization needs to happen again for the
+	// rewritten request.
+	ErrInternalRedir = fmt.Errorf("internal redirect; re-authorization required")
+
+	// DefaultAdminConfig is the default configuration
+	// for the administration endpoint.
+	DefaultAdminConfig = &AdminConfig{
+		Listen: DefaultAdminListen,
+	}
+)
+
+// idRegexp is used to match ID fields and their associated values
+// in the config. It also matches adjacent commas so that syntax
+// can be preserved no matter where in the object the field appears.
+// It supports string and most numeric values.
+var idRegexp = regexp.MustCompile(`(?m),?\s*"` + idKey + `":\s?(-?[0-9]+(\.[0-9]+)?|(?U)".*")\s*,?`)
+
+const (
+	rawConfigKey = "config"
+	idKey        = "@id"
+)
+
+var bufPool = sync.Pool{
+	New: func() interface{} {
+		return new(bytes.Buffer)
+	},
+}
+
+var adminServer *http.Server

admin_test.go

@@ -0,0 +1,132 @@
+// Copyright 2015 Matthew Holt and The Caddy Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package caddy
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+)
+
+func TestUnsyncedConfigAccess(t *testing.T) {
+	// each test is performed in sequence, so
+	// each change builds on the previous ones;
+	// the config is not reset between tests
+	for i, tc := range []struct {
+		method    string
+		path      string // rawConfigKey will be prepended
+		payload   string
+		expect    string // JSON representation of what the whole config is expected to be after the request
+		shouldErr bool
+	}{
+		{
+			method:  "POST",
+			path:    "",
+			payload: `{"foo": "bar", "list": ["a", "b", "c"]}`, // starting value
+			expect:  `{"foo": "bar", "list": ["a", "b", "c"]}`,
+		},
+		{
+			method:  "POST",
+			path:    "/foo",
+			payload: `"jet"`,
+			expect:  `{"foo": "jet", "list": ["a", "b", "c"]}`,
+		},
+		{
+			method:  "POST",
+			path:    "/bar",
+			payload: `{"aa": "bb", "qq": "zz"}`,
+			expect:  `{"foo": "jet", "bar": {"aa": "bb", "qq": "zz"}, "list": ["a", "b", "c"]}`,
+		},
+		{
+			method: "DELETE",
+			path:   "/bar/qq",
+			expect: `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c"]}`,
+		},
+		{
+			method:  "POST",
+			path:    "/list",
+			payload: `"e"`,
+			expect:  `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "e"]}`,
+		},
+		{
+			method:  "PUT",
+			path:    "/list/3",
+			payload: `"d"`,
+			expect:  `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "d", "e"]}`,
+		},
+		{
+			method: "DELETE",
+			path:   "/list/3",
+			expect: `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "e"]}`,
+		},
+		{
+			method:  "PATCH",
+			path:    "/list/3",
+			payload: `"d"`,
+			expect:  `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "d"]}`,
+		},
+		{
+			method:  "POST",
+			path:    "/list/...",
+			payload: `["e", "f", "g"]`,
+			expect:  `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "d", "e", "f", "g"]}`,
+		},
+	} {
+		err := unsyncedConfigAccess(tc.method, rawConfigKey+tc.path, []byte(tc.payload), nil)
+
+		if tc.shouldErr && err == nil {
+			t.Fatalf("Test %d: Expected error return value, but got: %v", i, err)
+		}
+		if !tc.shouldErr && err != nil {
+			t.Fatalf("Test %d: Should not have had error return value, but got: %v", i, err)
+		}
+
+		// decode the expected config so we can do a convenient DeepEqual
+		var expectedDecoded interface{}
+		err = json.Unmarshal([]byte(tc.expect), &expectedDecoded)
+		if err != nil {
+			t.Fatalf("Test %d: Unmarshaling expected config: %v", i, err)
+		}
+
+		// make sure the resulting config is as we expect it
+		if !reflect.DeepEqual(rawCfg[rawConfigKey], expectedDecoded) {
+			t.Fatalf("Test %d:\nExpected:\n\t%#v\nActual:\n\t%#v",
+				i, expectedDecoded, rawCfg[rawConfigKey])
+		}
+	}
+}
+
+func BenchmarkLoad(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		cfg := []byte(`{
+			"apps": {
+				"http": {
+					"servers": {
+						"myserver": {
+							"listen": ["tcp/localhost:8080-8084"],
+							"read_timeout": "30s"
+						},
+						"yourserver": {
+							"listen": ["127.0.0.1:5000"],
+							"read_header_timeout": "15s"
+						}
+					}
+				}
+			}
+		}
+		`)
+		Load(cfg, true)
+	}
+}

appveyor.yml

@@ -1,32 +0,0 @@
-version: "{build}"
-
-os: Windows Server 2012 R2
-
-clone_folder: c:\gopath\src\github.com\mholt\caddy
-
-environment:
-  GOPATH: c:\gopath
-  CGO_ENABLED: 0
-
-install:
-  - rmdir c:\go /s /q
-  - appveyor DownloadFile https://storage.googleapis.com/golang/go1.6.windows-amd64.zip
-  - 7z x go1.6.windows-amd64.zip -y -oC:\ > NUL
-  - go version
-  - go env
-  - go get -t ./...
-  - go get github.com/golang/lint/golint
-  - go get github.com/gordonklaus/ineffassign
-  - set PATH=%GOPATH%\bin;%PATH%
-
-build: off
-
-test_script:
-  - go vet ./...
-  - go test ./...
-  - ineffassign .
-
-after_test:
-  - golint ./...
-
-deploy: off

azure-pipelines.yml

@@ -0,0 +1,240 @@
+# Mutilated beyond recognition from the example at:
+# https://docs.microsoft.com/azure/devops/pipelines/languages/go
+
+trigger:
+  - v2
+
+schedules:
+- cron: "0 0 * * *"
+  displayName: Daily midnight fuzzing
+  branches:
+    include:
+    - v2
+  always: true
+
+variables:
+  GOROOT: $(gorootDir)/go
+  GOPATH: $(system.defaultWorkingDirectory)/gopath
+  GOBIN:  $(GOPATH)/bin
+  modulePath: '$(GOPATH)/src/github.com/$(build.repository.name)'
+  # TODO: Remove once it's enabled by default
+  GO111MODULE: on
+
+jobs:
+- job: crossPlatformTest
+  displayName: "Cross-Platform Tests"
+  strategy:
+    matrix:
+      linux:
+        imageName: ubuntu-16.04
+        gorootDir: /usr/local
+      mac:
+        imageName: macos-10.13
+        gorootDir: /usr/local
+      windows:
+        imageName: windows-2019
+        gorootDir: C:\
+  pool:
+    vmImage: $(imageName)
+  
+  steps:
+  - bash: |
+      latestGo=$(curl "https://golang.org/VERSION?m=text")
+      echo "##vso[task.setvariable variable=LATEST_GO]$latestGo"
+      echo "Latest Go version: $latestGo"
+    displayName: "Get latest Go version"
+
+  - bash: |
+      sudo rm -f $(which go)
+      echo '##vso[task.prependpath]$(GOBIN)'
+      echo '##vso[task.prependpath]$(GOROOT)/bin'
+      mkdir -p '$(modulePath)'
+      shopt -s extglob
+      shopt -s dotglob
+      mv !(gopath) '$(modulePath)'
+    displayName: Remove old Go, set GOBIN/GOROOT, and move project into GOPATH
+
+  # Install Go (this varies by platform)
+  - bash: |
+      wget "https://dl.google.com/go/$(LATEST_GO).linux-amd64.tar.gz"
+      sudo tar -C $(gorootDir) -xzf "$(LATEST_GO).linux-amd64.tar.gz"
+    condition: eq( variables['Agent.OS'], 'Linux' )
+    displayName: Install Go on Linux
+
+  - bash: |
+      wget "https://dl.google.com/go/$(LATEST_GO).darwin-amd64.tar.gz"
+      sudo tar -C $(gorootDir) -xzf "$(LATEST_GO).darwin-amd64.tar.gz"
+    condition: eq( variables['Agent.OS'], 'Darwin' )
+    displayName: Install Go on macOS
+
+  # The low performance is partly due to PowerShell's attempt to update the progress bar. Disabling it speeds up the process.
+  # Reference: https://github.com/PowerShell/PowerShell/issues/2138
+  - powershell: |
+      $ProgressPreference = 'SilentlyContinue'
+      Write-Host "Downloading Go..."
+      (New-Object System.Net.WebClient).DownloadFile("https://dl.google.com/go/$(LATEST_GO).windows-amd64.zip", "$(LATEST_GO).windows-amd64.zip")
+      Write-Host "Extracting Go... (I'm slow too)"
+      7z x "$(LATEST_GO).windows-amd64.zip" -o"$(gorootDir)"
+    condition: eq( variables['Agent.OS'], 'Windows_NT' )
+    displayName: Install Go on Windows
+
+  - bash: curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.19.1
+    displayName: Install golangci-lint
+
+  - script: |
+      go get github.com/axw/gocov/gocov
+      go get github.com/AlekSi/gocov-xml
+      go get -u github.com/jstemmer/go-junit-report
+    displayName: Install test and coverage analysis tools
+
+  - bash: |
+      printf "Using go at: $(which go)\n"
+      printf "Go version: $(go version)\n"
+      printf "\n\nGo environment:\n\n"
+      go env
+      printf "\n\nSystem environment:\n\n"
+      env
+    displayName: Print Go version and environment
+
+  - script: |
+      go get -v -t -d ./...
+      mkdir test-results
+    workingDirectory: '$(modulePath)'
+    displayName: Get dependencies
+
+  # its behavior is governed by .golangci.yml
+  - script: |
+      (golangci-lint run --out-format junit-xml) > test-results/lint-result.xml
+      exit 0
+    workingDirectory: '$(modulePath)'
+    continueOnError: true
+    displayName: Run lint check
+
+  - script: |
+      (go test -v -coverprofile=cover-profile.out -race ./... 2>&1) > test-results/test-result.out
+    workingDirectory: '$(modulePath)'
+    continueOnError: true
+    displayName: Run tests
+
+  - script: |
+      mkdir coverage
+      gocov convert cover-profile.out > coverage/coverage.json
+      # Because Windows doesn't work with input redirection like *nix, but output redirection works.
+      (cat ./coverage/coverage.json | gocov-xml) > coverage/coverage.xml 
+    workingDirectory: '$(modulePath)'
+    displayName: Prepare coverage reports
+
+  - script: |
+      (cat ./test-results/test-result.out | go-junit-report) > test-results/test-result.xml
+    workingDirectory: '$(modulePath)'
+    displayName: Prepare test report
+
+  - task: PublishCodeCoverageResults@1
+    displayName: Publish test coverage report
+    inputs:
+      codeCoverageTool: Cobertura 
+      summaryFileLocation: $(modulePath)/coverage/coverage.xml
+
+  - task: PublishTestResults@2
+    displayName: Publish unit test
+    inputs:
+      testResultsFormat: 'JUnit'
+      testResultsFiles: $(modulePath)/test-results/test-result.xml
+      testRunTitle: $(agent.OS) Unit Test
+      mergeTestResults: false
+
+  - task: PublishTestResults@2
+    displayName: Publish lint results
+    inputs:
+      testResultsFormat: 'JUnit'
+      testResultsFiles: $(modulePath)/test-results/lint-result.xml
+      testRunTitle: $(agent.OS) Lint
+      mergeTestResults: false
+
+  - bash: |
+      exit 1
+    condition: eq(variables['Agent.JobStatus'], 'SucceededWithIssues')
+    displayName: Coerce correct build result
+
+- job: fuzzing
+  displayName: 'Fuzzing'
+  # Only run this job on schedules or PRs for non-forks.
+  condition: or(eq(variables['System.PullRequest.IsFork'], 'False'), eq(variables['Build.Reason'], 'Schedule') )
+  strategy:
+    matrix:
+      linux:
+        imageName: ubuntu-16.04
+        gorootDir: /usr/local
+  pool:
+    vmImage: $(imageName)
+
+  steps:
+  - bash: |
+      latestGo=$(curl "https://golang.org/VERSION?m=text")
+      echo "##vso[task.setvariable variable=LATEST_GO]$latestGo"
+      echo "Latest Go version: $latestGo"
+    displayName: "Get latest Go version"
+
+  - bash: |
+      sudo rm -f $(which go)
+      echo '##vso[task.prependpath]$(GOBIN)'
+      echo '##vso[task.prependpath]$(GOROOT)/bin'
+      mkdir -p '$(modulePath)'
+      shopt -s extglob
+      shopt -s dotglob
+      mv !(gopath) '$(modulePath)'
+    displayName: Remove old Go, set GOBIN/GOROOT, and move project into GOPATH
+
+  - bash: |
+      wget "https://dl.google.com/go/$(LATEST_GO).linux-amd64.tar.gz"
+      sudo tar -C $(gorootDir) -xzf "$(LATEST_GO).linux-amd64.tar.gz"
+    condition: eq( variables['Agent.OS'], 'Linux' )
+    displayName: Install Go on Linux
+
+  - bash: |
+      # Install Clang-7.0 because other versions seem to be missing the file libclang_rt.fuzzer-x86_64.a
+      sudo add-apt-repository "deb http://apt.llvm.org/xenial/ llvm-toolchain-xenial-7 main"
+      wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -
+      sudo apt update && sudo apt install -y clang-7 lldb-7 lld-7
+
+      go get -v github.com/dvyukov/go-fuzz/go-fuzz github.com/dvyukov/go-fuzz/go-fuzz-build
+      wget -q -O fuzzit https://github.com/fuzzitdev/fuzzit/releases/download/v2.4.74/fuzzit_Linux_x86_64
+      chmod a+x fuzzit
+      mv fuzzit $(GOBIN)
+    displayName: Download go-fuzz tools and the Fuzzit CLI, and move Fuzzit CLI to GOBIN
+    condition: and(eq(variables['System.PullRequest.IsFork'], 'False') , eq( variables['Agent.OS'], 'Linux' ))
+
+  - bash: |
+      declare -A fuzzers_funcs=(\
+        ["./caddyconfig/httpcaddyfile/addresses_fuzz.go"]="FuzzParseAddress" \
+        ["./caddyconfig/caddyfile/parse_fuzz.go"]="FuzzParseCaddyfile" \
+        ["./listeners_fuzz.go"]="FuzzParseNetworkAddress" \
+        ["./replacer_fuzz.go"]="FuzzReplacer" \
+      )
+
+      declare -A fuzzers_targets=(\
+        ["./caddyconfig/httpcaddyfile/addresses_fuzz.go"]="parse-address" \
+        ["./caddyconfig/caddyfile/parse_fuzz.go"]="parse-caddyfile" \
+        ["./listeners_fuzz.go"]="parse-network-address" \
+        ["./replacer_fuzz.go"]="replacer" \
+      )
+
+      fuzz_type="local-regression"
+      if [[ $(Build.Reason) == "Schedule" ]]; then
+        fuzz_type="fuzzing"
+      fi
+      echo "Fuzzing type: $fuzz_type"
+
+      for f in $(find . -name \*_fuzz.go); do
+        FUZZER_DIRECTORY=$(dirname $f)
+        echo "go-fuzz-build func ${fuzzers_funcs[$f]} residing in $f"
+        go-fuzz-build -func "${fuzzers_funcs[$f]}" -libfuzzer -o "$FUZZER_DIRECTORY/${fuzzers_targets[$f]}.a" $FUZZER_DIRECTORY
+        echo "Generating fuzzer binary of func ${fuzzers_funcs[$f]} which resides in $f"
+        clang-7 -fsanitize=fuzzer "$FUZZER_DIRECTORY/${fuzzers_targets[$f]}.a" -o "$FUZZER_DIRECTORY/${fuzzers_targets[$f]}"
+        fuzzit create job caddyserver/${fuzzers_targets[$f]} $FUZZER_DIRECTORY/${fuzzers_targets[$f]} --api-key ${FUZZIT_API_KEY} --type "${fuzz_type}" --branch "${SYSTEM_PULLREQUEST_SOURCEBRANCH}" --revision "${BUILD_SOURCEVERSION}"
+        echo "Completed $f"
+      done
+    env:
+      FUZZIT_API_KEY: $(FUZZIT_API_KEY)
+    workingDirectory: '$(modulePath)'
+    displayName: Generate fuzzers & submit them to Fuzzit

build.bash

@@ -1,57 +0,0 @@
-#!/usr/bin/env bash
-#
-# Caddy build script. Automates proper versioning.
-#
-# Usage:
-#
-#     $ ./build.bash [output_filename] [git_repo]
-#
-# Outputs compiled program in current directory.
-# Default file name is 'ecaddy'.
-# Default git repo is current directory.
-# Builds always take place from current directory.
-
-set -euo pipefail
-
-: ${output_filename:="${1:-}"}
-: ${output_filename:="ecaddy"}
-
-: ${git_repo:="${2:-}"}
-: ${git_repo:="."}
-
-pkg=main
-ldflags=()
-
-# Timestamp of build
-name="${pkg}.buildDate"
-value=$(date -u +"%a %b %d %H:%M:%S %Z %Y")
-ldflags+=("-X" "\"${name}=${value}\"")
-
-# Current tag, if HEAD is on a tag
-name="${pkg}.gitTag"
-set +e
-value="$(git -C "${git_repo}" describe --exact-match HEAD 2>/dev/null)"
-set -e
-ldflags+=("-X" "\"${name}=${value}\"")
-
-# Nearest tag on branch
-name="${pkg}.gitNearestTag"
-value="$(git -C "${git_repo}" describe --abbrev=0 --tags HEAD)"
-ldflags+=("-X" "\"${name}=${value}\"")
-
-# Commit SHA
-name="${pkg}.gitCommit"
-value="$(git -C "${git_repo}" rev-parse --short HEAD)"
-ldflags+=("-X" "\"${name}=${value}\"")
-
-# Summary of uncommitted changes
-name="${pkg}.gitShortStat"
-value="$(git -C "${git_repo}" diff-index --shortstat HEAD)"
-ldflags+=("-X" "\"${name}=${value}\"")
-
-# List of modified files
-name="${pkg}.gitFilesModified"
-value="$(git -C "${git_repo}" diff-index --name-only HEAD)"
-ldflags+=("-X" "\"${name}=${value}\"")
-
-go build -ldflags "${ldflags[*]}" -o "${output_filename}"

caddy.go

@@ -0,0 +1,572 @@
+// Copyright 2015 Matthew Holt and The Caddy Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package caddy
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"log"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"runtime/debug"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/mholt/certmagic"
+	"go.uber.org/zap"
+)
+
+// Config is the top (or beginning) of the Caddy configuration structure.
+// Caddy config is expressed natively as a JSON document. If you prefer
+// not to work with JSON directly, there are [many config adapters](/docs/config-adapters)
+// available that can convert various inputs into Caddy JSON.
+//
+// Many parts of this config are extensible through the use of Caddy modules.
+// Fields which have a json.RawMessage type and which appear as dots (•••) in
+// the online docs can be fulfilled by modules in a certain module
+// namespace. The docs show which modules can be used in a given place.
+//
+// Whenever a module is used, its name must be given either inline as part of
+// the module, or as the key to the module's value. The docs will make it clear
+// which to use.
+//
+// Generally, all config settings are optional, as it is Caddy convention to
+// have good, documented default values. If a parameter is required, the docs
+// should say so.
+//
+// Go programs which are directly building a Config struct value should take
+// care to populate the JSON-encodable fields of the struct (i.e. the fields
+// with `json` struct tags) if employing the module lifecycle (e.g. Provision
+// method calls).
+type Config struct {
+	Admin   *AdminConfig `json:"admin,omitempty"`
+	Logging *Logging     `json:"logging,omitempty"`
+
+	// StorageRaw is a storage module that defines how/where Caddy
+	// stores assets (such as TLS certificates). The default storage
+	// module is `caddy.storage.file_system` (the local file system),
+	// and the default path
+	// [depends on the OS and environment](/docs/conventions#data-directory).
+	StorageRaw json.RawMessage `json:"storage,omitempty" caddy:"namespace=caddy.storage inline_key=module"`
+
+	// AppsRaw are the apps that Caddy will load and run. The
+	// app module name is the key, and the app's config is the
+	// associated value.
+	AppsRaw ModuleMap `json:"apps,omitempty" caddy:"namespace="`
+
+	apps    map[string]App
+	storage certmagic.Storage
+
+	cancelFunc context.CancelFunc
+}
+
+// App is a thing that Caddy runs.
+type App interface {
+	Start() error
+	Stop() error
+}
+
+// Run runs the given config, replacing any existing config.
+func Run(cfg *Config) error {
+	cfgJSON, err := json.Marshal(cfg)
+	if err != nil {
+		return err
+	}
+	return Load(cfgJSON, true)
+}
+
+// Load loads the given config JSON and runs it only
+// if it is different from the current config or
+// forceReload is true.
+func Load(cfgJSON []byte, forceReload bool) error {
+	return changeConfig(http.MethodPost, "/"+rawConfigKey, cfgJSON, forceReload)
+}
+
+// changeConfig changes the current config (rawCfg) according to the
+// method, traversed via the given path, and uses the given input as
+// the new value (if applicable; i.e. "DELETE" doesn't have an input).
+// If the resulting config is the same as the previous, no reload will
+// occur unless forceReload is true. This function is safe for
+// concurrent use.
+func changeConfig(method, path string, input []byte, forceReload bool) error {
+	switch method {
+	case http.MethodGet,
+		http.MethodHead,
+		http.MethodOptions,
+		http.MethodConnect,
+		http.MethodTrace:
+		return fmt.Errorf("method not allowed")
+	}
+
+	currentCfgMu.Lock()
+	defer currentCfgMu.Unlock()
+
+	err := unsyncedConfigAccess(method, path, input, nil)
+	if err != nil {
+		return err
+	}
+
+	// the mutation is complete, so encode the entire config as JSON
+	newCfg, err := json.Marshal(rawCfg[rawConfigKey])
+	if err != nil {
+		return APIError{
+			Code: http.StatusBadRequest,
+			Err:  fmt.Errorf("encoding new config: %v", err),
+		}
+	}
+
+	// if nothing changed, no need to do a whole reload unless the client forces it
+	if !forceReload && bytes.Equal(rawCfgJSON, newCfg) {
+		Log().Named("admin.api").Info("config is unchanged")
+		return nil
+	}
+
+	// find any IDs in this config and index them
+	idx := make(map[string]string)
+	err = indexConfigObjects(rawCfg[rawConfigKey], "/"+rawConfigKey, idx)
+	if err != nil {
+		return APIError{
+			Code: http.StatusInternalServerError,
+			Err:  fmt.Errorf("indexing config: %v", err),
+		}
+	}
+
+	// load this new config; if it fails, we need to revert to
+	// our old representation of caddy's actual config
+	err = unsyncedDecodeAndRun(newCfg)
+	if err != nil {
+		if len(rawCfgJSON) > 0 {
+			// restore old config state to keep it consistent
+			// with what caddy is still running; we need to
+			// unmarshal it again because it's likely that
+			// pointers deep in our rawCfg map were modified
+			var oldCfg interface{}
+			err2 := json.Unmarshal(rawCfgJSON, &oldCfg)
+			if err2 != nil {
+				err = fmt.Errorf("%v; additionally, restoring old config: %v", err, err2)
+			}
+			rawCfg[rawConfigKey] = oldCfg
+		}
+
+		return fmt.Errorf("loading new config: %v", err)
+	}
+
+	// success, so update our stored copy of the encoded
+	// config to keep it consistent with what caddy is now
+	// running (storing an encoded copy is not strictly
+	// necessary, but avoids an extra json.Marshal for
+	// each config change)
+	rawCfgJSON = newCfg
+	rawCfgIndex = idx
+
+	return nil
+}
+
+// readConfig traverses the current config to path
+// and writes its JSON encoding to out.
+func readConfig(path string, out io.Writer) error {
+	currentCfgMu.RLock()
+	defer currentCfgMu.RUnlock()
+	return unsyncedConfigAccess(http.MethodGet, path, nil, out)
+}
+
+// indexConfigObjects recurisvely searches ptr for object fields named
+// "@id" and maps that ID value to the full configPath in the index.
+// This function is NOT safe for concurrent access; obtain a write lock
+// on currentCfgMu.
+func indexConfigObjects(ptr interface{}, configPath string, index map[string]string) error {
+	switch val := ptr.(type) {
+	case map[string]interface{}:
+		for k, v := range val {
+			if k == idKey {
+				switch idVal := v.(type) {
+				case string:
+					index[idVal] = configPath
+				case float64: // all JSON numbers decode as float64
+					index[fmt.Sprintf("%v", idVal)] = configPath
+				default:
+					return fmt.Errorf("%s: %s field must be a string or number", configPath, idKey)
+				}
+				continue
+			}
+			// traverse this object property recursively
+			err := indexConfigObjects(val[k], path.Join(configPath, k), index)
+			if err != nil {
+				return err
+			}
+		}
+	case []interface{}:
+		// traverse each element of the array recursively
+		for i := range val {
+			err := indexConfigObjects(val[i], path.Join(configPath, strconv.Itoa(i)), index)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+// unsyncedDecodeAndRun removes any meta fields (like @id tags)
+// from cfgJSON, decodes the result into a *Config, and runs
+// it as the new config, replacing any other current config.
+// It does NOT update the raw config state, as this is a
+// lower-level function; most callers will want to use Load
+// instead. A write lock on currentCfgMu is required!
+func unsyncedDecodeAndRun(cfgJSON []byte) error {
+	// remove any @id fields from the JSON, which would cause
+	// loading to break since the field wouldn't be recognized
+	strippedCfgJSON := RemoveMetaFields(cfgJSON)
+
+	var newCfg *Config
+	err := strictUnmarshalJSON(strippedCfgJSON, &newCfg)
+	if err != nil {
+		return err
+	}
+
+	// run the new config and start all its apps
+	err = run(newCfg, true)
+	if err != nil {
+		return err
+	}
+
+	// swap old config with the new one
+	oldCfg := currentCfg
+	currentCfg = newCfg
+
+	// Stop, Cleanup each old app
+	unsyncedStop(oldCfg)
+
+	// autosave a non-nil config, if not disabled
+	if newCfg != nil &&
+		(newCfg.Admin == nil ||
+			newCfg.Admin.Config == nil ||
+			newCfg.Admin.Config.Persist == nil ||
+			*newCfg.Admin.Config.Persist) {
+		dir := filepath.Dir(ConfigAutosavePath)
+		err := os.MkdirAll(dir, 0700)
+		if err != nil {
+			Log().Error("unable to create folder for config autosave",
+				zap.String("dir", dir),
+				zap.Error(err))
+		} else {
+			err := ioutil.WriteFile(ConfigAutosavePath, cfgJSON, 0600)
+			if err == nil {
+				Log().Info("autosaved config", zap.String("file", ConfigAutosavePath))
+			} else {
+				Log().Error("unable to autosave config",
+					zap.String("file", ConfigAutosavePath),
+					zap.Error(err))
+			}
+		}
+	}
+
+	return nil
+}
+
+// run runs newCfg and starts all its apps if
+// start is true. If any errors happen, cleanup
+// is performed if any modules were provisioned;
+// apps that were started already will be stopped,
+// so this function should not leak resources if
+// an error is returned. However, if no error is
+// returned and start == false, you should cancel
+// the config if you are not going to start it,
+// so that each provisioned module will be
+// cleaned up.
+//
+// This is a low-level function; most callers
+// will want to use Run instead, which also
+// updates the config's raw state.
+func run(newCfg *Config, start bool) error {
+	// because we will need to roll back any state
+	// modifications if this function errors, we
+	// keep a single error value and scope all
+	// sub-operations to their own functions to
+	// ensure this error value does not get
+	// overridden or missed when it should have
+	// been set by a short assignment
+	var err error
+
+	// start the admin endpoint (and stop any prior one)
+	if start {
+		err = replaceAdmin(newCfg)
+		if err != nil {
+			return fmt.Errorf("starting caddy administration endpoint: %v", err)
+		}
+	}
+
+	if newCfg == nil {
+		return nil
+	}
+
+	// prepare the new config for use
+	newCfg.apps = make(map[string]App)
+
+	// create a context within which to load
+	// modules - essentially our new config's
+	// execution environment; be sure that
+	// cleanup occurs when we return if there
+	// was an error; if no error, it will get
+	// cleaned up on next config cycle
+	ctx, cancel := NewContext(Context{Context: context.Background(), cfg: newCfg})
+	defer func() {
+		if err != nil {
+			// if there were any errors during startup,
+			// we should cancel the new context we created
+			// since the associated config won't be used;
+			// this will cause all modules that were newly
+			// provisioned to clean themselves up
+			cancel()
+
+			// also undo any other state changes we made
+			if currentCfg != nil {
+				certmagic.Default.Storage = currentCfg.storage
+			}
+		}
+	}()
+	newCfg.cancelFunc = cancel // clean up later
+
+	// set up logging before anything bad happens
+	if newCfg.Logging == nil {
+		newCfg.Logging = new(Logging)
+	}
+	err = newCfg.Logging.openLogs(ctx)
+	if err != nil {
+		return err
+	}
+
+	// set up global storage and make it CertMagic's default storage, too
+	err = func() error {
+		if newCfg.StorageRaw != nil {
+			val, err := ctx.LoadModule(newCfg, "StorageRaw")
+			if err != nil {
+				return fmt.Errorf("loading storage module: %v", err)
+			}
+			stor, err := val.(StorageConverter).CertMagicStorage()
+			if err != nil {
+				return fmt.Errorf("creating storage value: %v", err)
+			}
+			newCfg.storage = stor
+		}
+
+		if newCfg.storage == nil {
+			newCfg.storage = &certmagic.FileStorage{Path: AppDataDir()}
+		}
+		certmagic.Default.Storage = newCfg.storage
+
+		return nil
+	}()
+	if err != nil {
+		return err
+	}
+
+	// Load, Provision, Validate each app and their submodules
+	err = func() error {
+		appsIface, err := ctx.LoadModule(newCfg, "AppsRaw")
+		if err != nil {
+			return fmt.Errorf("loading app modules: %v", err)
+		}
+		for appName, appIface := range appsIface.(map[string]interface{}) {
+			newCfg.apps[appName] = appIface.(App)
+		}
+		return nil
+	}()
+	if err != nil {
+		return err
+	}
+
+	if !start {
+		return nil
+	}
+
+	// Start
+	return func() error {
+		var started []string
+		for name, a := range newCfg.apps {
+			err := a.Start()
+			if err != nil {
+				// an app failed to start, so we need to stop
+				// all other apps that were already started
+				for _, otherAppName := range started {
+					err2 := newCfg.apps[otherAppName].Stop()
+					if err2 != nil {
+						err = fmt.Errorf("%v; additionally, aborting app %s: %v",
+							err, otherAppName, err2)
+					}
+				}
+				return fmt.Errorf("%s app module: start: %v", name, err)
+			}
+			started = append(started, name)
+		}
+		return nil
+	}()
+}
+
+// Stop stops running the current configuration.
+// It is the antithesis of Run(). This function
+// will log any errors that occur during the
+// stopping of individual apps and continue to
+// stop the others. Stop should only be called
+// if not replacing with a new config.
+func Stop() error {
+	currentCfgMu.Lock()
+	defer currentCfgMu.Unlock()
+	unsyncedStop(currentCfg)
+	currentCfg = nil
+	rawCfgJSON = nil
+	rawCfgIndex = nil
+	rawCfg[rawConfigKey] = nil
+	return nil
+}
+
+// unsyncedStop stops cfg from running, but has
+// no locking around cfg. It is a no-op if cfg is
+// nil. If any app returns an error when stopping,
+// it is logged and the function continues stopping
+// the next app. This function assumes all apps in
+// cfg were successfully started first.
+func unsyncedStop(cfg *Config) {
+	if cfg == nil {
+		return
+	}
+
+	// stop each app
+	for name, a := range cfg.apps {
+		err := a.Stop()
+		if err != nil {
+			log.Printf("[ERROR] stop %s: %v", name, err)
+		}
+	}
+
+	// clean up all modules
+	cfg.cancelFunc()
+}
+
+// stopAndCleanup calls stop and cleans up anything
+// else that is expedient. This should only be used
+// when stopping and not replacing with a new config.
+func stopAndCleanup() error {
+	if err := Stop(); err != nil {
+		return err
+	}
+	certmagic.CleanUpOwnLocks()
+	return nil
+}
+
+// Validate loads, provisions, and validates
+// cfg, but does not start running it.
+func Validate(cfg *Config) error {
+	err := run(cfg, false)
+	if err == nil {
+		cfg.cancelFunc() // call Cleanup on all modules
+	}
+	return err
+}
+
+// Duration can be an integer or a string. An integer is
+// interpreted as nanoseconds. If a string, it is a Go
+// time.Duration value such as `300ms`, `1.5h`, or `2h45m`;
+// valid units are `ns`, `us`/`µs`, `ms`, `s`, `m`, and `h`.
+type Duration time.Duration
+
+// UnmarshalJSON satisfies json.Unmarshaler.
+func (d *Duration) UnmarshalJSON(b []byte) error {
+	if len(b) == 0 {
+		return io.EOF
+	}
+	var dur time.Duration
+	var err error
+	if b[0] == byte('"') && b[len(b)-1] == byte('"') {
+		dur, err = time.ParseDuration(strings.Trim(string(b), `"`))
+	} else {
+		err = json.Unmarshal(b, &dur)
+	}
+	*d = Duration(dur)
+	return err
+}
+
+// GoModule returns the build info of this Caddy
+// build from debug.BuildInfo (requires Go modules).
+// If no version information is available, a non-nil
+// value will still be returned, but with an
+// unknown version.
+func GoModule() *debug.Module {
+	var mod debug.Module
+	return goModule(&mod)
+}
+
+// goModule holds the actual implementation of GoModule.
+// Allocating debug.Module in GoModule() and passing a
+// reference to goModule enables mid-stack inlining.
+func goModule(mod *debug.Module) *debug.Module {
+	mod.Version = "unknown"
+	bi, ok := debug.ReadBuildInfo()
+	if ok {
+		mod.Path = bi.Main.Path
+		// The recommended way to build Caddy involves
+		// creating a separate main module, which
+		// TODO: track related Go issue: https://github.com/golang/go/issues/29228
+		// once that issue is fixed, we should just be able to use bi.Main... hopefully.
+		for _, dep := range bi.Deps {
+			if dep.Path == ImportPath {
+				return dep
+			}
+		}
+		return &bi.Main
+	}
+	return mod
+}
+
+// CtxKey is a value type for use with context.WithValue.
+type CtxKey string
+
+// This group of variables pertains to the current configuration.
+var (
+	// currentCfgMu protects everything in this var block.
+	currentCfgMu sync.RWMutex
+
+	// currentCfg is the currently-running configuration.
+	currentCfg *Config
+
+	// rawCfg is the current, generic-decoded configuration;
+	// we initialize it as a map with one field ("config")
+	// to maintain parity with the API endpoint and to avoid
+	// the special case of having to access/mutate the variable
+	// directly without traversing into it.
+	rawCfg = map[string]interface{}{
+		rawConfigKey: nil,
+	}
+
+	// rawCfgJSON is the JSON-encoded form of rawCfg. Keeping
+	// this around avoids an extra Marshal call during changes.
+	rawCfgJSON []byte
+
+	// rawCfgIndex is the map of user-assigned ID to expanded
+	// path, for converting /id/ paths to /config/ paths.
+	rawCfgIndex map[string]string
+)
+
+// ImportPath is the package import path for Caddy core.
+const ImportPath = "github.com/caddyserver/caddy/v2"

caddy/assets/path.go

@@ -1,29 +0,0 @@
-package assets
-
-import (
-	"os"
-	"path/filepath"
-	"runtime"
-)
-
-// Path returns the path to the folder
-// where the application may store data. This
-// currently resolves to ~/.caddy
-func Path() string {
-	return filepath.Join(userHomeDir(), ".caddy")
-}
-
-// userHomeDir returns the user's home directory according to
-// environment variables.
-//
-// Credit: http://stackoverflow.com/a/7922977/1048862
-func userHomeDir() string {
-	if runtime.GOOS == "windows" {
-		home := os.Getenv("HOMEDRIVE") + os.Getenv("HOMEPATH")
-		if home == "" {
-			home = os.Getenv("USERPROFILE")
-		}
-		return home
-	}
-	return os.Getenv("HOME")
-}

caddy/assets/path_test.go

@@ -1,12 +0,0 @@
-package assets
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestPath(t *testing.T) {
-	if actual := Path(); !strings.HasSuffix(actual, ".caddy") {
-		t.Errorf("Expected path to be a .caddy folder, got: %v", actual)
-	}
-}

caddy/caddy.go

@@ -1,401 +0,0 @@
-// Package caddy implements the Caddy web server as a service
-// in your own Go programs.
-//
-// To use this package, follow a few simple steps:
-//
-//   1. Set the AppName and AppVersion variables.
-//   2. Call LoadCaddyfile() to get the Caddyfile (it
-//      might have been piped in as part of a restart).
-//      You should pass in your own Caddyfile loader.
-//   3. Call caddy.Start() to start Caddy, caddy.Stop()
-//      to stop it, or caddy.Restart() to restart it.
-//
-// You should use caddy.Wait() to wait for all Caddy servers
-// to quit before your process exits.
-package caddy
-
-import (
-	"bytes"
-	"encoding/gob"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"log"
-	"net"
-	"os"
-	"path"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"github.com/mholt/caddy/caddy/https"
-	"github.com/mholt/caddy/server"
-)
-
-// Configurable application parameters
-var (
-	// AppName is the name of the application.
-	AppName string
-
-	// AppVersion is the version of the application.
-	AppVersion string
-
-	// Quiet when set to true, will not show any informative output on initialization.
-	Quiet bool
-
-	// HTTP2 indicates whether HTTP2 is enabled or not.
-	HTTP2 bool
-
-	// PidFile is the path to the pidfile to create.
-	PidFile string
-
-	// GracefulTimeout is the maximum duration of a graceful shutdown.
-	GracefulTimeout time.Duration
-
-	// RestartMode is the mode used for restart,
-	// "inproc" will restart in process,
-	// otherwise default behavior is used (inproc on Windows, fork on Linux).
-	RestartMode = ""
-)
-
-var (
-	// caddyfile is the input configuration text used for this process
-	caddyfile Input
-
-	// caddyfileMu protects caddyfile during changes
-	caddyfileMu sync.Mutex
-
-	// errIncompleteRestart occurs if this process is a fork
-	// of the parent but no Caddyfile was piped in
-	errIncompleteRestart = errors.New("incomplete restart")
-
-	// servers is a list of all the currently-listening servers
-	servers []*server.Server
-
-	// serversMu protects the servers slice during changes
-	serversMu sync.Mutex
-
-	// wg is used to wait for all servers to shut down
-	wg sync.WaitGroup
-
-	// loadedGob is used if this is a child process as part of
-	// a graceful restart; it is used to map listeners to their
-	// index in the list of inherited file descriptors. This
-	// variable is not safe for concurrent access.
-	loadedGob caddyfileGob
-
-	// startedBefore should be set to true if caddy has been started
-	// at least once (does not indicate whether currently running).
-	startedBefore bool
-)
-
-const (
-	// DefaultHost is the default host.
-	DefaultHost = ""
-	// DefaultPort is the default port.
-	DefaultPort = "2015"
-	// DefaultRoot is the default root folder.
-	DefaultRoot = "."
-)
-
-// Start starts Caddy with the given Caddyfile. If cdyfile
-// is nil, the LoadCaddyfile function will be called to get
-// one.
-//
-// This function blocks until all the servers are listening.
-//
-// Note (POSIX): If Start is called in the child process of a
-// restart more than once within the duration of the graceful
-// cutoff (i.e. the child process called Start a first time,
-// then called Stop, then Start again within the first 5 seconds
-// or however long GracefulTimeout is) and the Caddyfiles have
-// at least one listener address in common, the second Start
-// may fail with "address already in use" as there's no
-// guarantee that the parent process has relinquished the
-// address before the grace period ends.
-func Start(cdyfile Input) (err error) {
-	// If we return with no errors, we must do two things: tell the
-	// parent that we succeeded and write to the pidfile.
-	defer func() {
-		if err == nil {
-			signalSuccessToParent() // TODO: Is doing this more than once per process a bad idea? Start could get called more than once in other apps.
-			if PidFile != "" {
-				err := writePidFile()
-				if err != nil {
-					log.Printf("[ERROR] Could not write pidfile: %v", err)
-				}
-			}
-		}
-	}()
-
-	// Input must never be nil; try to load something
-	if cdyfile == nil {
-		cdyfile, err = LoadCaddyfile(nil)
-		if err != nil {
-			return err
-		}
-	}
-
-	caddyfileMu.Lock()
-	caddyfile = cdyfile
-	caddyfileMu.Unlock()
-
-	// load the server configs (activates Let's Encrypt)
-	configs, err := loadConfigs(path.Base(cdyfile.Path()), bytes.NewReader(cdyfile.Body()))
-	if err != nil {
-		return err
-	}
-
-	// group virtualhosts by address
-	groupings, err := arrangeBindings(configs)
-	if err != nil {
-		return err
-	}
-
-	// Start each server with its one or more configurations
-	err = startServers(groupings)
-	if err != nil {
-		return err
-	}
-	startedBefore = true
-
-	showInitializationOutput(groupings)
-
-	return nil
-}
-
-// showInitializationOutput just outputs some basic information about
-// what is being served to stdout, as well as any applicable, non-essential
-// warnings for the user.
-func showInitializationOutput(groupings bindingGroup) {
-	// Show initialization output
-	if !Quiet && !IsRestart() {
-		var checkedFdLimit bool
-		for _, group := range groupings {
-			for _, conf := range group.Configs {
-				// Print address of site
-				fmt.Println(conf.Address())
-
-				// Note if non-localhost site resolves to loopback interface
-				if group.BindAddr.IP.IsLoopback() && !isLocalhost(conf.Host) {
-					fmt.Printf("Notice: %s is only accessible on this machine (%s)\n",
-						conf.Host, group.BindAddr.IP.String())
-				}
-				if !checkedFdLimit && !group.BindAddr.IP.IsLoopback() && !isLocalhost(conf.Host) {
-					checkFdlimit()
-					checkedFdLimit = true
-				}
-			}
-		}
-	}
-}
-
-// startServers starts all the servers in groupings,
-// taking into account whether or not this process is
-// a child from a graceful restart or not. It blocks
-// until the servers are listening.
-func startServers(groupings bindingGroup) error {
-	var startupWg sync.WaitGroup
-	errChan := make(chan error, len(groupings)) // must be buffered to allow Serve functions below to return if stopped later
-
-	for _, group := range groupings {
-		s, err := server.New(group.BindAddr.String(), group.Configs, GracefulTimeout)
-		if err != nil {
-			return err
-		}
-		s.HTTP2 = HTTP2
-		s.ReqCallback = https.RequestCallback // ensures we can solve ACME challenges while running
-		if s.OnDemandTLS {
-			s.TLSConfig.GetCertificate = https.GetOrObtainCertificate // TLS on demand -- awesome!
-		} else {
-			s.TLSConfig.GetCertificate = https.GetCertificate
-		}
-
-		var ln server.ListenerFile
-		if IsRestart() {
-			// Look up this server's listener in the map of inherited file descriptors;
-			// if we don't have one, we must make a new one (later).
-			if fdIndex, ok := loadedGob.ListenerFds[s.Addr]; ok {
-				file := os.NewFile(fdIndex, "")
-
-				fln, err := net.FileListener(file)
-				if err != nil {
-					return err
-				}
-
-				ln, ok = fln.(server.ListenerFile)
-				if !ok {
-					return errors.New("listener for " + s.Addr + " was not a ListenerFile")
-				}
-
-				file.Close()
-				delete(loadedGob.ListenerFds, s.Addr)
-			}
-		}
-
-		wg.Add(1)
-		go func(s *server.Server, ln server.ListenerFile) {
-			defer wg.Done()
-
-			// run startup functions that should only execute when
-			// the original parent process is starting.
-			if !IsRestart() && !startedBefore {
-				err := s.RunFirstStartupFuncs()
-				if err != nil {
-					errChan <- err
-					return
-				}
-			}
-
-			// start the server
-			if ln != nil {
-				errChan <- s.Serve(ln)
-			} else {
-				errChan <- s.ListenAndServe()
-			}
-		}(s, ln)
-
-		startupWg.Add(1)
-		go func(s *server.Server) {
-			defer startupWg.Done()
-			s.WaitUntilStarted()
-		}(s)
-
-		serversMu.Lock()
-		servers = append(servers, s)
-		serversMu.Unlock()
-	}
-
-	// Close the remaining (unused) file descriptors to free up resources
-	if IsRestart() {
-		for key, fdIndex := range loadedGob.ListenerFds {
-			os.NewFile(fdIndex, "").Close()
-			delete(loadedGob.ListenerFds, key)
-		}
-	}
-
-	// Wait for all servers to finish starting
-	startupWg.Wait()
-
-	// Return the first error, if any
-	select {
-	case err := <-errChan:
-		// "use of closed network connection" is normal if it was a graceful shutdown
-		if err != nil && !strings.Contains(err.Error(), "use of closed network connection") {
-			return err
-		}
-	default:
-	}
-
-	return nil
-}
-
-// Stop stops all servers. It blocks until they are all stopped.
-// It does NOT execute shutdown callbacks that may have been
-// configured by middleware (they must be executed separately).
-func Stop() error {
-	https.Deactivate()
-
-	serversMu.Lock()
-	for _, s := range servers {
-		if err := s.Stop(); err != nil {
-			log.Printf("[ERROR] Stopping %s: %v", s.Addr, err)
-		}
-	}
-	servers = []*server.Server{} // don't reuse servers
-	serversMu.Unlock()
-
-	return nil
-}
-
-// Wait blocks until all servers are stopped.
-func Wait() {
-	wg.Wait()
-}
-
-// LoadCaddyfile loads a Caddyfile, prioritizing a Caddyfile
-// piped from stdin as part of a restart (only happens on first call
-// to LoadCaddyfile). If it is not a restart, this function tries
-// calling the user's loader function, and if that returns nil, then
-// this function resorts to the default configuration. Thus, if there
-// are no other errors, this function always returns at least the
-// default Caddyfile.
-func LoadCaddyfile(loader func() (Input, error)) (cdyfile Input, err error) {
-	// If we are a fork, finishing the restart is highest priority;
-	// piped input is required in this case.
-	if IsRestart() {
-		err := gob.NewDecoder(os.Stdin).Decode(&loadedGob)
-		if err != nil {
-			return nil, err
-		}
-		cdyfile = loadedGob.Caddyfile
-		atomic.StoreInt32(https.OnDemandIssuedCount, loadedGob.OnDemandTLSCertsIssued)
-	}
-
-	// Try user's loader
-	if cdyfile == nil && loader != nil {
-		cdyfile, err = loader()
-	}
-
-	// Otherwise revert to default
-	if cdyfile == nil {
-		cdyfile = DefaultInput()
-	}
-
-	return
-}
-
-// CaddyfileFromPipe loads the Caddyfile input from f if f is
-// not interactive input. f is assumed to be a pipe or stream,
-// such as os.Stdin. If f is not a pipe, no error is returned
-// but the Input value will be nil. An error is only returned
-// if there was an error reading the pipe, even if the length
-// of what was read is 0.
-func CaddyfileFromPipe(f *os.File) (Input, error) {
-	fi, err := f.Stat()
-	if err == nil && fi.Mode()&os.ModeCharDevice == 0 {
-		// Note that a non-nil error is not a problem. Windows
-		// will not create a stdin if there is no pipe, which
-		// produces an error when calling Stat(). But Unix will
-		// make one either way, which is why we also check that
-		// bitmask.
-		// BUG: Reading from stdin after this fails (e.g. for the let's encrypt email address) (OS X)
-		confBody, err := ioutil.ReadAll(f)
-		if err != nil {
-			return nil, err
-		}
-		return CaddyfileInput{
-			Contents: confBody,
-			Filepath: f.Name(),
-		}, nil
-	}
-
-	// not having input from the pipe is not itself an error,
-	// just means no input to return.
-	return nil, nil
-}
-
-// Caddyfile returns the current Caddyfile
-func Caddyfile() Input {
-	caddyfileMu.Lock()
-	defer caddyfileMu.Unlock()
-	return caddyfile
-}
-
-// Input represents a Caddyfile; its contents and file path
-// (which should include the file name at the end of the path).
-// If path does not apply (e.g. piped input) you may use
-// any understandable value. The path is mainly used for logging,
-// error messages, and debugging.
-type Input interface {
-	// Gets the Caddyfile contents
-	Body() []byte
-
-	// Gets the path to the origin file
-	Path() string
-
-	// IsFile returns true if the original input was a file on the file system
-	// that could be loaded again later if requested.
-	IsFile() bool
-}

caddy/caddy_test.go

@@ -1,32 +0,0 @@
-package caddy
-
-import (
-	"net/http"
-	"testing"
-	"time"
-)
-
-func TestCaddyStartStop(t *testing.T) {
-	caddyfile := "localhost:1984"
-
-	for i := 0; i < 2; i++ {
-		err := Start(CaddyfileInput{Contents: []byte(caddyfile)})
-		if err != nil {
-			t.Fatalf("Error starting, iteration %d: %v", i, err)
-		}
-
-		client := http.Client{
-			Timeout: time.Duration(2 * time.Second),
-		}
-		resp, err := client.Get("http://localhost:1984")
-		if err != nil {
-			t.Fatalf("Expected GET request to succeed (iteration %d), but it failed: %v", i, err)
-		}
-		resp.Body.Close()
-
-		err = Stop()
-		if err != nil {
-			t.Fatalf("Error stopping, iteration %d: %v", i, err)
-		}
-	}
-}

caddy/caddyfile/json.go

@@ -1,185 +0,0 @@
-package caddyfile
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"net"
-	"sort"
-	"strconv"
-	"strings"
-
-	"github.com/mholt/caddy/caddy/parse"
-)
-
-const filename = "Caddyfile"
-
-// ToJSON converts caddyfile to its JSON representation.
-func ToJSON(caddyfile []byte) ([]byte, error) {
-	var j Caddyfile
-
-	serverBlocks, err := parse.ServerBlocks(filename, bytes.NewReader(caddyfile), false)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, sb := range serverBlocks {
-		block := ServerBlock{Body: [][]interface{}{}}
-
-		// Fill up host list
-		for _, host := range sb.HostList() {
-			block.Hosts = append(block.Hosts, standardizeScheme(host))
-		}
-
-		// Extract directives deterministically by sorting them
-		var directives = make([]string, len(sb.Tokens))
-		for dir := range sb.Tokens {
-			directives = append(directives, dir)
-		}
-		sort.Strings(directives)
-
-		// Convert each directive's tokens into our JSON structure
-		for _, dir := range directives {
-			disp := parse.NewDispenserTokens(filename, sb.Tokens[dir])
-			for disp.Next() {
-				block.Body = append(block.Body, constructLine(&disp))
-			}
-		}
-
-		// tack this block onto the end of the list
-		j = append(j, block)
-	}
-
-	result, err := json.Marshal(j)
-	if err != nil {
-		return nil, err
-	}
-
-	return result, nil
-}
-
-// constructLine transforms tokens into a JSON-encodable structure;
-// but only one line at a time, to be used at the top-level of
-// a server block only (where the first token on each line is a
-// directive) - not to be used at any other nesting level.
-func constructLine(d *parse.Dispenser) []interface{} {
-	var args []interface{}
-
-	args = append(args, d.Val())
-
-	for d.NextArg() {
-		if d.Val() == "{" {
-			args = append(args, constructBlock(d))
-			continue
-		}
-		args = append(args, d.Val())
-	}
-
-	return args
-}
-
-// constructBlock recursively processes tokens into a
-// JSON-encodable structure. To be used in a directive's
-// block. Goes to end of block.
-func constructBlock(d *parse.Dispenser) [][]interface{} {
-	block := [][]interface{}{}
-
-	for d.Next() {
-		if d.Val() == "}" {
-			break
-		}
-		block = append(block, constructLine(d))
-	}
-
-	return block
-}
-
-// FromJSON converts JSON-encoded jsonBytes to Caddyfile text
-func FromJSON(jsonBytes []byte) ([]byte, error) {
-	var j Caddyfile
-	var result string
-
-	err := json.Unmarshal(jsonBytes, &j)
-	if err != nil {
-		return nil, err
-	}
-
-	for sbPos, sb := range j {
-		if sbPos > 0 {
-			result += "\n\n"
-		}
-		for i, host := range sb.Hosts {
-			if i > 0 {
-				result += ", "
-			}
-			result += standardizeScheme(host)
-		}
-		result += jsonToText(sb.Body, 1)
-	}
-
-	return []byte(result), nil
-}
-
-// jsonToText recursively transforms a scope of JSON into plain
-// Caddyfile text.
-func jsonToText(scope interface{}, depth int) string {
-	var result string
-
-	switch val := scope.(type) {
-	case string:
-		if strings.ContainsAny(val, "\" \n\t\r") {
-			result += `"` + strings.Replace(val, "\"", "\\\"", -1) + `"`
-		} else {
-			result += val
-		}
-	case int:
-		result += strconv.Itoa(val)
-	case float64:
-		result += fmt.Sprintf("%v", val)
-	case bool:
-		result += fmt.Sprintf("%t", val)
-	case [][]interface{}:
-		result += " {\n"
-		for _, arg := range val {
-			result += strings.Repeat("\t", depth) + jsonToText(arg, depth+1) + "\n"
-		}
-		result += strings.Repeat("\t", depth-1) + "}"
-	case []interface{}:
-		for i, v := range val {
-			if block, ok := v.([]interface{}); ok {
-				result += "{\n"
-				for _, arg := range block {
-					result += strings.Repeat("\t", depth) + jsonToText(arg, depth+1) + "\n"
-				}
-				result += strings.Repeat("\t", depth-1) + "}"
-				continue
-			}
-			result += jsonToText(v, depth)
-			if i < len(val)-1 {
-				result += " "
-			}
-		}
-	}
-
-	return result
-}
-
-// standardizeScheme turns an address like host:https into https://host,
-// or "host:" into "host".
-func standardizeScheme(addr string) string {
-	if hostname, port, err := net.SplitHostPort(addr); err == nil {
-		if port == "http" || port == "https" {
-			addr = port + "://" + hostname
-		}
-	}
-	return strings.TrimSuffix(addr, ":")
-}
-
-// Caddyfile encapsulates a slice of ServerBlocks.
-type Caddyfile []ServerBlock
-
-// ServerBlock represents a server block.
-type ServerBlock struct {
-	Hosts []string        `json:"hosts"`
-	Body  [][]interface{} `json:"body"`
-}

caddy/caddyfile/json_test.go

@@ -1,161 +0,0 @@
-package caddyfile
-
-import "testing"
-
-var tests = []struct {
-	caddyfile, json string
-}{
-	{ // 0
-		caddyfile: `foo {
-	root /bar
-}`,
-		json: `[{"hosts":["foo"],"body":[["root","/bar"]]}]`,
-	},
-	{ // 1
-		caddyfile: `host1, host2 {
-	dir {
-		def
-	}
-}`,
-		json: `[{"hosts":["host1","host2"],"body":[["dir",[["def"]]]]}]`,
-	},
-	{ // 2
-		caddyfile: `host1, host2 {
-	dir abc {
-		def ghi
-		jkl
-	}
-}`,
-		json: `[{"hosts":["host1","host2"],"body":[["dir","abc",[["def","ghi"],["jkl"]]]]}]`,
-	},
-	{ // 3
-		caddyfile: `host1:1234, host2:5678 {
-	dir abc {
-	}
-}`,
-		json: `[{"hosts":["host1:1234","host2:5678"],"body":[["dir","abc",[]]]}]`,
-	},
-	{ // 4
-		caddyfile: `host {
-	foo "bar baz"
-}`,
-		json: `[{"hosts":["host"],"body":[["foo","bar baz"]]}]`,
-	},
-	{ // 5
-		caddyfile: `host, host:80 {
-	foo "bar \"baz\""
-}`,
-		json: `[{"hosts":["host","host:80"],"body":[["foo","bar \"baz\""]]}]`,
-	},
-	{ // 6
-		caddyfile: `host {
-	foo "bar
-baz"
-}`,
-		json: `[{"hosts":["host"],"body":[["foo","bar\nbaz"]]}]`,
-	},
-	{ // 7
-		caddyfile: `host {
-	dir 123 4.56 true
-}`,
-		json: `[{"hosts":["host"],"body":[["dir","123","4.56","true"]]}]`, // NOTE: I guess we assume numbers and booleans should be encoded as strings...?
-	},
-	{ // 8
-		caddyfile: `http://host, https://host {
-}`,
-		json: `[{"hosts":["http://host","https://host"],"body":[]}]`, // hosts in JSON are always host:port format (if port is specified), for consistency
-	},
-	{ // 9
-		caddyfile: `host {
-	dir1 a b
-	dir2 c d
-}`,
-		json: `[{"hosts":["host"],"body":[["dir1","a","b"],["dir2","c","d"]]}]`,
-	},
-	{ // 10
-		caddyfile: `host {
-	dir a b
-	dir c d
-}`,
-		json: `[{"hosts":["host"],"body":[["dir","a","b"],["dir","c","d"]]}]`,
-	},
-	{ // 11
-		caddyfile: `host {
-	dir1 a b
-	dir2 {
-		c
-		d
-	}
-}`,
-		json: `[{"hosts":["host"],"body":[["dir1","a","b"],["dir2",[["c"],["d"]]]]}]`,
-	},
-	{ // 12
-		caddyfile: `host1 {
-	dir1
-}
-
-host2 {
-	dir2
-}`,
-		json: `[{"hosts":["host1"],"body":[["dir1"]]},{"hosts":["host2"],"body":[["dir2"]]}]`,
-	},
-}
-
-func TestToJSON(t *testing.T) {
-	for i, test := range tests {
-		output, err := ToJSON([]byte(test.caddyfile))
-		if err != nil {
-			t.Errorf("Test %d: %v", i, err)
-		}
-		if string(output) != test.json {
-			t.Errorf("Test %d\nExpected:\n'%s'\nActual:\n'%s'", i, test.json, string(output))
-		}
-	}
-}
-
-func TestFromJSON(t *testing.T) {
-	for i, test := range tests {
-		output, err := FromJSON([]byte(test.json))
-		if err != nil {
-			t.Errorf("Test %d: %v", i, err)
-		}
-		if string(output) != test.caddyfile {
-			t.Errorf("Test %d\nExpected:\n'%s'\nActual:\n'%s'", i, test.caddyfile, string(output))
-		}
-	}
-}
-
-func TestStandardizeAddress(t *testing.T) {
-	// host:https should be converted to https://host
-	output, err := ToJSON([]byte(`host:https`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if expected, actual := `[{"hosts":["https://host"],"body":[]}]`, string(output); expected != actual {
-		t.Errorf("Expected:\n'%s'\nActual:\n'%s'", expected, actual)
-	}
-
-	output, err = FromJSON([]byte(`[{"hosts":["https://host"],"body":[]}]`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if expected, actual := "https://host {\n}", string(output); expected != actual {
-		t.Errorf("Expected:\n'%s'\nActual:\n'%s'", expected, actual)
-	}
-
-	// host: should be converted to just host
-	output, err = ToJSON([]byte(`host:`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if expected, actual := `[{"hosts":["host"],"body":[]}]`, string(output); expected != actual {
-		t.Errorf("Expected:\n'%s'\nActual:\n'%s'", expected, actual)
-	}
-	output, err = FromJSON([]byte(`[{"hosts":["host:"],"body":[]}]`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if expected, actual := "host {\n}", string(output); expected != actual {
-		t.Errorf("Expected:\n'%s'\nActual:\n'%s'", expected, actual)
-	}
-}

caddy/config.go

@@ -1,348 +0,0 @@
-package caddy
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"log"
-	"net"
-	"sync"
-
-	"github.com/mholt/caddy/caddy/https"
-	"github.com/mholt/caddy/caddy/parse"
-	"github.com/mholt/caddy/caddy/setup"
-	"github.com/mholt/caddy/server"
-)
-
-const (
-	// DefaultConfigFile is the name of the configuration file that is loaded
-	// by default if no other file is specified.
-	DefaultConfigFile = "Caddyfile"
-)
-
-// loadConfigsUpToIncludingTLS loads the configs from input with name filename and returns them,
-// the parsed server blocks, the index of the last directive it processed, and an error (if any).
-func loadConfigsUpToIncludingTLS(filename string, input io.Reader) ([]server.Config, []parse.ServerBlock, int, error) {
-	var configs []server.Config
-
-	// Each server block represents similar hosts/addresses, since they
-	// were grouped together in the Caddyfile.
-	serverBlocks, err := parse.ServerBlocks(filename, input, true)
-	if err != nil {
-		return nil, nil, 0, err
-	}
-	if len(serverBlocks) == 0 {
-		newInput := DefaultInput()
-		serverBlocks, err = parse.ServerBlocks(newInput.Path(), bytes.NewReader(newInput.Body()), true)
-		if err != nil {
-			return nil, nil, 0, err
-		}
-	}
-
-	var lastDirectiveIndex int // we set up directives in two parts; this stores where we left off
-
-	// Iterate each server block and make a config for each one,
-	// executing the directives that were parsed in order up to the tls
-	// directive; this is because we must activate Let's Encrypt.
-	for i, sb := range serverBlocks {
-		onces := makeOnces()
-		storages := makeStorages()
-
-		for j, addr := range sb.Addresses {
-			config := server.Config{
-				Host:       addr.Host,
-				Port:       addr.Port,
-				Scheme:     addr.Scheme,
-				Root:       Root,
-				ConfigFile: filename,
-				AppName:    AppName,
-				AppVersion: AppVersion,
-			}
-
-			// It is crucial that directives are executed in the proper order.
-			for k, dir := range directiveOrder {
-				// Execute directive if it is in the server block
-				if tokens, ok := sb.Tokens[dir.name]; ok {
-					// Each setup function gets a controller, from which setup functions
-					// get access to the config, tokens, and other state information useful
-					// to set up its own host only.
-					controller := &setup.Controller{
-						Config:    &config,
-						Dispenser: parse.NewDispenserTokens(filename, tokens),
-						OncePerServerBlock: func(f func() error) error {
-							var err error
-							onces[dir.name].Do(func() {
-								err = f()
-							})
-							return err
-						},
-						ServerBlockIndex:     i,
-						ServerBlockHostIndex: j,
-						ServerBlockHosts:     sb.HostList(),
-						ServerBlockStorage:   storages[dir.name],
-					}
-					// execute setup function and append middleware handler, if any
-					midware, err := dir.setup(controller)
-					if err != nil {
-						return nil, nil, lastDirectiveIndex, err
-					}
-					if midware != nil {
-						config.Middleware = append(config.Middleware, midware)
-					}
-					storages[dir.name] = controller.ServerBlockStorage // persist for this server block
-				}
-
-				// Stop after TLS setup, since we need to activate Let's Encrypt before continuing;
-				// it makes some changes to the configs that middlewares might want to know about.
-				if dir.name == "tls" {
-					lastDirectiveIndex = k
-					break
-				}
-			}
-
-			configs = append(configs, config)
-		}
-	}
-
-	return configs, serverBlocks, lastDirectiveIndex, nil
-}
-
-// loadConfigs reads input (named filename) and parses it, returning the
-// server configurations in the order they appeared in the input. As part
-// of this, it activates Let's Encrypt for the configs that are produced.
-// Thus, the returned configs are already optimally configured for HTTPS.
-func loadConfigs(filename string, input io.Reader) ([]server.Config, error) {
-	configs, serverBlocks, lastDirectiveIndex, err := loadConfigsUpToIncludingTLS(filename, input)
-	if err != nil {
-		return nil, err
-	}
-
-	// Now we have all the configs, but they have only been set up to the
-	// point of tls. We need to activate Let's Encrypt before setting up
-	// the rest of the middlewares so they have correct information regarding
-	// TLS configuration, if necessary. (this only appends, so our iterations
-	// over server blocks below shouldn't be affected)
-	if !IsRestart() && !Quiet {
-		fmt.Print("Activating privacy features...")
-	}
-	configs, err = https.Activate(configs)
-	if err != nil {
-		return nil, err
-	} else if !IsRestart() && !Quiet {
-		fmt.Println(" done.")
-	}
-
-	// Finish setting up the rest of the directives, now that TLS is
-	// optimally configured. These loops are similar to above except
-	// we don't iterate all the directives from the beginning and we
-	// don't create new configs.
-	configIndex := -1
-	for i, sb := range serverBlocks {
-		onces := makeOnces()
-		storages := makeStorages()
-
-		for j := range sb.Addresses {
-			configIndex++
-
-			for k := lastDirectiveIndex + 1; k < len(directiveOrder); k++ {
-				dir := directiveOrder[k]
-
-				if tokens, ok := sb.Tokens[dir.name]; ok {
-					controller := &setup.Controller{
-						Config:    &configs[configIndex],
-						Dispenser: parse.NewDispenserTokens(filename, tokens),
-						OncePerServerBlock: func(f func() error) error {
-							var err error
-							onces[dir.name].Do(func() {
-								err = f()
-							})
-							return err
-						},
-						ServerBlockIndex:     i,
-						ServerBlockHostIndex: j,
-						ServerBlockHosts:     sb.HostList(),
-						ServerBlockStorage:   storages[dir.name],
-					}
-					midware, err := dir.setup(controller)
-					if err != nil {
-						return nil, err
-					}
-					if midware != nil {
-						configs[configIndex].Middleware = append(configs[configIndex].Middleware, midware)
-					}
-					storages[dir.name] = controller.ServerBlockStorage // persist for this server block
-				}
-			}
-		}
-	}
-
-	return configs, nil
-}
-
-// makeOnces makes a map of directive name to sync.Once
-// instance. This is intended to be called once per server
-// block when setting up configs so that Setup functions
-// for each directive can perform a task just once per
-// server block, even if there are multiple hosts on the block.
-//
-// We need one Once per directive, otherwise the first
-// directive to use it would exclude other directives from
-// using it at all, which would be a bug.
-func makeOnces() map[string]*sync.Once {
-	onces := make(map[string]*sync.Once)
-	for _, dir := range directiveOrder {
-		onces[dir.name] = new(sync.Once)
-	}
-	return onces
-}
-
-// makeStorages makes a map of directive name to interface{}
-// so that directives' setup functions can persist state
-// between different hosts on the same server block during the
-// setup phase.
-func makeStorages() map[string]interface{} {
-	storages := make(map[string]interface{})
-	for _, dir := range directiveOrder {
-		storages[dir.name] = nil
-	}
-	return storages
-}
-
-// arrangeBindings groups configurations by their bind address. For example,
-// a server that should listen on localhost and another on 127.0.0.1 will
-// be grouped into the same address: 127.0.0.1. It will return an error
-// if an address is malformed or a TLS listener is configured on the
-// same address as a plaintext HTTP listener. The return value is a map of
-// bind address to list of configs that would become VirtualHosts on that
-// server. Use the keys of the returned map to create listeners, and use
-// the associated values to set up the virtualhosts.
-func arrangeBindings(allConfigs []server.Config) (bindingGroup, error) {
-	var groupings bindingGroup
-
-	// Group configs by bind address
-	for _, conf := range allConfigs {
-		// use default port if none is specified
-		if conf.Port == "" {
-			conf.Port = Port
-		}
-
-		bindAddr, warnErr, fatalErr := resolveAddr(conf)
-		if fatalErr != nil {
-			return groupings, fatalErr
-		}
-		if warnErr != nil {
-			log.Printf("[WARNING] Resolving bind address for %s: %v", conf.Address(), warnErr)
-		}
-
-		// Make sure to compare the string representation of the address,
-		// not the pointer, since a new *TCPAddr is created each time.
-		var existing bool
-		for i := 0; i < len(groupings); i++ {
-			if groupings[i].BindAddr.String() == bindAddr.String() {
-				groupings[i].Configs = append(groupings[i].Configs, conf)
-				existing = true
-				break
-			}
-		}
-		if !existing {
-			groupings = append(groupings, bindingMapping{
-				BindAddr: bindAddr,
-				Configs:  []server.Config{conf},
-			})
-		}
-	}
-
-	// Don't allow HTTP and HTTPS to be served on the same address
-	for _, group := range groupings {
-		isTLS := group.Configs[0].TLS.Enabled
-		for _, config := range group.Configs {
-			if config.TLS.Enabled != isTLS {
-				thisConfigProto, otherConfigProto := "HTTP", "HTTP"
-				if config.TLS.Enabled {
-					thisConfigProto = "HTTPS"
-				}
-				if group.Configs[0].TLS.Enabled {
-					otherConfigProto = "HTTPS"
-				}
-				return groupings, fmt.Errorf("configuration error: Cannot multiplex %s (%s) and %s (%s) on same address",
-					group.Configs[0].Address(), otherConfigProto, config.Address(), thisConfigProto)
-			}
-		}
-	}
-
-	return groupings, nil
-}
-
-// resolveAddr determines the address (host and port) that a config will
-// bind to. The returned address, resolvAddr, should be used to bind the
-// listener or group the config with other configs using the same address.
-// The first error, if not nil, is just a warning and should be reported
-// but execution may continue. The second error, if not nil, is a real
-// problem and the server should not be started.
-//
-// This function does not handle edge cases like port "http" or "https" if
-// they are not known to the system. It does, however, serve on the wildcard
-// host if resolving the address of the specific hostname fails.
-func resolveAddr(conf server.Config) (resolvAddr *net.TCPAddr, warnErr, fatalErr error) {
-	resolvAddr, warnErr = net.ResolveTCPAddr("tcp", net.JoinHostPort(conf.BindHost, conf.Port))
-	if warnErr != nil {
-		// the hostname probably couldn't be resolved, just bind to wildcard then
-		resolvAddr, fatalErr = net.ResolveTCPAddr("tcp", net.JoinHostPort("", conf.Port))
-		if fatalErr != nil {
-			return
-		}
-	}
-
-	return
-}
-
-// validDirective returns true if d is a valid
-// directive; false otherwise.
-func validDirective(d string) bool {
-	for _, dir := range directiveOrder {
-		if dir.name == d {
-			return true
-		}
-	}
-	return false
-}
-
-// DefaultInput returns the default Caddyfile input
-// to use when it is otherwise empty or missing.
-// It uses the default host and port (depends on
-// host, e.g. localhost is 2015, otherwise 443) and
-// root.
-func DefaultInput() CaddyfileInput {
-	port := Port
-	if https.HostQualifies(Host) && port == DefaultPort {
-		port = "443"
-	}
-	return CaddyfileInput{
-		Contents: []byte(fmt.Sprintf("%s:%s\nroot %s", Host, port, Root)),
-	}
-}
-
-// These defaults are configurable through the command line
-var (
-	// Root is the site root
-	Root = DefaultRoot
-
-	// Host is the site host
-	Host = DefaultHost
-
-	// Port is the site port
-	Port = DefaultPort
-)
-
-// bindingMapping maps a network address to configurations
-// that will bind to it. The order of the configs is important.
-type bindingMapping struct {
-	BindAddr *net.TCPAddr
-	Configs  []server.Config
-}
-
-// bindingGroup maps network addresses to their configurations.
-// Preserving the order of the groupings is important
-// (related to graceful shutdown and restart)
-// so this is a slice, not a literal map.
-type bindingGroup []bindingMapping

caddy/config_test.go

@@ -1,159 +0,0 @@
-package caddy
-
-import (
-	"reflect"
-	"sync"
-	"testing"
-
-	"github.com/mholt/caddy/server"
-)
-
-func TestDefaultInput(t *testing.T) {
-	if actual, expected := string(DefaultInput().Body()), ":2015\nroot ."; actual != expected {
-		t.Errorf("Host=%s; Port=%s; Root=%s;\nEXPECTED: '%s'\n  ACTUAL: '%s'", Host, Port, Root, expected, actual)
-	}
-
-	// next few tests simulate user providing -host and/or -port flags
-
-	Host = "not-localhost.com"
-	if actual, expected := string(DefaultInput().Body()), "not-localhost.com:443\nroot ."; actual != expected {
-		t.Errorf("Host=%s; Port=%s; Root=%s;\nEXPECTED: '%s'\n  ACTUAL: '%s'", Host, Port, Root, expected, actual)
-	}
-
-	Host = "[::1]"
-	if actual, expected := string(DefaultInput().Body()), "[::1]:2015\nroot ."; actual != expected {
-		t.Errorf("Host=%s; Port=%s; Root=%s;\nEXPECTED: '%s'\n  ACTUAL: '%s'", Host, Port, Root, expected, actual)
-	}
-
-	Host = "127.0.1.1"
-	if actual, expected := string(DefaultInput().Body()), "127.0.1.1:2015\nroot ."; actual != expected {
-		t.Errorf("Host=%s; Port=%s; Root=%s;\nEXPECTED: '%s'\n  ACTUAL: '%s'", Host, Port, Root, expected, actual)
-	}
-
-	Host = "not-localhost.com"
-	Port = "1234"
-	if actual, expected := string(DefaultInput().Body()), "not-localhost.com:1234\nroot ."; actual != expected {
-		t.Errorf("Host=%s; Port=%s; Root=%s;\nEXPECTED: '%s'\n  ACTUAL: '%s'", Host, Port, Root, expected, actual)
-	}
-
-	Host = DefaultHost
-	Port = "1234"
-	if actual, expected := string(DefaultInput().Body()), ":1234\nroot ."; actual != expected {
-		t.Errorf("Host=%s; Port=%s; Root=%s;\nEXPECTED: '%s'\n  ACTUAL: '%s'", Host, Port, Root, expected, actual)
-	}
-}
-
-func TestResolveAddr(t *testing.T) {
-	// NOTE: If tests fail due to comparing to string "127.0.0.1",
-	// it's possible that system env resolves with IPv6, or ::1.
-	// If that happens, maybe we should use actualAddr.IP.IsLoopback()
-	// for the assertion, rather than a direct string comparison.
-
-	// NOTE: Tests with {Host: "", Port: ""} and {Host: "localhost", Port: ""}
-	// will not behave the same cross-platform, so they have been omitted.
-
-	for i, test := range []struct {
-		config         server.Config
-		shouldWarnErr  bool
-		shouldFatalErr bool
-		expectedIP     string
-		expectedPort   int
-	}{
-		{server.Config{Host: "127.0.0.1", Port: "1234"}, false, false, "<nil>", 1234},
-		{server.Config{Host: "localhost", Port: "80"}, false, false, "<nil>", 80},
-		{server.Config{BindHost: "localhost", Port: "1234"}, false, false, "127.0.0.1", 1234},
-		{server.Config{BindHost: "127.0.0.1", Port: "1234"}, false, false, "127.0.0.1", 1234},
-		{server.Config{BindHost: "should-not-resolve", Port: "1234"}, true, false, "<nil>", 1234},
-		{server.Config{BindHost: "localhost", Port: "http"}, false, false, "127.0.0.1", 80},
-		{server.Config{BindHost: "localhost", Port: "https"}, false, false, "127.0.0.1", 443},
-		{server.Config{BindHost: "", Port: "1234"}, false, false, "<nil>", 1234},
-		{server.Config{BindHost: "localhost", Port: "abcd"}, false, true, "", 0},
-		{server.Config{BindHost: "127.0.0.1", Host: "should-not-be-used", Port: "1234"}, false, false, "127.0.0.1", 1234},
-		{server.Config{BindHost: "localhost", Host: "should-not-be-used", Port: "1234"}, false, false, "127.0.0.1", 1234},
-		{server.Config{BindHost: "should-not-resolve", Host: "localhost", Port: "1234"}, true, false, "<nil>", 1234},
-	} {
-		actualAddr, warnErr, fatalErr := resolveAddr(test.config)
-
-		if test.shouldFatalErr && fatalErr == nil {
-			t.Errorf("Test %d: Expected error, but there wasn't any", i)
-		}
-		if !test.shouldFatalErr && fatalErr != nil {
-			t.Errorf("Test %d: Expected no error, but there was one: %v", i, fatalErr)
-		}
-		if fatalErr != nil {
-			continue
-		}
-
-		if test.shouldWarnErr && warnErr == nil {
-			t.Errorf("Test %d: Expected warning, but there wasn't any", i)
-		}
-		if !test.shouldWarnErr && warnErr != nil {
-			t.Errorf("Test %d: Expected no warning, but there was one: %v", i, warnErr)
-		}
-
-		if actual, expected := actualAddr.IP.String(), test.expectedIP; actual != expected {
-			t.Errorf("Test %d: IP was %s but expected %s", i, actual, expected)
-		}
-		if actual, expected := actualAddr.Port, test.expectedPort; actual != expected {
-			t.Errorf("Test %d: Port was %d but expected %d", i, actual, expected)
-		}
-	}
-}
-
-func TestMakeOnces(t *testing.T) {
-	directives := []directive{
-		{"dummy", nil},
-		{"dummy2", nil},
-	}
-	directiveOrder = directives
-	onces := makeOnces()
-	if len(onces) != len(directives) {
-		t.Errorf("onces had len %d , expected %d", len(onces), len(directives))
-	}
-	expected := map[string]*sync.Once{
-		"dummy":  new(sync.Once),
-		"dummy2": new(sync.Once),
-	}
-	if !reflect.DeepEqual(onces, expected) {
-		t.Errorf("onces was %v, expected %v", onces, expected)
-	}
-}
-
-func TestMakeStorages(t *testing.T) {
-	directives := []directive{
-		{"dummy", nil},
-		{"dummy2", nil},
-	}
-	directiveOrder = directives
-	storages := makeStorages()
-	if len(storages) != len(directives) {
-		t.Errorf("storages had len %d , expected %d", len(storages), len(directives))
-	}
-	expected := map[string]interface{}{
-		"dummy":  nil,
-		"dummy2": nil,
-	}
-	if !reflect.DeepEqual(storages, expected) {
-		t.Errorf("storages was %v, expected %v", storages, expected)
-	}
-}
-
-func TestValidDirective(t *testing.T) {
-	directives := []directive{
-		{"dummy", nil},
-		{"dummy2", nil},
-	}
-	directiveOrder = directives
-	for i, test := range []struct {
-		directive string
-		valid     bool
-	}{
-		{"dummy", true},
-		{"dummy2", true},
-		{"dummy3", false},
-	} {
-		if actual, expected := validDirective(test.directive), test.valid; actual != expected {
-			t.Errorf("Test %d: valid was %t, expected %t", i, actual, expected)
-		}
-	}
-}

caddy/directives.go

@@ -1,109 +0,0 @@
-package caddy
-
-import (
-	"github.com/mholt/caddy/caddy/https"
-	"github.com/mholt/caddy/caddy/parse"
-	"github.com/mholt/caddy/caddy/setup"
-	"github.com/mholt/caddy/middleware"
-)
-
-func init() {
-	// The parse package must know which directives
-	// are valid, but it must not import the setup
-	// or config package. To solve this problem, we
-	// fill up this map in our init function here.
-	// The parse package does not need to know the
-	// ordering of the directives.
-	for _, dir := range directiveOrder {
-		parse.ValidDirectives[dir.name] = struct{}{}
-	}
-}
-
-// Directives are registered in the order they should be
-// executed. Middleware (directives that inject a handler)
-// are executed in the order A-B-C-*-C-B-A, assuming
-// they all call the Next handler in the chain.
-//
-// Ordering is VERY important. Every middleware will
-// feel the effects of all other middleware below
-// (after) them during a request, but they must not
-// care what middleware above them are doing.
-//
-// For example, log needs to know the status code and
-// exactly how many bytes were written to the client,
-// which every other middleware can affect, so it gets
-// registered first. The errors middleware does not
-// care if gzip or log modifies its response, so it
-// gets registered below them. Gzip, on the other hand,
-// DOES care what errors does to the response since it
-// must compress every output to the client, even error
-// pages, so it must be registered before the errors
-// middleware and any others that would write to the
-// response.
-var directiveOrder = []directive{
-	// Essential directives that initialize vital configuration settings
-	{"root", setup.Root},
-	{"bind", setup.BindHost},
-	{"tls", https.Setup},
-
-	// Other directives that don't create HTTP handlers
-	{"startup", setup.Startup},
-	{"shutdown", setup.Shutdown},
-
-	// Directives that inject handlers (middleware)
-	{"log", setup.Log},
-	{"gzip", setup.Gzip},
-	{"errors", setup.Errors},
-	{"header", setup.Headers},
-	{"rewrite", setup.Rewrite},
-	{"redir", setup.Redir},
-	{"ext", setup.Ext},
-	{"mime", setup.Mime},
-	{"basicauth", setup.BasicAuth},
-	{"internal", setup.Internal},
-	{"pprof", setup.PProf},
-	{"expvar", setup.ExpVar},
-	{"proxy", setup.Proxy},
-	{"fastcgi", setup.FastCGI},
-	{"websocket", setup.WebSocket},
-	{"markdown", setup.Markdown},
-	{"templates", setup.Templates},
-	{"browse", setup.Browse},
-}
-
-// Directives returns the list of directives in order of priority.
-func Directives() []string {
-	directives := make([]string, len(directiveOrder))
-	for i, d := range directiveOrder {
-		directives[i] = d.name
-	}
-	return directives
-}
-
-// RegisterDirective adds the given directive to caddy's list of directives.
-// Pass the name of a directive you want it to be placed after,
-// otherwise it will be placed at the bottom of the stack.
-func RegisterDirective(name string, setup SetupFunc, after string) {
-	dir := directive{name: name, setup: setup}
-	idx := len(directiveOrder)
-	for i := range directiveOrder {
-		if directiveOrder[i].name == after {
-			idx = i + 1
-			break
-		}
-	}
-	newDirectives := append(directiveOrder[:idx], append([]directive{dir}, directiveOrder[idx:]...)...)
-	directiveOrder = newDirectives
-	parse.ValidDirectives[name] = struct{}{}
-}
-
-// directive ties together a directive name with its setup function.
-type directive struct {
-	name  string
-	setup SetupFunc
-}
-
-// SetupFunc takes a controller and may optionally return a middleware.
-// If the resulting middleware is not nil, it will be chained into
-// the HTTP handlers in the order specified in this package.
-type SetupFunc func(c *setup.Controller) (middleware.Middleware, error)

caddy/directives_test.go

@@ -1,31 +0,0 @@
-package caddy
-
-import (
-	"reflect"
-	"testing"
-)
-
-func TestRegister(t *testing.T) {
-	directives := []directive{
-		{"dummy", nil},
-		{"dummy2", nil},
-	}
-	directiveOrder = directives
-	RegisterDirective("foo", nil, "dummy")
-	if len(directiveOrder) != 3 {
-		t.Fatal("Should have 3 directives now")
-	}
-	getNames := func() (s []string) {
-		for _, d := range directiveOrder {
-			s = append(s, d.name)
-		}
-		return s
-	}
-	if !reflect.DeepEqual(getNames(), []string{"dummy", "foo", "dummy2"}) {
-		t.Fatalf("directive order doesn't match: %s", getNames())
-	}
-	RegisterDirective("bar", nil, "ASDASD")
-	if !reflect.DeepEqual(getNames(), []string{"dummy", "foo", "dummy2", "bar"}) {
-		t.Fatalf("directive order doesn't match: %s", getNames())
-	}
-}

caddy/helpers.go

@@ -1,102 +0,0 @@
-package caddy
-
-import (
-	"bytes"
-	"fmt"
-	"io/ioutil"
-	"log"
-	"os"
-	"os/exec"
-	"runtime"
-	"strconv"
-	"strings"
-	"sync"
-)
-
-// isLocalhost returns true if host looks explicitly like a localhost address.
-func isLocalhost(host string) bool {
-	return host == "localhost" || host == "::1" || strings.HasPrefix(host, "127.")
-}
-
-// checkFdlimit issues a warning if the OS max file descriptors is below a recommended minimum.
-func checkFdlimit() {
-	const min = 4096
-
-	// Warn if ulimit is too low for production sites
-	if runtime.GOOS == "linux" || runtime.GOOS == "darwin" {
-		out, err := exec.Command("sh", "-c", "ulimit -n").Output() // use sh because ulimit isn't in Linux $PATH
-		if err == nil {
-			// Note that an error here need not be reported
-			lim, err := strconv.Atoi(string(bytes.TrimSpace(out)))
-			if err == nil && lim < min {
-				fmt.Printf("Warning: File descriptor limit %d is too low for production sites. At least %d is recommended. Set with \"ulimit -n %d\".\n", lim, min, min)
-			}
-		}
-	}
-}
-
-// signalSuccessToParent tells the parent our status using pipe at index 3.
-// If this process is not a restart, this function does nothing.
-// Calling this function once this process has successfully initialized
-// is vital so that the parent process can unblock and kill itself.
-// This function is idempotent; it executes at most once per process.
-func signalSuccessToParent() {
-	signalParentOnce.Do(func() {
-		if IsRestart() {
-			ppipe := os.NewFile(3, "")               // parent is reading from pipe at index 3
-			_, err := ppipe.Write([]byte("success")) // we must send some bytes to the parent
-			if err != nil {
-				log.Printf("[ERROR] Communicating successful init to parent: %v", err)
-			}
-			ppipe.Close()
-		}
-	})
-}
-
-// signalParentOnce is used to make sure that the parent is only
-// signaled once; doing so more than once breaks whatever socket is
-// at fd 4 (the reason for this is still unclear - to reproduce,
-// call Stop() and Start() in succession at least once after a
-// restart, then try loading first host of Caddyfile in the browser).
-// Do not use this directly - call signalSuccessToParent instead.
-var signalParentOnce sync.Once
-
-// caddyfileGob maps bind address to index of the file descriptor
-// in the Files array passed to the child process. It also contains
-// the caddyfile contents and other state needed by the new process.
-// Used only during graceful restarts where a new process is spawned.
-type caddyfileGob struct {
-	ListenerFds            map[string]uintptr
-	Caddyfile              Input
-	OnDemandTLSCertsIssued int32
-}
-
-// IsRestart returns whether this process is, according
-// to env variables, a fork as part of a graceful restart.
-func IsRestart() bool {
-	return os.Getenv("CADDY_RESTART") == "true"
-}
-
-// writePidFile writes the process ID to the file at PidFile, if specified.
-func writePidFile() error {
-	pid := []byte(strconv.Itoa(os.Getpid()) + "\n")
-	return ioutil.WriteFile(PidFile, pid, 0644)
-}
-
-// CaddyfileInput represents a Caddyfile as input
-// and is simply a convenient way to implement
-// the Input interface.
-type CaddyfileInput struct {
-	Filepath string
-	Contents []byte
-	RealFile bool
-}
-
-// Body returns c.Contents.
-func (c CaddyfileInput) Body() []byte { return c.Contents }
-
-// Path returns c.Filepath.
-func (c CaddyfileInput) Path() string { return c.Filepath }
-
-// IsFile returns true if the original input was a real file on the file system.
-func (c CaddyfileInput) IsFile() bool { return c.RealFile }

caddy/https/certificates.go

@@ -1,234 +0,0 @@
-package https
-
-import (
-	"crypto/tls"
-	"crypto/x509"
-	"errors"
-	"io/ioutil"
-	"log"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/xenolf/lego/acme"
-	"golang.org/x/crypto/ocsp"
-)
-
-// certCache stores certificates in memory,
-// keying certificates by name.
-var certCache = make(map[string]Certificate)
-var certCacheMu sync.RWMutex
-
-// Certificate is a tls.Certificate with associated metadata tacked on.
-// Even if the metadata can be obtained by parsing the certificate,
-// we can be more efficient by extracting the metadata once so it's
-// just there, ready to use.
-type Certificate struct {
-	tls.Certificate
-
-	// Names is the list of names this certificate is written for.
-	// The first is the CommonName (if any), the rest are SAN.
-	Names []string
-
-	// NotAfter is when the certificate expires.
-	NotAfter time.Time
-
-	// Managed certificates are certificates that Caddy is managing,
-	// as opposed to the user specifying a certificate and key file
-	// or directory and managing the certificate resources themselves.
-	Managed bool
-
-	// OnDemand certificates are obtained or loaded on-demand during TLS
-	// handshakes (as opposed to preloaded certificates, which are loaded
-	// at startup). If OnDemand is true, Managed must necessarily be true.
-	// OnDemand certificates are maintained in the background just like
-	// preloaded ones, however, if an OnDemand certificate fails to renew,
-	// it is removed from the in-memory cache.
-	OnDemand bool
-
-	// OCSP contains the certificate's parsed OCSP response.
-	OCSP *ocsp.Response
-}
-
-// getCertificate gets a certificate that matches name (a server name)
-// from the in-memory cache. If there is no exact match for name, it
-// will be checked against names of the form '*.example.com' (wildcard
-// certificates) according to RFC 6125. If a match is found, matched will
-// be true. If no matches are found, matched will be false and a default
-// certificate will be returned with defaulted set to true. If no default
-// certificate is set, defaulted will be set to false.
-//
-// The logic in this function is adapted from the Go standard library,
-// which is by the Go Authors.
-//
-// This function is safe for concurrent use.
-func getCertificate(name string) (cert Certificate, matched, defaulted bool) {
-	var ok bool
-
-	// Not going to trim trailing dots here since RFC 3546 says,
-	// "The hostname is represented ... without a trailing dot."
-	// Just normalize to lowercase.
-	name = strings.ToLower(name)
-
-	certCacheMu.RLock()
-	defer certCacheMu.RUnlock()
-
-	// exact match? great, let's use it
-	if cert, ok = certCache[name]; ok {
-		matched = true
-		return
-	}
-
-	// try replacing labels in the name with wildcards until we get a match
-	labels := strings.Split(name, ".")
-	for i := range labels {
-		labels[i] = "*"
-		candidate := strings.Join(labels, ".")
-		if cert, ok = certCache[candidate]; ok {
-			matched = true
-			return
-		}
-	}
-
-	// if nothing matches, use the default certificate or bust
-	cert, defaulted = certCache[""]
-	return
-}
-
-// cacheManagedCertificate loads the certificate for domain into the
-// cache, flagging it as Managed and, if onDemand is true, as OnDemand
-// (meaning that it was obtained or loaded during a TLS handshake).
-//
-// This function is safe for concurrent use.
-func cacheManagedCertificate(domain string, onDemand bool) (Certificate, error) {
-	cert, err := makeCertificateFromDisk(storage.SiteCertFile(domain), storage.SiteKeyFile(domain))
-	if err != nil {
-		return cert, err
-	}
-	cert.Managed = true
-	cert.OnDemand = onDemand
-	cacheCertificate(cert)
-	return cert, nil
-}
-
-// cacheUnmanagedCertificatePEMFile loads a certificate for host using certFile
-// and keyFile, which must be in PEM format. It stores the certificate in
-// memory. The Managed and OnDemand flags of the certificate will be set to
-// false.
-//
-// This function is safe for concurrent use.
-func cacheUnmanagedCertificatePEMFile(certFile, keyFile string) error {
-	cert, err := makeCertificateFromDisk(certFile, keyFile)
-	if err != nil {
-		return err
-	}
-	cacheCertificate(cert)
-	return nil
-}
-
-// cacheUnmanagedCertificatePEMBytes makes a certificate out of the PEM bytes
-// of the certificate and key, then caches it in memory.
-//
-// This function is safe for concurrent use.
-func cacheUnmanagedCertificatePEMBytes(certBytes, keyBytes []byte) error {
-	cert, err := makeCertificate(certBytes, keyBytes)
-	if err != nil {
-		return err
-	}
-	cacheCertificate(cert)
-	return nil
-}
-
-// makeCertificateFromDisk makes a Certificate by loading the
-// certificate and key files. It fills out all the fields in
-// the certificate except for the Managed and OnDemand flags.
-// (It is up to the caller to set those.)
-func makeCertificateFromDisk(certFile, keyFile string) (Certificate, error) {
-	certPEMBlock, err := ioutil.ReadFile(certFile)
-	if err != nil {
-		return Certificate{}, err
-	}
-	keyPEMBlock, err := ioutil.ReadFile(keyFile)
-	if err != nil {
-		return Certificate{}, err
-	}
-	return makeCertificate(certPEMBlock, keyPEMBlock)
-}
-
-// makeCertificate turns a certificate PEM bundle and a key PEM block into
-// a Certificate, with OCSP and other relevant metadata tagged with it,
-// except for the OnDemand and Managed flags. It is up to the caller to
-// set those properties.
-func makeCertificate(certPEMBlock, keyPEMBlock []byte) (Certificate, error) {
-	var cert Certificate
-
-	// Convert to a tls.Certificate
-	tlsCert, err := tls.X509KeyPair(certPEMBlock, keyPEMBlock)
-	if err != nil {
-		return cert, err
-	}
-	if len(tlsCert.Certificate) == 0 {
-		return cert, errors.New("certificate is empty")
-	}
-
-	// Parse leaf certificate and extract relevant metadata
-	leaf, err := x509.ParseCertificate(tlsCert.Certificate[0])
-	if err != nil {
-		return cert, err
-	}
-	if leaf.Subject.CommonName != "" {
-		cert.Names = []string{strings.ToLower(leaf.Subject.CommonName)}
-	}
-	for _, name := range leaf.DNSNames {
-		if name != leaf.Subject.CommonName {
-			cert.Names = append(cert.Names, strings.ToLower(name))
-		}
-	}
-	cert.NotAfter = leaf.NotAfter
-
-	// Staple OCSP
-	ocspBytes, ocspResp, err := acme.GetOCSPForCert(certPEMBlock)
-	if err != nil {
-		// An error here is not a problem because a certificate may simply
-		// not contain a link to an OCSP server. But we should log it anyway.
-		log.Printf("[WARNING] No OCSP stapling for %v: %v", cert.Names, err)
-	} else if ocspResp.Status == ocsp.Good {
-		tlsCert.OCSPStaple = ocspBytes
-		cert.OCSP = ocspResp
-	}
-
-	cert.Certificate = tlsCert
-	return cert, nil
-}
-
-// cacheCertificate adds cert to the in-memory cache. If the cache is
-// empty, cert will be used as the default certificate. If the cache is
-// full, random entries are deleted until there is room to map all the
-// names on the certificate.
-//
-// This certificate will be keyed to the names in cert.Names. Any name
-// that is already a key in the cache will be replaced with this cert.
-//
-// This function is safe for concurrent use.
-func cacheCertificate(cert Certificate) {
-	certCacheMu.Lock()
-	if _, ok := certCache[""]; !ok {
-		// use as default
-		cert.Names = append(cert.Names, "")
-		certCache[""] = cert
-	}
-	for len(certCache)+len(cert.Names) > 10000 {
-		// for simplicity, just remove random elements
-		for key := range certCache {
-			if key == "" { // ... but not the default cert
-				continue
-			}
-			delete(certCache, key)
-			break
-		}
-	}
-	for _, name := range cert.Names {
-		certCache[name] = cert
-	}
-	certCacheMu.Unlock()
-}

caddy/https/certificates_test.go

@@ -1,59 +0,0 @@
-package https
-
-import "testing"
-
-func TestUnexportedGetCertificate(t *testing.T) {
-	defer func() { certCache = make(map[string]Certificate) }()
-
-	// When cache is empty
-	if _, matched, defaulted := getCertificate("example.com"); matched || defaulted {
-		t.Errorf("Got a certificate when cache was empty; matched=%v, defaulted=%v", matched, defaulted)
-	}
-
-	// When cache has one certificate in it (also is default)
-	defaultCert := Certificate{Names: []string{"example.com", ""}}
-	certCache[""] = defaultCert
-	certCache["example.com"] = defaultCert
-	if cert, matched, defaulted := getCertificate("Example.com"); !matched || defaulted || cert.Names[0] != "example.com" {
-		t.Errorf("Didn't get a cert for 'Example.com' or got the wrong one: %v, matched=%v, defaulted=%v", cert, matched, defaulted)
-	}
-	if cert, matched, defaulted := getCertificate(""); !matched || defaulted || cert.Names[0] != "example.com" {
-		t.Errorf("Didn't get a cert for '' or got the wrong one: %v, matched=%v, defaulted=%v", cert, matched, defaulted)
-	}
-
-	// When retrieving wildcard certificate
-	certCache["*.example.com"] = Certificate{Names: []string{"*.example.com"}}
-	if cert, matched, defaulted := getCertificate("sub.example.com"); !matched || defaulted || cert.Names[0] != "*.example.com" {
-		t.Errorf("Didn't get wildcard cert for 'sub.example.com' or got the wrong one: %v, matched=%v, defaulted=%v", cert, matched, defaulted)
-	}
-
-	// When no certificate matches, the default is returned
-	if cert, matched, defaulted := getCertificate("nomatch"); matched || !defaulted {
-		t.Errorf("Expected matched=false, defaulted=true; but got matched=%v, defaulted=%v (cert: %v)", matched, defaulted, cert)
-	} else if cert.Names[0] != "example.com" {
-		t.Errorf("Expected default cert, got: %v", cert)
-	}
-}
-
-func TestCacheCertificate(t *testing.T) {
-	defer func() { certCache = make(map[string]Certificate) }()
-
-	cacheCertificate(Certificate{Names: []string{"example.com", "sub.example.com"}})
-	if _, ok := certCache["example.com"]; !ok {
-		t.Error("Expected first cert to be cached by key 'example.com', but it wasn't")
-	}
-	if _, ok := certCache["sub.example.com"]; !ok {
-		t.Error("Expected first cert to be cached by key 'sub.exmaple.com', but it wasn't")
-	}
-	if cert, ok := certCache[""]; !ok || cert.Names[2] != "" {
-		t.Error("Expected first cert to be cached additionally as the default certificate with empty name added, but it wasn't")
-	}
-
-	cacheCertificate(Certificate{Names: []string{"example2.com"}})
-	if _, ok := certCache["example2.com"]; !ok {
-		t.Error("Expected second cert to be cached by key 'exmaple2.com', but it wasn't")
-	}
-	if cert, ok := certCache[""]; ok && cert.Names[0] == "example2.com" {
-		t.Error("Expected second cert to NOT be cached as default, but it was")
-	}
-}

caddy/https/client.go

@@ -1,215 +0,0 @@
-package https
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"net"
-	"sync"
-	"time"
-
-	"github.com/mholt/caddy/server"
-	"github.com/xenolf/lego/acme"
-)
-
-// acmeMu ensures that only one ACME challenge occurs at a time.
-var acmeMu sync.Mutex
-
-// ACMEClient is an acme.Client with custom state attached.
-type ACMEClient struct {
-	*acme.Client
-	AllowPrompts bool // if false, we assume AlternatePort must be used
-}
-
-// NewACMEClient creates a new ACMEClient given an email and whether
-// prompting the user is allowed. Clients should not be kept and
-// re-used over long periods of time, but immediate re-use is more
-// efficient than re-creating on every iteration.
-var NewACMEClient = func(email string, allowPrompts bool) (*ACMEClient, error) {
-	// Look up or create the LE user account
-	leUser, err := getUser(email)
-	if err != nil {
-		return nil, err
-	}
-
-	// The client facilitates our communication with the CA server.
-	client, err := acme.NewClient(CAUrl, &leUser, KeyType)
-	if err != nil {
-		return nil, err
-	}
-
-	// If not registered, the user must register an account with the CA
-	// and agree to terms
-	if leUser.Registration == nil {
-		reg, err := client.Register()
-		if err != nil {
-			return nil, errors.New("registration error: " + err.Error())
-		}
-		leUser.Registration = reg
-
-		if allowPrompts { // can't prompt a user who isn't there
-			if !Agreed && reg.TosURL == "" {
-				Agreed = promptUserAgreement(saURL, false) // TODO - latest URL
-			}
-			if !Agreed && reg.TosURL == "" {
-				return nil, errors.New("user must agree to terms")
-			}
-		}
-
-		err = client.AgreeToTOS()
-		if err != nil {
-			saveUser(leUser) // Might as well try, right?
-			return nil, errors.New("error agreeing to terms: " + err.Error())
-		}
-
-		// save user to the file system
-		err = saveUser(leUser)
-		if err != nil {
-			return nil, errors.New("could not save user: " + err.Error())
-		}
-	}
-
-	return &ACMEClient{
-		Client:       client,
-		AllowPrompts: allowPrompts,
-	}, nil
-}
-
-// NewACMEClientGetEmail creates a new ACMEClient and gets an email
-// address at the same time (a server config is required, since it
-// may contain an email address in it).
-func NewACMEClientGetEmail(config server.Config, allowPrompts bool) (*ACMEClient, error) {
-	return NewACMEClient(getEmail(config, allowPrompts), allowPrompts)
-}
-
-// Configure configures c according to bindHost, which is the host (not
-// whole address) to bind the listener to in solving the http and tls-sni
-// challenges.
-func (c *ACMEClient) Configure(bindHost string) {
-	// If we allow prompts, operator must be present. In our case,
-	// that is synonymous with saying the server is not already
-	// started. So if the user is still there, we don't use
-	// AlternatePort because we don't need to proxy the challenges.
-	// Conversely, if the operator is not there, the server has
-	// already started and we need to proxy the challenge.
-	if c.AllowPrompts {
-		// Operator is present; server is not already listening
-		c.SetHTTPAddress(net.JoinHostPort(bindHost, ""))
-		c.SetTLSAddress(net.JoinHostPort(bindHost, ""))
-		//c.ExcludeChallenges([]acme.Challenge{acme.DNS01})
-	} else {
-		// Operator is not present; server is started, so proxy challenges
-		c.SetHTTPAddress(net.JoinHostPort(bindHost, AlternatePort))
-		c.SetTLSAddress(net.JoinHostPort(bindHost, AlternatePort))
-		//c.ExcludeChallenges([]acme.Challenge{acme.TLSSNI01, acme.DNS01})
-	}
-	c.ExcludeChallenges([]acme.Challenge{acme.TLSSNI01, acme.DNS01}) // TODO: can we proxy TLS challenges? and we should support DNS...
-}
-
-// Obtain obtains a single certificate for names. It stores the certificate
-// on the disk if successful.
-func (c *ACMEClient) Obtain(names []string) error {
-Attempts:
-	for attempts := 0; attempts < 2; attempts++ {
-		acmeMu.Lock()
-		certificate, failures := c.ObtainCertificate(names, true, nil)
-		acmeMu.Unlock()
-		if len(failures) > 0 {
-			// Error - try to fix it or report it to the user and abort
-			var errMsg string             // we'll combine all the failures into a single error message
-			var promptedForAgreement bool // only prompt user for agreement at most once
-
-			for errDomain, obtainErr := range failures {
-				// TODO: Double-check, will obtainErr ever be nil?
-				if tosErr, ok := obtainErr.(acme.TOSError); ok {
-					// Terms of Service agreement error; we can probably deal with this
-					if !Agreed && !promptedForAgreement && c.AllowPrompts {
-						Agreed = promptUserAgreement(tosErr.Detail, true) // TODO: Use latest URL
-						promptedForAgreement = true
-					}
-					if Agreed || !c.AllowPrompts {
-						err := c.AgreeToTOS()
-						if err != nil {
-							return errors.New("error agreeing to updated terms: " + err.Error())
-						}
-						continue Attempts
-					}
-				}
-
-				// If user did not agree or it was any other kind of error, just append to the list of errors
-				errMsg += "[" + errDomain + "] failed to get certificate: " + obtainErr.Error() + "\n"
-			}
-			return errors.New(errMsg)
-		}
-
-		// Success - immediately save the certificate resource
-		err := saveCertResource(certificate)
-		if err != nil {
-			return fmt.Errorf("error saving assets for %v: %v", names, err)
-		}
-
-		break
-	}
-
-	return nil
-}
-
-// Renew renews the managed certificate for name. Right now our storage
-// mechanism only supports one name per certificate, so this function only
-// accepts one domain as input. It can be easily modified to support SAN
-// certificates if, one day, they become desperately needed enough that our
-// storage mechanism is upgraded to be more complex to support SAN certs.
-//
-// Anyway, this function is safe for concurrent use.
-func (c *ACMEClient) Renew(name string) error {
-	// Prepare for renewal (load PEM cert, key, and meta)
-	certBytes, err := ioutil.ReadFile(storage.SiteCertFile(name))
-	if err != nil {
-		return err
-	}
-	keyBytes, err := ioutil.ReadFile(storage.SiteKeyFile(name))
-	if err != nil {
-		return err
-	}
-	metaBytes, err := ioutil.ReadFile(storage.SiteMetaFile(name))
-	if err != nil {
-		return err
-	}
-	var certMeta acme.CertificateResource
-	err = json.Unmarshal(metaBytes, &certMeta)
-	certMeta.Certificate = certBytes
-	certMeta.PrivateKey = keyBytes
-
-	// Perform renewal and retry if necessary, but not too many times.
-	var newCertMeta acme.CertificateResource
-	var success bool
-	for attempts := 0; attempts < 2; attempts++ {
-		acmeMu.Lock()
-		newCertMeta, err = c.RenewCertificate(certMeta, true)
-		acmeMu.Unlock()
-		if err == nil {
-			success = true
-			break
-		}
-
-		// If the legal terms changed and need to be agreed to again,
-		// we can handle that.
-		if _, ok := err.(acme.TOSError); ok {
-			err := c.AgreeToTOS()
-			if err != nil {
-				return err
-			}
-			continue
-		}
-
-		// For any other kind of error, wait 10s and try again.
-		time.Sleep(10 * time.Second)
-	}
-
-	if !success {
-		return errors.New("too many renewal attempts; last error: " + err.Error())
-	}
-
-	return saveCertResource(newCertMeta)
-}

caddy/https/crypto.go

@@ -1,57 +0,0 @@
-package https
-
-import (
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/rsa"
-	"crypto/x509"
-	"encoding/pem"
-	"errors"
-	"io/ioutil"
-	"os"
-)
-
-// loadPrivateKey loads a PEM-encoded ECC/RSA private key from file.
-func loadPrivateKey(file string) (crypto.PrivateKey, error) {
-	keyBytes, err := ioutil.ReadFile(file)
-	if err != nil {
-		return nil, err
-	}
-	keyBlock, _ := pem.Decode(keyBytes)
-
-	switch keyBlock.Type {
-	case "RSA PRIVATE KEY":
-		return x509.ParsePKCS1PrivateKey(keyBlock.Bytes)
-	case "EC PRIVATE KEY":
-		return x509.ParseECPrivateKey(keyBlock.Bytes)
-	}
-
-	return nil, errors.New("unknown private key type")
-}
-
-// savePrivateKey saves a PEM-encoded ECC/RSA private key to file.
-func savePrivateKey(key crypto.PrivateKey, file string) error {
-	var pemType string
-	var keyBytes []byte
-	switch key := key.(type) {
-	case *ecdsa.PrivateKey:
-		var err error
-		pemType = "EC"
-		keyBytes, err = x509.MarshalECPrivateKey(key)
-		if err != nil {
-			return err
-		}
-	case *rsa.PrivateKey:
-		pemType = "RSA"
-		keyBytes = x509.MarshalPKCS1PrivateKey(key)
-	}
-
-	pemKey := pem.Block{Type: pemType + " PRIVATE KEY", Bytes: keyBytes}
-	keyOut, err := os.Create(file)
-	if err != nil {
-		return err
-	}
-	keyOut.Chmod(0600)
-	defer keyOut.Close()
-	return pem.Encode(keyOut, &pemKey)
-}

caddy/https/crypto_test.go

@@ -1,120 +0,0 @@
-package https
-
-import (
-	"bytes"
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"errors"
-	"os"
-	"runtime"
-	"testing"
-)
-
-func TestSaveAndLoadRSAPrivateKey(t *testing.T) {
-	keyFile := "test.key"
-	defer os.Remove(keyFile)
-
-	privateKey, err := rsa.GenerateKey(rand.Reader, 128) // make tests faster; small key size OK for testing
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// test save
-	err = savePrivateKey(privateKey, keyFile)
-	if err != nil {
-		t.Fatal("error saving private key:", err)
-	}
-
-	// it doesn't make sense to test file permission on windows
-	if runtime.GOOS != "windows" {
-		// get info of the key file
-		info, err := os.Stat(keyFile)
-		if err != nil {
-			t.Fatal("error stating private key:", err)
-		}
-		// verify permission of key file is correct
-		if info.Mode().Perm() != 0600 {
-			t.Error("Expected key file to have permission 0600, but it wasn't")
-		}
-	}
-
-	// test load
-	loadedKey, err := loadPrivateKey(keyFile)
-	if err != nil {
-		t.Error("error loading private key:", err)
-	}
-
-	// verify loaded key is correct
-	if !PrivateKeysSame(privateKey, loadedKey) {
-		t.Error("Expected key bytes to be the same, but they weren't")
-	}
-}
-
-func TestSaveAndLoadECCPrivateKey(t *testing.T) {
-	keyFile := "test.key"
-	defer os.Remove(keyFile)
-
-	privateKey, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// test save
-	err = savePrivateKey(privateKey, keyFile)
-	if err != nil {
-		t.Fatal("error saving private key:", err)
-	}
-
-	// it doesn't make sense to test file permission on windows
-	if runtime.GOOS != "windows" {
-		// get info of the key file
-		info, err := os.Stat(keyFile)
-		if err != nil {
-			t.Fatal("error stating private key:", err)
-		}
-		// verify permission of key file is correct
-		if info.Mode().Perm() != 0600 {
-			t.Error("Expected key file to have permission 0600, but it wasn't")
-		}
-	}
-
-	// test load
-	loadedKey, err := loadPrivateKey(keyFile)
-	if err != nil {
-		t.Error("error loading private key:", err)
-	}
-
-	// verify loaded key is correct
-	if !PrivateKeysSame(privateKey, loadedKey) {
-		t.Error("Expected key bytes to be the same, but they weren't")
-	}
-}
-
-// PrivateKeysSame compares the bytes of a and b and returns true if they are the same.
-func PrivateKeysSame(a, b crypto.PrivateKey) bool {
-	var abytes, bbytes []byte
-	var err error
-
-	if abytes, err = PrivateKeyBytes(a); err != nil {
-		return false
-	}
-	if bbytes, err = PrivateKeyBytes(b); err != nil {
-		return false
-	}
-	return bytes.Equal(abytes, bbytes)
-}
-
-// PrivateKeyBytes returns the bytes of DER-encoded key.
-func PrivateKeyBytes(key crypto.PrivateKey) ([]byte, error) {
-	switch key := key.(type) {
-	case *rsa.PrivateKey:
-		return x509.MarshalPKCS1PrivateKey(key), nil
-	case *ecdsa.PrivateKey:
-		return x509.MarshalECPrivateKey(key)
-	}
-	return nil, errors.New("Unknown private key type")
-}

caddy/https/handler.go

@@ -1,42 +0,0 @@
-package https
-
-import (
-	"crypto/tls"
-	"log"
-	"net/http"
-	"net/http/httputil"
-	"net/url"
-	"strings"
-)
-
-const challengeBasePath = "/.well-known/acme-challenge"
-
-// RequestCallback proxies challenge requests to ACME client if the
-// request path starts with challengeBasePath. It returns true if it
-// handled the request and no more needs to be done; it returns false
-// if this call was a no-op and the request still needs handling.
-func RequestCallback(w http.ResponseWriter, r *http.Request) bool {
-	if strings.HasPrefix(r.URL.Path, challengeBasePath) {
-		scheme := "http"
-		if r.TLS != nil {
-			scheme = "https"
-		}
-
-		upstream, err := url.Parse(scheme + "://localhost:" + AlternatePort)
-		if err != nil {
-			w.WriteHeader(http.StatusInternalServerError)
-			log.Printf("[ERROR] ACME proxy handler: %v", err)
-			return true
-		}
-
-		proxy := httputil.NewSingleHostReverseProxy(upstream)
-		proxy.Transport = &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // solver uses self-signed certs
-		}
-		proxy.ServeHTTP(w, r)
-
-		return true
-	}
-
-	return false
-}

caddy/https/handler_test.go

@@ -1,63 +0,0 @@
-package https
-
-import (
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-func TestRequestCallbackNoOp(t *testing.T) {
-	// try base paths that aren't handled by this handler
-	for _, url := range []string{
-		"http://localhost/",
-		"http://localhost/foo.html",
-		"http://localhost/.git",
-		"http://localhost/.well-known/",
-		"http://localhost/.well-known/acme-challenging",
-	} {
-		req, err := http.NewRequest("GET", url, nil)
-		if err != nil {
-			t.Fatalf("Could not craft request, got error: %v", err)
-		}
-		rw := httptest.NewRecorder()
-		if RequestCallback(rw, req) {
-			t.Errorf("Got true with this URL, but shouldn't have: %s", url)
-		}
-	}
-}
-
-func TestRequestCallbackSuccess(t *testing.T) {
-	expectedPath := challengeBasePath + "/asdf"
-
-	// Set up fake acme handler backend to make sure proxying succeeds
-	var proxySuccess bool
-	ts := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		proxySuccess = true
-		if r.URL.Path != expectedPath {
-			t.Errorf("Expected path '%s' but got '%s' instead", expectedPath, r.URL.Path)
-		}
-	}))
-
-	// Custom listener that uses the port we expect
-	ln, err := net.Listen("tcp", "127.0.0.1:"+AlternatePort)
-	if err != nil {
-		t.Fatalf("Unable to start test server listener: %v", err)
-	}
-	ts.Listener = ln
-
-	// Start our engines and run the test
-	ts.Start()
-	defer ts.Close()
-	req, err := http.NewRequest("GET", "http://127.0.0.1:"+AlternatePort+expectedPath, nil)
-	if err != nil {
-		t.Fatalf("Could not craft request, got error: %v", err)
-	}
-	rw := httptest.NewRecorder()
-
-	RequestCallback(rw, req)
-
-	if !proxySuccess {
-		t.Fatal("Expected request to be proxied, but it wasn't")
-	}
-}

caddy/https/handshake.go

@@ -1,320 +0,0 @@
-package https
-
-import (
-	"bytes"
-	"crypto/tls"
-	"encoding/pem"
-	"errors"
-	"fmt"
-	"log"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"github.com/mholt/caddy/server"
-	"github.com/xenolf/lego/acme"
-)
-
-// GetCertificate gets a certificate to satisfy clientHello as long as
-// the certificate is already cached in memory. It will not be loaded
-// from disk or obtained from the CA during the handshake.
-//
-// This function is safe for use as a tls.Config.GetCertificate callback.
-func GetCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-	cert, err := getCertDuringHandshake(clientHello.ServerName, false, false)
-	return &cert.Certificate, err
-}
-
-// GetOrObtainCertificate will get a certificate to satisfy clientHello, even
-// if that means obtaining a new certificate from a CA during the handshake.
-// It first checks the in-memory cache, then accesses disk, then accesses the
-// network if it must. An obtained certificate will be stored on disk and
-// cached in memory.
-//
-// This function is safe for use as a tls.Config.GetCertificate callback.
-func GetOrObtainCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
-	cert, err := getCertDuringHandshake(clientHello.ServerName, true, true)
-	return &cert.Certificate, err
-}
-
-// getCertDuringHandshake will get a certificate for name. It first tries
-// the in-memory cache. If no certificate for name is in the cache and if
-// loadIfNecessary == true, it goes to disk to load it into the cache and
-// serve it. If it's not on disk and if obtainIfNecessary == true, the
-// certificate will be obtained from the CA, cached, and served. If
-// obtainIfNecessary is true, then loadIfNecessary must also be set to true.
-// An error will be returned if and only if no certificate is available.
-//
-// This function is safe for concurrent use.
-func getCertDuringHandshake(name string, loadIfNecessary, obtainIfNecessary bool) (Certificate, error) {
-	// First check our in-memory cache to see if we've already loaded it
-	cert, matched, defaulted := getCertificate(name)
-	if matched {
-		return cert, nil
-	}
-
-	if loadIfNecessary {
-		// Then check to see if we have one on disk
-		loadedCert, err := cacheManagedCertificate(name, true)
-		if err == nil {
-			loadedCert, err = handshakeMaintenance(name, loadedCert)
-			if err != nil {
-				log.Printf("[ERROR] Maintaining newly-loaded certificate for %s: %v", name, err)
-			}
-			return loadedCert, nil
-		}
-
-		if obtainIfNecessary {
-			// By this point, we need to ask the CA for a certificate
-
-			name = strings.ToLower(name)
-
-			// Make sure aren't over any applicable limits
-			err := checkLimitsForObtainingNewCerts(name)
-			if err != nil {
-				return Certificate{}, err
-			}
-
-			// Name has to qualify for a certificate
-			if !HostQualifies(name) {
-				return cert, errors.New("hostname '" + name + "' does not qualify for certificate")
-			}
-
-			// Obtain certificate from the CA
-			return obtainOnDemandCertificate(name)
-		}
-	}
-
-	if defaulted {
-		return cert, nil
-	}
-
-	return Certificate{}, errors.New("no certificate for " + name)
-}
-
-// checkLimitsForObtainingNewCerts checks to see if name can be issued right
-// now according to mitigating factors we keep track of and preferences the
-// user has set. If a non-nil error is returned, do not issue a new certificate
-// for name.
-func checkLimitsForObtainingNewCerts(name string) error {
-	// User can set hard limit for number of certs for the process to issue
-	if onDemandMaxIssue > 0 && atomic.LoadInt32(OnDemandIssuedCount) >= onDemandMaxIssue {
-		return fmt.Errorf("%s: maximum certificates issued (%d)", name, onDemandMaxIssue)
-	}
-
-	// Make sure name hasn't failed a challenge recently
-	failedIssuanceMu.RLock()
-	when, ok := failedIssuance[name]
-	failedIssuanceMu.RUnlock()
-	if ok {
-		return fmt.Errorf("%s: throttled; refusing to issue cert since last attempt on %s failed", name, when.String())
-	}
-
-	// Make sure, if we've issued a few certificates already, that we haven't
-	// issued any recently
-	lastIssueTimeMu.Lock()
-	since := time.Since(lastIssueTime)
-	lastIssueTimeMu.Unlock()
-	if atomic.LoadInt32(OnDemandIssuedCount) >= 10 && since < 10*time.Minute {
-		return fmt.Errorf("%s: throttled; last certificate was obtained %v ago", name, since)
-	}
-
-	// 👍Good to go
-	return nil
-}
-
-// obtainOnDemandCertificate obtains a certificate for name for the given
-// name. If another goroutine has already started obtaining a cert for
-// name, it will wait and use what the other goroutine obtained.
-//
-// This function is safe for use by multiple concurrent goroutines.
-func obtainOnDemandCertificate(name string) (Certificate, error) {
-	// We must protect this process from happening concurrently, so synchronize.
-	obtainCertWaitChansMu.Lock()
-	wait, ok := obtainCertWaitChans[name]
-	if ok {
-		// lucky us -- another goroutine is already obtaining the certificate.
-		// wait for it to finish obtaining the cert and then we'll use it.
-		obtainCertWaitChansMu.Unlock()
-		<-wait
-		return getCertDuringHandshake(name, true, false)
-	}
-
-	// looks like it's up to us to do all the work and obtain the cert
-	wait = make(chan struct{})
-	obtainCertWaitChans[name] = wait
-	obtainCertWaitChansMu.Unlock()
-
-	// Unblock waiters and delete waitgroup when we return
-	defer func() {
-		obtainCertWaitChansMu.Lock()
-		close(wait)
-		delete(obtainCertWaitChans, name)
-		obtainCertWaitChansMu.Unlock()
-	}()
-
-	log.Printf("[INFO] Obtaining new certificate for %s", name)
-
-	// obtain cert
-	client, err := NewACMEClientGetEmail(server.Config{}, false)
-	if err != nil {
-		return Certificate{}, errors.New("error creating client: " + err.Error())
-	}
-	client.Configure("") // TODO: which BindHost?
-	err = client.Obtain([]string{name})
-	if err != nil {
-		// Failed to solve challenge, so don't allow another on-demand
-		// issue for this name to be attempted for a little while.
-		failedIssuanceMu.Lock()
-		failedIssuance[name] = time.Now()
-		go func(name string) {
-			time.Sleep(5 * time.Minute)
-			failedIssuanceMu.Lock()
-			delete(failedIssuance, name)
-			failedIssuanceMu.Unlock()
-		}(name)
-		failedIssuanceMu.Unlock()
-		return Certificate{}, err
-	}
-
-	// Success - update counters and stuff
-	atomic.AddInt32(OnDemandIssuedCount, 1)
-	lastIssueTimeMu.Lock()
-	lastIssueTime = time.Now()
-	lastIssueTimeMu.Unlock()
-
-	// The certificate is already on disk; now just start over to load it and serve it
-	return getCertDuringHandshake(name, true, false)
-}
-
-// handshakeMaintenance performs a check on cert for expiration and OCSP
-// validity.
-//
-// This function is safe for use by multiple concurrent goroutines.
-func handshakeMaintenance(name string, cert Certificate) (Certificate, error) {
-	// Check cert expiration
-	timeLeft := cert.NotAfter.Sub(time.Now().UTC())
-	if timeLeft < renewDurationBefore {
-		log.Printf("[INFO] Certificate for %v expires in %v; attempting renewal", cert.Names, timeLeft)
-		return renewDynamicCertificate(name)
-	}
-
-	// Check OCSP staple validity
-	if cert.OCSP != nil {
-		refreshTime := cert.OCSP.ThisUpdate.Add(cert.OCSP.NextUpdate.Sub(cert.OCSP.ThisUpdate) / 2)
-		if time.Now().After(refreshTime) {
-			err := stapleOCSP(&cert, nil)
-			if err != nil {
-				// An error with OCSP stapling is not the end of the world, and in fact, is
-				// quite common considering not all certs have issuer URLs that support it.
-				log.Printf("[ERROR] Getting OCSP for %s: %v", name, err)
-			}
-			certCacheMu.Lock()
-			certCache[name] = cert
-			certCacheMu.Unlock()
-		}
-	}
-
-	return cert, nil
-}
-
-// renewDynamicCertificate renews currentCert using the clientHello. It returns the
-// certificate to use and an error, if any. currentCert may be returned even if an
-// error occurs, since we perform renewals before they expire and it may still be
-// usable. name should already be lower-cased before calling this function.
-//
-// This function is safe for use by multiple concurrent goroutines.
-func renewDynamicCertificate(name string) (Certificate, error) {
-	obtainCertWaitChansMu.Lock()
-	wait, ok := obtainCertWaitChans[name]
-	if ok {
-		// lucky us -- another goroutine is already renewing the certificate.
-		// wait for it to finish, then we'll use the new one.
-		obtainCertWaitChansMu.Unlock()
-		<-wait
-		return getCertDuringHandshake(name, true, false)
-	}
-
-	// looks like it's up to us to do all the work and renew the cert
-	wait = make(chan struct{})
-	obtainCertWaitChans[name] = wait
-	obtainCertWaitChansMu.Unlock()
-
-	// unblock waiters and delete waitgroup when we return
-	defer func() {
-		obtainCertWaitChansMu.Lock()
-		close(wait)
-		delete(obtainCertWaitChans, name)
-		obtainCertWaitChansMu.Unlock()
-	}()
-
-	log.Printf("[INFO] Renewing certificate for %s", name)
-
-	client, err := NewACMEClientGetEmail(server.Config{}, false)
-	if err != nil {
-		return Certificate{}, err
-	}
-	client.Configure("") // TODO: Bind address of relevant listener, yuck
-	err = client.Renew(name)
-	if err != nil {
-		return Certificate{}, err
-	}
-
-	return getCertDuringHandshake(name, true, false)
-}
-
-// stapleOCSP staples OCSP information to cert for hostname name.
-// If you have it handy, you should pass in the PEM-encoded certificate
-// bundle; otherwise the DER-encoded cert will have to be PEM-encoded.
-// If you don't have the PEM blocks handy, just pass in nil.
-//
-// Errors here are not necessarily fatal, it could just be that the
-// certificate doesn't have an issuer URL.
-func stapleOCSP(cert *Certificate, pemBundle []byte) error {
-	if pemBundle == nil {
-		// The function in the acme package that gets OCSP requires a PEM-encoded cert
-		bundle := new(bytes.Buffer)
-		for _, derBytes := range cert.Certificate.Certificate {
-			pem.Encode(bundle, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
-		}
-		pemBundle = bundle.Bytes()
-	}
-
-	ocspBytes, ocspResp, err := acme.GetOCSPForCert(pemBundle)
-	if err != nil {
-		return err
-	}
-
-	cert.Certificate.OCSPStaple = ocspBytes
-	cert.OCSP = ocspResp
-
-	return nil
-}
-
-// obtainCertWaitChans is used to coordinate obtaining certs for each hostname.
-var obtainCertWaitChans = make(map[string]chan struct{})
-var obtainCertWaitChansMu sync.Mutex
-
-// OnDemandIssuedCount is the number of certificates that have been issued
-// on-demand by this process. It is only safe to modify this count atomically.
-// If it reaches onDemandMaxIssue, on-demand issuances will fail.
-var OnDemandIssuedCount = new(int32)
-
-// onDemandMaxIssue is set based on max_certs in tls config. It specifies the
-// maximum number of certificates that can be issued.
-// TODO: This applies globally, but we should probably make a server-specific
-// way to keep track of these limits and counts, since it's specified in the
-// Caddyfile...
-var onDemandMaxIssue int32
-
-// failedIssuance is a set of names that we recently failed to get a
-// certificate for from the ACME CA. They are removed after some time.
-// When a name is in this map, do not issue a certificate for it on-demand.
-var failedIssuance = make(map[string]time.Time)
-var failedIssuanceMu sync.RWMutex
-
-// lastIssueTime records when we last obtained a certificate successfully.
-// If this value is recent, do not make any on-demand certificate requests.
-var lastIssueTime time.Time
-var lastIssueTimeMu sync.Mutex

caddy/https/handshake_test.go

@@ -1,54 +0,0 @@
-package https
-
-import (
-	"crypto/tls"
-	"crypto/x509"
-	"testing"
-)
-
-func TestGetCertificate(t *testing.T) {
-	defer func() { certCache = make(map[string]Certificate) }()
-
-	hello := &tls.ClientHelloInfo{ServerName: "example.com"}
-	helloSub := &tls.ClientHelloInfo{ServerName: "sub.example.com"}
-	helloNoSNI := &tls.ClientHelloInfo{}
-	helloNoMatch := &tls.ClientHelloInfo{ServerName: "nomatch"}
-
-	// When cache is empty
-	if cert, err := GetCertificate(hello); err == nil {
-		t.Errorf("GetCertificate should return error when cache is empty, got: %v", cert)
-	}
-	if cert, err := GetCertificate(helloNoSNI); err == nil {
-		t.Errorf("GetCertificate should return error when cache is empty even if server name is blank, got: %v", cert)
-	}
-
-	// When cache has one certificate in it (also is default)
-	defaultCert := Certificate{Names: []string{"example.com", ""}, Certificate: tls.Certificate{Leaf: &x509.Certificate{DNSNames: []string{"example.com"}}}}
-	certCache[""] = defaultCert
-	certCache["example.com"] = defaultCert
-	if cert, err := GetCertificate(hello); err != nil {
-		t.Errorf("Got an error but shouldn't have, when cert exists in cache: %v", err)
-	} else if cert.Leaf.DNSNames[0] != "example.com" {
-		t.Errorf("Got wrong certificate with exact match; expected 'example.com', got: %v", cert)
-	}
-	if cert, err := GetCertificate(helloNoSNI); err != nil {
-		t.Errorf("Got an error with no SNI but shouldn't have, when cert exists in cache: %v", err)
-	} else if cert.Leaf.DNSNames[0] != "example.com" {
-		t.Errorf("Got wrong certificate for no SNI; expected 'example.com' as default, got: %v", cert)
-	}
-
-	// When retrieving wildcard certificate
-	certCache["*.example.com"] = Certificate{Names: []string{"*.example.com"}, Certificate: tls.Certificate{Leaf: &x509.Certificate{DNSNames: []string{"*.example.com"}}}}
-	if cert, err := GetCertificate(helloSub); err != nil {
-		t.Errorf("Didn't get wildcard cert, got: cert=%v, err=%v ", cert, err)
-	} else if cert.Leaf.DNSNames[0] != "*.example.com" {
-		t.Errorf("Got wrong certificate, expected wildcard: %v", cert)
-	}
-
-	// When no certificate matches, the default is returned
-	if cert, err := GetCertificate(helloNoMatch); err != nil {
-		t.Errorf("Expected default certificate with no error when no matches, got err: %v", err)
-	} else if cert.Leaf.DNSNames[0] != "example.com" {
-		t.Errorf("Expected default cert with no matches, got: %v", cert)
-	}
-}

caddy/https/https.go

@@ -1,411 +0,0 @@
-// Package https facilitates the management of TLS assets and integrates
-// Let's Encrypt functionality into Caddy with first-class support for
-// creating and renewing certificates automatically. It is designed to
-// configure sites for HTTPS by default.
-package https
-
-import (
-	"encoding/json"
-	"errors"
-	"io/ioutil"
-	"net"
-	"net/http"
-	"os"
-	"strings"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/redirect"
-	"github.com/mholt/caddy/server"
-	"github.com/xenolf/lego/acme"
-)
-
-// Activate sets up TLS for each server config in configs
-// as needed; this consists of acquiring and maintaining
-// certificates and keys for qualifying configs and enabling
-// OCSP stapling for all TLS-enabled configs.
-//
-// This function may prompt the user to provide an email
-// address if none is available through other means. It
-// prefers the email address specified in the config, but
-// if that is not available it will check the command line
-// argument. If absent, it will use the most recent email
-// address from last time. If there isn't one, the user
-// will be prompted and shown SA link.
-//
-// Also note that calling this function activates asset
-// management automatically, which keeps certificates
-// renewed and OCSP stapling updated.
-//
-// Activate returns the updated list of configs, since
-// some may have been appended, for example, to redirect
-// plaintext HTTP requests to their HTTPS counterpart.
-// This function only appends; it does not splice.
-func Activate(configs []server.Config) ([]server.Config, error) {
-	// just in case previous caller forgot...
-	Deactivate()
-
-	// pre-screen each config and earmark the ones that qualify for managed TLS
-	MarkQualified(configs)
-
-	// place certificates and keys on disk
-	err := ObtainCerts(configs, true, false)
-	if err != nil {
-		return configs, err
-	}
-
-	// update TLS configurations
-	err = EnableTLS(configs, true)
-	if err != nil {
-		return configs, err
-	}
-
-	// set up redirects
-	configs = MakePlaintextRedirects(configs)
-
-	// renew all relevant certificates that need renewal. this is important
-	// to do right away for a couple reasons, mainly because each restart,
-	// the renewal ticker is reset, so if restarts happen more often than
-	// the ticker interval, renewals would never happen. but doing
-	// it right away at start guarantees that renewals aren't missed.
-	err = renewManagedCertificates(true)
-	if err != nil {
-		return configs, err
-	}
-
-	// keep certificates renewed and OCSP stapling updated
-	go maintainAssets(stopChan)
-
-	return configs, nil
-}
-
-// Deactivate cleans up long-term, in-memory resources
-// allocated by calling Activate(). Essentially, it stops
-// the asset maintainer from running, meaning that certificates
-// will not be renewed, OCSP staples will not be updated, etc.
-func Deactivate() (err error) {
-	defer func() {
-		if rec := recover(); rec != nil {
-			err = errors.New("already deactivated")
-		}
-	}()
-	close(stopChan)
-	stopChan = make(chan struct{})
-	return
-}
-
-// MarkQualified scans each config and, if it qualifies for managed
-// TLS, it sets the Managed field of the TLSConfig to true.
-func MarkQualified(configs []server.Config) {
-	for i := 0; i < len(configs); i++ {
-		if ConfigQualifies(configs[i]) {
-			configs[i].TLS.Managed = true
-		}
-	}
-}
-
-// ObtainCerts obtains certificates for all these configs as long as a
-// certificate does not already exist on disk. It does not modify the
-// configs at all; it only obtains and stores certificates and keys to
-// the disk. If allowPrompts is true, the user may be shown a prompt.
-// If proxyACME is true, the ACME challenges will be proxied to our alt port.
-func ObtainCerts(configs []server.Config, allowPrompts, proxyACME bool) error {
-	// We group configs by email so we don't make the same clients over and
-	// over. This has the potential to prompt the user for an email, but we
-	// prevent that by assuming that if we already have a listener that can
-	// proxy ACME challenge requests, then the server is already running and
-	// the operator is no longer present.
-	groupedConfigs := groupConfigsByEmail(configs, allowPrompts)
-
-	for email, group := range groupedConfigs {
-		// Wait as long as we can before creating the client, because it
-		// may not be needed, for example, if we already have what we
-		// need on disk. Creating a client involves the network and
-		// potentially prompting the user, etc., so only do if necessary.
-		var client *ACMEClient
-
-		for _, cfg := range group {
-			if !HostQualifies(cfg.Host) || existingCertAndKey(cfg.Host) {
-				continue
-			}
-
-			// Now we definitely do need a client
-			if client == nil {
-				var err error
-				client, err = NewACMEClient(email, allowPrompts)
-				if err != nil {
-					return errors.New("error creating client: " + err.Error())
-				}
-			}
-
-			// c.Configure assumes that allowPrompts == !proxyACME,
-			// but that's not always true. For example, a restart where
-			// the user isn't present and we're not listening on port 80.
-			// TODO: This could probably be refactored better.
-			if proxyACME {
-				client.SetHTTPAddress(net.JoinHostPort(cfg.BindHost, AlternatePort))
-				client.SetTLSAddress(net.JoinHostPort(cfg.BindHost, AlternatePort))
-				client.ExcludeChallenges([]acme.Challenge{acme.TLSSNI01, acme.DNS01})
-			} else {
-				client.SetHTTPAddress(net.JoinHostPort(cfg.BindHost, ""))
-				client.SetTLSAddress(net.JoinHostPort(cfg.BindHost, ""))
-				client.ExcludeChallenges([]acme.Challenge{acme.DNS01})
-			}
-
-			err := client.Obtain([]string{cfg.Host})
-			if err != nil {
-				return err
-			}
-		}
-	}
-
-	return nil
-}
-
-// groupConfigsByEmail groups configs by the email address to be used by an
-// ACME client. It only groups configs that have TLS enabled and that are
-// marked as Managed. If userPresent is true, the operator MAY be prompted
-// for an email address.
-func groupConfigsByEmail(configs []server.Config, userPresent bool) map[string][]server.Config {
-	initMap := make(map[string][]server.Config)
-	for _, cfg := range configs {
-		if !cfg.TLS.Managed {
-			continue
-		}
-		leEmail := getEmail(cfg, userPresent)
-		initMap[leEmail] = append(initMap[leEmail], cfg)
-	}
-	return initMap
-}
-
-// EnableTLS configures each config to use TLS according to default settings.
-// It will only change configs that are marked as managed, and assumes that
-// certificates and keys are already on disk. If loadCertificates is true,
-// the certificates will be loaded from disk into the cache for this process
-// to use. If false, TLS will still be enabled and configured with default
-// settings, but no certificates will be parsed loaded into the cache, and
-// the returned error value will always be nil.
-func EnableTLS(configs []server.Config, loadCertificates bool) error {
-	for i := 0; i < len(configs); i++ {
-		if !configs[i].TLS.Managed {
-			continue
-		}
-		configs[i].TLS.Enabled = true
-		if loadCertificates && HostQualifies(configs[i].Host) {
-			_, err := cacheManagedCertificate(configs[i].Host, false)
-			if err != nil {
-				return err
-			}
-		}
-		setDefaultTLSParams(&configs[i])
-	}
-	return nil
-}
-
-// hostHasOtherPort returns true if there is another config in the list with the same
-// hostname that has port otherPort, or false otherwise. All the configs are checked
-// against the hostname of allConfigs[thisConfigIdx].
-func hostHasOtherPort(allConfigs []server.Config, thisConfigIdx int, otherPort string) bool {
-	for i, otherCfg := range allConfigs {
-		if i == thisConfigIdx {
-			continue // has to be a config OTHER than the one we're comparing against
-		}
-		if otherCfg.Host == allConfigs[thisConfigIdx].Host && otherCfg.Port == otherPort {
-			return true
-		}
-	}
-	return false
-}
-
-// MakePlaintextRedirects sets up redirects from port 80 to the relevant HTTPS
-// hosts. You must pass in all configs, not just configs that qualify, since
-// we must know whether the same host already exists on port 80, and those would
-// not be in a list of configs that qualify for automatic HTTPS. This function will
-// only set up redirects for configs that qualify. It returns the updated list of
-// all configs.
-func MakePlaintextRedirects(allConfigs []server.Config) []server.Config {
-	for i, cfg := range allConfigs {
-		if cfg.TLS.Managed &&
-			!hostHasOtherPort(allConfigs, i, "80") &&
-			(cfg.Port == "443" || !hostHasOtherPort(allConfigs, i, "443")) {
-			allConfigs = append(allConfigs, redirPlaintextHost(cfg))
-		}
-	}
-	return allConfigs
-}
-
-// ConfigQualifies returns true if cfg qualifies for
-// fully managed TLS (but not on-demand TLS, which is
-// not considered here). It does NOT check to see if a
-// cert and key already exist for the config. If the
-// config does qualify, you should set cfg.TLS.Managed
-// to true and check that instead, because the process of
-// setting up the config may make it look like it
-// doesn't qualify even though it originally did.
-func ConfigQualifies(cfg server.Config) bool {
-	return (!cfg.TLS.Manual || cfg.TLS.OnDemand) && // user might provide own cert and key
-
-		// user can force-disable automatic HTTPS for this host
-		cfg.Scheme != "http" &&
-		cfg.Port != "80" &&
-		cfg.TLS.LetsEncryptEmail != "off" &&
-
-		// we get can't certs for some kinds of hostnames, but
-		// on-demand TLS allows empty hostnames at startup
-		(HostQualifies(cfg.Host) || cfg.TLS.OnDemand)
-}
-
-// HostQualifies returns true if the hostname alone
-// appears eligible for automatic HTTPS. For example,
-// localhost, empty hostname, and IP addresses are
-// not eligible because we cannot obtain certificates
-// for those names.
-func HostQualifies(hostname string) bool {
-	return hostname != "localhost" && // localhost is ineligible
-
-		// hostname must not be empty
-		strings.TrimSpace(hostname) != "" &&
-
-		// cannot be an IP address, see
-		// https://community.letsencrypt.org/t/certificate-for-static-ip/84/2?u=mholt
-		// (also trim [] from either end, since that special case can sneak through
-		// for IPv6 addresses using the -host flag and with empty/no Caddyfile)
-		net.ParseIP(strings.Trim(hostname, "[]")) == nil
-}
-
-// existingCertAndKey returns true if the host has a certificate
-// and private key in storage already, false otherwise.
-func existingCertAndKey(host string) bool {
-	_, err := os.Stat(storage.SiteCertFile(host))
-	if err != nil {
-		return false
-	}
-	_, err = os.Stat(storage.SiteKeyFile(host))
-	if err != nil {
-		return false
-	}
-	return true
-}
-
-// saveCertResource saves the certificate resource to disk. This
-// includes the certificate file itself, the private key, and the
-// metadata file.
-func saveCertResource(cert acme.CertificateResource) error {
-	err := os.MkdirAll(storage.Site(cert.Domain), 0700)
-	if err != nil {
-		return err
-	}
-
-	// Save cert
-	err = ioutil.WriteFile(storage.SiteCertFile(cert.Domain), cert.Certificate, 0600)
-	if err != nil {
-		return err
-	}
-
-	// Save private key
-	err = ioutil.WriteFile(storage.SiteKeyFile(cert.Domain), cert.PrivateKey, 0600)
-	if err != nil {
-		return err
-	}
-
-	// Save cert metadata
-	jsonBytes, err := json.MarshalIndent(&cert, "", "\t")
-	if err != nil {
-		return err
-	}
-	err = ioutil.WriteFile(storage.SiteMetaFile(cert.Domain), jsonBytes, 0600)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-// redirPlaintextHost returns a new plaintext HTTP configuration for
-// a virtualHost that simply redirects to cfg, which is assumed to
-// be the HTTPS configuration. The returned configuration is set
-// to listen on port 80.
-func redirPlaintextHost(cfg server.Config) server.Config {
-	toURL := "https://{host}" // serve any host, since cfg.Host could be empty
-	if cfg.Port != "443" && cfg.Port != "80" {
-		toURL += ":" + cfg.Port
-	}
-
-	redirMidware := func(next middleware.Handler) middleware.Handler {
-		return redirect.Redirect{Next: next, Rules: []redirect.Rule{
-			{
-				FromScheme: "http",
-				FromPath:   "/",
-				To:         toURL + "{uri}",
-				Code:       http.StatusMovedPermanently,
-			},
-		}}
-	}
-
-	return server.Config{
-		Host:       cfg.Host,
-		BindHost:   cfg.BindHost,
-		Port:       "80",
-		Middleware: []middleware.Middleware{redirMidware},
-	}
-}
-
-// Revoke revokes the certificate for host via ACME protocol.
-func Revoke(host string) error {
-	if !existingCertAndKey(host) {
-		return errors.New("no certificate and key for " + host)
-	}
-
-	email := getEmail(server.Config{Host: host}, true)
-	if email == "" {
-		return errors.New("email is required to revoke")
-	}
-
-	client, err := NewACMEClient(email, true)
-	if err != nil {
-		return err
-	}
-
-	certFile := storage.SiteCertFile(host)
-	certBytes, err := ioutil.ReadFile(certFile)
-	if err != nil {
-		return err
-	}
-
-	err = client.RevokeCertificate(certBytes)
-	if err != nil {
-		return err
-	}
-
-	err = os.Remove(certFile)
-	if err != nil {
-		return errors.New("certificate revoked, but unable to delete certificate file: " + err.Error())
-	}
-
-	return nil
-}
-
-var (
-	// DefaultEmail represents the Let's Encrypt account email to use if none provided
-	DefaultEmail string
-
-	// Agreed indicates whether user has agreed to the Let's Encrypt SA
-	Agreed bool
-
-	// CAUrl represents the base URL to the CA's ACME endpoint
-	CAUrl string
-)
-
-// AlternatePort is the port on which the acme client will open a
-// listener and solve the CA's challenges. If this alternate port
-// is used instead of the default port (80 or 443), then the
-// default port for the challenge must be forwarded to this one.
-const AlternatePort = "5033"
-
-// KeyType is the type to use for new keys.
-// This shouldn't need to change except for in tests;
-// the size can be drastically reduced for speed.
-var KeyType = acme.RSA2048
-
-// stopChan is used to signal the maintenance goroutine
-// to terminate.
-var stopChan chan struct{}

caddy/https/https_test.go

@@ -1,332 +0,0 @@
-package https
-
-import (
-	"io/ioutil"
-	"net/http"
-	"os"
-	"testing"
-
-	"github.com/mholt/caddy/middleware/redirect"
-	"github.com/mholt/caddy/server"
-	"github.com/xenolf/lego/acme"
-)
-
-func TestHostQualifies(t *testing.T) {
-	for i, test := range []struct {
-		host   string
-		expect bool
-	}{
-		{"localhost", false},
-		{"127.0.0.1", false},
-		{"127.0.1.5", false},
-		{"::1", false},
-		{"[::1]", false},
-		{"[::]", false},
-		{"::", false},
-		{"", false},
-		{" ", false},
-		{"0.0.0.0", false},
-		{"192.168.1.3", false},
-		{"10.0.2.1", false},
-		{"169.112.53.4", false},
-		{"foobar.com", true},
-		{"sub.foobar.com", true},
-	} {
-		if HostQualifies(test.host) && !test.expect {
-			t.Errorf("Test %d: Expected '%s' to NOT qualify, but it did", i, test.host)
-		}
-		if !HostQualifies(test.host) && test.expect {
-			t.Errorf("Test %d: Expected '%s' to qualify, but it did NOT", i, test.host)
-		}
-	}
-}
-
-func TestConfigQualifies(t *testing.T) {
-	for i, test := range []struct {
-		cfg    server.Config
-		expect bool
-	}{
-		{server.Config{Host: ""}, false},
-		{server.Config{Host: "localhost"}, false},
-		{server.Config{Host: "123.44.3.21"}, false},
-		{server.Config{Host: "example.com"}, true},
-		{server.Config{Host: "example.com", TLS: server.TLSConfig{Manual: true}}, false},
-		{server.Config{Host: "example.com", TLS: server.TLSConfig{LetsEncryptEmail: "off"}}, false},
-		{server.Config{Host: "example.com", TLS: server.TLSConfig{LetsEncryptEmail: "foo@bar.com"}}, true},
-		{server.Config{Host: "example.com", Scheme: "http"}, false},
-		{server.Config{Host: "example.com", Port: "80"}, false},
-		{server.Config{Host: "example.com", Port: "1234"}, true},
-		{server.Config{Host: "example.com", Scheme: "https"}, true},
-		{server.Config{Host: "example.com", Port: "80", Scheme: "https"}, false},
-	} {
-		if test.expect && !ConfigQualifies(test.cfg) {
-			t.Errorf("Test %d: Expected config to qualify, but it did NOT: %#v", i, test.cfg)
-		}
-		if !test.expect && ConfigQualifies(test.cfg) {
-			t.Errorf("Test %d: Expected config to NOT qualify, but it did: %#v", i, test.cfg)
-		}
-	}
-}
-
-func TestRedirPlaintextHost(t *testing.T) {
-	cfg := redirPlaintextHost(server.Config{
-		Host:     "example.com",
-		BindHost: "93.184.216.34",
-		Port:     "1234",
-	})
-
-	// Check host and port
-	if actual, expected := cfg.Host, "example.com"; actual != expected {
-		t.Errorf("Expected redir config to have host %s but got %s", expected, actual)
-	}
-	if actual, expected := cfg.BindHost, "93.184.216.34"; actual != expected {
-		t.Errorf("Expected redir config to have bindhost %s but got %s", expected, actual)
-	}
-	if actual, expected := cfg.Port, "80"; actual != expected {
-		t.Errorf("Expected redir config to have port '%s' but got '%s'", expected, actual)
-	}
-
-	// Make sure redirect handler is set up properly
-	if cfg.Middleware == nil || len(cfg.Middleware) != 1 {
-		t.Fatalf("Redir config middleware not set up properly; got: %#v", cfg.Middleware)
-	}
-
-	handler, ok := cfg.Middleware[0](nil).(redirect.Redirect)
-	if !ok {
-		t.Fatalf("Expected a redirect.Redirect middleware, but got: %#v", handler)
-	}
-	if len(handler.Rules) != 1 {
-		t.Fatalf("Expected one redirect rule, got: %#v", handler.Rules)
-	}
-
-	// Check redirect rule for correctness
-	if actual, expected := handler.Rules[0].FromScheme, "http"; actual != expected {
-		t.Errorf("Expected redirect rule to be from scheme '%s' but is actually from '%s'", expected, actual)
-	}
-	if actual, expected := handler.Rules[0].FromPath, "/"; actual != expected {
-		t.Errorf("Expected redirect rule to be for path '%s' but is actually for '%s'", expected, actual)
-	}
-	if actual, expected := handler.Rules[0].To, "https://{host}:1234{uri}"; actual != expected {
-		t.Errorf("Expected redirect rule to be to URL '%s' but is actually to '%s'", expected, actual)
-	}
-	if actual, expected := handler.Rules[0].Code, http.StatusMovedPermanently; actual != expected {
-		t.Errorf("Expected redirect rule to have code %d but was %d", expected, actual)
-	}
-
-	// browsers can infer a default port from scheme, so make sure the port
-	// doesn't get added in explicitly for default ports like 443 for https.
-	cfg = redirPlaintextHost(server.Config{Host: "example.com", Port: "443"})
-	handler, _ = cfg.Middleware[0](nil).(redirect.Redirect)
-	if actual, expected := handler.Rules[0].To, "https://{host}{uri}"; actual != expected {
-		t.Errorf("(Default Port) Expected redirect rule to be to URL '%s' but is actually to '%s'", expected, actual)
-	}
-}
-
-func TestSaveCertResource(t *testing.T) {
-	storage = Storage("./le_test_save")
-	defer func() {
-		err := os.RemoveAll(string(storage))
-		if err != nil {
-			t.Fatalf("Could not remove temporary storage directory (%s): %v", storage, err)
-		}
-	}()
-
-	domain := "example.com"
-	certContents := "certificate"
-	keyContents := "private key"
-	metaContents := `{
-	"domain": "example.com",
-	"certUrl": "https://example.com/cert",
-	"certStableUrl": "https://example.com/cert/stable"
-}`
-
-	cert := acme.CertificateResource{
-		Domain:        domain,
-		CertURL:       "https://example.com/cert",
-		CertStableURL: "https://example.com/cert/stable",
-		PrivateKey:    []byte(keyContents),
-		Certificate:   []byte(certContents),
-	}
-
-	err := saveCertResource(cert)
-	if err != nil {
-		t.Fatalf("Expected no error, got: %v", err)
-	}
-
-	certFile, err := ioutil.ReadFile(storage.SiteCertFile(domain))
-	if err != nil {
-		t.Errorf("Expected no error reading certificate file, got: %v", err)
-	}
-	if string(certFile) != certContents {
-		t.Errorf("Expected certificate file to contain '%s', got '%s'", certContents, string(certFile))
-	}
-
-	keyFile, err := ioutil.ReadFile(storage.SiteKeyFile(domain))
-	if err != nil {
-		t.Errorf("Expected no error reading private key file, got: %v", err)
-	}
-	if string(keyFile) != keyContents {
-		t.Errorf("Expected private key file to contain '%s', got '%s'", keyContents, string(keyFile))
-	}
-
-	metaFile, err := ioutil.ReadFile(storage.SiteMetaFile(domain))
-	if err != nil {
-		t.Errorf("Expected no error reading meta file, got: %v", err)
-	}
-	if string(metaFile) != metaContents {
-		t.Errorf("Expected meta file to contain '%s', got '%s'", metaContents, string(metaFile))
-	}
-}
-
-func TestExistingCertAndKey(t *testing.T) {
-	storage = Storage("./le_test_existing")
-	defer func() {
-		err := os.RemoveAll(string(storage))
-		if err != nil {
-			t.Fatalf("Could not remove temporary storage directory (%s): %v", storage, err)
-		}
-	}()
-
-	domain := "example.com"
-
-	if existingCertAndKey(domain) {
-		t.Errorf("Did NOT expect %v to have existing cert or key, but it did", domain)
-	}
-
-	err := saveCertResource(acme.CertificateResource{
-		Domain:      domain,
-		PrivateKey:  []byte("key"),
-		Certificate: []byte("cert"),
-	})
-	if err != nil {
-		t.Fatalf("Expected no error, got: %v", err)
-	}
-
-	if !existingCertAndKey(domain) {
-		t.Errorf("Expected %v to have existing cert and key, but it did NOT", domain)
-	}
-}
-
-func TestHostHasOtherPort(t *testing.T) {
-	configs := []server.Config{
-		{Host: "example.com", Port: "80"},
-		{Host: "sub1.example.com", Port: "80"},
-		{Host: "sub1.example.com", Port: "443"},
-	}
-
-	if hostHasOtherPort(configs, 0, "80") {
-		t.Errorf(`Expected hostHasOtherPort(configs, 0, "80") to be false, but got true`)
-	}
-	if hostHasOtherPort(configs, 0, "443") {
-		t.Errorf(`Expected hostHasOtherPort(configs, 0, "443") to be false, but got true`)
-	}
-	if !hostHasOtherPort(configs, 1, "443") {
-		t.Errorf(`Expected hostHasOtherPort(configs, 1, "443") to be true, but got false`)
-	}
-}
-
-func TestMakePlaintextRedirects(t *testing.T) {
-	configs := []server.Config{
-		// Happy path = standard redirect from 80 to 443
-		{Host: "example.com", TLS: server.TLSConfig{Managed: true}},
-
-		// Host on port 80 already defined; don't change it (no redirect)
-		{Host: "sub1.example.com", Port: "80", Scheme: "http"},
-		{Host: "sub1.example.com", TLS: server.TLSConfig{Managed: true}},
-
-		// Redirect from port 80 to port 5000 in this case
-		{Host: "sub2.example.com", Port: "5000", TLS: server.TLSConfig{Managed: true}},
-
-		// Can redirect from 80 to either 443 or 5001, but choose 443
-		{Host: "sub3.example.com", Port: "443", TLS: server.TLSConfig{Managed: true}},
-		{Host: "sub3.example.com", Port: "5001", Scheme: "https", TLS: server.TLSConfig{Managed: true}},
-	}
-
-	result := MakePlaintextRedirects(configs)
-	expectedRedirCount := 3
-
-	if len(result) != len(configs)+expectedRedirCount {
-		t.Errorf("Expected %d redirect(s) to be added, but got %d",
-			expectedRedirCount, len(result)-len(configs))
-	}
-}
-
-func TestEnableTLS(t *testing.T) {
-	configs := []server.Config{
-		{Host: "example.com", TLS: server.TLSConfig{Managed: true}},
-		{}, // not managed - no changes!
-	}
-
-	EnableTLS(configs, false)
-
-	if !configs[0].TLS.Enabled {
-		t.Errorf("Expected config 0 to have TLS.Enabled == true, but it was false")
-	}
-	if configs[1].TLS.Enabled {
-		t.Errorf("Expected config 1 to have TLS.Enabled == false, but it was true")
-	}
-}
-
-func TestGroupConfigsByEmail(t *testing.T) {
-	if groupConfigsByEmail([]server.Config{}, false) == nil {
-		t.Errorf("With empty input, returned map was nil, but expected non-nil map")
-	}
-
-	configs := []server.Config{
-		{Host: "example.com", TLS: server.TLSConfig{LetsEncryptEmail: "", Managed: true}},
-		{Host: "sub1.example.com", TLS: server.TLSConfig{LetsEncryptEmail: "foo@bar", Managed: true}},
-		{Host: "sub2.example.com", TLS: server.TLSConfig{LetsEncryptEmail: "", Managed: true}},
-		{Host: "sub3.example.com", TLS: server.TLSConfig{LetsEncryptEmail: "foo@bar", Managed: true}},
-		{Host: "sub4.example.com", TLS: server.TLSConfig{LetsEncryptEmail: "", Managed: true}},
-		{Host: "sub5.example.com", TLS: server.TLSConfig{LetsEncryptEmail: ""}}, // not managed
-	}
-	DefaultEmail = "test@example.com"
-
-	groups := groupConfigsByEmail(configs, true)
-
-	if groups == nil {
-		t.Fatalf("Returned map was nil, but expected values")
-	}
-
-	if len(groups) != 2 {
-		t.Errorf("Expected 2 groups, got %d: %#v", len(groups), groups)
-	}
-	if len(groups["foo@bar"]) != 2 {
-		t.Errorf("Expected 2 configs for foo@bar, got %d: %#v", len(groups["foobar"]), groups["foobar"])
-	}
-	if len(groups[DefaultEmail]) != 3 {
-		t.Errorf("Expected 3 configs for %s, got %d: %#v", DefaultEmail, len(groups["foobar"]), groups["foobar"])
-	}
-}
-
-func TestMarkQualified(t *testing.T) {
-	// TODO: TestConfigQualifies and this test share the same config list...
-	configs := []server.Config{
-		{Host: ""},
-		{Host: "localhost"},
-		{Host: "123.44.3.21"},
-		{Host: "example.com"},
-		{Host: "example.com", TLS: server.TLSConfig{Manual: true}},
-		{Host: "example.com", TLS: server.TLSConfig{LetsEncryptEmail: "off"}},
-		{Host: "example.com", TLS: server.TLSConfig{LetsEncryptEmail: "foo@bar.com"}},
-		{Host: "example.com", Scheme: "http"},
-		{Host: "example.com", Port: "80"},
-		{Host: "example.com", Port: "1234"},
-		{Host: "example.com", Scheme: "https"},
-		{Host: "example.com", Port: "80", Scheme: "https"},
-	}
-	expectedManagedCount := 4
-
-	MarkQualified(configs)
-
-	count := 0
-	for _, cfg := range configs {
-		if cfg.TLS.Managed {
-			count++
-		}
-	}
-
-	if count != expectedManagedCount {
-		t.Errorf("Expected %d managed configs, but got %d", expectedManagedCount, count)
-	}
-}

caddy/https/maintain.go

@@ -1,220 +0,0 @@
-package https
-
-import (
-	"log"
-	"time"
-
-	"github.com/mholt/caddy/server"
-
-	"golang.org/x/crypto/ocsp"
-)
-
-const (
-	// RenewInterval is how often to check certificates for renewal.
-	RenewInterval = 12 * time.Hour
-
-	// OCSPInterval is how often to check if OCSP stapling needs updating.
-	OCSPInterval = 1 * time.Hour
-)
-
-// maintainAssets is a permanently-blocking function
-// that loops indefinitely and, on a regular schedule, checks
-// certificates for expiration and initiates a renewal of certs
-// that are expiring soon. It also updates OCSP stapling and
-// performs other maintenance of assets.
-//
-// You must pass in the channel which you'll close when
-// maintenance should stop, to allow this goroutine to clean up
-// after itself and unblock.
-func maintainAssets(stopChan chan struct{}) {
-	renewalTicker := time.NewTicker(RenewInterval)
-	ocspTicker := time.NewTicker(OCSPInterval)
-
-	for {
-		select {
-		case <-renewalTicker.C:
-			log.Println("[INFO] Scanning for expiring certificates")
-			renewManagedCertificates(false)
-			log.Println("[INFO] Done checking certificates")
-		case <-ocspTicker.C:
-			log.Println("[INFO] Scanning for stale OCSP staples")
-			updateOCSPStaples()
-			log.Println("[INFO] Done checking OCSP staples")
-		case <-stopChan:
-			renewalTicker.Stop()
-			ocspTicker.Stop()
-			log.Println("[INFO] Stopped background maintenance routine")
-			return
-		}
-	}
-}
-
-func renewManagedCertificates(allowPrompts bool) (err error) {
-	var renewed, deleted []Certificate
-	var client *ACMEClient
-	visitedNames := make(map[string]struct{})
-
-	certCacheMu.RLock()
-	for name, cert := range certCache {
-		if !cert.Managed {
-			continue
-		}
-
-		// the list of names on this cert should never be empty...
-		if cert.Names == nil || len(cert.Names) == 0 {
-			log.Printf("[WARNING] Certificate keyed by '%s' has no names: %v", name, cert.Names)
-			deleted = append(deleted, cert)
-			continue
-		}
-
-		// skip names whose certificate we've already renewed
-		if _, ok := visitedNames[name]; ok {
-			continue
-		}
-		for _, name := range cert.Names {
-			visitedNames[name] = struct{}{}
-		}
-
-		timeLeft := cert.NotAfter.Sub(time.Now().UTC())
-		if timeLeft < renewDurationBefore {
-			log.Printf("[INFO] Certificate for %v expires in %v; attempting renewal", cert.Names, timeLeft)
-
-			if client == nil {
-				client, err = NewACMEClientGetEmail(server.Config{}, allowPrompts)
-				if err != nil {
-					return err
-				}
-				client.Configure("") // TODO: Bind address of relevant listener, yuck
-			}
-
-			err := client.Renew(cert.Names[0]) // managed certs better have only one name
-			if err != nil {
-				if client.AllowPrompts && timeLeft < 0 {
-					// Certificate renewal failed, the operator is present, and the certificate
-					// is already expired; we should stop immediately and return the error. Note
-					// that we used to do this any time a renewal failed at startup. However,
-					// after discussion in https://github.com/mholt/caddy/issues/642 we decided to
-					// only stop startup if the certificate is expired. We still log the error
-					// otherwise.
-					certCacheMu.RUnlock()
-					return err
-				}
-				log.Printf("[ERROR] %v", err)
-				if cert.OnDemand {
-					deleted = append(deleted, cert)
-				}
-			} else {
-				renewed = append(renewed, cert)
-			}
-		}
-	}
-	certCacheMu.RUnlock()
-
-	// Apply changes to the cache
-	for _, cert := range renewed {
-		if cert.Names[len(cert.Names)-1] == "" {
-			// Special case: This is the default certificate, so we must
-			// ensure it gets updated as well, otherwise the renewal
-			// routine will find it and think it still needs to be renewed,
-			// even though we already renewed it...
-			certCacheMu.Lock()
-			delete(certCache, "")
-			certCacheMu.Unlock()
-		}
-		_, err := cacheManagedCertificate(cert.Names[0], cert.OnDemand)
-		if err != nil {
-			if client.AllowPrompts {
-				return err // operator is present, so report error immediately
-			}
-			log.Printf("[ERROR] Caching renewed certificate: %v", err)
-		}
-	}
-	for _, cert := range deleted {
-		certCacheMu.Lock()
-		for _, name := range cert.Names {
-			delete(certCache, name)
-		}
-		certCacheMu.Unlock()
-	}
-
-	return nil
-}
-
-func updateOCSPStaples() {
-	// Create a temporary place to store updates
-	// until we release the potentially long-lived
-	// read lock and use a short-lived write lock.
-	type ocspUpdate struct {
-		rawBytes []byte
-		parsed   *ocsp.Response
-	}
-	updated := make(map[string]ocspUpdate)
-
-	// A single SAN certificate maps to multiple names, so we use this
-	// set to make sure we don't waste cycles checking OCSP for the same
-	// certificate multiple times.
-	visited := make(map[string]struct{})
-
-	certCacheMu.RLock()
-	for name, cert := range certCache {
-		// skip this certificate if we've already visited it,
-		// and if not, mark all the names as visited
-		if _, ok := visited[name]; ok {
-			continue
-		}
-		for _, n := range cert.Names {
-			visited[n] = struct{}{}
-		}
-
-		// no point in updating OCSP for expired certificates
-		if time.Now().After(cert.NotAfter) {
-			continue
-		}
-
-		var lastNextUpdate time.Time
-		if cert.OCSP != nil {
-			// start checking OCSP staple about halfway through validity period for good measure
-			lastNextUpdate = cert.OCSP.NextUpdate
-			refreshTime := cert.OCSP.ThisUpdate.Add(lastNextUpdate.Sub(cert.OCSP.ThisUpdate) / 2)
-
-			// since OCSP is already stapled, we need only check if we're in that "refresh window"
-			if time.Now().Before(refreshTime) {
-				continue
-			}
-		}
-
-		err := stapleOCSP(&cert, nil)
-		if err != nil {
-			if cert.OCSP != nil {
-				// if it was no staple before, that's fine, otherwise we should log the error
-				log.Printf("[ERROR] Checking OCSP for %v: %v", cert.Names, err)
-			}
-			continue
-		}
-
-		// By this point, we've obtained the latest OCSP response.
-		// If there was no staple before, or if the response is updated, make
-		// sure we apply the update to all names on the certificate.
-		if lastNextUpdate.IsZero() || lastNextUpdate != cert.OCSP.NextUpdate {
-			log.Printf("[INFO] Advancing OCSP staple for %v from %s to %s",
-				cert.Names, lastNextUpdate, cert.OCSP.NextUpdate)
-			for _, n := range cert.Names {
-				updated[n] = ocspUpdate{rawBytes: cert.Certificate.OCSPStaple, parsed: cert.OCSP}
-			}
-		}
-	}
-	certCacheMu.RUnlock()
-
-	// This write lock should be brief since we have all the info we need now.
-	certCacheMu.Lock()
-	for name, update := range updated {
-		cert := certCache[name]
-		cert.OCSP = update.parsed
-		cert.Certificate.OCSPStaple = update.rawBytes
-		certCache[name] = cert
-	}
-	certCacheMu.Unlock()
-}
-
-// renewDurationBefore is how long before expiration to renew certificates.
-const renewDurationBefore = (24 * time.Hour) * 30

caddy/https/setup.go

@@ -1,355 +0,0 @@
-package https
-
-import (
-	"bytes"
-	"crypto/tls"
-	"encoding/pem"
-	"io/ioutil"
-	"log"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-
-	"github.com/mholt/caddy/caddy/setup"
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/server"
-	"github.com/xenolf/lego/acme"
-)
-
-// Setup sets up the TLS configuration and installs certificates that
-// are specified by the user in the config file. All the automatic HTTPS
-// stuff comes later outside of this function.
-func Setup(c *setup.Controller) (middleware.Middleware, error) {
-	if c.Port == "80" || c.Scheme == "http" {
-		c.TLS.Enabled = false
-		log.Printf("[WARNING] TLS disabled for %s://%s.", c.Scheme, c.Address())
-		return nil, nil
-	}
-	c.TLS.Enabled = true
-
-	for c.Next() {
-		var certificateFile, keyFile, loadDir, maxCerts string
-
-		args := c.RemainingArgs()
-		switch len(args) {
-		case 1:
-			c.TLS.LetsEncryptEmail = args[0]
-
-			// user can force-disable managed TLS this way
-			if c.TLS.LetsEncryptEmail == "off" {
-				c.TLS.Enabled = false
-				return nil, nil
-			}
-		case 2:
-			certificateFile = args[0]
-			keyFile = args[1]
-			c.TLS.Manual = true
-		}
-
-		// Optional block with extra parameters
-		var hadBlock bool
-		for c.NextBlock() {
-			hadBlock = true
-			switch c.Val() {
-			case "key_type":
-				arg := c.RemainingArgs()
-				value, ok := supportedKeyTypes[strings.ToUpper(arg[0])]
-				if !ok {
-					return nil, c.Errf("Wrong KeyType name or KeyType not supported '%s'", c.Val())
-				}
-				KeyType = value
-			case "protocols":
-				args := c.RemainingArgs()
-				if len(args) != 2 {
-					return nil, c.ArgErr()
-				}
-				value, ok := supportedProtocols[strings.ToLower(args[0])]
-				if !ok {
-					return nil, c.Errf("Wrong protocol name or protocol not supported '%s'", c.Val())
-				}
-				c.TLS.ProtocolMinVersion = value
-				value, ok = supportedProtocols[strings.ToLower(args[1])]
-				if !ok {
-					return nil, c.Errf("Wrong protocol name or protocol not supported '%s'", c.Val())
-				}
-				c.TLS.ProtocolMaxVersion = value
-			case "ciphers":
-				for c.NextArg() {
-					value, ok := supportedCiphersMap[strings.ToUpper(c.Val())]
-					if !ok {
-						return nil, c.Errf("Wrong cipher name or cipher not supported '%s'", c.Val())
-					}
-					c.TLS.Ciphers = append(c.TLS.Ciphers, value)
-				}
-			case "clients":
-				clientCertList := c.RemainingArgs()
-				if len(clientCertList) == 0 {
-					return nil, c.ArgErr()
-				}
-
-				listStart, mustProvideCA := 1, true
-				switch clientCertList[0] {
-				case "request":
-					c.TLS.ClientAuth = tls.RequestClientCert
-					mustProvideCA = false
-				case "require":
-					c.TLS.ClientAuth = tls.RequireAnyClientCert
-					mustProvideCA = false
-				case "verify_if_given":
-					c.TLS.ClientAuth = tls.VerifyClientCertIfGiven
-				default:
-					c.TLS.ClientAuth = tls.RequireAndVerifyClientCert
-					listStart = 0
-				}
-				if mustProvideCA && len(clientCertList) <= listStart {
-					return nil, c.ArgErr()
-				}
-
-				c.TLS.ClientCerts = clientCertList[listStart:]
-			case "load":
-				c.Args(&loadDir)
-				c.TLS.Manual = true
-			case "max_certs":
-				c.Args(&maxCerts)
-				c.TLS.OnDemand = true
-			default:
-				return nil, c.Errf("Unknown keyword '%s'", c.Val())
-			}
-		}
-
-		// tls requires at least one argument if a block is not opened
-		if len(args) == 0 && !hadBlock {
-			return nil, c.ArgErr()
-		}
-
-		// set certificate limit if on-demand TLS is enabled
-		if maxCerts != "" {
-			maxCertsNum, err := strconv.Atoi(maxCerts)
-			if err != nil || maxCertsNum < 1 {
-				return nil, c.Err("max_certs must be a positive integer")
-			}
-			if onDemandMaxIssue == 0 || int32(maxCertsNum) < onDemandMaxIssue { // keep the minimum; TODO: We have to do this because it is global; should be per-server or per-vhost...
-				onDemandMaxIssue = int32(maxCertsNum)
-			}
-		}
-
-		// don't try to load certificates unless we're supposed to
-		if !c.TLS.Enabled || !c.TLS.Manual {
-			continue
-		}
-
-		// load a single certificate and key, if specified
-		if certificateFile != "" && keyFile != "" {
-			err := cacheUnmanagedCertificatePEMFile(certificateFile, keyFile)
-			if err != nil {
-				return nil, c.Errf("Unable to load certificate and key files for %s: %v", c.Host, err)
-			}
-			log.Printf("[INFO] Successfully loaded TLS assets from %s and %s", certificateFile, keyFile)
-		}
-
-		// load a directory of certificates, if specified
-		if loadDir != "" {
-			err := loadCertsInDir(c, loadDir)
-			if err != nil {
-				return nil, err
-			}
-		}
-	}
-
-	setDefaultTLSParams(c.Config)
-
-	return nil, nil
-}
-
-// loadCertsInDir loads all the certificates/keys in dir, as long as
-// the file ends with .pem. This method of loading certificates is
-// modeled after haproxy, which expects the certificate and key to
-// be bundled into the same file:
-// https://cbonte.github.io/haproxy-dconv/configuration-1.5.html#5.1-crt
-//
-// This function may write to the log as it walks the directory tree.
-func loadCertsInDir(c *setup.Controller, dir string) error {
-	return filepath.Walk(dir, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			log.Printf("[WARNING] Unable to traverse into %s; skipping", path)
-			return nil
-		}
-		if info.IsDir() {
-			return nil
-		}
-		if strings.HasSuffix(strings.ToLower(info.Name()), ".pem") {
-			certBuilder, keyBuilder := new(bytes.Buffer), new(bytes.Buffer)
-			var foundKey bool // use only the first key in the file
-
-			bundle, err := ioutil.ReadFile(path)
-			if err != nil {
-				return err
-			}
-
-			for {
-				// Decode next block so we can see what type it is
-				var derBlock *pem.Block
-				derBlock, bundle = pem.Decode(bundle)
-				if derBlock == nil {
-					break
-				}
-
-				if derBlock.Type == "CERTIFICATE" {
-					// Re-encode certificate as PEM, appending to certificate chain
-					pem.Encode(certBuilder, derBlock)
-				} else if derBlock.Type == "EC PARAMETERS" {
-					// EC keys generated from openssl can be composed of two blocks:
-					// parameters and key (parameter block should come first)
-					if !foundKey {
-						// Encode parameters
-						pem.Encode(keyBuilder, derBlock)
-
-						// Key must immediately follow
-						derBlock, bundle = pem.Decode(bundle)
-						if derBlock == nil || derBlock.Type != "EC PRIVATE KEY" {
-							return c.Errf("%s: expected elliptic private key to immediately follow EC parameters", path)
-						}
-						pem.Encode(keyBuilder, derBlock)
-						foundKey = true
-					}
-				} else if derBlock.Type == "PRIVATE KEY" || strings.HasSuffix(derBlock.Type, " PRIVATE KEY") {
-					// RSA key
-					if !foundKey {
-						pem.Encode(keyBuilder, derBlock)
-						foundKey = true
-					}
-				} else {
-					return c.Errf("%s: unrecognized PEM block type: %s", path, derBlock.Type)
-				}
-			}
-
-			certPEMBytes, keyPEMBytes := certBuilder.Bytes(), keyBuilder.Bytes()
-			if len(certPEMBytes) == 0 {
-				return c.Errf("%s: failed to parse PEM data", path)
-			}
-			if len(keyPEMBytes) == 0 {
-				return c.Errf("%s: no private key block found", path)
-			}
-
-			err = cacheUnmanagedCertificatePEMBytes(certPEMBytes, keyPEMBytes)
-			if err != nil {
-				return c.Errf("%s: failed to load cert and key for %s: %v", path, c.Host, err)
-			}
-			log.Printf("[INFO] Successfully loaded TLS assets from %s", path)
-		}
-		return nil
-	})
-}
-
-// setDefaultTLSParams sets the default TLS cipher suites, protocol versions,
-// and server preferences of a server.Config if they were not previously set
-// (it does not overwrite; only fills in missing values). It will also set the
-// port to 443 if not already set, TLS is enabled, TLS is manual, and the host
-// does not equal localhost.
-func setDefaultTLSParams(c *server.Config) {
-	// If no ciphers provided, use default list
-	if len(c.TLS.Ciphers) == 0 {
-		c.TLS.Ciphers = defaultCiphers
-	}
-
-	// Not a cipher suite, but still important for mitigating protocol downgrade attacks
-	// (prepend since having it at end breaks http2 due to non-h2-approved suites before it)
-	c.TLS.Ciphers = append([]uint16{tls.TLS_FALLBACK_SCSV}, c.TLS.Ciphers...)
-
-	// Set default protocol min and max versions - must balance compatibility and security
-	if c.TLS.ProtocolMinVersion == 0 {
-		c.TLS.ProtocolMinVersion = tls.VersionTLS10
-	}
-	if c.TLS.ProtocolMaxVersion == 0 {
-		c.TLS.ProtocolMaxVersion = tls.VersionTLS12
-	}
-
-	// Prefer server cipher suites
-	c.TLS.PreferServerCipherSuites = true
-
-	// Default TLS port is 443; only use if port is not manually specified,
-	// TLS is enabled, and the host is not localhost
-	if c.Port == "" && c.TLS.Enabled && (!c.TLS.Manual || c.TLS.OnDemand) && c.Host != "localhost" {
-		c.Port = "443"
-	}
-}
-
-// Map of supported key types
-var supportedKeyTypes = map[string]acme.KeyType{
-	"P384":    acme.EC384,
-	"P256":    acme.EC256,
-	"RSA8192": acme.RSA8192,
-	"RSA4096": acme.RSA4096,
-	"RSA2048": acme.RSA2048,
-}
-
-// Map of supported protocols.
-// SSLv3 will be not supported in future release.
-// HTTP/2 only supports TLS 1.2 and higher.
-var supportedProtocols = map[string]uint16{
-	"ssl3.0": tls.VersionSSL30,
-	"tls1.0": tls.VersionTLS10,
-	"tls1.1": tls.VersionTLS11,
-	"tls1.2": tls.VersionTLS12,
-}
-
-// Map of supported ciphers, used only for parsing config.
-//
-// Note that, at time of writing, HTTP/2 blacklists 276 cipher suites,
-// including all but two of the suites below (the two GCM suites).
-// See https://http2.github.io/http2-spec/#BadCipherSuites
-//
-// TLS_FALLBACK_SCSV is not in this list because we manually ensure
-// it is always added (even though it is not technically a cipher suite).
-//
-// This map, like any map, is NOT ORDERED. Do not range over this map.
-var supportedCiphersMap = map[string]uint16{
-	"ECDHE-RSA-AES256-GCM-SHA384":   tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-	"ECDHE-ECDSA-AES256-GCM-SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-	"ECDHE-RSA-AES128-GCM-SHA256":   tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-	"ECDHE-ECDSA-AES128-GCM-SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-	"ECDHE-RSA-AES128-CBC-SHA":      tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-	"ECDHE-RSA-AES256-CBC-SHA":      tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-	"ECDHE-ECDSA-AES256-CBC-SHA":    tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-	"ECDHE-ECDSA-AES128-CBC-SHA":    tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-	"RSA-AES128-CBC-SHA":            tls.TLS_RSA_WITH_AES_128_CBC_SHA,
-	"RSA-AES256-CBC-SHA":            tls.TLS_RSA_WITH_AES_256_CBC_SHA,
-	"ECDHE-RSA-3DES-EDE-CBC-SHA":    tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
-	"RSA-3DES-EDE-CBC-SHA":          tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
-}
-
-// List of supported cipher suites in descending order of preference.
-// Ordering is very important! Getting the wrong order will break
-// mainstream clients, especially with HTTP/2.
-//
-// Note that TLS_FALLBACK_SCSV is not in this list since it is always
-// added manually.
-var supportedCiphers = []uint16{
-	tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-	tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-	tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-	tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-	tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-	tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-	tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-	tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-	tls.TLS_RSA_WITH_AES_256_CBC_SHA,
-	tls.TLS_RSA_WITH_AES_128_CBC_SHA,
-	tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
-	tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
-}
-
-// List of all the ciphers we want to use by default
-var defaultCiphers = []uint16{
-	tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-	tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-	tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-	tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-	tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-	tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-	tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-	tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-	tls.TLS_RSA_WITH_AES_256_CBC_SHA,
-	tls.TLS_RSA_WITH_AES_128_CBC_SHA,
-}

caddy/https/setup_test.go

@@ -1,299 +0,0 @@
-package https
-
-import (
-	"crypto/tls"
-	"io/ioutil"
-	"log"
-	"os"
-	"testing"
-
-	"github.com/mholt/caddy/caddy/setup"
-	"github.com/xenolf/lego/acme"
-)
-
-func TestMain(m *testing.M) {
-	// Write test certificates to disk before tests, and clean up
-	// when we're done.
-	err := ioutil.WriteFile(certFile, testCert, 0644)
-	if err != nil {
-		log.Fatal(err)
-	}
-	err = ioutil.WriteFile(keyFile, testKey, 0644)
-	if err != nil {
-		os.Remove(certFile)
-		log.Fatal(err)
-	}
-
-	result := m.Run()
-
-	os.Remove(certFile)
-	os.Remove(keyFile)
-	os.Exit(result)
-}
-
-func TestSetupParseBasic(t *testing.T) {
-	c := setup.NewTestController(`tls ` + certFile + ` ` + keyFile + ``)
-
-	_, err := Setup(c)
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-
-	// Basic checks
-	if !c.TLS.Manual {
-		t.Error("Expected TLS Manual=true, but was false")
-	}
-	if !c.TLS.Enabled {
-		t.Error("Expected TLS Enabled=true, but was false")
-	}
-
-	// Security defaults
-	if c.TLS.ProtocolMinVersion != tls.VersionTLS10 {
-		t.Errorf("Expected 'tls1.0 (0x0301)' as ProtocolMinVersion, got %#v", c.TLS.ProtocolMinVersion)
-	}
-	if c.TLS.ProtocolMaxVersion != tls.VersionTLS12 {
-		t.Errorf("Expected 'tls1.2 (0x0303)' as ProtocolMaxVersion, got %v", c.TLS.ProtocolMaxVersion)
-	}
-
-	// KeyType default
-	if KeyType != acme.RSA2048 {
-		t.Errorf("Expected '2048' as KeyType, got %#v", KeyType)
-	}
-
-	// Cipher checks
-	expectedCiphers := []uint16{
-		tls.TLS_FALLBACK_SCSV,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-		tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-		tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-		tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-		tls.TLS_RSA_WITH_AES_256_CBC_SHA,
-		tls.TLS_RSA_WITH_AES_128_CBC_SHA,
-	}
-
-	// Ensure count is correct (plus one for TLS_FALLBACK_SCSV)
-	if len(c.TLS.Ciphers) != len(expectedCiphers) {
-		t.Errorf("Expected %v Ciphers (including TLS_FALLBACK_SCSV), got %v",
-			len(expectedCiphers), len(c.TLS.Ciphers))
-	}
-
-	// Ensure ordering is correct
-	for i, actual := range c.TLS.Ciphers {
-		if actual != expectedCiphers[i] {
-			t.Errorf("Expected cipher in position %d to be %0x, got %0x", i, expectedCiphers[i], actual)
-		}
-	}
-
-	if !c.TLS.PreferServerCipherSuites {
-		t.Error("Expected PreferServerCipherSuites = true, but was false")
-	}
-}
-
-func TestSetupParseIncompleteParams(t *testing.T) {
-	// Using tls without args is an error because it's unnecessary.
-	c := setup.NewTestController(`tls`)
-	_, err := Setup(c)
-	if err == nil {
-		t.Error("Expected an error, but didn't get one")
-	}
-}
-
-func TestSetupParseWithOptionalParams(t *testing.T) {
-	params := `tls ` + certFile + ` ` + keyFile + ` {
-            protocols ssl3.0 tls1.2
-            ciphers RSA-AES256-CBC-SHA ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384
-        }`
-	c := setup.NewTestController(params)
-
-	_, err := Setup(c)
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-
-	if c.TLS.ProtocolMinVersion != tls.VersionSSL30 {
-		t.Errorf("Expected 'ssl3.0 (0x0300)' as ProtocolMinVersion, got %#v", c.TLS.ProtocolMinVersion)
-	}
-
-	if c.TLS.ProtocolMaxVersion != tls.VersionTLS12 {
-		t.Errorf("Expected 'tls1.2 (0x0302)' as ProtocolMaxVersion, got %#v", c.TLS.ProtocolMaxVersion)
-	}
-
-	if len(c.TLS.Ciphers)-1 != 3 {
-		t.Errorf("Expected 3 Ciphers (not including TLS_FALLBACK_SCSV), got %v", len(c.TLS.Ciphers)-1)
-	}
-}
-
-func TestSetupDefaultWithOptionalParams(t *testing.T) {
-	params := `tls {
-            ciphers RSA-3DES-EDE-CBC-SHA
-        }`
-	c := setup.NewTestController(params)
-
-	_, err := Setup(c)
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-	if len(c.TLS.Ciphers)-1 != 1 {
-		t.Errorf("Expected 1 ciphers (not including TLS_FALLBACK_SCSV), got %v", len(c.TLS.Ciphers)-1)
-	}
-}
-
-// TODO: If we allow this... but probably not a good idea.
-// func TestSetupDisableHTTPRedirect(t *testing.T) {
-// 	c := NewTestController(`tls {
-// 	    allow_http
-// 	}`)
-// 	_, err := TLS(c)
-// 	if err != nil {
-// 		t.Errorf("Expected no error, but got %v", err)
-// 	}
-// 	if !c.TLS.DisableHTTPRedir {
-// 		t.Error("Expected HTTP redirect to be disabled, but it wasn't")
-// 	}
-// }
-
-func TestSetupParseWithWrongOptionalParams(t *testing.T) {
-	// Test protocols wrong params
-	params := `tls ` + certFile + ` ` + keyFile + ` {
-			protocols ssl tls
-		}`
-	c := setup.NewTestController(params)
-	_, err := Setup(c)
-	if err == nil {
-		t.Errorf("Expected errors, but no error returned")
-	}
-
-	// Test ciphers wrong params
-	params = `tls ` + certFile + ` ` + keyFile + ` {
-			ciphers not-valid-cipher
-		}`
-	c = setup.NewTestController(params)
-	_, err = Setup(c)
-	if err == nil {
-		t.Errorf("Expected errors, but no error returned")
-	}
-
-	// Test key_type wrong params
-	params = `tls {
-			key_type ab123
-		}`
-	c = setup.NewTestController(params)
-	_, err = Setup(c)
-	if err == nil {
-		t.Errorf("Expected errors, but no error returned")
-	}
-}
-
-func TestSetupParseWithClientAuth(t *testing.T) {
-	// Test missing client cert file
-	params := `tls ` + certFile + ` ` + keyFile + ` {
-			clients
-		}`
-	c := setup.NewTestController(params)
-	_, err := Setup(c)
-	if err == nil {
-		t.Errorf("Expected an error, but no error returned")
-	}
-
-	noCAs, twoCAs := []string{}, []string{"client_ca.crt", "client2_ca.crt"}
-	for caseNumber, caseData := range []struct {
-		params         string
-		clientAuthType tls.ClientAuthType
-		expectedErr    bool
-		expectedCAs    []string
-	}{
-		{"", tls.NoClientCert, false, noCAs},
-		{`tls ` + certFile + ` ` + keyFile + ` {
-			clients client_ca.crt client2_ca.crt
-		}`, tls.RequireAndVerifyClientCert, false, twoCAs},
-		// now come modifier
-		{`tls ` + certFile + ` ` + keyFile + ` {
-			clients request
-		}`, tls.RequestClientCert, false, noCAs},
-		{`tls ` + certFile + ` ` + keyFile + ` {
-			clients require
-		}`, tls.RequireAnyClientCert, false, noCAs},
-		{`tls ` + certFile + ` ` + keyFile + ` {
-			clients verify_if_given client_ca.crt client2_ca.crt
-		}`, tls.VerifyClientCertIfGiven, false, twoCAs},
-		{`tls ` + certFile + ` ` + keyFile + ` {
-			clients verify_if_given
-		}`, tls.VerifyClientCertIfGiven, true, noCAs},
-	} {
-		c := setup.NewTestController(caseData.params)
-		_, err := Setup(c)
-		if caseData.expectedErr {
-			if err == nil {
-				t.Errorf("In case %d: Expected an error, got: %v", caseNumber, err)
-			}
-			continue
-		}
-		if err != nil {
-			t.Errorf("In case %d: Expected no errors, got: %v", caseNumber, err)
-		}
-
-		if caseData.clientAuthType != c.TLS.ClientAuth {
-			t.Errorf("In case %d: Expected TLS client auth type %v, got: %v",
-				caseNumber, caseData.clientAuthType, c.TLS.ClientAuth)
-		}
-
-		if count := len(c.TLS.ClientCerts); count < len(caseData.expectedCAs) {
-			t.Fatalf("In case %d: Expected %d client certs, had %d", caseNumber, len(caseData.expectedCAs), count)
-		}
-
-		for idx, expected := range caseData.expectedCAs {
-			if actual := c.TLS.ClientCerts[idx]; actual != expected {
-				t.Errorf("In case %d: Expected %dth client cert file to be '%s', but was '%s'",
-					caseNumber, idx, expected, actual)
-			}
-		}
-	}
-}
-
-func TestSetupParseWithKeyType(t *testing.T) {
-	params := `tls {
-            key_type p384
-        }`
-	c := setup.NewTestController(params)
-
-	_, err := Setup(c)
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-
-	if KeyType != acme.EC384 {
-		t.Errorf("Expected 'P384' as KeyType, got %#v", KeyType)
-	}
-}
-
-const (
-	certFile = "test_cert.pem"
-	keyFile  = "test_key.pem"
-)
-
-var testCert = []byte(`-----BEGIN CERTIFICATE-----
-MIIBkjCCATmgAwIBAgIJANfFCBcABL6LMAkGByqGSM49BAEwFDESMBAGA1UEAxMJ
-bG9jYWxob3N0MB4XDTE2MDIxMDIyMjAyNFoXDTE4MDIwOTIyMjAyNFowFDESMBAG
-A1UEAxMJbG9jYWxob3N0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEs22MtnG7
-9K1mvIyjEO9GLx7BFD0tBbGnwQ0VPsuCxC6IeVuXbQDLSiVQvFZ6lUszTlczNxVk
-pEfqrM6xAupB7qN1MHMwHQYDVR0OBBYEFHxYDvAxUwL4XrjPev6qZ/BiLDs5MEQG
-A1UdIwQ9MDuAFHxYDvAxUwL4XrjPev6qZ/BiLDs5oRikFjAUMRIwEAYDVQQDEwls
-b2NhbGhvc3SCCQDXxQgXAAS+izAMBgNVHRMEBTADAQH/MAkGByqGSM49BAEDSAAw
-RQIgRvBqbyJM2JCJqhA1FmcoZjeMocmhxQHTt1c+1N2wFUgCIQDtvrivbBPA688N
-Qh3sMeAKNKPsx5NxYdoWuu9KWcKz9A==
------END CERTIFICATE-----
-`)
-
-var testKey = []byte(`-----BEGIN EC PARAMETERS-----
-BggqhkjOPQMBBw==
------END EC PARAMETERS-----
------BEGIN EC PRIVATE KEY-----
-MHcCAQEEIGLtRmwzYVcrH3J0BnzYbGPdWVF10i9p6mxkA4+b2fURoAoGCCqGSM49
-AwEHoUQDQgAEs22MtnG79K1mvIyjEO9GLx7BFD0tBbGnwQ0VPsuCxC6IeVuXbQDL
-SiVQvFZ6lUszTlczNxVkpEfqrM6xAupB7g==
------END EC PRIVATE KEY-----
-`)

caddy/https/storage.go

@@ -1,94 +0,0 @@
-package https
-
-import (
-	"path/filepath"
-	"strings"
-
-	"github.com/mholt/caddy/caddy/assets"
-)
-
-// storage is used to get file paths in a consistent,
-// cross-platform way for persisting Let's Encrypt assets
-// on the file system.
-var storage = Storage(filepath.Join(assets.Path(), "letsencrypt"))
-
-// Storage is a root directory and facilitates
-// forming file paths derived from it.
-type Storage string
-
-// Sites gets the directory that stores site certificate and keys.
-func (s Storage) Sites() string {
-	return filepath.Join(string(s), "sites")
-}
-
-// Site returns the path to the folder containing assets for domain.
-func (s Storage) Site(domain string) string {
-	return filepath.Join(s.Sites(), domain)
-}
-
-// SiteCertFile returns the path to the certificate file for domain.
-func (s Storage) SiteCertFile(domain string) string {
-	return filepath.Join(s.Site(domain), domain+".crt")
-}
-
-// SiteKeyFile returns the path to domain's private key file.
-func (s Storage) SiteKeyFile(domain string) string {
-	return filepath.Join(s.Site(domain), domain+".key")
-}
-
-// SiteMetaFile returns the path to the domain's asset metadata file.
-func (s Storage) SiteMetaFile(domain string) string {
-	return filepath.Join(s.Site(domain), domain+".json")
-}
-
-// Users gets the directory that stores account folders.
-func (s Storage) Users() string {
-	return filepath.Join(string(s), "users")
-}
-
-// User gets the account folder for the user with email.
-func (s Storage) User(email string) string {
-	if email == "" {
-		email = emptyEmail
-	}
-	return filepath.Join(s.Users(), email)
-}
-
-// UserRegFile gets the path to the registration file for
-// the user with the given email address.
-func (s Storage) UserRegFile(email string) string {
-	if email == "" {
-		email = emptyEmail
-	}
-	fileName := emailUsername(email)
-	if fileName == "" {
-		fileName = "registration"
-	}
-	return filepath.Join(s.User(email), fileName+".json")
-}
-
-// UserKeyFile gets the path to the private key file for
-// the user with the given email address.
-func (s Storage) UserKeyFile(email string) string {
-	if email == "" {
-		email = emptyEmail
-	}
-	fileName := emailUsername(email)
-	if fileName == "" {
-		fileName = "private"
-	}
-	return filepath.Join(s.User(email), fileName+".key")
-}
-
-// emailUsername returns the username portion of an
-// email address (part before '@') or the original
-// input if it can't find the "@" symbol.
-func emailUsername(email string) string {
-	at := strings.Index(email, "@")
-	if at == -1 {
-		return email
-	} else if at == 0 {
-		return email[1:]
-	}
-	return email[:at]
-}

caddy/https/storage_test.go

@@ -1,88 +0,0 @@
-package https
-
-import (
-	"path/filepath"
-	"testing"
-)
-
-func TestStorage(t *testing.T) {
-	storage = Storage("./le_test")
-
-	if expected, actual := filepath.Join("le_test", "sites"), storage.Sites(); actual != expected {
-		t.Errorf("Expected Sites() to return '%s' but got '%s'", expected, actual)
-	}
-	if expected, actual := filepath.Join("le_test", "sites", "test.com"), storage.Site("test.com"); actual != expected {
-		t.Errorf("Expected Site() to return '%s' but got '%s'", expected, actual)
-	}
-	if expected, actual := filepath.Join("le_test", "sites", "test.com", "test.com.crt"), storage.SiteCertFile("test.com"); actual != expected {
-		t.Errorf("Expected SiteCertFile() to return '%s' but got '%s'", expected, actual)
-	}
-	if expected, actual := filepath.Join("le_test", "sites", "test.com", "test.com.key"), storage.SiteKeyFile("test.com"); actual != expected {
-		t.Errorf("Expected SiteKeyFile() to return '%s' but got '%s'", expected, actual)
-	}
-	if expected, actual := filepath.Join("le_test", "sites", "test.com", "test.com.json"), storage.SiteMetaFile("test.com"); actual != expected {
-		t.Errorf("Expected SiteMetaFile() to return '%s' but got '%s'", expected, actual)
-	}
-	if expected, actual := filepath.Join("le_test", "users"), storage.Users(); actual != expected {
-		t.Errorf("Expected Users() to return '%s' but got '%s'", expected, actual)
-	}
-	if expected, actual := filepath.Join("le_test", "users", "me@example.com"), storage.User("me@example.com"); actual != expected {
-		t.Errorf("Expected User() to return '%s' but got '%s'", expected, actual)
-	}
-	if expected, actual := filepath.Join("le_test", "users", "me@example.com", "me.json"), storage.UserRegFile("me@example.com"); actual != expected {
-		t.Errorf("Expected UserRegFile() to return '%s' but got '%s'", expected, actual)
-	}
-	if expected, actual := filepath.Join("le_test", "users", "me@example.com", "me.key"), storage.UserKeyFile("me@example.com"); actual != expected {
-		t.Errorf("Expected UserKeyFile() to return '%s' but got '%s'", expected, actual)
-	}
-
-	// Test with empty emails
-	if expected, actual := filepath.Join("le_test", "users", emptyEmail), storage.User(emptyEmail); actual != expected {
-		t.Errorf("Expected User(\"\") to return '%s' but got '%s'", expected, actual)
-	}
-	if expected, actual := filepath.Join("le_test", "users", emptyEmail, emptyEmail+".json"), storage.UserRegFile(""); actual != expected {
-		t.Errorf("Expected UserRegFile(\"\") to return '%s' but got '%s'", expected, actual)
-	}
-	if expected, actual := filepath.Join("le_test", "users", emptyEmail, emptyEmail+".key"), storage.UserKeyFile(""); actual != expected {
-		t.Errorf("Expected UserKeyFile(\"\") to return '%s' but got '%s'", expected, actual)
-	}
-}
-
-func TestEmailUsername(t *testing.T) {
-	for i, test := range []struct {
-		input, expect string
-	}{
-		{
-			input:  "username@example.com",
-			expect: "username",
-		},
-		{
-			input:  "plus+addressing@example.com",
-			expect: "plus+addressing",
-		},
-		{
-			input:  "me+plus-addressing@example.com",
-			expect: "me+plus-addressing",
-		},
-		{
-			input:  "not-an-email",
-			expect: "not-an-email",
-		},
-		{
-			input:  "@foobar.com",
-			expect: "foobar.com",
-		},
-		{
-			input:  emptyEmail,
-			expect: emptyEmail,
-		},
-		{
-			input:  "",
-			expect: "",
-		},
-	} {
-		if actual := emailUsername(test.input); actual != test.expect {
-			t.Errorf("Test %d: Expected username to be '%s' but was '%s'", i, test.expect, actual)
-		}
-	}
-}

caddy/https/user.go

@@ -1,200 +0,0 @@
-package https
-
-import (
-	"bufio"
-	"crypto"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"os"
-	"strings"
-
-	"github.com/mholt/caddy/server"
-	"github.com/xenolf/lego/acme"
-)
-
-// User represents a Let's Encrypt user account.
-type User struct {
-	Email        string
-	Registration *acme.RegistrationResource
-	key          crypto.PrivateKey
-}
-
-// GetEmail gets u's email.
-func (u User) GetEmail() string {
-	return u.Email
-}
-
-// GetRegistration gets u's registration resource.
-func (u User) GetRegistration() *acme.RegistrationResource {
-	return u.Registration
-}
-
-// GetPrivateKey gets u's private key.
-func (u User) GetPrivateKey() crypto.PrivateKey {
-	return u.key
-}
-
-// getUser loads the user with the given email from disk.
-// If the user does not exist, it will create a new one,
-// but it does NOT save new users to the disk or register
-// them via ACME. It does NOT prompt the user.
-func getUser(email string) (User, error) {
-	var user User
-
-	// open user file
-	regFile, err := os.Open(storage.UserRegFile(email))
-	if err != nil {
-		if os.IsNotExist(err) {
-			// create a new user
-			return newUser(email)
-		}
-		return user, err
-	}
-	defer regFile.Close()
-
-	// load user information
-	err = json.NewDecoder(regFile).Decode(&user)
-	if err != nil {
-		return user, err
-	}
-
-	// load their private key
-	user.key, err = loadPrivateKey(storage.UserKeyFile(email))
-	if err != nil {
-		return user, err
-	}
-
-	return user, nil
-}
-
-// saveUser persists a user's key and account registration
-// to the file system. It does NOT register the user via ACME
-// or prompt the user.
-func saveUser(user User) error {
-	// make user account folder
-	err := os.MkdirAll(storage.User(user.Email), 0700)
-	if err != nil {
-		return err
-	}
-
-	// save private key file
-	err = savePrivateKey(user.key, storage.UserKeyFile(user.Email))
-	if err != nil {
-		return err
-	}
-
-	// save registration file
-	jsonBytes, err := json.MarshalIndent(&user, "", "\t")
-	if err != nil {
-		return err
-	}
-
-	return ioutil.WriteFile(storage.UserRegFile(user.Email), jsonBytes, 0600)
-}
-
-// newUser creates a new User for the given email address
-// with a new private key. This function does NOT save the
-// user to disk or register it via ACME. If you want to use
-// a user account that might already exist, call getUser
-// instead. It does NOT prompt the user.
-func newUser(email string) (User, error) {
-	user := User{Email: email}
-	privateKey, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
-	if err != nil {
-		return user, errors.New("error generating private key: " + err.Error())
-	}
-	user.key = privateKey
-	return user, nil
-}
-
-// getEmail does everything it can to obtain an email
-// address from the user to use for TLS for cfg. If it
-// cannot get an email address, it returns empty string.
-// (It will warn the user of the consequences of an
-// empty email.) This function MAY prompt the user for
-// input. If userPresent is false, the operator will
-// NOT be prompted and an empty email may be returned.
-func getEmail(cfg server.Config, userPresent bool) string {
-	// First try the tls directive from the Caddyfile
-	leEmail := cfg.TLS.LetsEncryptEmail
-	if leEmail == "" {
-		// Then try memory (command line flag or typed by user previously)
-		leEmail = DefaultEmail
-	}
-	if leEmail == "" {
-		// Then try to get most recent user email ~/.caddy/users file
-		userDirs, err := ioutil.ReadDir(storage.Users())
-		if err == nil {
-			var mostRecent os.FileInfo
-			for _, dir := range userDirs {
-				if !dir.IsDir() {
-					continue
-				}
-				if mostRecent == nil || dir.ModTime().After(mostRecent.ModTime()) {
-					leEmail = dir.Name()
-					DefaultEmail = leEmail // save for next time
-				}
-			}
-		}
-	}
-	if leEmail == "" && userPresent {
-		// Alas, we must bother the user and ask for an email address;
-		// if they proceed they also agree to the SA.
-		reader := bufio.NewReader(stdin)
-		fmt.Println("\nYour sites will be served over HTTPS automatically using Let's Encrypt.")
-		fmt.Println("By continuing, you agree to the Let's Encrypt Subscriber Agreement at:")
-		fmt.Println("  " + saURL) // TODO: Show current SA link
-		fmt.Println("Please enter your email address so you can recover your account if needed.")
-		fmt.Println("You can leave it blank, but you'll lose the ability to recover your account.")
-		fmt.Print("Email address: ")
-		var err error
-		leEmail, err = reader.ReadString('\n')
-		if err != nil {
-			return ""
-		}
-		leEmail = strings.TrimSpace(leEmail)
-		DefaultEmail = leEmail
-		Agreed = true
-	}
-	return leEmail
-}
-
-// promptUserAgreement prompts the user to agree to the agreement
-// at agreementURL via stdin. If the agreement has changed, then pass
-// true as the second argument. If this is the user's first time
-// agreeing, pass false. It returns whether the user agreed or not.
-func promptUserAgreement(agreementURL string, changed bool) bool {
-	if changed {
-		fmt.Printf("The Let's Encrypt Subscriber Agreement has changed:\n  %s\n", agreementURL)
-		fmt.Print("Do you agree to the new terms? (y/n): ")
-	} else {
-		fmt.Printf("To continue, you must agree to the Let's Encrypt Subscriber Agreement:\n  %s\n", agreementURL)
-		fmt.Print("Do you agree to the terms? (y/n): ")
-	}
-
-	reader := bufio.NewReader(stdin)
-	answer, err := reader.ReadString('\n')
-	if err != nil {
-		return false
-	}
-	answer = strings.ToLower(strings.TrimSpace(answer))
-
-	return answer == "y" || answer == "yes"
-}
-
-// stdin is used to read the user's input if prompted;
-// this is changed by tests during tests.
-var stdin = io.ReadWriter(os.Stdin)
-
-// The name of the folder for accounts where the email
-// address was not provided; default 'username' if you will.
-const emptyEmail = "default"
-
-// TODO: Use latest
-const saURL = "https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf"

caddy/https/user_test.go

@@ -1,196 +0,0 @@
-package https
-
-import (
-	"bytes"
-	"crypto/rand"
-	"crypto/rsa"
-	"io"
-	"os"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/mholt/caddy/server"
-	"github.com/xenolf/lego/acme"
-)
-
-func TestUser(t *testing.T) {
-	privateKey, err := rsa.GenerateKey(rand.Reader, 128)
-	if err != nil {
-		t.Fatalf("Could not generate test private key: %v", err)
-	}
-	u := User{
-		Email:        "me@mine.com",
-		Registration: new(acme.RegistrationResource),
-		key:          privateKey,
-	}
-
-	if expected, actual := "me@mine.com", u.GetEmail(); actual != expected {
-		t.Errorf("Expected email '%s' but got '%s'", expected, actual)
-	}
-	if u.GetRegistration() == nil {
-		t.Error("Expected a registration resource, but got nil")
-	}
-	if expected, actual := privateKey, u.GetPrivateKey(); actual != expected {
-		t.Errorf("Expected the private key at address %p but got one at %p instead ", expected, actual)
-	}
-}
-
-func TestNewUser(t *testing.T) {
-	email := "me@foobar.com"
-	user, err := newUser(email)
-	if err != nil {
-		t.Fatalf("Error creating user: %v", err)
-	}
-	if user.key == nil {
-		t.Error("Private key is nil")
-	}
-	if user.Email != email {
-		t.Errorf("Expected email to be %s, but was %s", email, user.Email)
-	}
-	if user.Registration != nil {
-		t.Error("New user already has a registration resource; it shouldn't")
-	}
-}
-
-func TestSaveUser(t *testing.T) {
-	storage = Storage("./testdata")
-	defer os.RemoveAll(string(storage))
-
-	email := "me@foobar.com"
-	user, err := newUser(email)
-	if err != nil {
-		t.Fatalf("Error creating user: %v", err)
-	}
-
-	err = saveUser(user)
-	if err != nil {
-		t.Fatalf("Error saving user: %v", err)
-	}
-	_, err = os.Stat(storage.UserRegFile(email))
-	if err != nil {
-		t.Errorf("Cannot access user registration file, error: %v", err)
-	}
-	_, err = os.Stat(storage.UserKeyFile(email))
-	if err != nil {
-		t.Errorf("Cannot access user private key file, error: %v", err)
-	}
-}
-
-func TestGetUserDoesNotAlreadyExist(t *testing.T) {
-	storage = Storage("./testdata")
-	defer os.RemoveAll(string(storage))
-
-	user, err := getUser("user_does_not_exist@foobar.com")
-	if err != nil {
-		t.Fatalf("Error getting user: %v", err)
-	}
-
-	if user.key == nil {
-		t.Error("Expected user to have a private key, but it was nil")
-	}
-}
-
-func TestGetUserAlreadyExists(t *testing.T) {
-	storage = Storage("./testdata")
-	defer os.RemoveAll(string(storage))
-
-	email := "me@foobar.com"
-
-	// Set up test
-	user, err := newUser(email)
-	if err != nil {
-		t.Fatalf("Error creating user: %v", err)
-	}
-	err = saveUser(user)
-	if err != nil {
-		t.Fatalf("Error saving user: %v", err)
-	}
-
-	// Expect to load user from disk
-	user2, err := getUser(email)
-	if err != nil {
-		t.Fatalf("Error getting user: %v", err)
-	}
-
-	// Assert keys are the same
-	if !PrivateKeysSame(user.key, user2.key) {
-		t.Error("Expected private key to be the same after loading, but it wasn't")
-	}
-
-	// Assert emails are the same
-	if user.Email != user2.Email {
-		t.Errorf("Expected emails to be equal, but was '%s' before and '%s' after loading", user.Email, user2.Email)
-	}
-}
-
-func TestGetEmail(t *testing.T) {
-	// let's not clutter up the output
-	origStdout := os.Stdout
-	os.Stdout = nil
-	defer func() { os.Stdout = origStdout }()
-
-	storage = Storage("./testdata")
-	defer os.RemoveAll(string(storage))
-	DefaultEmail = "test2@foo.com"
-
-	// Test1: Use email in config
-	config := server.Config{
-		TLS: server.TLSConfig{
-			LetsEncryptEmail: "test1@foo.com",
-		},
-	}
-	actual := getEmail(config, true)
-	if actual != "test1@foo.com" {
-		t.Errorf("Did not get correct email from config; expected '%s' but got '%s'", "test1@foo.com", actual)
-	}
-
-	// Test2: Use default email from flag (or user previously typing it)
-	actual = getEmail(server.Config{}, true)
-	if actual != DefaultEmail {
-		t.Errorf("Did not get correct email from config; expected '%s' but got '%s'", DefaultEmail, actual)
-	}
-
-	// Test3: Get input from user
-	DefaultEmail = ""
-	stdin = new(bytes.Buffer)
-	_, err := io.Copy(stdin, strings.NewReader("test3@foo.com\n"))
-	if err != nil {
-		t.Fatalf("Could not simulate user input, error: %v", err)
-	}
-	actual = getEmail(server.Config{}, true)
-	if actual != "test3@foo.com" {
-		t.Errorf("Did not get correct email from user input prompt; expected '%s' but got '%s'", "test3@foo.com", actual)
-	}
-
-	// Test4: Get most recent email from before
-	DefaultEmail = ""
-	for i, eml := range []string{
-		"test4-3@foo.com",
-		"test4-2@foo.com",
-		"test4-1@foo.com",
-	} {
-		u, err := newUser(eml)
-		if err != nil {
-			t.Fatalf("Error creating user %d: %v", i, err)
-		}
-		err = saveUser(u)
-		if err != nil {
-			t.Fatalf("Error saving user %d: %v", i, err)
-		}
-
-		// Change modified time so they're all different, so the test becomes deterministic
-		f, err := os.Stat(storage.User(eml))
-		if err != nil {
-			t.Fatalf("Could not access user folder for '%s': %v", eml, err)
-		}
-		chTime := f.ModTime().Add(-(time.Duration(i) * time.Second))
-		if err := os.Chtimes(storage.User(eml), chTime, chTime); err != nil {
-			t.Fatalf("Could not change user folder mod time for '%s': %v", eml, err)
-		}
-	}
-	actual = getEmail(server.Config{}, true)
-	if actual != "test4-3@foo.com" {
-		t.Errorf("Did not get correct email from storage; expected '%s' but got '%s'", "test4-3@foo.com", actual)
-	}
-}

caddy/parse/dispenser.go

@@ -1,251 +0,0 @@
-package parse
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"strings"
-)
-
-// Dispenser is a type that dispenses tokens, similarly to a lexer,
-// except that it can do so with some notion of structure and has
-// some really convenient methods.
-type Dispenser struct {
-	filename string
-	tokens   []token
-	cursor   int
-	nesting  int
-}
-
-// NewDispenser returns a Dispenser, ready to use for parsing the given input.
-func NewDispenser(filename string, input io.Reader) Dispenser {
-	return Dispenser{
-		filename: filename,
-		tokens:   allTokens(input),
-		cursor:   -1,
-	}
-}
-
-// NewDispenserTokens returns a Dispenser filled with the given tokens.
-func NewDispenserTokens(filename string, tokens []token) Dispenser {
-	return Dispenser{
-		filename: filename,
-		tokens:   tokens,
-		cursor:   -1,
-	}
-}
-
-// Next loads the next token. Returns true if a token
-// was loaded; false otherwise. If false, all tokens
-// have been consumed.
-func (d *Dispenser) Next() bool {
-	if d.cursor < len(d.tokens)-1 {
-		d.cursor++
-		return true
-	}
-	return false
-}
-
-// NextArg loads the next token if it is on the same
-// line. Returns true if a token was loaded; false
-// otherwise. If false, all tokens on the line have
-// been consumed. It handles imported tokens correctly.
-func (d *Dispenser) NextArg() bool {
-	if d.cursor < 0 {
-		d.cursor++
-		return true
-	}
-	if d.cursor >= len(d.tokens) {
-		return false
-	}
-	if d.cursor < len(d.tokens)-1 &&
-		d.tokens[d.cursor].file == d.tokens[d.cursor+1].file &&
-		d.tokens[d.cursor].line+d.numLineBreaks(d.cursor) == d.tokens[d.cursor+1].line {
-		d.cursor++
-		return true
-	}
-	return false
-}
-
-// NextLine loads the next token only if it is not on the same
-// line as the current token, and returns true if a token was
-// loaded; false otherwise. If false, there is not another token
-// or it is on the same line. It handles imported tokens correctly.
-func (d *Dispenser) NextLine() bool {
-	if d.cursor < 0 {
-		d.cursor++
-		return true
-	}
-	if d.cursor >= len(d.tokens) {
-		return false
-	}
-	if d.cursor < len(d.tokens)-1 &&
-		(d.tokens[d.cursor].file != d.tokens[d.cursor+1].file ||
-			d.tokens[d.cursor].line+d.numLineBreaks(d.cursor) < d.tokens[d.cursor+1].line) {
-		d.cursor++
-		return true
-	}
-	return false
-}
-
-// NextBlock can be used as the condition of a for loop
-// to load the next token as long as it opens a block or
-// is already in a block. It returns true if a token was
-// loaded, or false when the block's closing curly brace
-// was loaded and thus the block ended. Nested blocks are
-// not supported.
-func (d *Dispenser) NextBlock() bool {
-	if d.nesting > 0 {
-		d.Next()
-		if d.Val() == "}" {
-			d.nesting--
-			return false
-		}
-		return true
-	}
-	if !d.NextArg() { // block must open on same line
-		return false
-	}
-	if d.Val() != "{" {
-		d.cursor-- // roll back if not opening brace
-		return false
-	}
-	d.Next()
-	if d.Val() == "}" {
-		// Open and then closed right away
-		return false
-	}
-	d.nesting++
-	return true
-}
-
-// IncrNest adds a level of nesting to the dispenser.
-func (d *Dispenser) IncrNest() {
-	d.nesting++
-	return
-}
-
-// Val gets the text of the current token. If there is no token
-// loaded, it returns empty string.
-func (d *Dispenser) Val() string {
-	if d.cursor < 0 || d.cursor >= len(d.tokens) {
-		return ""
-	}
-	return d.tokens[d.cursor].text
-}
-
-// Line gets the line number of the current token. If there is no token
-// loaded, it returns 0.
-func (d *Dispenser) Line() int {
-	if d.cursor < 0 || d.cursor >= len(d.tokens) {
-		return 0
-	}
-	return d.tokens[d.cursor].line
-}
-
-// File gets the filename of the current token. If there is no token loaded,
-// it returns the filename originally given when parsing started.
-func (d *Dispenser) File() string {
-	if d.cursor < 0 || d.cursor >= len(d.tokens) {
-		return d.filename
-	}
-	if tokenFilename := d.tokens[d.cursor].file; tokenFilename != "" {
-		return tokenFilename
-	}
-	return d.filename
-}
-
-// Args is a convenience function that loads the next arguments
-// (tokens on the same line) into an arbitrary number of strings
-// pointed to in targets. If there are fewer tokens available
-// than string pointers, the remaining strings will not be changed
-// and false will be returned. If there were enough tokens available
-// to fill the arguments, then true will be returned.
-func (d *Dispenser) Args(targets ...*string) bool {
-	enough := true
-	for i := 0; i < len(targets); i++ {
-		if !d.NextArg() {
-			enough = false
-			break
-		}
-		*targets[i] = d.Val()
-	}
-	return enough
-}
-
-// RemainingArgs loads any more arguments (tokens on the same line)
-// into a slice and returns them. Open curly brace tokens also indicate
-// the end of arguments, and the curly brace is not included in
-// the return value nor is it loaded.
-func (d *Dispenser) RemainingArgs() []string {
-	var args []string
-
-	for d.NextArg() {
-		if d.Val() == "{" {
-			d.cursor--
-			break
-		}
-		args = append(args, d.Val())
-	}
-
-	return args
-}
-
-// ArgErr returns an argument error, meaning that another
-// argument was expected but not found. In other words,
-// a line break or open curly brace was encountered instead of
-// an argument.
-func (d *Dispenser) ArgErr() error {
-	if d.Val() == "{" {
-		return d.Err("Unexpected token '{', expecting argument")
-	}
-	return d.Errf("Wrong argument count or unexpected line ending after '%s'", d.Val())
-}
-
-// SyntaxErr creates a generic syntax error which explains what was
-// found and what was expected.
-func (d *Dispenser) SyntaxErr(expected string) error {
-	msg := fmt.Sprintf("%s:%d - Syntax error: Unexpected token '%s', expecting '%s'", d.File(), d.Line(), d.Val(), expected)
-	return errors.New(msg)
-}
-
-// EOFErr returns an error indicating that the dispenser reached
-// the end of the input when searching for the next token.
-func (d *Dispenser) EOFErr() error {
-	return d.Errf("Unexpected EOF")
-}
-
-// Err generates a custom parse error with a message of msg.
-func (d *Dispenser) Err(msg string) error {
-	msg = fmt.Sprintf("%s:%d - Parse error: %s", d.File(), d.Line(), msg)
-	return errors.New(msg)
-}
-
-// Errf is like Err, but for formatted error messages
-func (d *Dispenser) Errf(format string, args ...interface{}) error {
-	return d.Err(fmt.Sprintf(format, args...))
-}
-
-// numLineBreaks counts how many line breaks are in the token
-// value given by the token index tknIdx. It returns 0 if the
-// token does not exist or there are no line breaks.
-func (d *Dispenser) numLineBreaks(tknIdx int) int {
-	if tknIdx < 0 || tknIdx >= len(d.tokens) {
-		return 0
-	}
-	return strings.Count(d.tokens[tknIdx].text, "\n")
-}
-
-// isNewLine determines whether the current token is on a different
-// line (higher line number) than the previous token. It handles imported
-// tokens correctly. If there isn't a previous token, it returns true.
-func (d *Dispenser) isNewLine() bool {
-	if d.cursor < 1 {
-		return true
-	}
-	if d.cursor > len(d.tokens)-1 {
-		return false
-	}
-	return d.tokens[d.cursor-1].file != d.tokens[d.cursor].file ||
-		d.tokens[d.cursor-1].line+d.numLineBreaks(d.cursor-1) < d.tokens[d.cursor].line
-}

caddy/parse/lexer_test.go

@@ -1,165 +0,0 @@
-package parse
-
-import (
-	"strings"
-	"testing"
-)
-
-type lexerTestCase struct {
-	input    string
-	expected []token
-}
-
-func TestLexer(t *testing.T) {
-	testCases := []lexerTestCase{
-		{
-			input: `host:123`,
-			expected: []token{
-				{line: 1, text: "host:123"},
-			},
-		},
-		{
-			input: `host:123
-
-					directive`,
-			expected: []token{
-				{line: 1, text: "host:123"},
-				{line: 3, text: "directive"},
-			},
-		},
-		{
-			input: `host:123 {
-						directive
-					}`,
-			expected: []token{
-				{line: 1, text: "host:123"},
-				{line: 1, text: "{"},
-				{line: 2, text: "directive"},
-				{line: 3, text: "}"},
-			},
-		},
-		{
-			input: `host:123 { directive }`,
-			expected: []token{
-				{line: 1, text: "host:123"},
-				{line: 1, text: "{"},
-				{line: 1, text: "directive"},
-				{line: 1, text: "}"},
-			},
-		},
-		{
-			input: `host:123 {
-						#comment
-						directive
-						# comment
-						foobar # another comment
-					}`,
-			expected: []token{
-				{line: 1, text: "host:123"},
-				{line: 1, text: "{"},
-				{line: 3, text: "directive"},
-				{line: 5, text: "foobar"},
-				{line: 6, text: "}"},
-			},
-		},
-		{
-			input: `a "quoted value" b
-					foobar`,
-			expected: []token{
-				{line: 1, text: "a"},
-				{line: 1, text: "quoted value"},
-				{line: 1, text: "b"},
-				{line: 2, text: "foobar"},
-			},
-		},
-		{
-			input: `A "quoted \"value\" inside" B`,
-			expected: []token{
-				{line: 1, text: "A"},
-				{line: 1, text: `quoted "value" inside`},
-				{line: 1, text: "B"},
-			},
-		},
-		{
-			input: `"don't\escape"`,
-			expected: []token{
-				{line: 1, text: `don't\escape`},
-			},
-		},
-		{
-			input: `"don't\\escape"`,
-			expected: []token{
-				{line: 1, text: `don't\\escape`},
-			},
-		},
-		{
-			input: `A "quoted value with line
-					break inside" {
-						foobar
-					}`,
-			expected: []token{
-				{line: 1, text: "A"},
-				{line: 1, text: "quoted value with line\n\t\t\t\t\tbreak inside"},
-				{line: 2, text: "{"},
-				{line: 3, text: "foobar"},
-				{line: 4, text: "}"},
-			},
-		},
-		{
-			input: `"C:\php\php-cgi.exe"`,
-			expected: []token{
-				{line: 1, text: `C:\php\php-cgi.exe`},
-			},
-		},
-		{
-			input: `empty "" string`,
-			expected: []token{
-				{line: 1, text: `empty`},
-				{line: 1, text: ``},
-				{line: 1, text: `string`},
-			},
-		},
-		{
-			input: "skip those\r\nCR characters",
-			expected: []token{
-				{line: 1, text: "skip"},
-				{line: 1, text: "those"},
-				{line: 2, text: "CR"},
-				{line: 2, text: "characters"},
-			},
-		},
-	}
-
-	for i, testCase := range testCases {
-		actual := tokenize(testCase.input)
-		lexerCompare(t, i, testCase.expected, actual)
-	}
-}
-
-func tokenize(input string) (tokens []token) {
-	l := lexer{}
-	l.load(strings.NewReader(input))
-	for l.next() {
-		tokens = append(tokens, l.token)
-	}
-	return
-}
-
-func lexerCompare(t *testing.T, n int, expected, actual []token) {
-	if len(expected) != len(actual) {
-		t.Errorf("Test case %d: expected %d token(s) but got %d", n, len(expected), len(actual))
-	}
-
-	for i := 0; i < len(actual) && i < len(expected); i++ {
-		if actual[i].line != expected[i].line {
-			t.Errorf("Test case %d token %d ('%s'): expected line %d but was line %d",
-				n, i, expected[i].text, expected[i].line, actual[i].line)
-			break
-		}
-		if actual[i].text != expected[i].text {
-			t.Errorf("Test case %d token %d: expected text '%s' but was '%s'",
-				n, i, expected[i].text, actual[i].text)
-			break
-		}
-	}
-}

caddy/parse/parse.go

@@ -1,32 +0,0 @@
-// Package parse provides facilities for parsing configuration files.
-package parse
-
-import "io"
-
-// ServerBlocks parses the input just enough to organize tokens,
-// in order, by server block. No further parsing is performed.
-// If checkDirectives is true, only valid directives will be allowed
-// otherwise we consider it a parse error. Server blocks are returned
-// in the order in which they appear.
-func ServerBlocks(filename string, input io.Reader, checkDirectives bool) ([]ServerBlock, error) {
-	p := parser{Dispenser: NewDispenser(filename, input)}
-	p.checkDirectives = checkDirectives
-	blocks, err := p.parseAll()
-	return blocks, err
-}
-
-// allTokens lexes the entire input, but does not parse it.
-// It returns all the tokens from the input, unstructured
-// and in order.
-func allTokens(input io.Reader) (tokens []token) {
-	l := new(lexer)
-	l.load(input)
-	for l.next() {
-		tokens = append(tokens, l.token)
-	}
-	return
-}
-
-// ValidDirectives is a set of directives that are valid (unordered). Populated
-// by config package's init function.
-var ValidDirectives = make(map[string]struct{})

caddy/parse/parse_test.go

@@ -1,22 +0,0 @@
-package parse
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestAllTokens(t *testing.T) {
-	input := strings.NewReader("a b c\nd e")
-	expected := []string{"a", "b", "c", "d", "e"}
-	tokens := allTokens(input)
-
-	if len(tokens) != len(expected) {
-		t.Fatalf("Expected %d tokens, got %d", len(expected), len(tokens))
-	}
-
-	for i, val := range expected {
-		if tokens[i].text != val {
-			t.Errorf("Token %d should be '%s' but was '%s'", i, val, tokens[i].text)
-		}
-	}
-}

caddy/parse/parsing.go

@@ -1,415 +0,0 @@
-package parse
-
-import (
-	"fmt"
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-type parser struct {
-	Dispenser
-	block           ServerBlock // current server block being parsed
-	eof             bool        // if we encounter a valid EOF in a hard place
-	checkDirectives bool        // if true, directives must be known
-}
-
-func (p *parser) parseAll() ([]ServerBlock, error) {
-	var blocks []ServerBlock
-
-	for p.Next() {
-		err := p.parseOne()
-		if err != nil {
-			return blocks, err
-		}
-		if len(p.block.Addresses) > 0 {
-			blocks = append(blocks, p.block)
-		}
-	}
-
-	return blocks, nil
-}
-
-func (p *parser) parseOne() error {
-	p.block = ServerBlock{Tokens: make(map[string][]token)}
-
-	err := p.begin()
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *parser) begin() error {
-	if len(p.tokens) == 0 {
-		return nil
-	}
-
-	err := p.addresses()
-	if err != nil {
-		return err
-	}
-
-	if p.eof {
-		// this happens if the Caddyfile consists of only
-		// a line of addresses and nothing else
-		return nil
-	}
-
-	err = p.blockContents()
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (p *parser) addresses() error {
-	var expectingAnother bool
-
-	for {
-		tkn := replaceEnvVars(p.Val())
-
-		// special case: import directive replaces tokens during parse-time
-		if tkn == "import" && p.isNewLine() {
-			err := p.doImport()
-			if err != nil {
-				return err
-			}
-			continue
-		}
-
-		// Open brace definitely indicates end of addresses
-		if tkn == "{" {
-			if expectingAnother {
-				return p.Errf("Expected another address but had '%s' - check for extra comma", tkn)
-			}
-			break
-		}
-
-		if tkn != "" { // empty token possible if user typed "" in Caddyfile
-			// Trailing comma indicates another address will follow, which
-			// may possibly be on the next line
-			if tkn[len(tkn)-1] == ',' {
-				tkn = tkn[:len(tkn)-1]
-				expectingAnother = true
-			} else {
-				expectingAnother = false // but we may still see another one on this line
-			}
-
-			// Parse and save this address
-			addr, err := standardAddress(tkn)
-			if err != nil {
-				return err
-			}
-
-			p.block.Addresses = append(p.block.Addresses, addr)
-		}
-
-		// Advance token and possibly break out of loop or return error
-		hasNext := p.Next()
-		if expectingAnother && !hasNext {
-			return p.EOFErr()
-		}
-		if !hasNext {
-			p.eof = true
-			break // EOF
-		}
-		if !expectingAnother && p.isNewLine() {
-			break
-		}
-	}
-
-	return nil
-}
-
-func (p *parser) blockContents() error {
-	errOpenCurlyBrace := p.openCurlyBrace()
-	if errOpenCurlyBrace != nil {
-		// single-server configs don't need curly braces
-		p.cursor--
-	}
-
-	err := p.directives()
-	if err != nil {
-		return err
-	}
-
-	// Only look for close curly brace if there was an opening
-	if errOpenCurlyBrace == nil {
-		err = p.closeCurlyBrace()
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// directives parses through all the lines for directives
-// and it expects the next token to be the first
-// directive. It goes until EOF or closing curly brace
-// which ends the server block.
-func (p *parser) directives() error {
-	for p.Next() {
-		// end of server block
-		if p.Val() == "}" {
-			break
-		}
-
-		// special case: import directive replaces tokens during parse-time
-		if p.Val() == "import" {
-			err := p.doImport()
-			if err != nil {
-				return err
-			}
-			p.cursor-- // cursor is advanced when we continue, so roll back one more
-			continue
-		}
-
-		// normal case: parse a directive on this line
-		if err := p.directive(); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// doImport swaps out the import directive and its argument
-// (a total of 2 tokens) with the tokens in the specified file
-// or globbing pattern. When the function returns, the cursor
-// is on the token before where the import directive was. In
-// other words, call Next() to access the first token that was
-// imported.
-func (p *parser) doImport() error {
-	// syntax check
-	if !p.NextArg() {
-		return p.ArgErr()
-	}
-	importPattern := p.Val()
-	if p.NextArg() {
-		return p.Err("Import takes only one argument (glob pattern or file)")
-	}
-
-	// do glob
-	matches, err := filepath.Glob(importPattern)
-	if err != nil {
-		return p.Errf("Failed to use import pattern %s: %v", importPattern, err)
-	}
-	if len(matches) == 0 {
-		return p.Errf("No files matching import pattern %s", importPattern)
-	}
-
-	// splice out the import directive and its argument (2 tokens total)
-	tokensBefore := p.tokens[:p.cursor-1]
-	tokensAfter := p.tokens[p.cursor+1:]
-
-	// collect all the imported tokens
-	var importedTokens []token
-	for _, importFile := range matches {
-		newTokens, err := p.doSingleImport(importFile)
-		if err != nil {
-			return err
-		}
-		importedTokens = append(importedTokens, newTokens...)
-	}
-
-	// splice the imported tokens in the place of the import statement
-	// and rewind cursor so Next() will land on first imported token
-	p.tokens = append(tokensBefore, append(importedTokens, tokensAfter...)...)
-	p.cursor--
-
-	return nil
-}
-
-// doSingleImport lexes the individual file at importFile and returns
-// its tokens or an error, if any.
-func (p *parser) doSingleImport(importFile string) ([]token, error) {
-	file, err := os.Open(importFile)
-	if err != nil {
-		return nil, p.Errf("Could not import %s: %v", importFile, err)
-	}
-	defer file.Close()
-	importedTokens := allTokens(file)
-
-	// Tack the filename onto these tokens so errors show the imported file's name
-	filename := filepath.Base(importFile)
-	for i := 0; i < len(importedTokens); i++ {
-		importedTokens[i].file = filename
-	}
-
-	return importedTokens, nil
-}
-
-// directive collects tokens until the directive's scope
-// closes (either end of line or end of curly brace block).
-// It expects the currently-loaded token to be a directive
-// (or } that ends a server block). The collected tokens
-// are loaded into the current server block for later use
-// by directive setup functions.
-func (p *parser) directive() error {
-	dir := p.Val()
-	nesting := 0
-
-	if p.checkDirectives {
-		if _, ok := ValidDirectives[dir]; !ok {
-			return p.Errf("Unknown directive '%s'", dir)
-		}
-	}
-
-	// The directive itself is appended as a relevant token
-	p.block.Tokens[dir] = append(p.block.Tokens[dir], p.tokens[p.cursor])
-
-	for p.Next() {
-		if p.Val() == "{" {
-			nesting++
-		} else if p.isNewLine() && nesting == 0 {
-			p.cursor-- // read too far
-			break
-		} else if p.Val() == "}" && nesting > 0 {
-			nesting--
-		} else if p.Val() == "}" && nesting == 0 {
-			return p.Err("Unexpected '}' because no matching opening brace")
-		}
-		p.tokens[p.cursor].text = replaceEnvVars(p.tokens[p.cursor].text)
-		p.block.Tokens[dir] = append(p.block.Tokens[dir], p.tokens[p.cursor])
-	}
-
-	if nesting > 0 {
-		return p.EOFErr()
-	}
-	return nil
-}
-
-// openCurlyBrace expects the current token to be an
-// opening curly brace. This acts like an assertion
-// because it returns an error if the token is not
-// a opening curly brace. It does NOT advance the token.
-func (p *parser) openCurlyBrace() error {
-	if p.Val() != "{" {
-		return p.SyntaxErr("{")
-	}
-	return nil
-}
-
-// closeCurlyBrace expects the current token to be
-// a closing curly brace. This acts like an assertion
-// because it returns an error if the token is not
-// a closing curly brace. It does NOT advance the token.
-func (p *parser) closeCurlyBrace() error {
-	if p.Val() != "}" {
-		return p.SyntaxErr("}")
-	}
-	return nil
-}
-
-// standardAddress parses an address string into a structured format with separate
-// scheme, host, and port portions, as well as the original input string.
-func standardAddress(str string) (address, error) {
-	var scheme string
-	var err error
-
-	// first check for scheme and strip it off
-	input := str
-	if strings.HasPrefix(str, "https://") {
-		scheme = "https"
-		str = str[8:]
-	} else if strings.HasPrefix(str, "http://") {
-		scheme = "http"
-		str = str[7:]
-	}
-
-	// separate host and port
-	host, port, err := net.SplitHostPort(str)
-	if err != nil {
-		host, port, err = net.SplitHostPort(str + ":")
-		if err != nil {
-			host = str
-		}
-	}
-
-	// "The host subcomponent is case-insensitive." (RFC 3986)
-	host = strings.ToLower(host)
-
-	// see if we can set port based off scheme
-	if port == "" {
-		if scheme == "http" {
-			port = "80"
-		} else if scheme == "https" {
-			port = "443"
-		}
-	}
-
-	// repeated or conflicting scheme is confusing, so error
-	if scheme != "" && (port == "http" || port == "https") {
-		return address{}, fmt.Errorf("[%s] scheme specified twice in address", input)
-	}
-
-	// error if scheme and port combination violate convention
-	if (scheme == "http" && port == "443") || (scheme == "https" && port == "80") {
-		return address{}, fmt.Errorf("[%s] scheme and port violate convention", input)
-	}
-
-	// standardize http and https ports to their respective port numbers
-	if port == "http" {
-		scheme = "http"
-		port = "80"
-	} else if port == "https" {
-		scheme = "https"
-		port = "443"
-	}
-
-	return address{Original: input, Scheme: scheme, Host: host, Port: port}, err
-}
-
-// replaceEnvVars replaces environment variables that appear in the token
-// and understands both the $UNIX and %WINDOWS% syntaxes.
-func replaceEnvVars(s string) string {
-	s = replaceEnvReferences(s, "{%", "%}")
-	s = replaceEnvReferences(s, "{$", "}")
-	return s
-}
-
-// replaceEnvReferences performs the actual replacement of env variables
-// in s, given the placeholder start and placeholder end strings.
-func replaceEnvReferences(s, refStart, refEnd string) string {
-	index := strings.Index(s, refStart)
-	for index != -1 {
-		endIndex := strings.Index(s, refEnd)
-		if endIndex != -1 {
-			ref := s[index : endIndex+len(refEnd)]
-			s = strings.Replace(s, ref, os.Getenv(ref[len(refStart):len(ref)-len(refEnd)]), -1)
-		} else {
-			return s
-		}
-		index = strings.Index(s, refStart)
-	}
-	return s
-}
-
-type (
-	// ServerBlock associates tokens with a list of addresses
-	// and groups tokens by directive name.
-	ServerBlock struct {
-		Addresses []address
-		Tokens    map[string][]token
-	}
-
-	address struct {
-		Original, Scheme, Host, Port string
-	}
-)
-
-// HostList converts the list of addresses that are
-// associated with this server block into a slice of
-// strings, where each address is as it was originally
-// read from the input.
-func (sb ServerBlock) HostList() []string {
-	sbHosts := make([]string, len(sb.Addresses))
-	for j, addr := range sb.Addresses {
-		sbHosts[j] = addr.Original
-	}
-	return sbHosts
-}

caddy/parse/parsing_test.go

@@ -1,480 +0,0 @@
-package parse
-
-import (
-	"os"
-	"strings"
-	"testing"
-)
-
-func TestStandardAddress(t *testing.T) {
-	for i, test := range []struct {
-		input              string
-		scheme, host, port string
-		shouldErr          bool
-	}{
-		{`localhost`, "", "localhost", "", false},
-		{`LOCALHOST`, "", "localhost", "", false},
-		{`localhost:1234`, "", "localhost", "1234", false},
-		{`LOCALHOST:1234`, "", "localhost", "1234", false},
-		{`localhost:`, "", "localhost", "", false},
-		{`0.0.0.0`, "", "0.0.0.0", "", false},
-		{`127.0.0.1:1234`, "", "127.0.0.1", "1234", false},
-		{`:1234`, "", "", "1234", false},
-		{`[::1]`, "", "::1", "", false},
-		{`[::1]:1234`, "", "::1", "1234", false},
-		{`:`, "", "", "", false},
-		{`localhost:http`, "http", "localhost", "80", false},
-		{`localhost:https`, "https", "localhost", "443", false},
-		{`:http`, "http", "", "80", false},
-		{`:https`, "https", "", "443", false},
-		{`http://localhost:https`, "", "", "", true}, // conflict
-		{`http://localhost:http`, "", "", "", true},  // repeated scheme
-		{`http://localhost:443`, "", "", "", true},   // not conventional
-		{`https://localhost:80`, "", "", "", true},   // not conventional
-		{`http://localhost`, "http", "localhost", "80", false},
-		{`https://localhost`, "https", "localhost", "443", false},
-		{`http://127.0.0.1`, "http", "127.0.0.1", "80", false},
-		{`https://127.0.0.1`, "https", "127.0.0.1", "443", false},
-		{`http://[::1]`, "http", "::1", "80", false},
-		{`http://localhost:1234`, "http", "localhost", "1234", false},
-		{`http://LOCALHOST:1234`, "http", "localhost", "1234", false},
-		{`https://127.0.0.1:1234`, "https", "127.0.0.1", "1234", false},
-		{`http://[::1]:1234`, "http", "::1", "1234", false},
-		{``, "", "", "", false},
-		{`::1`, "", "::1", "", true},
-		{`localhost::`, "", "localhost::", "", true},
-		{`#$%@`, "", "#$%@", "", true},
-	} {
-		actual, err := standardAddress(test.input)
-
-		if err != nil && !test.shouldErr {
-			t.Errorf("Test %d (%s): Expected no error, but had error: %v", i, test.input, err)
-		}
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d (%s): Expected error, but had none", i, test.input)
-		}
-
-		if actual.Scheme != test.scheme {
-			t.Errorf("Test %d (%s): Expected scheme '%s', got '%s'", i, test.input, test.scheme, actual.Scheme)
-		}
-		if actual.Host != test.host {
-			t.Errorf("Test %d (%s): Expected host '%s', got '%s'", i, test.input, test.host, actual.Host)
-		}
-		if actual.Port != test.port {
-			t.Errorf("Test %d (%s): Expected port '%s', got '%s'", i, test.input, test.port, actual.Port)
-		}
-	}
-}
-
-func TestParseOneAndImport(t *testing.T) {
-	setupParseTests()
-
-	testParseOne := func(input string) (ServerBlock, error) {
-		p := testParser(input)
-		p.Next() // parseOne doesn't call Next() to start, so we must
-		err := p.parseOne()
-		return p.block, err
-	}
-
-	for i, test := range []struct {
-		input     string
-		shouldErr bool
-		addresses []address
-		tokens    map[string]int // map of directive name to number of tokens expected
-	}{
-		{`localhost`, false, []address{
-			{"localhost", "", "localhost", ""},
-		}, map[string]int{}},
-
-		{`localhost
-		  dir1`, false, []address{
-			{"localhost", "", "localhost", ""},
-		}, map[string]int{
-			"dir1": 1,
-		}},
-
-		{`localhost:1234
-		  dir1 foo bar`, false, []address{
-			{"localhost:1234", "", "localhost", "1234"},
-		}, map[string]int{
-			"dir1": 3,
-		}},
-
-		{`localhost {
-		    dir1
-		  }`, false, []address{
-			{"localhost", "", "localhost", ""},
-		}, map[string]int{
-			"dir1": 1,
-		}},
-
-		{`localhost:1234 {
-		    dir1 foo bar
-		    dir2
-		  }`, false, []address{
-			{"localhost:1234", "", "localhost", "1234"},
-		}, map[string]int{
-			"dir1": 3,
-			"dir2": 1,
-		}},
-
-		{`http://localhost https://localhost
-		  dir1 foo bar`, false, []address{
-			{"http://localhost", "http", "localhost", "80"},
-			{"https://localhost", "https", "localhost", "443"},
-		}, map[string]int{
-			"dir1": 3,
-		}},
-
-		{`http://localhost https://localhost {
-		    dir1 foo bar
-		  }`, false, []address{
-			{"http://localhost", "http", "localhost", "80"},
-			{"https://localhost", "https", "localhost", "443"},
-		}, map[string]int{
-			"dir1": 3,
-		}},
-
-		{`http://localhost, https://localhost {
-		    dir1 foo bar
-		  }`, false, []address{
-			{"http://localhost", "http", "localhost", "80"},
-			{"https://localhost", "https", "localhost", "443"},
-		}, map[string]int{
-			"dir1": 3,
-		}},
-
-		{`http://localhost, {
-		  }`, true, []address{
-			{"http://localhost", "http", "localhost", "80"},
-		}, map[string]int{}},
-
-		{`host1:80, http://host2.com
-		  dir1 foo bar
-		  dir2 baz`, false, []address{
-			{"host1:80", "", "host1", "80"},
-			{"http://host2.com", "http", "host2.com", "80"},
-		}, map[string]int{
-			"dir1": 3,
-			"dir2": 2,
-		}},
-
-		{`http://host1.com,
-		  http://host2.com,
-		  https://host3.com`, false, []address{
-			{"http://host1.com", "http", "host1.com", "80"},
-			{"http://host2.com", "http", "host2.com", "80"},
-			{"https://host3.com", "https", "host3.com", "443"},
-		}, map[string]int{}},
-
-		{`http://host1.com:1234, https://host2.com
-		  dir1 foo {
-		    bar baz
-		  }
-		  dir2`, false, []address{
-			{"http://host1.com:1234", "http", "host1.com", "1234"},
-			{"https://host2.com", "https", "host2.com", "443"},
-		}, map[string]int{
-			"dir1": 6,
-			"dir2": 1,
-		}},
-
-		{`127.0.0.1
-		  dir1 {
-		    bar baz
-		  }
-		  dir2 {
-		    foo bar
-		  }`, false, []address{
-			{"127.0.0.1", "", "127.0.0.1", ""},
-		}, map[string]int{
-			"dir1": 5,
-			"dir2": 5,
-		}},
-
-		{`127.0.0.1
-		  unknown_directive`, true, []address{
-			{"127.0.0.1", "", "127.0.0.1", ""},
-		}, map[string]int{}},
-
-		{`localhost
-		  dir1 {
-		    foo`, true, []address{
-			{"localhost", "", "localhost", ""},
-		}, map[string]int{
-			"dir1": 3,
-		}},
-
-		{`localhost
-		  dir1 {
-		  }`, false, []address{
-			{"localhost", "", "localhost", ""},
-		}, map[string]int{
-			"dir1": 3,
-		}},
-
-		{`localhost
-		  dir1 {
-		  } }`, true, []address{
-			{"localhost", "", "localhost", ""},
-		}, map[string]int{
-			"dir1": 3,
-		}},
-
-		{`localhost
-		  dir1 {
-		    nested {
-		      foo
-		    }
-		  }
-		  dir2 foo bar`, false, []address{
-			{"localhost", "", "localhost", ""},
-		}, map[string]int{
-			"dir1": 7,
-			"dir2": 3,
-		}},
-
-		{``, false, []address{}, map[string]int{}},
-
-		{`localhost
-		  dir1 arg1
-		  import import_test1.txt`, false, []address{
-			{"localhost", "", "localhost", ""},
-		}, map[string]int{
-			"dir1": 2,
-			"dir2": 3,
-			"dir3": 1,
-		}},
-
-		{`import import_test2.txt`, false, []address{
-			{"host1", "", "host1", ""},
-		}, map[string]int{
-			"dir1": 1,
-			"dir2": 2,
-		}},
-
-		{`import import_test1.txt import_test2.txt`, true, []address{}, map[string]int{}},
-
-		{`import not_found.txt`, true, []address{}, map[string]int{}},
-
-		{`""`, false, []address{}, map[string]int{}},
-
-		{``, false, []address{}, map[string]int{}},
-	} {
-		result, err := testParseOne(test.input)
-
-		if test.shouldErr && err == nil {
-			t.Errorf("Test %d: Expected an error, but didn't get one", i)
-		}
-		if !test.shouldErr && err != nil {
-			t.Errorf("Test %d: Expected no error, but got: %v", i, err)
-		}
-
-		if len(result.Addresses) != len(test.addresses) {
-			t.Errorf("Test %d: Expected %d addresses, got %d",
-				i, len(test.addresses), len(result.Addresses))
-			continue
-		}
-		for j, addr := range result.Addresses {
-			if addr.Host != test.addresses[j].Host {
-				t.Errorf("Test %d, address %d: Expected host to be '%s', but was '%s'",
-					i, j, test.addresses[j].Host, addr.Host)
-			}
-			if addr.Port != test.addresses[j].Port {
-				t.Errorf("Test %d, address %d: Expected port to be '%s', but was '%s'",
-					i, j, test.addresses[j].Port, addr.Port)
-			}
-		}
-
-		if len(result.Tokens) != len(test.tokens) {
-			t.Errorf("Test %d: Expected %d directives, had %d",
-				i, len(test.tokens), len(result.Tokens))
-			continue
-		}
-		for directive, tokens := range result.Tokens {
-			if len(tokens) != test.tokens[directive] {
-				t.Errorf("Test %d, directive '%s': Expected %d tokens, counted %d",
-					i, directive, test.tokens[directive], len(tokens))
-				continue
-			}
-		}
-	}
-}
-
-func TestParseAll(t *testing.T) {
-	setupParseTests()
-
-	for i, test := range []struct {
-		input     string
-		shouldErr bool
-		addresses [][]address // addresses per server block, in order
-	}{
-		{`localhost`, false, [][]address{
-			{{"localhost", "", "localhost", ""}},
-		}},
-
-		{`localhost:1234`, false, [][]address{
-			{{"localhost:1234", "", "localhost", "1234"}},
-		}},
-
-		{`localhost:1234 {
-		  }
-		  localhost:2015 {
-		  }`, false, [][]address{
-			{{"localhost:1234", "", "localhost", "1234"}},
-			{{"localhost:2015", "", "localhost", "2015"}},
-		}},
-
-		{`localhost:1234, http://host2`, false, [][]address{
-			{{"localhost:1234", "", "localhost", "1234"}, {"http://host2", "http", "host2", "80"}},
-		}},
-
-		{`localhost:1234, http://host2,`, true, [][]address{}},
-
-		{`http://host1.com, http://host2.com {
-		  }
-		  https://host3.com, https://host4.com {
-		  }`, false, [][]address{
-			{{"http://host1.com", "http", "host1.com", "80"}, {"http://host2.com", "http", "host2.com", "80"}},
-			{{"https://host3.com", "https", "host3.com", "443"}, {"https://host4.com", "https", "host4.com", "443"}},
-		}},
-
-		{`import import_glob*.txt`, false, [][]address{
-			{{"glob0.host0", "", "glob0.host0", ""}},
-			{{"glob0.host1", "", "glob0.host1", ""}},
-			{{"glob1.host0", "", "glob1.host0", ""}},
-			{{"glob2.host0", "", "glob2.host0", ""}},
-		}},
-	} {
-		p := testParser(test.input)
-		blocks, err := p.parseAll()
-
-		if test.shouldErr && err == nil {
-			t.Errorf("Test %d: Expected an error, but didn't get one", i)
-		}
-		if !test.shouldErr && err != nil {
-			t.Errorf("Test %d: Expected no error, but got: %v", i, err)
-		}
-
-		if len(blocks) != len(test.addresses) {
-			t.Errorf("Test %d: Expected %d server blocks, got %d",
-				i, len(test.addresses), len(blocks))
-			continue
-		}
-		for j, block := range blocks {
-			if len(block.Addresses) != len(test.addresses[j]) {
-				t.Errorf("Test %d: Expected %d addresses in block %d, got %d",
-					i, len(test.addresses[j]), j, len(block.Addresses))
-				continue
-			}
-			for k, addr := range block.Addresses {
-				if addr.Host != test.addresses[j][k].Host {
-					t.Errorf("Test %d, block %d, address %d: Expected host to be '%s', but was '%s'",
-						i, j, k, test.addresses[j][k].Host, addr.Host)
-				}
-				if addr.Port != test.addresses[j][k].Port {
-					t.Errorf("Test %d, block %d, address %d: Expected port to be '%s', but was '%s'",
-						i, j, k, test.addresses[j][k].Port, addr.Port)
-				}
-			}
-		}
-	}
-}
-
-func TestEnvironmentReplacement(t *testing.T) {
-	setupParseTests()
-
-	os.Setenv("PORT", "8080")
-	os.Setenv("ADDRESS", "servername.com")
-	os.Setenv("FOOBAR", "foobar")
-
-	// basic test; unix-style env vars
-	p := testParser(`{$ADDRESS}`)
-	blocks, _ := p.parseAll()
-	if actual, expected := blocks[0].Addresses[0].Host, "servername.com"; expected != actual {
-		t.Errorf("Expected host to be '%s' but was '%s'", expected, actual)
-	}
-
-	// multiple vars per token
-	p = testParser(`{$ADDRESS}:{$PORT}`)
-	blocks, _ = p.parseAll()
-	if actual, expected := blocks[0].Addresses[0].Host, "servername.com"; expected != actual {
-		t.Errorf("Expected host to be '%s' but was '%s'", expected, actual)
-	}
-	if actual, expected := blocks[0].Addresses[0].Port, "8080"; expected != actual {
-		t.Errorf("Expected port to be '%s' but was '%s'", expected, actual)
-	}
-
-	// windows-style var and unix style in same token
-	p = testParser(`{%ADDRESS%}:{$PORT}`)
-	blocks, _ = p.parseAll()
-	if actual, expected := blocks[0].Addresses[0].Host, "servername.com"; expected != actual {
-		t.Errorf("Expected host to be '%s' but was '%s'", expected, actual)
-	}
-	if actual, expected := blocks[0].Addresses[0].Port, "8080"; expected != actual {
-		t.Errorf("Expected port to be '%s' but was '%s'", expected, actual)
-	}
-
-	// reverse order
-	p = testParser(`{$ADDRESS}:{%PORT%}`)
-	blocks, _ = p.parseAll()
-	if actual, expected := blocks[0].Addresses[0].Host, "servername.com"; expected != actual {
-		t.Errorf("Expected host to be '%s' but was '%s'", expected, actual)
-	}
-	if actual, expected := blocks[0].Addresses[0].Port, "8080"; expected != actual {
-		t.Errorf("Expected port to be '%s' but was '%s'", expected, actual)
-	}
-
-	// env var in server block body as argument
-	p = testParser(":{%PORT%}\ndir1 {$FOOBAR}")
-	blocks, _ = p.parseAll()
-	if actual, expected := blocks[0].Addresses[0].Port, "8080"; expected != actual {
-		t.Errorf("Expected port to be '%s' but was '%s'", expected, actual)
-	}
-	if actual, expected := blocks[0].Tokens["dir1"][1].text, "foobar"; expected != actual {
-		t.Errorf("Expected argument to be '%s' but was '%s'", expected, actual)
-	}
-
-	// combined windows env vars in argument
-	p = testParser(":{%PORT%}\ndir1 {%ADDRESS%}/{%FOOBAR%}")
-	blocks, _ = p.parseAll()
-	if actual, expected := blocks[0].Tokens["dir1"][1].text, "servername.com/foobar"; expected != actual {
-		t.Errorf("Expected argument to be '%s' but was '%s'", expected, actual)
-	}
-
-	// malformed env var (windows)
-	p = testParser(":1234\ndir1 {%ADDRESS}")
-	blocks, _ = p.parseAll()
-	if actual, expected := blocks[0].Tokens["dir1"][1].text, "{%ADDRESS}"; expected != actual {
-		t.Errorf("Expected host to be '%s' but was '%s'", expected, actual)
-	}
-
-	// malformed (non-existent) env var (unix)
-	p = testParser(`:{$PORT$}`)
-	blocks, _ = p.parseAll()
-	if actual, expected := blocks[0].Addresses[0].Port, ""; expected != actual {
-		t.Errorf("Expected port to be '%s' but was '%s'", expected, actual)
-	}
-
-	// in quoted field
-	p = testParser(":1234\ndir1 \"Test {$FOOBAR} test\"")
-	blocks, _ = p.parseAll()
-	if actual, expected := blocks[0].Tokens["dir1"][1].text, "Test foobar test"; expected != actual {
-		t.Errorf("Expected argument to be '%s' but was '%s'", expected, actual)
-	}
-}
-
-func setupParseTests() {
-	// Set up some bogus directives for testing
-	ValidDirectives = map[string]struct{}{
-		"dir1": {},
-		"dir2": {},
-		"dir3": {},
-	}
-}
-
-func testParser(input string) parser {
-	buf := strings.NewReader(input)
-	p := parser{Dispenser: NewDispenser("Test", buf), checkDirectives: true}
-	return p
-}

caddy/restart.go

@@ -1,174 +0,0 @@
-// +build !windows
-
-package caddy
-
-import (
-	"bytes"
-	"encoding/gob"
-	"errors"
-	"io/ioutil"
-	"log"
-	"net"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"sync/atomic"
-
-	"github.com/mholt/caddy/caddy/https"
-)
-
-func init() {
-	gob.Register(CaddyfileInput{})
-}
-
-// Restart restarts the entire application; gracefully with zero
-// downtime if on a POSIX-compatible system, or forcefully if on
-// Windows but with imperceptibly-short downtime.
-//
-// The behavior can be controlled by the RestartMode variable,
-// where "inproc" will restart forcefully in process same as
-// Windows on a POSIX-compatible system.
-//
-// The restarted application will use newCaddyfile as its input
-// configuration. If newCaddyfile is nil, the current (existing)
-// Caddyfile configuration will be used.
-//
-// Note: The process must exist in the same place on the disk in
-// order for this to work. Thus, multiple graceful restarts don't
-// work if executing with `go run`, since the binary is cleaned up
-// when `go run` sees the initial parent process exit.
-func Restart(newCaddyfile Input) error {
-	log.Println("[INFO] Restarting")
-
-	if newCaddyfile == nil {
-		caddyfileMu.Lock()
-		newCaddyfile = caddyfile
-		caddyfileMu.Unlock()
-	}
-
-	// Get certificates for any new hosts in the new Caddyfile without causing downtime
-	err := getCertsForNewCaddyfile(newCaddyfile)
-	if err != nil {
-		return errors.New("TLS preload: " + err.Error())
-	}
-
-	if RestartMode == "inproc" {
-		return restartInProc(newCaddyfile)
-	}
-
-	if len(os.Args) == 0 { // this should never happen, but...
-		os.Args = []string{""}
-	}
-
-	// Tell the child that it's a restart
-	os.Setenv("CADDY_RESTART", "true")
-
-	// Prepare our payload to the child process
-	cdyfileGob := caddyfileGob{
-		ListenerFds:            make(map[string]uintptr),
-		Caddyfile:              newCaddyfile,
-		OnDemandTLSCertsIssued: atomic.LoadInt32(https.OnDemandIssuedCount),
-	}
-
-	// Prepare a pipe to the fork's stdin so it can get the Caddyfile
-	rpipe, wpipe, err := os.Pipe()
-	if err != nil {
-		return err
-	}
-
-	// Prepare a pipe that the child process will use to communicate
-	// its success with us by sending > 0 bytes
-	sigrpipe, sigwpipe, err := os.Pipe()
-	if err != nil {
-		return err
-	}
-
-	// Pass along relevant file descriptors to child process; ordering
-	// is very important since we rely on these being in certain positions.
-	extraFiles := []*os.File{sigwpipe} // fd 3
-
-	// Add file descriptors of all the sockets
-	serversMu.Lock()
-	for i, s := range servers {
-		extraFiles = append(extraFiles, s.ListenerFd())
-		cdyfileGob.ListenerFds[s.Addr] = uintptr(4 + i) // 4 fds come before any of the listeners
-	}
-	serversMu.Unlock()
-
-	// Set up the command
-	cmd := exec.Command(os.Args[0], os.Args[1:]...)
-	cmd.Stdin = rpipe      // fd 0
-	cmd.Stdout = os.Stdout // fd 1
-	cmd.Stderr = os.Stderr // fd 2
-	cmd.ExtraFiles = extraFiles
-
-	// Spawn the child process
-	err = cmd.Start()
-	if err != nil {
-		return err
-	}
-
-	// Immediately close our dup'ed fds and the write end of our signal pipe
-	for _, f := range extraFiles {
-		f.Close()
-	}
-
-	// Feed Caddyfile to the child
-	err = gob.NewEncoder(wpipe).Encode(cdyfileGob)
-	if err != nil {
-		return err
-	}
-	wpipe.Close()
-
-	// Determine whether child startup succeeded
-	answer, readErr := ioutil.ReadAll(sigrpipe)
-	if answer == nil || len(answer) == 0 {
-		cmdErr := cmd.Wait() // get exit status
-		log.Printf("[ERROR] Restart: child failed to initialize (%v) - changes not applied", cmdErr)
-		if readErr != nil {
-			log.Printf("[ERROR] Restart: additionally, error communicating with child process: %v", readErr)
-		}
-		return errIncompleteRestart
-	}
-
-	// Looks like child is successful; we can exit gracefully.
-	return Stop()
-}
-
-func getCertsForNewCaddyfile(newCaddyfile Input) error {
-	// parse the new caddyfile only up to (and including) TLS
-	// so we can know what we need to get certs for.
-	configs, _, _, err := loadConfigsUpToIncludingTLS(filepath.Base(newCaddyfile.Path()), bytes.NewReader(newCaddyfile.Body()))
-	if err != nil {
-		return errors.New("loading Caddyfile: " + err.Error())
-	}
-
-	// first mark the configs that are qualified for managed TLS
-	https.MarkQualified(configs)
-
-	// since we group by bind address to obtain certs, we must call
-	// EnableTLS to make sure the port is set properly first
-	// (can ignore error since we aren't actually using the certs)
-	https.EnableTLS(configs, false)
-
-	// find out if we can let the acme package start its own challenge listener
-	// on port 80
-	var proxyACME bool
-	serversMu.Lock()
-	for _, s := range servers {
-		_, port, _ := net.SplitHostPort(s.Addr)
-		if port == "80" {
-			proxyACME = true
-			break
-		}
-	}
-	serversMu.Unlock()
-
-	// place certs on the disk
-	err = https.ObtainCerts(configs, false, proxyACME)
-	if err != nil {
-		return errors.New("obtaining certs: " + err.Error())
-	}
-
-	return nil
-}

caddy/restart_windows.go

@@ -1,17 +0,0 @@
-package caddy
-
-import "log"
-
-// Restart restarts Caddy forcefully using newCaddyfile,
-// or, if nil, the current/existing Caddyfile is reused.
-func Restart(newCaddyfile Input) error {
-	log.Println("[INFO] Restarting")
-
-	if newCaddyfile == nil {
-		caddyfileMu.Lock()
-		newCaddyfile = caddyfile
-		caddyfileMu.Unlock()
-	}
-
-	return restartInProc(newCaddyfile)
-}

caddy/restartinproc.go

@@ -1,32 +0,0 @@
-package caddy
-
-import "log"
-
-// restartInProc restarts Caddy forcefully in process using newCaddyfile.
-func restartInProc(newCaddyfile Input) error {
-	wg.Add(1) // barrier so Wait() doesn't unblock
-
-	err := Stop()
-	if err != nil {
-		return err
-	}
-
-	caddyfileMu.Lock()
-	oldCaddyfile := caddyfile
-	caddyfileMu.Unlock()
-
-	err = Start(newCaddyfile)
-	if err != nil {
-		// revert to old Caddyfile
-		if oldErr := Start(oldCaddyfile); oldErr != nil {
-			log.Printf("[ERROR] Restart: in-process restart failed and cannot revert to old Caddyfile: %v", oldErr)
-		} else {
-			wg.Done() // take down our barrier
-		}
-		return err
-	}
-
-	wg.Done() // take down our barrier
-
-	return nil
-}

caddy/setup/basicauth.go

@@ -1,72 +0,0 @@
-package setup
-
-import (
-	"strings"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/basicauth"
-)
-
-// BasicAuth configures a new BasicAuth middleware instance.
-func BasicAuth(c *Controller) (middleware.Middleware, error) {
-	root := c.Root
-
-	rules, err := basicAuthParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	basic := basicauth.BasicAuth{Rules: rules}
-
-	return func(next middleware.Handler) middleware.Handler {
-		basic.Next = next
-		basic.SiteRoot = root
-		return basic
-	}, nil
-}
-
-func basicAuthParse(c *Controller) ([]basicauth.Rule, error) {
-	var rules []basicauth.Rule
-
-	var err error
-	for c.Next() {
-		var rule basicauth.Rule
-
-		args := c.RemainingArgs()
-
-		switch len(args) {
-		case 2:
-			rule.Username = args[0]
-			if rule.Password, err = passwordMatcher(rule.Username, args[1], c.Root); err != nil {
-				return rules, c.Errf("Get password matcher from %s: %v", c.Val(), err)
-			}
-
-			for c.NextBlock() {
-				rule.Resources = append(rule.Resources, c.Val())
-				if c.NextArg() {
-					return rules, c.Errf("Expecting only one resource per line (extra '%s')", c.Val())
-				}
-			}
-		case 3:
-			rule.Resources = append(rule.Resources, args[0])
-			rule.Username = args[1]
-			if rule.Password, err = passwordMatcher(rule.Username, args[2], c.Root); err != nil {
-				return rules, c.Errf("Get password matcher from %s: %v", c.Val(), err)
-			}
-		default:
-			return rules, c.ArgErr()
-		}
-
-		rules = append(rules, rule)
-	}
-
-	return rules, nil
-}
-
-func passwordMatcher(username, passw, siteRoot string) (basicauth.PasswordMatcher, error) {
-	if !strings.HasPrefix(passw, "htpasswd=") {
-		return basicauth.PlainMatcher(passw), nil
-	}
-
-	return basicauth.GetHtpasswdMatcher(passw[9:], username, siteRoot)
-}

caddy/setup/basicauth_test.go

@@ -1,132 +0,0 @@
-package setup
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/mholt/caddy/middleware/basicauth"
-)
-
-func TestBasicAuth(t *testing.T) {
-	c := NewTestController(`basicauth user pwd`)
-
-	mid, err := BasicAuth(c)
-	if err != nil {
-		t.Errorf("Expected no errors, but got: %v", err)
-	}
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(basicauth.BasicAuth)
-	if !ok {
-		t.Fatalf("Expected handler to be type BasicAuth, got: %#v", handler)
-	}
-
-	if !SameNext(myHandler.Next, EmptyNext) {
-		t.Error("'Next' field of handler was not set properly")
-	}
-}
-
-func TestBasicAuthParse(t *testing.T) {
-	htpasswdPasswd := "IedFOuGmTpT8"
-	htpasswdFile := `sha1:{SHA}dcAUljwz99qFjYR0YLTXx0RqLww=
-md5:$apr1$l42y8rex$pOA2VJ0x/0TwaFeAF9nX61`
-
-	var skipHtpassword bool
-	htfh, err := ioutil.TempFile(".", "basicauth-")
-	if err != nil {
-		t.Logf("Error creating temp file (%v), will skip htpassword test", err)
-		skipHtpassword = true
-	} else {
-		if _, err = htfh.Write([]byte(htpasswdFile)); err != nil {
-			t.Fatalf("write htpasswd file %q: %v", htfh.Name(), err)
-		}
-		htfh.Close()
-		defer os.Remove(htfh.Name())
-	}
-
-	tests := []struct {
-		input     string
-		shouldErr bool
-		password  string
-		expected  []basicauth.Rule
-	}{
-		{`basicauth user pwd`, false, "pwd", []basicauth.Rule{
-			{Username: "user"},
-		}},
-		{`basicauth user pwd {
-		}`, false, "pwd", []basicauth.Rule{
-			{Username: "user"},
-		}},
-		{`basicauth user pwd {
-			/resource1
-			/resource2
-		}`, false, "pwd", []basicauth.Rule{
-			{Username: "user", Resources: []string{"/resource1", "/resource2"}},
-		}},
-		{`basicauth /resource user pwd`, false, "pwd", []basicauth.Rule{
-			{Username: "user", Resources: []string{"/resource"}},
-		}},
-		{`basicauth /res1 user1 pwd1
-		  basicauth /res2 user2 pwd2`, false, "pwd", []basicauth.Rule{
-			{Username: "user1", Resources: []string{"/res1"}},
-			{Username: "user2", Resources: []string{"/res2"}},
-		}},
-		{`basicauth user`, true, "", []basicauth.Rule{}},
-		{`basicauth`, true, "", []basicauth.Rule{}},
-		{`basicauth /resource user pwd asdf`, true, "", []basicauth.Rule{}},
-
-		{`basicauth sha1 htpasswd=` + htfh.Name(), false, htpasswdPasswd, []basicauth.Rule{
-			{Username: "sha1"},
-		}},
-	}
-
-	for i, test := range tests {
-		c := NewTestController(test.input)
-		actual, err := basicAuthParse(c)
-
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d didn't error, but it should have", i)
-		} else if err != nil && !test.shouldErr {
-			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
-		}
-
-		if len(actual) != len(test.expected) {
-			t.Fatalf("Test %d expected %d rules, but got %d",
-				i, len(test.expected), len(actual))
-		}
-
-		for j, expectedRule := range test.expected {
-			actualRule := actual[j]
-
-			if actualRule.Username != expectedRule.Username {
-				t.Errorf("Test %d, rule %d: Expected username '%s', got '%s'",
-					i, j, expectedRule.Username, actualRule.Username)
-			}
-
-			if strings.Contains(test.input, "htpasswd=") && skipHtpassword {
-				continue
-			}
-			pwd := test.password
-			if len(actual) > 1 {
-				pwd = fmt.Sprintf("%s%d", pwd, j+1)
-			}
-			if !actualRule.Password(pwd) || actualRule.Password(test.password+"!") {
-				t.Errorf("Test %d, rule %d: Expected password '%v', got '%v'",
-					i, j, test.password, actualRule.Password(""))
-			}
-
-			expectedRes := fmt.Sprintf("%v", expectedRule.Resources)
-			actualRes := fmt.Sprintf("%v", actualRule.Resources)
-			if actualRes != expectedRes {
-				t.Errorf("Test %d, rule %d: Expected resource list %s, but got %s",
-					i, j, expectedRes, actualRes)
-			}
-		}
-	}
-}

caddy/setup/bindhost.go

@@ -1,13 +0,0 @@
-package setup
-
-import "github.com/mholt/caddy/middleware"
-
-// BindHost sets the host to bind the listener to.
-func BindHost(c *Controller) (middleware.Middleware, error) {
-	for c.Next() {
-		if !c.Args(&c.BindHost) {
-			return nil, c.ArgErr()
-		}
-	}
-	return nil, nil
-}

caddy/setup/browse.go

@@ -1,410 +0,0 @@
-package setup
-
-import (
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"text/template"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/browse"
-)
-
-// Browse configures a new Browse middleware instance.
-func Browse(c *Controller) (middleware.Middleware, error) {
-	configs, err := browseParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	browse := browse.Browse{
-		Configs:       configs,
-		IgnoreIndexes: false,
-	}
-
-	return func(next middleware.Handler) middleware.Handler {
-		browse.Next = next
-		return browse
-	}, nil
-}
-
-func browseParse(c *Controller) ([]browse.Config, error) {
-	var configs []browse.Config
-
-	appendCfg := func(bc browse.Config) error {
-		for _, c := range configs {
-			if c.PathScope == bc.PathScope {
-				return fmt.Errorf("duplicate browsing config for %s", c.PathScope)
-			}
-		}
-		configs = append(configs, bc)
-		return nil
-	}
-
-	for c.Next() {
-		var bc browse.Config
-
-		// First argument is directory to allow browsing; default is site root
-		if c.NextArg() {
-			bc.PathScope = c.Val()
-		} else {
-			bc.PathScope = "/"
-		}
-		bc.Root = http.Dir(c.Root)
-		theRoot, err := bc.Root.Open("/") // catch a missing path early
-		if err != nil {
-			return configs, err
-		}
-		defer theRoot.Close()
-		_, err = theRoot.Readdir(-1)
-		if err != nil {
-			return configs, err
-		}
-
-		// Second argument would be the template file to use
-		var tplText string
-		if c.NextArg() {
-			tplBytes, err := ioutil.ReadFile(c.Val())
-			if err != nil {
-				return configs, err
-			}
-			tplText = string(tplBytes)
-		} else {
-			tplText = defaultTemplate
-		}
-
-		// Build the template
-		tpl, err := template.New("listing").Parse(tplText)
-		if err != nil {
-			return configs, err
-		}
-		bc.Template = tpl
-
-		// Save configuration
-		err = appendCfg(bc)
-		if err != nil {
-			return configs, err
-		}
-	}
-
-	return configs, nil
-}
-
-// The default template to use when serving up directory listings
-const defaultTemplate = `<!DOCTYPE html>
-<html>
-	<head>
-		<title>{{.Name}}</title>
-		<meta name="viewport" content="width=device-width, initial-scale=1.0">
-<style>
-* { padding: 0; margin: 0; }
-
-body {
-	font-family: sans-serif;
-	text-rendering: optimizespeed;
-}
-
-a {
-	color: #006ed3;
-	text-decoration: none;
-}
-
-a:hover,
-h1 a:hover {
-	color: #319cff;
-}
-
-header,
-#summary {
-	padding-left: 5%;
-	padding-right: 5%;
-}
-
-th:first-child,
-td:first-child {
-	padding-left: 5%;
-}
-
-th:last-child,
-td:last-child {
-	padding-right: 5%;
-}
-
-header {
-	padding-top: 25px;
-	padding-bottom: 15px;
-	background-color: #f2f2f2;
-}
-
-h1 {
-	font-size: 20px;
-	font-weight: normal;
-	white-space: nowrap;
-	overflow-x: hidden;
-	text-overflow: ellipsis;
-}
-
-h1 a {
-	color: inherit;
-}
-
-h1 a:hover {
-	text-decoration: underline;
-}
-
-main {
-	display: block;
-}
-
-.meta {
-	font-size: 12px;
-	font-family: Verdana, sans-serif;
-	border-bottom: 1px solid #9C9C9C;
-	padding-top: 15px;
-	padding-bottom: 15px;
-}
-
-.meta-item {
-	margin-right: 1em;
-}
-
-table {
-	width: 100%;
-	border-collapse: collapse;
-}
-
-tr {
-	border-bottom: 1px dashed #dadada;
-}
-
-tr:not(:first-child):hover {
-	background-color: #ffffec;
-}
-
-th,
-td {
-	text-align: left;
-	padding: 10px 0;
-}
-
-th {
-	padding-top: 15px;
-	padding-bottom: 15px;
-	font-size: 16px;
-	white-space: nowrap;
-}
-
-th a {
-	color: black;
-}
-
-th svg {
-	vertical-align: middle;
-}
-
-td {
-	font-size: 14px;
-}
-
-td:first-child {
-	width: 50%;
-}
-
-th:last-child,
-td:last-child {
-	text-align: right;
-}
-
-td:first-child svg {
-	position: absolute;
-}
-
-td .name,
-td .goup {
-	margin-left: 1.75em;
-	word-break: break-all;
-	overflow-wrap: break-word;
-	white-space: pre-wrap;
-}
-
-footer {
-	padding: 40px 20px;
-	font-size: 12px;
-	text-align: center;
-}
-
-@media (max-width: 600px) {
-	.hideable {
-		display: none;
-	}
-
-	td:first-child {
-		width: auto;
-	}
-
-	th:nth-child(2),
-	td:nth-child(2) {
-		padding-right: 5%;
-		text-align: right;
-	}
-}
-</style>
-	</head>
-	<body>
-		<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" height="0" width="0" style="position: absolute;">
-			<defs>
-				<!-- Folder -->
-				<linearGradient id="f" y2="640" gradientUnits="userSpaceOnUse" x2="244.84" gradientTransform="matrix(.97319 0 0 1.0135 -.50695 -13.679)" y1="415.75" x1="244.84">
-					<stop stop-color="#b3ddfd" offset="0"/>
-					<stop stop-color="#69c" offset="1"/>
-				</linearGradient>
-				<linearGradient id="e" y2="571.06" gradientUnits="userSpaceOnUse" x2="238.03" gradientTransform="translate(0,2)" y1="346.05" x1="236.26">
-					<stop stop-color="#ace" offset="0"/>
-					<stop stop-color="#369" offset="1"/>
-				</linearGradient>
-				<g id="folder" transform="translate(-266.06 -193.36)">
-					<g transform="matrix(.066019 0 0 .066019 264.2 170.93)">
-						<g transform="matrix(1.4738 0 0 1.4738 -52.053 -166.93)">
-							<path fill="#69c" d="m98.424 343.78c-11.08 0-20 8.92-20 20v48.5 33.719 105.06c0 11.08 8.92 20 20 20h279.22c11.08 0 20-8.92 20-20v-138.78c0-11.08-8.92-20-20-20h-117.12c-7.5478-1.1844-9.7958-6.8483-10.375-11.312v-5.625-11.562c0-11.08-8.92-20-20-20h-131.72z"/>
-							<rect rx="12.885" ry="12.199" height="227.28" width="366.69" y="409.69" x="54.428" fill="#369"/>
-							<path fill="url(#e)" d="m98.424 345.78c-11.08 0-20 8.92-20 20v48.5 33.719 105.06c0 11.08 8.92 20 20 20h279.22c11.08 0 20-8.92 20-20v-138.78c0-11.08-8.92-20-20-20h-117.12c-7.5478-1.1844-9.7958-6.8483-10.375-11.312v-5.625-11.562c0-11.08-8.92-20-20-20h-131.72z"/>
-							<rect rx="12.885" ry="12.199" height="227.28" width="366.69" y="407.69" x="54.428" fill="url(#f)"/>
-						</g>
-					</g>
-				</g>
-
-				<!-- File -->
-				<linearGradient id="a">
-					<stop stop-color="#cbcbcb" offset="0"/>
-					<stop stop-color="#f0f0f0" offset=".34923"/>
-					<stop stop-color="#e2e2e2" offset="1"/>
-				</linearGradient>
-				<linearGradient id="d" y2="686.15" xlink:href="#a" gradientUnits="userSpaceOnUse" y1="207.83" gradientTransform="matrix(.28346 0 0 .31053 -608.52 485.11)" x2="380.1" x1="749.25"/>
-				<linearGradient id="c" y2="287.74" xlink:href="#a" gradientUnits="userSpaceOnUse" y1="169.44" gradientTransform="matrix(.28342 0 0 .31057 -608.52 485.11)" x2="622.33" x1="741.64"/>
-				<linearGradient id="b" y2="418.54" gradientUnits="userSpaceOnUse" y1="236.13" gradientTransform="matrix(.29343 0 0 .29999 -608.52 485.11)" x2="330.88" x1="687.96">
-					<stop stop-color="#fff" offset="0"/>
-					<stop stop-color="#fff" stop-opacity="0" offset="1"/>
-				</linearGradient>
-				<g id="file" transform="translate(-278.15 -216.59)">
-					<g fill-rule="evenodd" transform="matrix(.19775 0 0 .19775 381.05 112.68)">
-						<path d="m-520.17 525.5v36.739 36.739 36.739 36.739h33.528 33.528 33.528 33.528v-36.739-36.739-36.739l-33.528-36.739h-33.528-33.528-33.528z" stroke-opacity=".36478" stroke-width=".42649" fill="#fff"/>
-						<g>
-							<path d="m-520.11 525.68v36.739 36.739 36.739 36.739h33.528 33.528 33.528 33.528v-36.739-36.739-36.739l-33.528-36.739h-33.528-33.528-33.528z" stroke-opacity=".36478" stroke="#000" stroke-width=".42649" fill="url(#d)"/>
-							<path d="m-386 562.42c-10.108-2.9925-23.206-2.5682-33.101-0.86253 1.7084-10.962 1.922-24.701-0.4271-35.877l33.528 36.739z" stroke-width=".95407pt" fill="url(#c)"/>
-							<path d="m-519.13 537-0.60402 134.7h131.68l0.0755-33.296c-2.9446 1.1325-32.692-40.998-70.141-39.186-37.483 1.8137-27.785-56.777-61.006-62.214z" stroke-width="1pt" fill="url(#b)"/>
-						</g>
-					</g>
-				</g>
-
-				<!-- Up arrow -->
-				<g id="up-arrow" transform="translate(-279.22 -208.12)">
-					<path transform="matrix(.22413 0 0 .12089 335.67 164.35)" stroke-width="0" d="m-194.17 412.01h-28.827-28.827l14.414-24.965 14.414-24.965 14.414 24.965z"/>
-				</g>
-
-				<!-- Down arrow -->
-				<g id="down-arrow" transform="translate(-279.22 -208.12)">
-					<path transform="matrix(.22413 0 0 -.12089 335.67 257.93)" stroke-width="0" d="m-194.17 412.01h-28.827-28.827l14.414-24.965 14.414-24.965 14.414 24.965z"/>
-				</g>
-			</defs>
-		</svg>
-
-		<header>
-			<h1>
-				{{range $url, $name := .BreadcrumbMap}}<a href="{{$url}}">{{$name}}</a>{{if ne $url "/"}}/{{end}}{{end}}
-			</h1>
-		</header>
-		<main>
-			<div class="meta">
-				<div id="summary">
-					<span class="meta-item"><b>{{.NumDirs}}</b> director{{if eq 1 .NumDirs}}y{{else}}ies{{end}}</span>
-					<span class="meta-item"><b>{{.NumFiles}}</b> file{{if ne 1 .NumFiles}}s{{end}}</span>
-					{{- if ne 0 .ItemsLimitedTo}}
-					<span class="meta-item">(of which only <b>{{.ItemsLimitedTo}}</b> are displayed)</span>
-					{{- end}}
-				</div>
-			</div>
-			<div class="listing">
-				<table aria-describedby="summary">
-					<thead>
-					<tr>
-						<th>
-							{{- if and (eq .Sort "name") (ne .Order "desc")}}
-							<a href="?sort=name&order=desc{{if ne 0 .ItemsLimitedTo}}&limit={{.ItemsLimitedTo}}{{end}}">Name <svg width="1em" height=".4em" version="1.1" viewBox="0 0 12.922194 6.0358899"><use xlink:href="#up-arrow"></use></svg></a>
-							{{- else if and (eq .Sort "name") (ne .Order "asc")}}
-							<a href="?sort=name&order=asc{{if ne 0 .ItemsLimitedTo}}&limit={{.ItemsLimitedTo}}{{end}}">Name <svg width="1em" height=".4em" version="1.1" viewBox="0 0 12.922194 6.0358899"><use xlink:href="#down-arrow"></use></svg></a>
-							{{- else}}
-							<a href="?sort=name&order=asc{{if ne 0 .ItemsLimitedTo}}&limit={{.ItemsLimitedTo}}{{end}}">Name</a>
-							{{- end}}
-						</th>
-						<th>
-							{{- if and (eq .Sort "size") (ne .Order "desc")}}
-							<a href="?sort=size&order=desc{{if ne 0 .ItemsLimitedTo}}&limit={{.ItemsLimitedTo}}{{end}}">Size <svg width="1em" height=".4em" version="1.1" viewBox="0 0 12.922194 6.0358899"><use xlink:href="#up-arrow"></use></svg></a></a>
-							{{- else if and (eq .Sort "size") (ne .Order "asc")}}
-							<a href="?sort=size&order=asc{{if ne 0 .ItemsLimitedTo}}&limit={{.ItemsLimitedTo}}{{end}}">Size <svg width="1em" height=".4em" version="1.1" viewBox="0 0 12.922194 6.0358899"><use xlink:href="#down-arrow"></use></svg></a></a>
-							{{- else}}
-							<a href="?sort=size&order=asc{{if ne 0 .ItemsLimitedTo}}&limit={{.ItemsLimitedTo}}{{end}}">Size</a>
-							{{- end}}
-						</th>
-						<th class="hideable">
-							{{- if and (eq .Sort "time") (ne .Order "desc")}}
-							<a href="?sort=time&order=desc{{if ne 0 .ItemsLimitedTo}}&limit={{.ItemsLimitedTo}}{{end}}">Modified <svg width="1em" height=".4em" version="1.1" viewBox="0 0 12.922194 6.0358899"><use xlink:href="#up-arrow"></use></svg></a></a>
-							{{- else if and (eq .Sort "time") (ne .Order "asc")}}
-							<a href="?sort=time&order=asc{{if ne 0 .ItemsLimitedTo}}&limit={{.ItemsLimitedTo}}{{end}}">Modified <svg width="1em" height=".4em" version="1.1" viewBox="0 0 12.922194 6.0358899"><use xlink:href="#down-arrow"></use></svg></a></a>
-							{{- else}}
-							<a href="?sort=time&order=asc{{if ne 0 .ItemsLimitedTo}}&limit={{.ItemsLimitedTo}}{{end}}">Modified</a>
-							{{- end}}
-						</th>
-					</tr>
-					</thead>
-					<tbody>
-					{{- if .CanGoUp}}
-					<tr>
-						<td>
-							<a href="..">
-								<span class="goup">Go up</span>
-							</a>
-						</td>
-						<td>&mdash;</td>
-						<td class="hideable">&mdash;</td>
-					</tr>
-					{{- end}}
-					{{- range .Items}}
-					<tr>
-						<td>
-							<a href="{{.URL}}">
-								{{- if .IsDir}}
-								<svg width="1.5em" height="1em" version="1.1" viewBox="0 0 35.678803 28.527945"><use xlink:href="#folder"></use></svg>
-								{{- else}}
-								<svg width="1.5em" height="1em" version="1.1" viewBox="0 0 26.604381 29.144726"><use xlink:href="#file"></use></svg>
-								{{- end}}
-								<span class="name">{{.Name}}</span>
-							</a>
-						</td>
-						{{- if .IsDir}}
-						<td data-order="-1">&mdash;</td>
-						{{- else}}
-						<td data-order="{{.Size}}">{{.HumanSize}}</td>
-						{{- end}}
-						<td class="hideable"><time datetime="{{.HumanModTime "2006-01-02 15:04:05-0700"}}">{{.HumanModTime "01/02/2006 03:04:05 PM"}}</time></td>
-					</tr>
-					{{- end}}
-					</tbody>
-				</table>
-			</div>
-		</main>
-		<footer>
-			Served with <a href="https://caddyserver.com">Caddy</a>
-		</footer>
-		<script type="text/javascript">
-			function localizeDatetime(e, index, ar) {
-				if (e.textContent === undefined) {
-					return;
-				}
-				var d = new Date(e.getAttribute('datetime'));
-				e.textContent = d.toLocaleString();
-			}
-			var timeList = Array.prototype.slice.call(document.getElementsByTagName("time"));
-			timeList.forEach(localizeDatetime);
-		</script>
-	</body>
-</html>`

caddy/setup/browse_test.go

@@ -1,65 +0,0 @@
-package setup
-
-import (
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"strconv"
-	"testing"
-	"time"
-
-	"github.com/mholt/caddy/middleware/browse"
-)
-
-func TestBrowse(t *testing.T) {
-
-	tempDirPath, err := getTempDirPath()
-	if err != nil {
-		t.Fatalf("BeforeTest: Failed to find an existing directory for testing! Error was: %v", err)
-	}
-	nonExistantDirPath := filepath.Join(tempDirPath, strconv.Itoa(int(time.Now().UnixNano())))
-
-	tempTemplate, err := ioutil.TempFile(".", "tempTemplate")
-	if err != nil {
-		t.Fatalf("BeforeTest: Failed to create a temporary file in the working directory! Error was: %v", err)
-	}
-	defer os.Remove(tempTemplate.Name())
-
-	tempTemplatePath := filepath.Join(".", tempTemplate.Name())
-
-	for i, test := range []struct {
-		input             string
-		expectedPathScope []string
-		shouldErr         bool
-	}{
-		// test case #0 tests handling of multiple pathscopes
-		{"browse " + tempDirPath + "\n browse .", []string{tempDirPath, "."}, false},
-
-		// test case #1 tests instantiation of browse.Config with default values
-		{"browse /", []string{"/"}, false},
-
-		// test case #2 tests detectaction of custom template
-		{"browse . " + tempTemplatePath, []string{"."}, false},
-
-		// test case #3 tests detection of non-existent template
-		{"browse . " + nonExistantDirPath, nil, true},
-
-		// test case #4 tests detection of duplicate pathscopes
-		{"browse " + tempDirPath + "\n browse " + tempDirPath, nil, true},
-	} {
-
-		recievedFunc, err := Browse(NewTestController(test.input))
-		if err != nil && !test.shouldErr {
-			t.Errorf("Test case #%d recieved an error of %v", i, err)
-		}
-		if test.expectedPathScope == nil {
-			continue
-		}
-		recievedConfigs := recievedFunc(nil).(browse.Browse).Configs
-		for j, config := range recievedConfigs {
-			if config.PathScope != test.expectedPathScope[j] {
-				t.Errorf("Test case #%d expected a pathscope of %v, but got %v", i, test.expectedPathScope, config.PathScope)
-			}
-		}
-	}
-}

caddy/setup/controller.go

@@ -1,83 +0,0 @@
-package setup
-
-import (
-	"fmt"
-	"net/http"
-	"strings"
-
-	"github.com/mholt/caddy/caddy/parse"
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/server"
-)
-
-// Controller is given to the setup function of middlewares which
-// gives them access to be able to read tokens and set config. Each
-// virtualhost gets their own server config and dispenser.
-type Controller struct {
-	*server.Config
-	parse.Dispenser
-
-	// OncePerServerBlock is a function that executes f
-	// exactly once per server block, no matter how many
-	// hosts are associated with it. If it is the first
-	// time, the function f is executed immediately
-	// (not deferred) and may return an error which is
-	// returned by OncePerServerBlock.
-	OncePerServerBlock func(f func() error) error
-
-	// ServerBlockIndex is the 0-based index of the
-	// server block as it appeared in the input.
-	ServerBlockIndex int
-
-	// ServerBlockHostIndex is the 0-based index of this
-	// host as it appeared in the input at the head of the
-	// server block.
-	ServerBlockHostIndex int
-
-	// ServerBlockHosts is a list of hosts that are
-	// associated with this server block. All these
-	// hosts, consequently, share the same tokens.
-	ServerBlockHosts []string
-
-	// ServerBlockStorage is used by a directive's
-	// setup function to persist state between all
-	// the hosts on a server block.
-	ServerBlockStorage interface{}
-}
-
-// NewTestController creates a new *Controller for
-// the input specified, with a filename of "Testfile".
-// The Config is bare, consisting only of a Root of cwd.
-//
-// Used primarily for testing but needs to be exported so
-// add-ons can use this as a convenience. Does not initialize
-// the server-block-related fields.
-func NewTestController(input string) *Controller {
-	return &Controller{
-		Config: &server.Config{
-			Root: ".",
-		},
-		Dispenser: parse.NewDispenser("Testfile", strings.NewReader(input)),
-		OncePerServerBlock: func(f func() error) error {
-			return f()
-		},
-	}
-}
-
-// EmptyNext is a no-op function that can be passed into
-// middleware.Middleware functions so that the assignment
-// to the Next field of the Handler can be tested.
-//
-// Used primarily for testing but needs to be exported so
-// add-ons can use this as a convenience.
-var EmptyNext = middleware.HandlerFunc(func(w http.ResponseWriter, r *http.Request) (int, error) {
-	return 0, nil
-})
-
-// SameNext does a pointer comparison between next1 and next2.
-//
-// Used primarily for testing but needs to be exported so
-// add-ons can use this as a convenience.
-func SameNext(next1, next2 middleware.Handler) bool {
-	return fmt.Sprintf("%v", next1) == fmt.Sprintf("%v", next2)
-}

caddy/setup/errors.go

@@ -1,148 +0,0 @@
-package setup
-
-import (
-	"io"
-	"log"
-	"os"
-	"path/filepath"
-	"strconv"
-
-	"github.com/hashicorp/go-syslog"
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/errors"
-)
-
-// Errors configures a new errors middleware instance.
-func Errors(c *Controller) (middleware.Middleware, error) {
-	handler, err := errorsParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	// Open the log file for writing when the server starts
-	c.Startup = append(c.Startup, func() error {
-		var err error
-		var writer io.Writer
-
-		switch handler.LogFile {
-		case "visible":
-			handler.Debug = true
-		case "stdout":
-			writer = os.Stdout
-		case "stderr":
-			writer = os.Stderr
-		case "syslog":
-			writer, err = gsyslog.NewLogger(gsyslog.LOG_ERR, "LOCAL0", "caddy")
-			if err != nil {
-				return err
-			}
-		default:
-			if handler.LogFile == "" {
-				writer = os.Stderr // default
-				break
-			}
-
-			var file *os.File
-			file, err = os.OpenFile(handler.LogFile, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0644)
-			if err != nil {
-				return err
-			}
-			if handler.LogRoller != nil {
-				file.Close()
-
-				handler.LogRoller.Filename = handler.LogFile
-
-				writer = handler.LogRoller.GetLogWriter()
-			} else {
-				writer = file
-			}
-		}
-
-		handler.Log = log.New(writer, "", 0)
-		return nil
-	})
-
-	return func(next middleware.Handler) middleware.Handler {
-		handler.Next = next
-		return handler
-	}, nil
-}
-
-func errorsParse(c *Controller) (*errors.ErrorHandler, error) {
-	// Very important that we make a pointer because the Startup
-	// function that opens the log file must have access to the
-	// same instance of the handler, not a copy.
-	handler := &errors.ErrorHandler{ErrorPages: make(map[int]string)}
-
-	optionalBlock := func() (bool, error) {
-		var hadBlock bool
-
-		for c.NextBlock() {
-			hadBlock = true
-
-			what := c.Val()
-			if !c.NextArg() {
-				return hadBlock, c.ArgErr()
-			}
-			where := c.Val()
-
-			if what == "log" {
-				if where == "visible" {
-					handler.Debug = true
-				} else {
-					handler.LogFile = where
-					if c.NextArg() {
-						if c.Val() == "{" {
-							c.IncrNest()
-							logRoller, err := parseRoller(c)
-							if err != nil {
-								return hadBlock, err
-							}
-							handler.LogRoller = logRoller
-						}
-					}
-				}
-			} else {
-				// Error page; ensure it exists
-				where = filepath.Join(c.Root, where)
-				f, err := os.Open(where)
-				if err != nil {
-					log.Printf("[WARNING] Unable to open error page '%s': %v", where, err)
-				}
-				f.Close()
-
-				whatInt, err := strconv.Atoi(what)
-				if err != nil {
-					return hadBlock, c.Err("Expecting a numeric status code, got '" + what + "'")
-				}
-				handler.ErrorPages[whatInt] = where
-			}
-		}
-		return hadBlock, nil
-	}
-
-	for c.Next() {
-		// weird hack to avoid having the handler values overwritten.
-		if c.Val() == "}" {
-			continue
-		}
-		// Configuration may be in a block
-		hadBlock, err := optionalBlock()
-		if err != nil {
-			return handler, err
-		}
-
-		// Otherwise, the only argument would be an error log file name or 'visible'
-		if !hadBlock {
-			if c.NextArg() {
-				if c.Val() == "visible" {
-					handler.Debug = true
-				} else {
-					handler.LogFile = c.Val()
-				}
-			}
-		}
-	}
-
-	return handler, nil
-}

caddy/setup/errors_test.go

@@ -1,158 +0,0 @@
-package setup
-
-import (
-	"testing"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/errors"
-)
-
-func TestErrors(t *testing.T) {
-	c := NewTestController(`errors`)
-	mid, err := Errors(c)
-
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(*errors.ErrorHandler)
-
-	if !ok {
-		t.Fatalf("Expected handler to be type ErrorHandler, got: %#v", handler)
-	}
-
-	if myHandler.LogFile != "" {
-		t.Errorf("Expected '%s' as the default LogFile", "")
-	}
-	if myHandler.LogRoller != nil {
-		t.Errorf("Expected LogRoller to be nil, got: %v", *myHandler.LogRoller)
-	}
-	if !SameNext(myHandler.Next, EmptyNext) {
-		t.Error("'Next' field of handler was not set properly")
-	}
-
-	// Test Startup function
-	if len(c.Startup) == 0 {
-		t.Fatal("Expected 1 startup function, had 0")
-	}
-	c.Startup[0]()
-	if myHandler.Log == nil {
-		t.Error("Expected Log to be non-nil after startup because Debug is not enabled")
-	}
-}
-
-func TestErrorsParse(t *testing.T) {
-	tests := []struct {
-		inputErrorsRules     string
-		shouldErr            bool
-		expectedErrorHandler errors.ErrorHandler
-	}{
-		{`errors`, false, errors.ErrorHandler{
-			LogFile: "",
-		}},
-		{`errors errors.txt`, false, errors.ErrorHandler{
-			LogFile: "errors.txt",
-		}},
-		{`errors visible`, false, errors.ErrorHandler{
-			LogFile: "",
-			Debug:   true,
-		}},
-		{`errors { log visible }`, false, errors.ErrorHandler{
-			LogFile: "",
-			Debug:   true,
-		}},
-		{`errors { log errors.txt
-        404 404.html
-        500 500.html
-}`, false, errors.ErrorHandler{
-			LogFile: "errors.txt",
-			ErrorPages: map[int]string{
-				404: "404.html",
-				500: "500.html",
-			},
-		}},
-		{`errors { log errors.txt { size 2 age 10 keep 3 } }`, false, errors.ErrorHandler{
-			LogFile: "errors.txt",
-			LogRoller: &middleware.LogRoller{
-				MaxSize:    2,
-				MaxAge:     10,
-				MaxBackups: 3,
-				LocalTime:  true,
-			},
-		}},
-		{`errors { log errors.txt {
-            size 3
-            age 11
-            keep 5
-        }
-        404 404.html
-        503 503.html
-}`, false, errors.ErrorHandler{
-			LogFile: "errors.txt",
-			ErrorPages: map[int]string{
-				404: "404.html",
-				503: "503.html",
-			},
-			LogRoller: &middleware.LogRoller{
-				MaxSize:    3,
-				MaxAge:     11,
-				MaxBackups: 5,
-				LocalTime:  true,
-			},
-		}},
-	}
-	for i, test := range tests {
-		c := NewTestController(test.inputErrorsRules)
-		actualErrorsRule, err := errorsParse(c)
-
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d didn't error, but it should have", i)
-		} else if err != nil && !test.shouldErr {
-			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
-		}
-		if actualErrorsRule.LogFile != test.expectedErrorHandler.LogFile {
-			t.Errorf("Test %d expected LogFile to be %s, but got %s",
-				i, test.expectedErrorHandler.LogFile, actualErrorsRule.LogFile)
-		}
-		if actualErrorsRule.Debug != test.expectedErrorHandler.Debug {
-			t.Errorf("Test %d expected Debug to be %v, but got %v",
-				i, test.expectedErrorHandler.Debug, actualErrorsRule.Debug)
-		}
-		if actualErrorsRule.LogRoller != nil && test.expectedErrorHandler.LogRoller == nil || actualErrorsRule.LogRoller == nil && test.expectedErrorHandler.LogRoller != nil {
-			t.Fatalf("Test %d expected LogRoller to be %v, but got %v",
-				i, test.expectedErrorHandler.LogRoller, actualErrorsRule.LogRoller)
-		}
-		if len(actualErrorsRule.ErrorPages) != len(test.expectedErrorHandler.ErrorPages) {
-			t.Fatalf("Test %d expected %d no of Error pages, but got %d ",
-				i, len(test.expectedErrorHandler.ErrorPages), len(actualErrorsRule.ErrorPages))
-		}
-		if actualErrorsRule.LogRoller != nil && test.expectedErrorHandler.LogRoller != nil {
-			if actualErrorsRule.LogRoller.Filename != test.expectedErrorHandler.LogRoller.Filename {
-				t.Fatalf("Test %d expected LogRoller Filename to be %s, but got %s",
-					i, test.expectedErrorHandler.LogRoller.Filename, actualErrorsRule.LogRoller.Filename)
-			}
-			if actualErrorsRule.LogRoller.MaxAge != test.expectedErrorHandler.LogRoller.MaxAge {
-				t.Fatalf("Test %d expected LogRoller MaxAge to be %d, but got %d",
-					i, test.expectedErrorHandler.LogRoller.MaxAge, actualErrorsRule.LogRoller.MaxAge)
-			}
-			if actualErrorsRule.LogRoller.MaxBackups != test.expectedErrorHandler.LogRoller.MaxBackups {
-				t.Fatalf("Test %d expected LogRoller MaxBackups to be %d, but got %d",
-					i, test.expectedErrorHandler.LogRoller.MaxBackups, actualErrorsRule.LogRoller.MaxBackups)
-			}
-			if actualErrorsRule.LogRoller.MaxSize != test.expectedErrorHandler.LogRoller.MaxSize {
-				t.Fatalf("Test %d expected LogRoller MaxSize to be %d, but got %d",
-					i, test.expectedErrorHandler.LogRoller.MaxSize, actualErrorsRule.LogRoller.MaxSize)
-			}
-			if actualErrorsRule.LogRoller.LocalTime != test.expectedErrorHandler.LogRoller.LocalTime {
-				t.Fatalf("Test %d expected LogRoller LocalTime to be %t, but got %t",
-					i, test.expectedErrorHandler.LogRoller.LocalTime, actualErrorsRule.LogRoller.LocalTime)
-			}
-		}
-	}
-
-}

caddy/setup/expvar.go

@@ -1,60 +0,0 @@
-package setup
-
-import (
-	stdexpvar "expvar"
-	"runtime"
-	"sync"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/expvar"
-)
-
-// ExpVar configures a new ExpVar middleware instance.
-func ExpVar(c *Controller) (middleware.Middleware, error) {
-	resource, err := expVarParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	// publish any extra information/metrics we may want to capture
-	publishExtraVars()
-
-	expvar := expvar.ExpVar{Resource: resource}
-
-	return func(next middleware.Handler) middleware.Handler {
-		expvar.Next = next
-		return expvar
-	}, nil
-}
-
-func expVarParse(c *Controller) (expvar.Resource, error) {
-	var resource expvar.Resource
-	var err error
-
-	for c.Next() {
-		args := c.RemainingArgs()
-		switch len(args) {
-		case 0:
-			resource = expvar.Resource(defaultExpvarPath)
-		case 1:
-			resource = expvar.Resource(args[0])
-		default:
-			return resource, c.ArgErr()
-		}
-	}
-
-	return resource, err
-}
-
-func publishExtraVars() {
-	// By using sync.Once instead of an init() function, we don't clutter
-	// the app's expvar export unnecessarily, or risk colliding with it.
-	publishOnce.Do(func() {
-		stdexpvar.Publish("Goroutines", stdexpvar.Func(func() interface{} {
-			return runtime.NumGoroutine()
-		}))
-	})
-}
-
-var publishOnce sync.Once // publishing variables should only be done once
-var defaultExpvarPath = "/debug/vars"

caddy/setup/expvar_test.go

@@ -1,39 +0,0 @@
-package setup
-
-import (
-	"testing"
-
-	"github.com/mholt/caddy/middleware/expvar"
-)
-
-func TestExpvar(t *testing.T) {
-	c := NewTestController(`expvar`)
-	mid, err := ExpVar(c)
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	c = NewTestController(`expvar /d/v`)
-	mid, err = ExpVar(c)
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(expvar.ExpVar)
-	if !ok {
-		t.Fatalf("Expected handler to be type ExpVar, got: %#v", handler)
-	}
-	if myHandler.Resource != "/d/v" {
-		t.Errorf("Expected /d/v as expvar resource")
-	}
-	if !SameNext(myHandler.Next, EmptyNext) {
-		t.Error("'Next' field of handler was not set properly")
-	}
-}

caddy/setup/ext.go

@@ -1,55 +0,0 @@
-package setup
-
-import (
-	"os"
-	"path/filepath"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/extensions"
-)
-
-// Ext configures a new instance of 'extensions' middleware for clean URLs.
-func Ext(c *Controller) (middleware.Middleware, error) {
-	root := c.Root
-
-	exts, err := extParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	return func(next middleware.Handler) middleware.Handler {
-		return extensions.Ext{
-			Next:       next,
-			Extensions: exts,
-			Root:       root,
-		}
-	}, nil
-}
-
-// extParse sets up an instance of extension middleware
-// from a middleware controller and returns a list of extensions.
-func extParse(c *Controller) ([]string, error) {
-	var exts []string
-
-	for c.Next() {
-		// At least one extension is required
-		if !c.NextArg() {
-			return exts, c.ArgErr()
-		}
-		exts = append(exts, c.Val())
-
-		// Tack on any other extensions that may have been listed
-		exts = append(exts, c.RemainingArgs()...)
-	}
-
-	return exts, nil
-}
-
-// resourceExists returns true if the file specified at
-// root + path exists; false otherwise.
-func resourceExists(root, path string) bool {
-	_, err := os.Stat(filepath.Join(root, path))
-	// technically we should use os.IsNotExist(err)
-	// but we don't handle any other kinds of errors anyway
-	return err == nil
-}

caddy/setup/ext_test.go

@@ -1,76 +0,0 @@
-package setup
-
-import (
-	"testing"
-
-	"github.com/mholt/caddy/middleware/extensions"
-)
-
-func TestExt(t *testing.T) {
-	c := NewTestController(`ext .html .htm .php`)
-
-	mid, err := Ext(c)
-
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(extensions.Ext)
-
-	if !ok {
-		t.Fatalf("Expected handler to be type Ext, got: %#v", handler)
-	}
-
-	if myHandler.Extensions[0] != ".html" {
-		t.Errorf("Expected .html in the list of Extensions")
-	}
-	if myHandler.Extensions[1] != ".htm" {
-		t.Errorf("Expected .htm in the list of Extensions")
-	}
-	if myHandler.Extensions[2] != ".php" {
-		t.Errorf("Expected .php in the list of Extensions")
-	}
-	if !SameNext(myHandler.Next, EmptyNext) {
-		t.Error("'Next' field of handler was not set properly")
-	}
-
-}
-
-func TestExtParse(t *testing.T) {
-	tests := []struct {
-		inputExts    string
-		shouldErr    bool
-		expectedExts []string
-	}{
-		{`ext .html .htm .php`, false, []string{".html", ".htm", ".php"}},
-		{`ext .php .html .xml`, false, []string{".php", ".html", ".xml"}},
-		{`ext .txt .php .xml`, false, []string{".txt", ".php", ".xml"}},
-	}
-	for i, test := range tests {
-		c := NewTestController(test.inputExts)
-		actualExts, err := extParse(c)
-
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d didn't error, but it should have", i)
-		} else if err != nil && !test.shouldErr {
-			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
-		}
-
-		if len(actualExts) != len(test.expectedExts) {
-			t.Fatalf("Test %d expected %d rules, but got %d",
-				i, len(test.expectedExts), len(actualExts))
-		}
-		for j, actualExt := range actualExts {
-			if actualExt != test.expectedExts[j] {
-				t.Fatalf("Test %d expected %dth extension to be  %s  , but got %s",
-					i, j, test.expectedExts[j], actualExt)
-			}
-		}
-	}
-
-}

caddy/setup/fastcgi.go

@@ -1,116 +0,0 @@
-package setup
-
-import (
-	"errors"
-	"net/http"
-	"path/filepath"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/fastcgi"
-)
-
-// FastCGI configures a new FastCGI middleware instance.
-func FastCGI(c *Controller) (middleware.Middleware, error) {
-	absRoot, err := filepath.Abs(c.Root)
-	if err != nil {
-		return nil, err
-	}
-
-	rules, err := fastcgiParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	return func(next middleware.Handler) middleware.Handler {
-		return fastcgi.Handler{
-			Next:            next,
-			Rules:           rules,
-			Root:            c.Root,
-			AbsRoot:         absRoot,
-			FileSys:         http.Dir(c.Root),
-			SoftwareName:    c.AppName,
-			SoftwareVersion: c.AppVersion,
-			ServerName:      c.Host,
-			ServerPort:      c.Port,
-		}
-	}, nil
-}
-
-func fastcgiParse(c *Controller) ([]fastcgi.Rule, error) {
-	var rules []fastcgi.Rule
-
-	for c.Next() {
-		var rule fastcgi.Rule
-
-		args := c.RemainingArgs()
-
-		switch len(args) {
-		case 0:
-			return rules, c.ArgErr()
-		case 1:
-			rule.Path = "/"
-			rule.Address = args[0]
-		case 2:
-			rule.Path = args[0]
-			rule.Address = args[1]
-		case 3:
-			rule.Path = args[0]
-			rule.Address = args[1]
-			err := fastcgiPreset(args[2], &rule)
-			if err != nil {
-				return rules, c.Err("Invalid fastcgi rule preset '" + args[2] + "'")
-			}
-		}
-
-		for c.NextBlock() {
-			switch c.Val() {
-			case "ext":
-				if !c.NextArg() {
-					return rules, c.ArgErr()
-				}
-				rule.Ext = c.Val()
-			case "split":
-				if !c.NextArg() {
-					return rules, c.ArgErr()
-				}
-				rule.SplitPath = c.Val()
-			case "index":
-				args := c.RemainingArgs()
-				if len(args) == 0 {
-					return rules, c.ArgErr()
-				}
-				rule.IndexFiles = args
-			case "env":
-				envArgs := c.RemainingArgs()
-				if len(envArgs) < 2 {
-					return rules, c.ArgErr()
-				}
-				rule.EnvVars = append(rule.EnvVars, [2]string{envArgs[0], envArgs[1]})
-			case "except":
-				ignoredPaths := c.RemainingArgs()
-				if len(ignoredPaths) == 0 {
-					return rules, c.ArgErr()
-				}
-				rule.IgnoredSubPaths = ignoredPaths
-			}
-		}
-
-		rules = append(rules, rule)
-	}
-
-	return rules, nil
-}
-
-// fastcgiPreset configures rule according to name. It returns an error if
-// name is not a recognized preset name.
-func fastcgiPreset(name string, rule *fastcgi.Rule) error {
-	switch name {
-	case "php":
-		rule.Ext = ".php"
-		rule.SplitPath = ".php"
-		rule.IndexFiles = []string{"index.php"}
-	default:
-		return errors.New(name + " is not a valid preset name")
-	}
-	return nil
-}

caddy/setup/fastcgi_test.go

@@ -1,125 +0,0 @@
-package setup
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/mholt/caddy/middleware/fastcgi"
-)
-
-func TestFastCGI(t *testing.T) {
-
-	c := NewTestController(`fastcgi / 127.0.0.1:9000`)
-
-	mid, err := FastCGI(c)
-
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(fastcgi.Handler)
-
-	if !ok {
-		t.Fatalf("Expected handler to be type , got: %#v", handler)
-	}
-
-	if myHandler.Rules[0].Path != "/" {
-		t.Errorf("Expected / as the Path")
-	}
-	if myHandler.Rules[0].Address != "127.0.0.1:9000" {
-		t.Errorf("Expected 127.0.0.1:9000 as the Address")
-	}
-
-}
-
-func TestFastcgiParse(t *testing.T) {
-	tests := []struct {
-		inputFastcgiConfig    string
-		shouldErr             bool
-		expectedFastcgiConfig []fastcgi.Rule
-	}{
-
-		{`fastcgi /blog 127.0.0.1:9000 php`,
-			false, []fastcgi.Rule{{
-				Path:       "/blog",
-				Address:    "127.0.0.1:9000",
-				Ext:        ".php",
-				SplitPath:  ".php",
-				IndexFiles: []string{"index.php"},
-			}}},
-		{`fastcgi / 127.0.0.1:9001 {
-	              split .html
-	              }`,
-			false, []fastcgi.Rule{{
-				Path:       "/",
-				Address:    "127.0.0.1:9001",
-				Ext:        "",
-				SplitPath:  ".html",
-				IndexFiles: []string{},
-			}}},
-		{`fastcgi / 127.0.0.1:9001 {
-	              split .html
-	              except /admin /user
-	              }`,
-			false, []fastcgi.Rule{{
-				Path:            "/",
-				Address:         "127.0.0.1:9001",
-				Ext:             "",
-				SplitPath:       ".html",
-				IndexFiles:      []string{},
-				IgnoredSubPaths: []string{"/admin", "/user"},
-			}}},
-	}
-	for i, test := range tests {
-		c := NewTestController(test.inputFastcgiConfig)
-		actualFastcgiConfigs, err := fastcgiParse(c)
-
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d didn't error, but it should have", i)
-		} else if err != nil && !test.shouldErr {
-			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
-		}
-		if len(actualFastcgiConfigs) != len(test.expectedFastcgiConfig) {
-			t.Fatalf("Test %d expected %d no of FastCGI configs, but got %d ",
-				i, len(test.expectedFastcgiConfig), len(actualFastcgiConfigs))
-		}
-		for j, actualFastcgiConfig := range actualFastcgiConfigs {
-
-			if actualFastcgiConfig.Path != test.expectedFastcgiConfig[j].Path {
-				t.Errorf("Test %d expected %dth FastCGI Path to be  %s  , but got %s",
-					i, j, test.expectedFastcgiConfig[j].Path, actualFastcgiConfig.Path)
-			}
-
-			if actualFastcgiConfig.Address != test.expectedFastcgiConfig[j].Address {
-				t.Errorf("Test %d expected %dth FastCGI Address to be  %s  , but got %s",
-					i, j, test.expectedFastcgiConfig[j].Address, actualFastcgiConfig.Address)
-			}
-
-			if actualFastcgiConfig.Ext != test.expectedFastcgiConfig[j].Ext {
-				t.Errorf("Test %d expected %dth FastCGI Ext to be  %s  , but got %s",
-					i, j, test.expectedFastcgiConfig[j].Ext, actualFastcgiConfig.Ext)
-			}
-
-			if actualFastcgiConfig.SplitPath != test.expectedFastcgiConfig[j].SplitPath {
-				t.Errorf("Test %d expected %dth FastCGI SplitPath to be  %s  , but got %s",
-					i, j, test.expectedFastcgiConfig[j].SplitPath, actualFastcgiConfig.SplitPath)
-			}
-
-			if fmt.Sprint(actualFastcgiConfig.IndexFiles) != fmt.Sprint(test.expectedFastcgiConfig[j].IndexFiles) {
-				t.Errorf("Test %d expected %dth FastCGI IndexFiles to be  %s  , but got %s",
-					i, j, test.expectedFastcgiConfig[j].IndexFiles, actualFastcgiConfig.IndexFiles)
-			}
-
-			if fmt.Sprint(actualFastcgiConfig.IgnoredSubPaths) != fmt.Sprint(test.expectedFastcgiConfig[j].IgnoredSubPaths) {
-				t.Errorf("Test %d expected %dth FastCGI IgnoredSubPaths to be  %s  , but got %s",
-					i, j, test.expectedFastcgiConfig[j].IgnoredSubPaths, actualFastcgiConfig.IgnoredSubPaths)
-			}
-		}
-	}
-
-}

caddy/setup/gzip.go

@@ -1,117 +0,0 @@
-package setup
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/gzip"
-)
-
-// Gzip configures a new gzip middleware instance.
-func Gzip(c *Controller) (middleware.Middleware, error) {
-	configs, err := gzipParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	return func(next middleware.Handler) middleware.Handler {
-		return gzip.Gzip{Next: next, Configs: configs}
-	}, nil
-}
-
-func gzipParse(c *Controller) ([]gzip.Config, error) {
-	var configs []gzip.Config
-
-	for c.Next() {
-		config := gzip.Config{}
-
-		// Request Filters
-		pathFilter := gzip.PathFilter{IgnoredPaths: make(gzip.Set)}
-		extFilter := gzip.ExtFilter{Exts: make(gzip.Set)}
-
-		// Response Filters
-		lengthFilter := gzip.LengthFilter(0)
-
-		// No extra args expected
-		if len(c.RemainingArgs()) > 0 {
-			return configs, c.ArgErr()
-		}
-
-		for c.NextBlock() {
-			switch c.Val() {
-			case "ext":
-				exts := c.RemainingArgs()
-				if len(exts) == 0 {
-					return configs, c.ArgErr()
-				}
-				for _, e := range exts {
-					if !strings.HasPrefix(e, ".") && e != gzip.ExtWildCard && e != "" {
-						return configs, fmt.Errorf(`gzip: invalid extension "%v" (must start with dot)`, e)
-					}
-					extFilter.Exts.Add(e)
-				}
-			case "not":
-				paths := c.RemainingArgs()
-				if len(paths) == 0 {
-					return configs, c.ArgErr()
-				}
-				for _, p := range paths {
-					if p == "/" {
-						return configs, fmt.Errorf(`gzip: cannot exclude path "/" - remove directive entirely instead`)
-					}
-					if !strings.HasPrefix(p, "/") {
-						return configs, fmt.Errorf(`gzip: invalid path "%v" (must start with /)`, p)
-					}
-					pathFilter.IgnoredPaths.Add(p)
-				}
-			case "level":
-				if !c.NextArg() {
-					return configs, c.ArgErr()
-				}
-				level, _ := strconv.Atoi(c.Val())
-				config.Level = level
-			case "min_length":
-				if !c.NextArg() {
-					return configs, c.ArgErr()
-				}
-				length, err := strconv.ParseInt(c.Val(), 10, 64)
-				if err != nil {
-					return configs, err
-				} else if length == 0 {
-					return configs, fmt.Errorf(`gzip: min_length must be greater than 0`)
-				}
-				lengthFilter = gzip.LengthFilter(length)
-			default:
-				return configs, c.ArgErr()
-			}
-		}
-
-		// Request Filters
-		config.RequestFilters = []gzip.RequestFilter{}
-
-		// If ignored paths are specified, put in front to filter with path first
-		if len(pathFilter.IgnoredPaths) > 0 {
-			config.RequestFilters = []gzip.RequestFilter{pathFilter}
-		}
-
-		// Then, if extensions are specified, use those to filter.
-		// Otherwise, use default extensions filter.
-		if len(extFilter.Exts) > 0 {
-			config.RequestFilters = append(config.RequestFilters, extFilter)
-		} else {
-			config.RequestFilters = append(config.RequestFilters, gzip.DefaultExtFilter())
-		}
-
-		// Response Filters
-		// If min_length is specified, use it.
-		if int64(lengthFilter) != 0 {
-			config.ResponseFilters = append(config.ResponseFilters, lengthFilter)
-		}
-
-		configs = append(configs, config)
-	}
-
-	return configs, nil
-}

caddy/setup/gzip_test.go

@@ -1,101 +0,0 @@
-package setup
-
-import (
-	"testing"
-
-	"github.com/mholt/caddy/middleware/gzip"
-)
-
-func TestGzip(t *testing.T) {
-	c := NewTestController(`gzip`)
-
-	mid, err := Gzip(c)
-	if err != nil {
-		t.Errorf("Expected no errors, but got: %v", err)
-	}
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(gzip.Gzip)
-	if !ok {
-		t.Fatalf("Expected handler to be type Gzip, got: %#v", handler)
-	}
-
-	if !SameNext(myHandler.Next, EmptyNext) {
-		t.Error("'Next' field of handler was not set properly")
-	}
-
-	tests := []struct {
-		input     string
-		shouldErr bool
-	}{
-		{`gzip {`, true},
-		{`gzip {}`, true},
-		{`gzip a b`, true},
-		{`gzip a {`, true},
-		{`gzip { not f } `, true},
-		{`gzip { not } `, true},
-		{`gzip { not /file
-		 ext .html
-		 level 1
-		} `, false},
-		{`gzip { level 9 } `, false},
-		{`gzip { ext } `, true},
-		{`gzip { ext /f
-		} `, true},
-		{`gzip { not /file
-		 ext .html
-		 level 1
-		}
-		gzip`, false},
-		{`gzip {
-		 ext ""
-		}`, false},
-		{`gzip { not /file
-		 ext .html
-		 level 1
-		}
-		gzip { not /file1
-		 ext .htm
-		 level 3
-		}
-		`, false},
-		{`gzip { not /file
-		 ext .html
-		 level 1
-		}
-		gzip { not /file1
-		 ext .htm
-		 level 3
-		}
-		`, false},
-		{`gzip { not /file
-		 ext *
-		 level 1
-		}
-		`, false},
-		{`gzip { not /file
-		 ext *
-		 level 1
-		 min_length ab
-		}
-		`, true},
-		{`gzip { not /file
-		 ext *
-		 level 1
-		 min_length 1000
-		}
-		`, false},
-	}
-	for i, test := range tests {
-		c := NewTestController(test.input)
-		_, err := gzipParse(c)
-		if test.shouldErr && err == nil {
-			t.Errorf("Test %v: Expected error but found nil", i)
-		} else if !test.shouldErr && err != nil {
-			t.Errorf("Test %v: Expected no error but found error: %v", i, err)
-		}
-	}
-}

caddy/setup/headers.go

@@ -1,84 +0,0 @@
-package setup
-
-import (
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/headers"
-)
-
-// Headers configures a new Headers middleware instance.
-func Headers(c *Controller) (middleware.Middleware, error) {
-	rules, err := headersParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	return func(next middleware.Handler) middleware.Handler {
-		return headers.Headers{Next: next, Rules: rules}
-	}, nil
-}
-
-func headersParse(c *Controller) ([]headers.Rule, error) {
-	var rules []headers.Rule
-
-	for c.NextLine() {
-		var head headers.Rule
-		var isNewPattern bool
-
-		if !c.NextArg() {
-			return rules, c.ArgErr()
-		}
-		pattern := c.Val()
-
-		// See if we already have a definition for this Path pattern...
-		for _, h := range rules {
-			if h.Path == pattern {
-				head = h
-				break
-			}
-		}
-
-		// ...otherwise, this is a new pattern
-		if head.Path == "" {
-			head.Path = pattern
-			isNewPattern = true
-		}
-
-		for c.NextBlock() {
-			// A block of headers was opened...
-
-			h := headers.Header{Name: c.Val()}
-
-			if c.NextArg() {
-				h.Value = c.Val()
-			}
-
-			head.Headers = append(head.Headers, h)
-		}
-		if c.NextArg() {
-			// ... or single header was defined as an argument instead.
-
-			h := headers.Header{Name: c.Val()}
-
-			h.Value = c.Val()
-
-			if c.NextArg() {
-				h.Value = c.Val()
-			}
-
-			head.Headers = append(head.Headers, h)
-		}
-
-		if isNewPattern {
-			rules = append(rules, head)
-		} else {
-			for i := 0; i < len(rules); i++ {
-				if rules[i].Path == pattern {
-					rules[i] = head
-					break
-				}
-			}
-		}
-	}
-
-	return rules, nil
-}

caddy/setup/headers_test.go

@@ -1,85 +0,0 @@
-package setup
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/mholt/caddy/middleware/headers"
-)
-
-func TestHeaders(t *testing.T) {
-	c := NewTestController(`header / Foo Bar`)
-
-	mid, err := Headers(c)
-	if err != nil {
-		t.Errorf("Expected no errors, but got: %v", err)
-	}
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(headers.Headers)
-	if !ok {
-		t.Fatalf("Expected handler to be type Headers, got: %#v", handler)
-	}
-
-	if !SameNext(myHandler.Next, EmptyNext) {
-		t.Error("'Next' field of handler was not set properly")
-	}
-}
-
-func TestHeadersParse(t *testing.T) {
-	tests := []struct {
-		input     string
-		shouldErr bool
-		expected  []headers.Rule
-	}{
-		{`header /foo Foo "Bar Baz"`,
-			false, []headers.Rule{
-				{Path: "/foo", Headers: []headers.Header{
-					{"Foo", "Bar Baz"},
-				}},
-			}},
-		{`header /bar { Foo "Bar Baz" Baz Qux }`,
-			false, []headers.Rule{
-				{Path: "/bar", Headers: []headers.Header{
-					{"Foo", "Bar Baz"},
-					{"Baz", "Qux"},
-				}},
-			}},
-	}
-
-	for i, test := range tests {
-		c := NewTestController(test.input)
-		actual, err := headersParse(c)
-
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d didn't error, but it should have", i)
-		} else if err != nil && !test.shouldErr {
-			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
-		}
-
-		if len(actual) != len(test.expected) {
-			t.Fatalf("Test %d expected %d rules, but got %d",
-				i, len(test.expected), len(actual))
-		}
-
-		for j, expectedRule := range test.expected {
-			actualRule := actual[j]
-
-			if actualRule.Path != expectedRule.Path {
-				t.Errorf("Test %d, rule %d: Expected path %s, but got %s",
-					i, j, expectedRule.Path, actualRule.Path)
-			}
-
-			expectedHeaders := fmt.Sprintf("%v", expectedRule.Headers)
-			actualHeaders := fmt.Sprintf("%v", actualRule.Headers)
-
-			if actualHeaders != expectedHeaders {
-				t.Errorf("Test %d, rule %d: Expected headers %s, but got %s",
-					i, j, expectedHeaders, actualHeaders)
-			}
-		}
-	}
-}

caddy/setup/internal.go

@@ -1,31 +0,0 @@
-package setup
-
-import (
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/inner"
-)
-
-// Internal configures a new Internal middleware instance.
-func Internal(c *Controller) (middleware.Middleware, error) {
-	paths, err := internalParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	return func(next middleware.Handler) middleware.Handler {
-		return inner.Internal{Next: next, Paths: paths}
-	}, nil
-}
-
-func internalParse(c *Controller) ([]string, error) {
-	var paths []string
-
-	for c.Next() {
-		if !c.NextArg() {
-			return paths, c.ArgErr()
-		}
-		paths = append(paths, c.Val())
-	}
-
-	return paths, nil
-}

caddy/setup/internal_test.go

@@ -1,72 +0,0 @@
-package setup
-
-import (
-	"testing"
-
-	"github.com/mholt/caddy/middleware/inner"
-)
-
-func TestInternal(t *testing.T) {
-	c := NewTestController(`internal /internal`)
-
-	mid, err := Internal(c)
-
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(inner.Internal)
-
-	if !ok {
-		t.Fatalf("Expected handler to be type Internal, got: %#v", handler)
-	}
-
-	if myHandler.Paths[0] != "/internal" {
-		t.Errorf("Expected internal in the list of internal Paths")
-	}
-
-	if !SameNext(myHandler.Next, EmptyNext) {
-		t.Error("'Next' field of handler was not set properly")
-	}
-
-}
-
-func TestInternalParse(t *testing.T) {
-	tests := []struct {
-		inputInternalPaths    string
-		shouldErr             bool
-		expectedInternalPaths []string
-	}{
-		{`internal /internal`, false, []string{"/internal"}},
-
-		{`internal /internal1
-		  internal /internal2`, false, []string{"/internal1", "/internal2"}},
-	}
-	for i, test := range tests {
-		c := NewTestController(test.inputInternalPaths)
-		actualInternalPaths, err := internalParse(c)
-
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d didn't error, but it should have", i)
-		} else if err != nil && !test.shouldErr {
-			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
-		}
-
-		if len(actualInternalPaths) != len(test.expectedInternalPaths) {
-			t.Fatalf("Test %d expected %d InternalPaths, but got %d",
-				i, len(test.expectedInternalPaths), len(actualInternalPaths))
-		}
-		for j, actualInternalPath := range actualInternalPaths {
-			if actualInternalPath != test.expectedInternalPaths[j] {
-				t.Fatalf("Test %d expected %dth Internal Path to be  %s  , but got %s",
-					i, j, test.expectedInternalPaths[j], actualInternalPath)
-			}
-		}
-	}
-
-}

caddy/setup/log.go

@@ -1,130 +0,0 @@
-package setup
-
-import (
-	"io"
-	"log"
-	"os"
-
-	"github.com/hashicorp/go-syslog"
-	"github.com/mholt/caddy/middleware"
-	caddylog "github.com/mholt/caddy/middleware/log"
-	"github.com/mholt/caddy/server"
-)
-
-// Log sets up the logging middleware.
-func Log(c *Controller) (middleware.Middleware, error) {
-	rules, err := logParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	// Open the log files for writing when the server starts
-	c.Startup = append(c.Startup, func() error {
-		for i := 0; i < len(rules); i++ {
-			var err error
-			var writer io.Writer
-
-			if rules[i].OutputFile == "stdout" {
-				writer = os.Stdout
-			} else if rules[i].OutputFile == "stderr" {
-				writer = os.Stderr
-			} else if rules[i].OutputFile == "syslog" {
-				writer, err = gsyslog.NewLogger(gsyslog.LOG_INFO, "LOCAL0", "caddy")
-				if err != nil {
-					return err
-				}
-			} else {
-				var file *os.File
-				file, err = os.OpenFile(rules[i].OutputFile, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0644)
-				if err != nil {
-					return err
-				}
-				if rules[i].Roller != nil {
-					file.Close()
-					rules[i].Roller.Filename = rules[i].OutputFile
-					writer = rules[i].Roller.GetLogWriter()
-				} else {
-					writer = file
-				}
-			}
-
-			rules[i].Log = log.New(writer, "", 0)
-		}
-
-		return nil
-	})
-
-	return func(next middleware.Handler) middleware.Handler {
-		return caddylog.Logger{Next: next, Rules: rules, ErrorFunc: server.DefaultErrorFunc}
-	}, nil
-}
-
-func logParse(c *Controller) ([]caddylog.Rule, error) {
-	var rules []caddylog.Rule
-
-	for c.Next() {
-		args := c.RemainingArgs()
-
-		var logRoller *middleware.LogRoller
-		if c.NextBlock() {
-			if c.Val() == "rotate" {
-				if c.NextArg() {
-					if c.Val() == "{" {
-						var err error
-						logRoller, err = parseRoller(c)
-						if err != nil {
-							return nil, err
-						}
-						// This part doesn't allow having something after the rotate block
-						if c.Next() {
-							if c.Val() != "}" {
-								return nil, c.ArgErr()
-							}
-						}
-					}
-				}
-			}
-		}
-		if len(args) == 0 {
-			// Nothing specified; use defaults
-			rules = append(rules, caddylog.Rule{
-				PathScope:  "/",
-				OutputFile: caddylog.DefaultLogFilename,
-				Format:     caddylog.DefaultLogFormat,
-				Roller:     logRoller,
-			})
-		} else if len(args) == 1 {
-			// Only an output file specified
-			rules = append(rules, caddylog.Rule{
-				PathScope:  "/",
-				OutputFile: args[0],
-				Format:     caddylog.DefaultLogFormat,
-				Roller:     logRoller,
-			})
-		} else {
-			// Path scope, output file, and maybe a format specified
-
-			format := caddylog.DefaultLogFormat
-
-			if len(args) > 2 {
-				switch args[2] {
-				case "{common}":
-					format = caddylog.CommonLogFormat
-				case "{combined}":
-					format = caddylog.CombinedLogFormat
-				default:
-					format = args[2]
-				}
-			}
-
-			rules = append(rules, caddylog.Rule{
-				PathScope:  args[0],
-				OutputFile: args[1],
-				Format:     format,
-				Roller:     logRoller,
-			})
-		}
-	}
-
-	return rules, nil
-}

caddy/setup/log_test.go

@@ -1,175 +0,0 @@
-package setup
-
-import (
-	"testing"
-
-	"github.com/mholt/caddy/middleware"
-	caddylog "github.com/mholt/caddy/middleware/log"
-)
-
-func TestLog(t *testing.T) {
-
-	c := NewTestController(`log`)
-
-	mid, err := Log(c)
-
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(caddylog.Logger)
-
-	if !ok {
-		t.Fatalf("Expected handler to be type Logger, got: %#v", handler)
-	}
-
-	if myHandler.Rules[0].PathScope != "/" {
-		t.Errorf("Expected / as the default PathScope")
-	}
-	if myHandler.Rules[0].OutputFile != caddylog.DefaultLogFilename {
-		t.Errorf("Expected %s as the default OutputFile", caddylog.DefaultLogFilename)
-	}
-	if myHandler.Rules[0].Format != caddylog.DefaultLogFormat {
-		t.Errorf("Expected %s as the default Log Format", caddylog.DefaultLogFormat)
-	}
-	if myHandler.Rules[0].Roller != nil {
-		t.Errorf("Expected Roller to be nil, got: %v", *myHandler.Rules[0].Roller)
-	}
-	if !SameNext(myHandler.Next, EmptyNext) {
-		t.Error("'Next' field of handler was not set properly")
-	}
-
-}
-
-func TestLogParse(t *testing.T) {
-	tests := []struct {
-		inputLogRules    string
-		shouldErr        bool
-		expectedLogRules []caddylog.Rule
-	}{
-		{`log`, false, []caddylog.Rule{{
-			PathScope:  "/",
-			OutputFile: caddylog.DefaultLogFilename,
-			Format:     caddylog.DefaultLogFormat,
-		}}},
-		{`log log.txt`, false, []caddylog.Rule{{
-			PathScope:  "/",
-			OutputFile: "log.txt",
-			Format:     caddylog.DefaultLogFormat,
-		}}},
-		{`log /api log.txt`, false, []caddylog.Rule{{
-			PathScope:  "/api",
-			OutputFile: "log.txt",
-			Format:     caddylog.DefaultLogFormat,
-		}}},
-		{`log /serve stdout`, false, []caddylog.Rule{{
-			PathScope:  "/serve",
-			OutputFile: "stdout",
-			Format:     caddylog.DefaultLogFormat,
-		}}},
-		{`log /myapi log.txt {common}`, false, []caddylog.Rule{{
-			PathScope:  "/myapi",
-			OutputFile: "log.txt",
-			Format:     caddylog.CommonLogFormat,
-		}}},
-		{`log /test accesslog.txt {combined}`, false, []caddylog.Rule{{
-			PathScope:  "/test",
-			OutputFile: "accesslog.txt",
-			Format:     caddylog.CombinedLogFormat,
-		}}},
-		{`log /api1 log.txt
-		  log /api2 accesslog.txt {combined}`, false, []caddylog.Rule{{
-			PathScope:  "/api1",
-			OutputFile: "log.txt",
-			Format:     caddylog.DefaultLogFormat,
-		}, {
-			PathScope:  "/api2",
-			OutputFile: "accesslog.txt",
-			Format:     caddylog.CombinedLogFormat,
-		}}},
-		{`log /api3 stdout {host}
-		  log /api4 log.txt {when}`, false, []caddylog.Rule{{
-			PathScope:  "/api3",
-			OutputFile: "stdout",
-			Format:     "{host}",
-		}, {
-			PathScope:  "/api4",
-			OutputFile: "log.txt",
-			Format:     "{when}",
-		}}},
-		{`log access.log { rotate { size 2 age 10 keep 3 } }`, false, []caddylog.Rule{{
-			PathScope:  "/",
-			OutputFile: "access.log",
-			Format:     caddylog.DefaultLogFormat,
-			Roller: &middleware.LogRoller{
-				MaxSize:    2,
-				MaxAge:     10,
-				MaxBackups: 3,
-				LocalTime:  true,
-			},
-		}}},
-	}
-	for i, test := range tests {
-		c := NewTestController(test.inputLogRules)
-		actualLogRules, err := logParse(c)
-
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d didn't error, but it should have", i)
-		} else if err != nil && !test.shouldErr {
-			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
-		}
-		if len(actualLogRules) != len(test.expectedLogRules) {
-			t.Fatalf("Test %d expected %d no of Log rules, but got %d ",
-				i, len(test.expectedLogRules), len(actualLogRules))
-		}
-		for j, actualLogRule := range actualLogRules {
-
-			if actualLogRule.PathScope != test.expectedLogRules[j].PathScope {
-				t.Errorf("Test %d expected %dth LogRule PathScope to be  %s  , but got %s",
-					i, j, test.expectedLogRules[j].PathScope, actualLogRule.PathScope)
-			}
-
-			if actualLogRule.OutputFile != test.expectedLogRules[j].OutputFile {
-				t.Errorf("Test %d expected %dth LogRule OutputFile to be  %s  , but got %s",
-					i, j, test.expectedLogRules[j].OutputFile, actualLogRule.OutputFile)
-			}
-
-			if actualLogRule.Format != test.expectedLogRules[j].Format {
-				t.Errorf("Test %d expected %dth LogRule Format to be  %s  , but got %s",
-					i, j, test.expectedLogRules[j].Format, actualLogRule.Format)
-			}
-			if actualLogRule.Roller != nil && test.expectedLogRules[j].Roller == nil || actualLogRule.Roller == nil && test.expectedLogRules[j].Roller != nil {
-				t.Fatalf("Test %d expected %dth LogRule Roller to be %v, but got %v",
-					i, j, test.expectedLogRules[j].Roller, actualLogRule.Roller)
-			}
-			if actualLogRule.Roller != nil && test.expectedLogRules[j].Roller != nil {
-				if actualLogRule.Roller.Filename != test.expectedLogRules[j].Roller.Filename {
-					t.Fatalf("Test %d expected %dth LogRule Roller Filename to be %s, but got %s",
-						i, j, test.expectedLogRules[j].Roller.Filename, actualLogRule.Roller.Filename)
-				}
-				if actualLogRule.Roller.MaxAge != test.expectedLogRules[j].Roller.MaxAge {
-					t.Fatalf("Test %d expected %dth LogRule Roller MaxAge to be %d, but got %d",
-						i, j, test.expectedLogRules[j].Roller.MaxAge, actualLogRule.Roller.MaxAge)
-				}
-				if actualLogRule.Roller.MaxBackups != test.expectedLogRules[j].Roller.MaxBackups {
-					t.Fatalf("Test %d expected %dth LogRule Roller MaxBackups to be %d, but got %d",
-						i, j, test.expectedLogRules[j].Roller.MaxBackups, actualLogRule.Roller.MaxBackups)
-				}
-				if actualLogRule.Roller.MaxSize != test.expectedLogRules[j].Roller.MaxSize {
-					t.Fatalf("Test %d expected %dth LogRule Roller MaxSize to be %d, but got %d",
-						i, j, test.expectedLogRules[j].Roller.MaxSize, actualLogRule.Roller.MaxSize)
-				}
-				if actualLogRule.Roller.LocalTime != test.expectedLogRules[j].Roller.LocalTime {
-					t.Fatalf("Test %d expected %dth LogRule Roller LocalTime to be %t, but got %t",
-						i, j, test.expectedLogRules[j].Roller.LocalTime, actualLogRule.Roller.LocalTime)
-				}
-			}
-		}
-	}
-
-}

caddy/setup/markdown.go

@@ -1,157 +0,0 @@
-package setup
-
-import (
-	"net/http"
-	"path"
-	"path/filepath"
-	"strings"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/markdown"
-	"github.com/russross/blackfriday"
-)
-
-// Markdown configures a new Markdown middleware instance.
-func Markdown(c *Controller) (middleware.Middleware, error) {
-	mdconfigs, err := markdownParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	md := markdown.Markdown{
-		Root:       c.Root,
-		FileSys:    http.Dir(c.Root),
-		Configs:    mdconfigs,
-		IndexFiles: []string{"index.md"},
-	}
-
-	// Sweep the whole path at startup to at least generate link index, maybe generate static site
-	c.Startup = append(c.Startup, func() error {
-		for i := range mdconfigs {
-			cfg := mdconfigs[i]
-
-			// Generate link index and static files (if enabled)
-			if err := markdown.GenerateStatic(md, cfg); err != nil {
-				return err
-			}
-
-			// Watch file changes for static site generation if not in development mode.
-			if !cfg.Development {
-				markdown.Watch(md, cfg, markdown.DefaultInterval)
-			}
-		}
-
-		return nil
-	})
-
-	return func(next middleware.Handler) middleware.Handler {
-		md.Next = next
-		return md
-	}, nil
-}
-
-func markdownParse(c *Controller) ([]*markdown.Config, error) {
-	var mdconfigs []*markdown.Config
-
-	for c.Next() {
-		md := &markdown.Config{
-			Renderer:    blackfriday.HtmlRenderer(0, "", ""),
-			Templates:   make(map[string]string),
-			StaticFiles: make(map[string]string),
-		}
-
-		// Get the path scope
-		args := c.RemainingArgs()
-		switch len(args) {
-		case 0:
-			md.PathScope = "/"
-		case 1:
-			md.PathScope = args[0]
-		default:
-			return mdconfigs, c.ArgErr()
-		}
-
-		// Load any other configuration parameters
-		for c.NextBlock() {
-			if err := loadParams(c, md); err != nil {
-				return mdconfigs, err
-			}
-		}
-
-		// If no extensions were specified, assume some defaults
-		if len(md.Extensions) == 0 {
-			md.Extensions = []string{".md", ".markdown", ".mdown"}
-		}
-
-		mdconfigs = append(mdconfigs, md)
-	}
-
-	return mdconfigs, nil
-}
-
-func loadParams(c *Controller, mdc *markdown.Config) error {
-	switch c.Val() {
-	case "ext":
-		exts := c.RemainingArgs()
-		if len(exts) == 0 {
-			return c.ArgErr()
-		}
-		mdc.Extensions = append(mdc.Extensions, exts...)
-		return nil
-	case "css":
-		if !c.NextArg() {
-			return c.ArgErr()
-		}
-		mdc.Styles = append(mdc.Styles, c.Val())
-		return nil
-	case "js":
-		if !c.NextArg() {
-			return c.ArgErr()
-		}
-		mdc.Scripts = append(mdc.Scripts, c.Val())
-		return nil
-	case "template":
-		tArgs := c.RemainingArgs()
-		switch len(tArgs) {
-		case 0:
-			return c.ArgErr()
-		case 1:
-			if _, ok := mdc.Templates[markdown.DefaultTemplate]; ok {
-				return c.Err("only one default template is allowed, use alias.")
-			}
-			fpath := filepath.ToSlash(filepath.Clean(c.Root + string(filepath.Separator) + tArgs[0]))
-			mdc.Templates[markdown.DefaultTemplate] = fpath
-			return nil
-		case 2:
-			fpath := filepath.ToSlash(filepath.Clean(c.Root + string(filepath.Separator) + tArgs[1]))
-			mdc.Templates[tArgs[0]] = fpath
-			return nil
-		default:
-			return c.ArgErr()
-		}
-	case "sitegen":
-		if c.NextArg() {
-			mdc.StaticDir = path.Join(c.Root, c.Val())
-		} else {
-			mdc.StaticDir = path.Join(c.Root, markdown.DefaultStaticDir)
-		}
-		if c.NextArg() {
-			// only 1 argument allowed
-			return c.ArgErr()
-		}
-		return nil
-	case "dev":
-		if c.NextArg() {
-			mdc.Development = strings.ToLower(c.Val()) == "true"
-		} else {
-			mdc.Development = true
-		}
-		if c.NextArg() {
-			// only 1 argument allowed
-			return c.ArgErr()
-		}
-		return nil
-	default:
-		return c.Err("Expected valid markdown configuration property")
-	}
-}

caddy/setup/markdown_test.go

@@ -1,184 +0,0 @@
-package setup
-
-import (
-	"bytes"
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/markdown"
-)
-
-func TestMarkdown(t *testing.T) {
-
-	c := NewTestController(`markdown /blog`)
-
-	mid, err := Markdown(c)
-
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(markdown.Markdown)
-
-	if !ok {
-		t.Fatalf("Expected handler to be type Markdown, got: %#v", handler)
-	}
-
-	if myHandler.Configs[0].PathScope != "/blog" {
-		t.Errorf("Expected /blog as the Path Scope")
-	}
-	if fmt.Sprint(myHandler.Configs[0].Extensions) != fmt.Sprint([]string{".md", ".markdown", ".mdown"}) {
-		t.Errorf("Expected .md, .markdown, and .mdown as default extensions")
-	}
-}
-
-func TestMarkdownStaticGen(t *testing.T) {
-	c := NewTestController(`markdown /blog {
-	ext .md
-	template tpl_with_include.html
-	sitegen
-}`)
-
-	c.Root = "./testdata"
-	mid, err := Markdown(c)
-
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	for _, start := range c.Startup {
-		err := start()
-		if err != nil {
-			t.Errorf("Startup error: %v", err)
-		}
-	}
-
-	next := middleware.HandlerFunc(func(w http.ResponseWriter, r *http.Request) (int, error) {
-		t.Fatalf("Next shouldn't be called")
-		return 0, nil
-	})
-	hndlr := mid(next)
-	mkdwn, ok := hndlr.(markdown.Markdown)
-	if !ok {
-		t.Fatalf("Was expecting a markdown.Markdown but got %T", hndlr)
-	}
-
-	expectedStaticFiles := map[string]string{"/blog/first_post.md": "testdata/generated_site/blog/first_post.md/index.html"}
-	if fmt.Sprint(expectedStaticFiles) != fmt.Sprint(mkdwn.Configs[0].StaticFiles) {
-		t.Fatalf("Test expected StaticFiles to be  %s, but got %s",
-			fmt.Sprint(expectedStaticFiles), fmt.Sprint(mkdwn.Configs[0].StaticFiles))
-	}
-
-	filePath := "testdata/generated_site/blog/first_post.md/index.html"
-	if _, err := os.Stat(filePath); err != nil {
-		t.Fatalf("An error occured when getting the file information: %v", err)
-	}
-
-	html, err := ioutil.ReadFile(filePath)
-	if err != nil {
-		t.Fatalf("An error occured when getting the file content: %v", err)
-	}
-
-	expectedBody := []byte(`<!DOCTYPE html>
-<html>
-<head>
-<title>first_post</title>
-</head>
-<body>
-<h1>Header title</h1>
-
-<h1>Test h1</h1>
-
-</body>
-</html>
-`)
-
-	if !bytes.Equal(html, expectedBody) {
-		t.Fatalf("Expected file content: %s got: %s", string(expectedBody), string(html))
-	}
-
-	fp := filepath.Join(c.Root, markdown.DefaultStaticDir)
-	if err = os.RemoveAll(fp); err != nil {
-		t.Errorf("Error while removing the generated static files: %v", err)
-	}
-}
-
-func TestMarkdownParse(t *testing.T) {
-	tests := []struct {
-		inputMarkdownConfig    string
-		shouldErr              bool
-		expectedMarkdownConfig []markdown.Config
-	}{
-
-		{`markdown /blog {
-	ext .md .txt
-	css /resources/css/blog.css
-	js  /resources/js/blog.js
-}`, false, []markdown.Config{{
-			PathScope:  "/blog",
-			Extensions: []string{".md", ".txt"},
-			Styles:     []string{"/resources/css/blog.css"},
-			Scripts:    []string{"/resources/js/blog.js"},
-		}}},
-		{`markdown /blog {
-	ext .md
-	template tpl_with_include.html
-	sitegen
-}`, false, []markdown.Config{{
-			PathScope:  "/blog",
-			Extensions: []string{".md"},
-			Templates:  map[string]string{markdown.DefaultTemplate: "testdata/tpl_with_include.html"},
-			StaticDir:  markdown.DefaultStaticDir,
-		}}},
-	}
-	for i, test := range tests {
-		c := NewTestController(test.inputMarkdownConfig)
-		c.Root = "./testdata"
-		actualMarkdownConfigs, err := markdownParse(c)
-
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d didn't error, but it should have", i)
-		} else if err != nil && !test.shouldErr {
-			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
-		}
-		if len(actualMarkdownConfigs) != len(test.expectedMarkdownConfig) {
-			t.Fatalf("Test %d expected %d no of WebSocket configs, but got %d ",
-				i, len(test.expectedMarkdownConfig), len(actualMarkdownConfigs))
-		}
-		for j, actualMarkdownConfig := range actualMarkdownConfigs {
-
-			if actualMarkdownConfig.PathScope != test.expectedMarkdownConfig[j].PathScope {
-				t.Errorf("Test %d expected %dth Markdown PathScope to be  %s  , but got %s",
-					i, j, test.expectedMarkdownConfig[j].PathScope, actualMarkdownConfig.PathScope)
-			}
-
-			if fmt.Sprint(actualMarkdownConfig.Styles) != fmt.Sprint(test.expectedMarkdownConfig[j].Styles) {
-				t.Errorf("Test %d expected %dth Markdown Config Styles to be  %s  , but got %s",
-					i, j, fmt.Sprint(test.expectedMarkdownConfig[j].Styles), fmt.Sprint(actualMarkdownConfig.Styles))
-			}
-			if fmt.Sprint(actualMarkdownConfig.Scripts) != fmt.Sprint(test.expectedMarkdownConfig[j].Scripts) {
-				t.Errorf("Test %d expected %dth Markdown Config Scripts to be  %s  , but got %s",
-					i, j, fmt.Sprint(test.expectedMarkdownConfig[j].Scripts), fmt.Sprint(actualMarkdownConfig.Scripts))
-			}
-			if fmt.Sprint(actualMarkdownConfig.Templates) != fmt.Sprint(test.expectedMarkdownConfig[j].Templates) {
-				t.Errorf("Test %d expected %dth Markdown Config Templates to be  %s  , but got %s",
-					i, j, fmt.Sprint(test.expectedMarkdownConfig[j].Templates), fmt.Sprint(actualMarkdownConfig.Templates))
-			}
-		}
-	}
-
-}

caddy/setup/mime.go

@@ -1,65 +0,0 @@
-package setup
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/mime"
-)
-
-// Mime configures a new mime middleware instance.
-func Mime(c *Controller) (middleware.Middleware, error) {
-	configs, err := mimeParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	return func(next middleware.Handler) middleware.Handler {
-		return mime.Mime{Next: next, Configs: configs}
-	}, nil
-}
-
-func mimeParse(c *Controller) (mime.Config, error) {
-	configs := mime.Config{}
-
-	for c.Next() {
-		// At least one extension is required
-
-		args := c.RemainingArgs()
-		switch len(args) {
-		case 2:
-			if err := validateExt(configs, args[0]); err != nil {
-				return configs, err
-			}
-			configs[args[0]] = args[1]
-		case 1:
-			return configs, c.ArgErr()
-		case 0:
-			for c.NextBlock() {
-				ext := c.Val()
-				if err := validateExt(configs, ext); err != nil {
-					return configs, err
-				}
-				if !c.NextArg() {
-					return configs, c.ArgErr()
-				}
-				configs[ext] = c.Val()
-			}
-		}
-
-	}
-
-	return configs, nil
-}
-
-// validateExt checks for valid file name extension.
-func validateExt(configs mime.Config, ext string) error {
-	if !strings.HasPrefix(ext, ".") {
-		return fmt.Errorf(`mime: invalid extension "%v" (must start with dot)`, ext)
-	}
-	if _, ok := configs[ext]; ok {
-		return fmt.Errorf(`mime: duplicate extension "%v" found`, ext)
-	}
-	return nil
-}

caddy/setup/mime_test.go

@@ -1,64 +0,0 @@
-package setup
-
-import (
-	"testing"
-
-	"github.com/mholt/caddy/middleware/mime"
-)
-
-func TestMime(t *testing.T) {
-
-	c := NewTestController(`mime .txt text/plain`)
-
-	mid, err := Mime(c)
-	if err != nil {
-		t.Errorf("Expected no errors, but got: %v", err)
-	}
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(mime.Mime)
-	if !ok {
-		t.Fatalf("Expected handler to be type Mime, got: %#v", handler)
-	}
-
-	if !SameNext(myHandler.Next, EmptyNext) {
-		t.Error("'Next' field of handler was not set properly")
-	}
-
-	tests := []struct {
-		input     string
-		shouldErr bool
-	}{
-		{`mime {`, true},
-		{`mime {}`, true},
-		{`mime a b`, true},
-		{`mime a {`, true},
-		{`mime { txt f } `, true},
-		{`mime { html } `, true},
-		{`mime {
-		 .html text/html
-		 .txt text/plain
-		} `, false},
-		{`mime {
-		 .foo text/foo
-		 .bar text/bar
-		 .foo text/foobar
-		} `, true},
-		{`mime { .html text/html } `, false},
-		{`mime { .html
-		} `, true},
-		{`mime .txt text/plain`, false},
-	}
-	for i, test := range tests {
-		c := NewTestController(test.input)
-		m, err := mimeParse(c)
-		if test.shouldErr && err == nil {
-			t.Errorf("Test %v: Expected error but found nil %v", i, m)
-		} else if !test.shouldErr && err != nil {
-			t.Errorf("Test %v: Expected no error but found error: %v", i, err)
-		}
-	}
-}

caddy/setup/pprof.go

@@ -1,27 +0,0 @@
-package setup
-
-import (
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/pprof"
-)
-
-//PProf returns a new instance of a pprof handler. It accepts no arguments or options.
-func PProf(c *Controller) (middleware.Middleware, error) {
-	found := false
-	for c.Next() {
-		if found {
-			return nil, c.Err("pprof can only be specified once")
-		}
-		if len(c.RemainingArgs()) != 0 {
-			return nil, c.ArgErr()
-		}
-		if c.NextBlock() {
-			return nil, c.ArgErr()
-		}
-		found = true
-	}
-
-	return func(next middleware.Handler) middleware.Handler {
-		return &pprof.Handler{Next: next, Mux: pprof.NewMux()}
-	}, nil
-}

caddy/setup/pprof_test.go

@@ -1,28 +0,0 @@
-package setup
-
-import "testing"
-
-func TestPProf(t *testing.T) {
-	tests := []struct {
-		input     string
-		shouldErr bool
-	}{
-		{`pprof`, false},
-		{`pprof {}`, true},
-		{`pprof /foo`, true},
-		{`pprof {
-            a b
-        }`, true},
-		{`pprof
-          pprof`, true},
-	}
-	for i, test := range tests {
-		c := NewTestController(test.input)
-		_, err := PProf(c)
-		if test.shouldErr && err == nil {
-			t.Errorf("Test %v: Expected error but found nil", i)
-		} else if !test.shouldErr && err != nil {
-			t.Errorf("Test %v: Expected no error but found error: %v", i, err)
-		}
-	}
-}

caddy/setup/proxy.go

@@ -1,17 +0,0 @@
-package setup
-
-import (
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/proxy"
-)
-
-// Proxy configures a new Proxy middleware instance.
-func Proxy(c *Controller) (middleware.Middleware, error) {
-	upstreams, err := proxy.NewStaticUpstreams(c.Dispenser)
-	if err != nil {
-		return nil, err
-	}
-	return func(next middleware.Handler) middleware.Handler {
-		return proxy.Proxy{Next: next, Upstreams: upstreams}
-	}, nil
-}

caddy/setup/redir.go

@@ -1,173 +0,0 @@
-package setup
-
-import (
-	"net/http"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/redirect"
-)
-
-// Redir configures a new Redirect middleware instance.
-func Redir(c *Controller) (middleware.Middleware, error) {
-	rules, err := redirParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	return func(next middleware.Handler) middleware.Handler {
-		return redirect.Redirect{Next: next, Rules: rules}
-	}, nil
-}
-
-func redirParse(c *Controller) ([]redirect.Rule, error) {
-	var redirects []redirect.Rule
-
-	// setRedirCode sets the redirect code for rule if it can, or returns an error
-	setRedirCode := func(code string, rule *redirect.Rule) error {
-		if code == "meta" {
-			rule.Meta = true
-		} else if codeNumber, ok := httpRedirs[code]; ok {
-			rule.Code = codeNumber
-		} else {
-			return c.Errf("Invalid redirect code '%v'", code)
-		}
-		return nil
-	}
-
-	// checkAndSaveRule checks the rule for validity (except the redir code)
-	// and saves it if it's valid, or returns an error.
-	checkAndSaveRule := func(rule redirect.Rule) error {
-		if rule.FromPath == rule.To {
-			return c.Err("'from' and 'to' values of redirect rule cannot be the same")
-		}
-
-		for _, otherRule := range redirects {
-			if otherRule.FromPath == rule.FromPath {
-				return c.Errf("rule with duplicate 'from' value: %s -> %s", otherRule.FromPath, otherRule.To)
-			}
-		}
-
-		redirects = append(redirects, rule)
-		return nil
-	}
-
-	for c.Next() {
-		args := c.RemainingArgs()
-
-		var hadOptionalBlock bool
-		for c.NextBlock() {
-			hadOptionalBlock = true
-
-			var rule redirect.Rule
-
-			if c.Config.TLS.Enabled {
-				rule.FromScheme = "https"
-			} else {
-				rule.FromScheme = "http"
-			}
-
-			// Set initial redirect code
-			// BUG: If the code is specified for a whole block and that code is invalid,
-			// the line number will appear on the first line inside the block, even if that
-			// line overwrites the block-level code with a valid redirect code. The program
-			// still functions correctly, but the line number in the error reporting is
-			// misleading to the user.
-			if len(args) == 1 {
-				err := setRedirCode(args[0], &rule)
-				if err != nil {
-					return redirects, err
-				}
-			} else {
-				rule.Code = http.StatusMovedPermanently // default code
-			}
-
-			// RemainingArgs only gets the values after the current token, but in our
-			// case we want to include the current token to get an accurate count.
-			insideArgs := append([]string{c.Val()}, c.RemainingArgs()...)
-
-			switch len(insideArgs) {
-			case 1:
-				// To specified (catch-all redirect)
-				// Not sure why user is doing this in a table, as it causes all other redirects to be ignored.
-				// As such, this feature remains undocumented.
-				rule.FromPath = "/"
-				rule.To = insideArgs[0]
-			case 2:
-				// From and To specified
-				rule.FromPath = insideArgs[0]
-				rule.To = insideArgs[1]
-			case 3:
-				// From, To, and Code specified
-				rule.FromPath = insideArgs[0]
-				rule.To = insideArgs[1]
-				err := setRedirCode(insideArgs[2], &rule)
-				if err != nil {
-					return redirects, err
-				}
-			default:
-				return redirects, c.ArgErr()
-			}
-
-			err := checkAndSaveRule(rule)
-			if err != nil {
-				return redirects, err
-			}
-		}
-
-		if !hadOptionalBlock {
-			var rule redirect.Rule
-
-			if c.Config.TLS.Enabled {
-				rule.FromScheme = "https"
-			} else {
-				rule.FromScheme = "http"
-			}
-
-			rule.Code = http.StatusMovedPermanently // default
-
-			switch len(args) {
-			case 1:
-				// To specified (catch-all redirect)
-				rule.FromPath = "/"
-				rule.To = args[0]
-			case 2:
-				// To and Code specified (catch-all redirect)
-				rule.FromPath = "/"
-				rule.To = args[0]
-				err := setRedirCode(args[1], &rule)
-				if err != nil {
-					return redirects, err
-				}
-			case 3:
-				// From, To, and Code specified
-				rule.FromPath = args[0]
-				rule.To = args[1]
-				err := setRedirCode(args[2], &rule)
-				if err != nil {
-					return redirects, err
-				}
-			default:
-				return redirects, c.ArgErr()
-			}
-
-			err := checkAndSaveRule(rule)
-			if err != nil {
-				return redirects, err
-			}
-		}
-	}
-
-	return redirects, nil
-}
-
-// httpRedirs is a list of supported HTTP redirect codes.
-var httpRedirs = map[string]int{
-	"300": http.StatusMultipleChoices,
-	"301": http.StatusMovedPermanently,
-	"302": http.StatusFound, // (NOT CORRECT for "Temporary Redirect", see 307)
-	"303": http.StatusSeeOther,
-	"304": http.StatusNotModified,
-	"305": http.StatusUseProxy,
-	"307": http.StatusTemporaryRedirect,
-	"308": 308, // Permanent Redirect
-}

caddy/setup/redir_test.go

@@ -1,67 +0,0 @@
-package setup
-
-import (
-	"testing"
-
-	"github.com/mholt/caddy/middleware/redirect"
-)
-
-func TestRedir(t *testing.T) {
-
-	for j, test := range []struct {
-		input         string
-		shouldErr     bool
-		expectedRules []redirect.Rule
-	}{
-		// test case #0 tests the recognition of a valid HTTP status code defined outside of block statement
-		{"redir 300 {\n/ /foo\n}", false, []redirect.Rule{{FromPath: "/", To: "/foo", Code: 300}}},
-
-		// test case #1 tests the recognition of an invalid HTTP status code defined outside of block statement
-		{"redir 9000 {\n/ /foo\n}", true, []redirect.Rule{{}}},
-
-		// test case #2 tests the detection of a valid HTTP status code outside of a block statement being overriden by an invalid HTTP status code inside statement of a block statement
-		{"redir 300 {\n/ /foo 9000\n}", true, []redirect.Rule{{}}},
-
-		// test case #3 tests the detection of an invalid HTTP status code outside of a block statement being overriden by a valid HTTP status code inside statement of a block statement
-		{"redir 9000 {\n/ /foo 300\n}", true, []redirect.Rule{{}}},
-
-		// test case #4 tests the recognition of a TO redirection in a block statement.The HTTP status code is set to the default of 301 - MovedPermanently
-		{"redir 302 {\n/foo\n}", false, []redirect.Rule{{FromPath: "/", To: "/foo", Code: 302}}},
-
-		// test case #5 tests the recognition of a TO and From redirection in a block statement
-		{"redir {\n/bar /foo 303\n}", false, []redirect.Rule{{FromPath: "/bar", To: "/foo", Code: 303}}},
-
-		// test case #6 tests the recognition of a TO redirection in a non-block statement. The HTTP status code is set to the default of 301 - MovedPermanently
-		{"redir /foo", false, []redirect.Rule{{FromPath: "/", To: "/foo", Code: 301}}},
-
-		// test case #7 tests the recognition of a TO and From redirection in a non-block statement
-		{"redir /bar /foo 303", false, []redirect.Rule{{FromPath: "/bar", To: "/foo", Code: 303}}},
-
-		// test case #8 tests the recognition of multiple redirections
-		{"redir {\n / /foo 304 \n} \n redir {\n /bar /foobar 305 \n}", false, []redirect.Rule{{FromPath: "/", To: "/foo", Code: 304}, {FromPath: "/bar", To: "/foobar", Code: 305}}},
-
-		// test case #9 tests the detection of duplicate redirections
-		{"redir {\n /bar /foo 304 \n} redir {\n /bar /foo 304 \n}", true, []redirect.Rule{{}}},
-	} {
-		recievedFunc, err := Redir(NewTestController(test.input))
-		if err != nil && !test.shouldErr {
-			t.Errorf("Test case #%d recieved an error of %v", j, err)
-		} else if test.shouldErr {
-			continue
-		}
-		recievedRules := recievedFunc(nil).(redirect.Redirect).Rules
-
-		for i, recievedRule := range recievedRules {
-			if recievedRule.FromPath != test.expectedRules[i].FromPath {
-				t.Errorf("Test case #%d.%d expected a from path of %s, but recieved a from path of %s", j, i, test.expectedRules[i].FromPath, recievedRule.FromPath)
-			}
-			if recievedRule.To != test.expectedRules[i].To {
-				t.Errorf("Test case #%d.%d expected a TO path of %s, but recieved a TO path of %s", j, i, test.expectedRules[i].To, recievedRule.To)
-			}
-			if recievedRule.Code != test.expectedRules[i].Code {
-				t.Errorf("Test case #%d.%d expected a HTTP status code of %d, but recieved a code of %d", j, i, test.expectedRules[i].Code, recievedRule.Code)
-			}
-		}
-	}
-
-}

caddy/setup/rewrite.go

@@ -1,109 +0,0 @@
-package setup
-
-import (
-	"net/http"
-	"strconv"
-	"strings"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/rewrite"
-)
-
-// Rewrite configures a new Rewrite middleware instance.
-func Rewrite(c *Controller) (middleware.Middleware, error) {
-	rewrites, err := rewriteParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	return func(next middleware.Handler) middleware.Handler {
-		return rewrite.Rewrite{
-			Next:    next,
-			FileSys: http.Dir(c.Root),
-			Rules:   rewrites,
-		}
-	}, nil
-}
-
-func rewriteParse(c *Controller) ([]rewrite.Rule, error) {
-	var simpleRules []rewrite.Rule
-	var regexpRules []rewrite.Rule
-
-	for c.Next() {
-		var rule rewrite.Rule
-		var err error
-		var base = "/"
-		var pattern, to string
-		var status int
-		var ext []string
-
-		args := c.RemainingArgs()
-
-		var ifs []rewrite.If
-
-		switch len(args) {
-		case 1:
-			base = args[0]
-			fallthrough
-		case 0:
-			for c.NextBlock() {
-				switch c.Val() {
-				case "r", "regexp":
-					if !c.NextArg() {
-						return nil, c.ArgErr()
-					}
-					pattern = c.Val()
-				case "to":
-					args1 := c.RemainingArgs()
-					if len(args1) == 0 {
-						return nil, c.ArgErr()
-					}
-					to = strings.Join(args1, " ")
-				case "ext":
-					args1 := c.RemainingArgs()
-					if len(args1) == 0 {
-						return nil, c.ArgErr()
-					}
-					ext = args1
-				case "if":
-					args1 := c.RemainingArgs()
-					if len(args1) != 3 {
-						return nil, c.ArgErr()
-					}
-					ifCond, err := rewrite.NewIf(args1[0], args1[1], args1[2])
-					if err != nil {
-						return nil, err
-					}
-					ifs = append(ifs, ifCond)
-				case "status":
-					if !c.NextArg() {
-						return nil, c.ArgErr()
-					}
-					status, _ = strconv.Atoi(c.Val())
-					if status < 200 || (status > 299 && status < 400) || status > 499 {
-						return nil, c.Err("status must be 2xx or 4xx")
-					}
-				default:
-					return nil, c.ArgErr()
-				}
-			}
-			// ensure to or status is specified
-			if to == "" && status == 0 {
-				return nil, c.ArgErr()
-			}
-			if rule, err = rewrite.NewComplexRule(base, pattern, to, status, ext, ifs); err != nil {
-				return nil, err
-			}
-			regexpRules = append(regexpRules, rule)
-
-		// the only unhandled case is 2 and above
-		default:
-			rule = rewrite.NewSimpleRule(args[0], strings.Join(args[1:], " "))
-			simpleRules = append(simpleRules, rule)
-		}
-
-	}
-
-	// put simple rules in front to avoid regexp computation for them
-	return append(simpleRules, regexpRules...), nil
-}

caddy/setup/rewrite_test.go

@@ -1,241 +0,0 @@
-package setup
-
-import (
-	"fmt"
-	"regexp"
-	"testing"
-
-	"github.com/mholt/caddy/middleware/rewrite"
-)
-
-func TestRewrite(t *testing.T) {
-	c := NewTestController(`rewrite /from /to`)
-
-	mid, err := Rewrite(c)
-	if err != nil {
-		t.Errorf("Expected no errors, but got: %v", err)
-	}
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(rewrite.Rewrite)
-	if !ok {
-		t.Fatalf("Expected handler to be type Rewrite, got: %#v", handler)
-	}
-
-	if !SameNext(myHandler.Next, EmptyNext) {
-		t.Error("'Next' field of handler was not set properly")
-	}
-
-	if len(myHandler.Rules) != 1 {
-		t.Errorf("Expected handler to have %d rule, has %d instead", 1, len(myHandler.Rules))
-	}
-}
-
-func TestRewriteParse(t *testing.T) {
-	simpleTests := []struct {
-		input     string
-		shouldErr bool
-		expected  []rewrite.Rule
-	}{
-		{`rewrite /from /to`, false, []rewrite.Rule{
-			rewrite.SimpleRule{From: "/from", To: "/to"},
-		}},
-		{`rewrite /from /to
-		  rewrite a b`, false, []rewrite.Rule{
-			rewrite.SimpleRule{From: "/from", To: "/to"},
-			rewrite.SimpleRule{From: "a", To: "b"},
-		}},
-		{`rewrite a`, true, []rewrite.Rule{}},
-		{`rewrite`, true, []rewrite.Rule{}},
-		{`rewrite a b c`, false, []rewrite.Rule{
-			rewrite.SimpleRule{From: "a", To: "b c"},
-		}},
-	}
-
-	for i, test := range simpleTests {
-		c := NewTestController(test.input)
-		actual, err := rewriteParse(c)
-
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d didn't error, but it should have", i)
-		} else if err != nil && !test.shouldErr {
-			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
-		} else if err != nil && test.shouldErr {
-			continue
-		}
-
-		if len(actual) != len(test.expected) {
-			t.Fatalf("Test %d expected %d rules, but got %d",
-				i, len(test.expected), len(actual))
-		}
-
-		for j, e := range test.expected {
-			actualRule := actual[j].(rewrite.SimpleRule)
-			expectedRule := e.(rewrite.SimpleRule)
-
-			if actualRule.From != expectedRule.From {
-				t.Errorf("Test %d, rule %d: Expected From=%s, got %s",
-					i, j, expectedRule.From, actualRule.From)
-			}
-
-			if actualRule.To != expectedRule.To {
-				t.Errorf("Test %d, rule %d: Expected To=%s, got %s",
-					i, j, expectedRule.To, actualRule.To)
-			}
-		}
-	}
-
-	regexpTests := []struct {
-		input     string
-		shouldErr bool
-		expected  []rewrite.Rule
-	}{
-		{`rewrite {
-			r	.*
-			to	/to /index.php?
-		 }`, false, []rewrite.Rule{
-			&rewrite.ComplexRule{Base: "/", To: "/to /index.php?", Regexp: regexp.MustCompile(".*")},
-		}},
-		{`rewrite {
-			regexp	.*
-			to		/to
-			ext		/ html txt
-		 }`, false, []rewrite.Rule{
-			&rewrite.ComplexRule{Base: "/", To: "/to", Exts: []string{"/", "html", "txt"}, Regexp: regexp.MustCompile(".*")},
-		}},
-		{`rewrite /path {
-			r	rr
-			to	/dest
-		 }
-		 rewrite / {
-		 	regexp	[a-z]+
-		 	to 		/to /to2
-		 }
-		 `, false, []rewrite.Rule{
-			&rewrite.ComplexRule{Base: "/path", To: "/dest", Regexp: regexp.MustCompile("rr")},
-			&rewrite.ComplexRule{Base: "/", To: "/to /to2", Regexp: regexp.MustCompile("[a-z]+")},
-		}},
-		{`rewrite {
-			r	.*
-		 }`, true, []rewrite.Rule{
-			&rewrite.ComplexRule{},
-		}},
-		{`rewrite {
-
-		 }`, true, []rewrite.Rule{
-			&rewrite.ComplexRule{},
-		}},
-		{`rewrite /`, true, []rewrite.Rule{
-			&rewrite.ComplexRule{},
-		}},
-		{`rewrite {
-			to	/to
-			if {path} is a
-		 }`, false, []rewrite.Rule{
-			&rewrite.ComplexRule{Base: "/", To: "/to", Ifs: []rewrite.If{{A: "{path}", Operator: "is", B: "a"}}},
-		}},
-		{`rewrite {
-			status 500
-		 }`, true, []rewrite.Rule{
-			&rewrite.ComplexRule{},
-		}},
-		{`rewrite {
-			status 400
-		 }`, false, []rewrite.Rule{
-			&rewrite.ComplexRule{Base: "/", Status: 400},
-		}},
-		{`rewrite {
-			to /to
-			status 400
-		 }`, false, []rewrite.Rule{
-			&rewrite.ComplexRule{Base: "/", To: "/to", Status: 400},
-		}},
-		{`rewrite {
-			status 399
-		 }`, true, []rewrite.Rule{
-			&rewrite.ComplexRule{},
-		}},
-		{`rewrite {
-			status 200
-		 }`, false, []rewrite.Rule{
-			&rewrite.ComplexRule{Base: "/", Status: 200},
-		}},
-		{`rewrite {
-			to /to
-			status 200
-		 }`, false, []rewrite.Rule{
-			&rewrite.ComplexRule{Base: "/", To: "/to", Status: 200},
-		}},
-		{`rewrite {
-			status 199
-		 }`, true, []rewrite.Rule{
-			&rewrite.ComplexRule{},
-		}},
-		{`rewrite {
-			status 0
-		 }`, true, []rewrite.Rule{
-			&rewrite.ComplexRule{},
-		}},
-		{`rewrite {
-			to /to
-			status 0
-		 }`, true, []rewrite.Rule{
-			&rewrite.ComplexRule{},
-		}},
-	}
-
-	for i, test := range regexpTests {
-		c := NewTestController(test.input)
-		actual, err := rewriteParse(c)
-
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d didn't error, but it should have", i)
-		} else if err != nil && !test.shouldErr {
-			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
-		} else if err != nil && test.shouldErr {
-			continue
-		}
-
-		if len(actual) != len(test.expected) {
-			t.Fatalf("Test %d expected %d rules, but got %d",
-				i, len(test.expected), len(actual))
-		}
-
-		for j, e := range test.expected {
-			actualRule := actual[j].(*rewrite.ComplexRule)
-			expectedRule := e.(*rewrite.ComplexRule)
-
-			if actualRule.Base != expectedRule.Base {
-				t.Errorf("Test %d, rule %d: Expected Base=%s, got %s",
-					i, j, expectedRule.Base, actualRule.Base)
-			}
-
-			if actualRule.To != expectedRule.To {
-				t.Errorf("Test %d, rule %d: Expected To=%s, got %s",
-					i, j, expectedRule.To, actualRule.To)
-			}
-
-			if fmt.Sprint(actualRule.Exts) != fmt.Sprint(expectedRule.Exts) {
-				t.Errorf("Test %d, rule %d: Expected Ext=%v, got %v",
-					i, j, expectedRule.To, actualRule.To)
-			}
-
-			if actualRule.Regexp != nil {
-				if actualRule.String() != expectedRule.String() {
-					t.Errorf("Test %d, rule %d: Expected Pattern=%s, got %s",
-						i, j, expectedRule.String(), actualRule.String())
-				}
-			}
-
-			if fmt.Sprint(actualRule.Ifs) != fmt.Sprint(expectedRule.Ifs) {
-				t.Errorf("Test %d, rule %d: Expected Pattern=%s, got %s",
-					i, j, fmt.Sprint(expectedRule.Ifs), fmt.Sprint(actualRule.Ifs))
-			}
-
-		}
-	}
-
-}

caddy/setup/roller.go

@@ -1,40 +0,0 @@
-package setup
-
-import (
-	"strconv"
-
-	"github.com/mholt/caddy/middleware"
-)
-
-func parseRoller(c *Controller) (*middleware.LogRoller, error) {
-	var size, age, keep int
-	// This is kind of a hack to support nested blocks:
-	// As we are already in a block: either log or errors,
-	// c.nesting > 0 but, as soon as c meets a }, it thinks
-	// the block is over and return false for c.NextBlock.
-	for c.NextBlock() {
-		what := c.Val()
-		if !c.NextArg() {
-			return nil, c.ArgErr()
-		}
-		value := c.Val()
-		var err error
-		switch what {
-		case "size":
-			size, err = strconv.Atoi(value)
-		case "age":
-			age, err = strconv.Atoi(value)
-		case "keep":
-			keep, err = strconv.Atoi(value)
-		}
-		if err != nil {
-			return nil, err
-		}
-	}
-	return &middleware.LogRoller{
-		MaxSize:    size,
-		MaxAge:     age,
-		MaxBackups: keep,
-		LocalTime:  true,
-	}, nil
-}

caddy/setup/root.go

@@ -1,32 +0,0 @@
-package setup
-
-import (
-	"log"
-	"os"
-
-	"github.com/mholt/caddy/middleware"
-)
-
-// Root sets up the root file path of the server.
-func Root(c *Controller) (middleware.Middleware, error) {
-	for c.Next() {
-		if !c.NextArg() {
-			return nil, c.ArgErr()
-		}
-		c.Root = c.Val()
-	}
-
-	// Check if root path exists
-	_, err := os.Stat(c.Root)
-	if err != nil {
-		if os.IsNotExist(err) {
-			// Allow this, because the folder might appear later.
-			// But make sure the user knows!
-			log.Printf("[WARNING] Root path does not exist: %s", c.Root)
-		} else {
-			return nil, c.Errf("Unable to access root path '%s': %v", c.Root, err)
-		}
-	}
-
-	return nil, nil
-}

caddy/setup/root_test.go

@@ -1,108 +0,0 @@
-package setup
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestRoot(t *testing.T) {
-
-	// Predefined error substrings
-	parseErrContent := "Parse error:"
-	unableToAccessErrContent := "Unable to access root path"
-
-	existingDirPath, err := getTempDirPath()
-	if err != nil {
-		t.Fatalf("BeforeTest: Failed to find an existing directory for testing! Error was: %v", err)
-	}
-
-	nonExistingDir := filepath.Join(existingDirPath, "highly_unlikely_to_exist_dir")
-
-	existingFile, err := ioutil.TempFile("", "root_test")
-	if err != nil {
-		t.Fatalf("BeforeTest: Failed to create temp file for testing! Error was: %v", err)
-	}
-	defer func() {
-		existingFile.Close()
-		os.Remove(existingFile.Name())
-	}()
-
-	inaccessiblePath := getInaccessiblePath(existingFile.Name())
-
-	tests := []struct {
-		input              string
-		shouldErr          bool
-		expectedRoot       string // expected root, set to the controller. Empty for negative cases.
-		expectedErrContent string // substring from the expected error. Empty for positive cases.
-	}{
-		// positive
-		{
-			fmt.Sprintf(`root %s`, nonExistingDir), false, nonExistingDir, "",
-		},
-		{
-			fmt.Sprintf(`root %s`, existingDirPath), false, existingDirPath, "",
-		},
-		// negative
-		{
-			`root `, true, "", parseErrContent,
-		},
-		{
-			fmt.Sprintf(`root %s`, inaccessiblePath), true, "", unableToAccessErrContent,
-		},
-		{
-			fmt.Sprintf(`root {
-				%s
-			}`, existingDirPath), true, "", parseErrContent,
-		},
-	}
-
-	for i, test := range tests {
-		c := NewTestController(test.input)
-		mid, err := Root(c)
-
-		if test.shouldErr && err == nil {
-			t.Errorf("Test %d: Expected error but found %s for input %s", i, err, test.input)
-		}
-
-		if err != nil {
-			if !test.shouldErr {
-				t.Errorf("Test %d: Expected no error but found one for input %s. Error was: %v", i, test.input, err)
-			}
-
-			if !strings.Contains(err.Error(), test.expectedErrContent) {
-				t.Errorf("Test %d: Expected error to contain: %v, found error: %v, input: %s", i, test.expectedErrContent, err, test.input)
-			}
-		}
-
-		// the Root method always returns a nil middleware
-		if mid != nil {
-			t.Errorf("Middware, returned from Root() was not nil: %v", mid)
-		}
-
-		// check c.Root only if we are in a positive test.
-		if !test.shouldErr && test.expectedRoot != c.Root {
-			t.Errorf("Root not correctly set for input %s. Expected: %s, actual: %s", test.input, test.expectedRoot, c.Root)
-		}
-	}
-}
-
-// getTempDirPath returnes the path to the system temp directory. If it does not exists - an error is returned.
-func getTempDirPath() (string, error) {
-	tempDir := os.TempDir()
-
-	_, err := os.Stat(tempDir)
-	if err != nil {
-		return "", err
-	}
-
-	return tempDir, nil
-}
-
-func getInaccessiblePath(file string) string {
-	// null byte in filename is not allowed on Windows AND unix
-	return filepath.Join("C:", "file\x00name")
-}

caddy/setup/startupshutdown.go

@@ -1,64 +0,0 @@
-package setup
-
-import (
-	"os"
-	"os/exec"
-	"strings"
-
-	"github.com/mholt/caddy/middleware"
-)
-
-// Startup registers a startup callback to execute during server start.
-func Startup(c *Controller) (middleware.Middleware, error) {
-	return nil, registerCallback(c, &c.FirstStartup)
-}
-
-// Shutdown registers a shutdown callback to execute during process exit.
-func Shutdown(c *Controller) (middleware.Middleware, error) {
-	return nil, registerCallback(c, &c.Shutdown)
-}
-
-// registerCallback registers a callback function to execute by
-// using c to parse the line. It appends the callback function
-// to the list of callback functions passed in by reference.
-func registerCallback(c *Controller, list *[]func() error) error {
-	var funcs []func() error
-
-	for c.Next() {
-		args := c.RemainingArgs()
-		if len(args) == 0 {
-			return c.ArgErr()
-		}
-
-		nonblock := false
-		if len(args) > 1 && args[len(args)-1] == "&" {
-			// Run command in background; non-blocking
-			nonblock = true
-			args = args[:len(args)-1]
-		}
-
-		command, args, err := middleware.SplitCommandAndArgs(strings.Join(args, " "))
-		if err != nil {
-			return c.Err(err.Error())
-		}
-
-		fn := func() error {
-			cmd := exec.Command(command, args...)
-			cmd.Stdin = os.Stdin
-			cmd.Stdout = os.Stdout
-			cmd.Stderr = os.Stderr
-
-			if nonblock {
-				return cmd.Start()
-			}
-			return cmd.Run()
-		}
-
-		funcs = append(funcs, fn)
-	}
-
-	return c.OncePerServerBlock(func() error {
-		*list = append(*list, funcs...)
-		return nil
-	})
-}

caddy/setup/startupshutdown_test.go

@@ -1,59 +0,0 @@
-package setup
-
-import (
-	"os"
-	"path/filepath"
-	"strconv"
-	"testing"
-	"time"
-)
-
-// The Startup function's tests are symmetrical to Shutdown tests,
-// because the Startup and Shutdown functions share virtually the
-// same functionality
-func TestStartup(t *testing.T) {
-	tempDirPath, err := getTempDirPath()
-	if err != nil {
-		t.Fatalf("BeforeTest: Failed to find an existing directory for testing! Error was: %v", err)
-	}
-
-	testDir := filepath.Join(tempDirPath, "temp_dir_for_testing_startupshutdown")
-	defer func() {
-		// clean up after non-blocking startup function quits
-		time.Sleep(500 * time.Millisecond)
-		os.RemoveAll(testDir)
-	}()
-	osSenitiveTestDir := filepath.FromSlash(testDir)
-	os.RemoveAll(osSenitiveTestDir) // start with a clean slate
-
-	tests := []struct {
-		input              string
-		shouldExecutionErr bool
-		shouldRemoveErr    bool
-	}{
-		// test case #0 tests proper functionality blocking commands
-		{"startup mkdir " + osSenitiveTestDir, false, false},
-
-		// test case #1 tests proper functionality of non-blocking commands
-		{"startup mkdir " + osSenitiveTestDir + " &", false, true},
-
-		// test case #2 tests handling of non-existent commands
-		{"startup " + strconv.Itoa(int(time.Now().UnixNano())), true, true},
-	}
-
-	for i, test := range tests {
-		c := NewTestController(test.input)
-		_, err = Startup(c)
-		if err != nil {
-			t.Errorf("Expected no errors, got: %v", err)
-		}
-		err = c.FirstStartup[0]()
-		if err != nil && !test.shouldExecutionErr {
-			t.Errorf("Test %d recieved an error of:\n%v", i, err)
-		}
-		err = os.Remove(osSenitiveTestDir)
-		if err != nil && !test.shouldRemoveErr {
-			t.Errorf("Test %d recieved an error of:\n%v", i, err)
-		}
-	}
-}

caddy/setup/templates.go

@@ -1,90 +0,0 @@
-package setup
-
-import (
-	"net/http"
-
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/templates"
-)
-
-// Templates configures a new Templates middleware instance.
-func Templates(c *Controller) (middleware.Middleware, error) {
-	rules, err := templatesParse(c)
-	if err != nil {
-		return nil, err
-	}
-
-	tmpls := templates.Templates{
-		Rules:   rules,
-		Root:    c.Root,
-		FileSys: http.Dir(c.Root),
-	}
-
-	return func(next middleware.Handler) middleware.Handler {
-		tmpls.Next = next
-		return tmpls
-	}, nil
-}
-
-func templatesParse(c *Controller) ([]templates.Rule, error) {
-	var rules []templates.Rule
-
-	for c.Next() {
-		var rule templates.Rule
-
-		rule.Path = defaultTemplatePath
-		rule.Extensions = defaultTemplateExtensions
-
-		args := c.RemainingArgs()
-
-		switch len(args) {
-		case 0:
-			// Optional block
-			for c.NextBlock() {
-				switch c.Val() {
-				case "path":
-					args := c.RemainingArgs()
-					if len(args) != 1 {
-						return nil, c.ArgErr()
-					}
-					rule.Path = args[0]
-
-				case "ext":
-					args := c.RemainingArgs()
-					if len(args) == 0 {
-						return nil, c.ArgErr()
-					}
-					rule.Extensions = args
-
-				case "between":
-					args := c.RemainingArgs()
-					if len(args) != 2 {
-						return nil, c.ArgErr()
-					}
-					rule.Delims[0] = args[0]
-					rule.Delims[1] = args[1]
-				}
-			}
-		default:
-			// First argument would be the path
-			rule.Path = args[0]
-
-			// Any remaining arguments are extensions
-			rule.Extensions = args[1:]
-			if len(rule.Extensions) == 0 {
-				rule.Extensions = defaultTemplateExtensions
-			}
-		}
-
-		for _, ext := range rule.Extensions {
-			rule.IndexFiles = append(rule.IndexFiles, "index"+ext)
-		}
-
-		rules = append(rules, rule)
-	}
-	return rules, nil
-}
-
-const defaultTemplatePath = "/"
-
-var defaultTemplateExtensions = []string{".html", ".htm", ".tmpl", ".tpl", ".txt"}

caddy/setup/templates_test.go

@@ -1,112 +0,0 @@
-package setup
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/mholt/caddy/middleware/templates"
-)
-
-func TestTemplates(t *testing.T) {
-
-	c := NewTestController(`templates`)
-
-	mid, err := Templates(c)
-
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(templates.Templates)
-
-	if !ok {
-		t.Fatalf("Expected handler to be type Templates, got: %#v", handler)
-	}
-
-	if myHandler.Rules[0].Path != defaultTemplatePath {
-		t.Errorf("Expected / as the default Path")
-	}
-	if fmt.Sprint(myHandler.Rules[0].Extensions) != fmt.Sprint(defaultTemplateExtensions) {
-		t.Errorf("Expected %v to be the Default Extensions", defaultTemplateExtensions)
-	}
-	var indexFiles []string
-	for _, extension := range defaultTemplateExtensions {
-		indexFiles = append(indexFiles, "index"+extension)
-	}
-	if fmt.Sprint(myHandler.Rules[0].IndexFiles) != fmt.Sprint(indexFiles) {
-		t.Errorf("Expected %v to be the Default Index files", indexFiles)
-	}
-	if myHandler.Rules[0].Delims != [2]string{} {
-		t.Errorf("Expected %v to be the Default Delims", [2]string{})
-	}
-}
-
-func TestTemplatesParse(t *testing.T) {
-	tests := []struct {
-		inputTemplateConfig    string
-		shouldErr              bool
-		expectedTemplateConfig []templates.Rule
-	}{
-		{`templates /api1`, false, []templates.Rule{{
-			Path:       "/api1",
-			Extensions: defaultTemplateExtensions,
-			Delims:     [2]string{},
-		}}},
-		{`templates /api2 .txt .htm`, false, []templates.Rule{{
-			Path:       "/api2",
-			Extensions: []string{".txt", ".htm"},
-			Delims:     [2]string{},
-		}}},
-
-		{`templates /api3 .htm .html
-		  templates /api4 .txt .tpl `, false, []templates.Rule{{
-			Path:       "/api3",
-			Extensions: []string{".htm", ".html"},
-			Delims:     [2]string{},
-		}, {
-			Path:       "/api4",
-			Extensions: []string{".txt", ".tpl"},
-			Delims:     [2]string{},
-		}}},
-		{`templates {
-				path /api5
-				ext .html
-				between {% %}
-			}`, false, []templates.Rule{{
-			Path:       "/api5",
-			Extensions: []string{".html"},
-			Delims:     [2]string{"{%", "%}"},
-		}}},
-	}
-	for i, test := range tests {
-		c := NewTestController(test.inputTemplateConfig)
-		actualTemplateConfigs, err := templatesParse(c)
-
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d didn't error, but it should have", i)
-		} else if err != nil && !test.shouldErr {
-			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
-		}
-		if len(actualTemplateConfigs) != len(test.expectedTemplateConfig) {
-			t.Fatalf("Test %d expected %d no of Template configs, but got %d ",
-				i, len(test.expectedTemplateConfig), len(actualTemplateConfigs))
-		}
-		for j, actualTemplateConfig := range actualTemplateConfigs {
-
-			if actualTemplateConfig.Path != test.expectedTemplateConfig[j].Path {
-				t.Errorf("Test %d expected %dth Template Config Path to be  %s  , but got %s",
-					i, j, test.expectedTemplateConfig[j].Path, actualTemplateConfig.Path)
-			}
-
-			if fmt.Sprint(actualTemplateConfig.Extensions) != fmt.Sprint(test.expectedTemplateConfig[j].Extensions) {
-				t.Errorf("Expected %v to be the  Extensions , but got %v instead", test.expectedTemplateConfig[j].Extensions, actualTemplateConfig.Extensions)
-			}
-		}
-	}
-
-}

caddy/setup/testdata/blog/first_post.md

@@ -1 +0,0 @@
-# Test h1

caddy/setup/testdata/header.html

@@ -1 +0,0 @@
-<h1>Header title</h1>

caddy/setup/testdata/tpl_with_include.html

@@ -1,10 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-<title>{{.Doc.title}}</title>
-</head>
-<body>
-{{.Include "header.html"}}
-{{.Doc.body}}
-</body>
-</html>

caddy/setup/websocket.go

@@ -1,87 +0,0 @@
-package setup
-
-import (
-	"github.com/mholt/caddy/middleware"
-	"github.com/mholt/caddy/middleware/websocket"
-)
-
-// WebSocket configures a new WebSocket middleware instance.
-func WebSocket(c *Controller) (middleware.Middleware, error) {
-
-	websocks, err := webSocketParse(c)
-	if err != nil {
-		return nil, err
-	}
-	websocket.GatewayInterface = c.AppName + "-CGI/1.1"
-	websocket.ServerSoftware = c.AppName + "/" + c.AppVersion
-
-	return func(next middleware.Handler) middleware.Handler {
-		return websocket.WebSocket{Next: next, Sockets: websocks}
-	}, nil
-}
-
-func webSocketParse(c *Controller) ([]websocket.Config, error) {
-	var websocks []websocket.Config
-	var respawn bool
-
-	optionalBlock := func() (hadBlock bool, err error) {
-		for c.NextBlock() {
-			hadBlock = true
-			if c.Val() == "respawn" {
-				respawn = true
-			} else {
-				return true, c.Err("Expected websocket configuration parameter in block")
-			}
-		}
-		return
-	}
-
-	for c.Next() {
-		var val, path, command string
-
-		// Path or command; not sure which yet
-		if !c.NextArg() {
-			return nil, c.ArgErr()
-		}
-		val = c.Val()
-
-		// Extra configuration may be in a block
-		hadBlock, err := optionalBlock()
-		if err != nil {
-			return nil, err
-		}
-
-		if !hadBlock {
-			// The next argument on this line will be the command or an open curly brace
-			if c.NextArg() {
-				path = val
-				command = c.Val()
-			} else {
-				path = "/"
-				command = val
-			}
-
-			// Okay, check again for optional block
-			_, err = optionalBlock()
-			if err != nil {
-				return nil, err
-			}
-		}
-
-		// Split command into the actual command and its arguments
-		cmd, args, err := middleware.SplitCommandAndArgs(command)
-		if err != nil {
-			return nil, err
-		}
-
-		websocks = append(websocks, websocket.Config{
-			Path:      path,
-			Command:   cmd,
-			Arguments: args,
-			Respawn:   respawn, // TODO: This isn't used currently
-		})
-	}
-
-	return websocks, nil
-
-}

caddy/setup/websocket_test.go

@@ -1,105 +0,0 @@
-package setup
-
-import (
-	"testing"
-
-	"github.com/mholt/caddy/middleware/websocket"
-)
-
-func TestWebSocket(t *testing.T) {
-
-	c := NewTestController(`websocket cat`)
-
-	mid, err := WebSocket(c)
-
-	if err != nil {
-		t.Errorf("Expected no errors, got: %v", err)
-	}
-
-	if mid == nil {
-		t.Fatal("Expected middleware, was nil instead")
-	}
-
-	handler := mid(EmptyNext)
-	myHandler, ok := handler.(websocket.WebSocket)
-
-	if !ok {
-		t.Fatalf("Expected handler to be type WebSocket, got: %#v", handler)
-	}
-
-	if myHandler.Sockets[0].Path != "/" {
-		t.Errorf("Expected / as the default Path")
-	}
-	if myHandler.Sockets[0].Command != "cat" {
-		t.Errorf("Expected %s as the command", "cat")
-	}
-
-}
-func TestWebSocketParse(t *testing.T) {
-	tests := []struct {
-		inputWebSocketConfig    string
-		shouldErr               bool
-		expectedWebSocketConfig []websocket.Config
-	}{
-		{`websocket /api1 cat`, false, []websocket.Config{{
-			Path:    "/api1",
-			Command: "cat",
-		}}},
-
-		{`websocket /api3 cat  
-		  websocket /api4 cat `, false, []websocket.Config{{
-			Path:    "/api3",
-			Command: "cat",
-		}, {
-			Path:    "/api4",
-			Command: "cat",
-		}}},
-
-		{`websocket /api5 "cmd arg1 arg2 arg3"`, false, []websocket.Config{{
-			Path:      "/api5",
-			Command:   "cmd",
-			Arguments: []string{"arg1", "arg2", "arg3"},
-		}}},
-
-		// accept respawn
-		{`websocket /api6 cat {
-			respawn
-		}`, false, []websocket.Config{{
-			Path:    "/api6",
-			Command: "cat",
-		}}},
-
-		// invalid configuration
-		{`websocket /api7 cat {
-			invalid
-		}`, true, []websocket.Config{}},
-	}
-	for i, test := range tests {
-		c := NewTestController(test.inputWebSocketConfig)
-		actualWebSocketConfigs, err := webSocketParse(c)
-
-		if err == nil && test.shouldErr {
-			t.Errorf("Test %d didn't error, but it should have", i)
-		} else if err != nil && !test.shouldErr {
-			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
-		}
-		if len(actualWebSocketConfigs) != len(test.expectedWebSocketConfig) {
-			t.Fatalf("Test %d expected %d no of WebSocket configs, but got %d ",
-				i, len(test.expectedWebSocketConfig), len(actualWebSocketConfigs))
-		}
-		for j, actualWebSocketConfig := range actualWebSocketConfigs {
-
-			if actualWebSocketConfig.Path != test.expectedWebSocketConfig[j].Path {
-				t.Errorf("Test %d expected %dth WebSocket Config Path to be  %s  , but got %s",
-					i, j, test.expectedWebSocketConfig[j].Path, actualWebSocketConfig.Path)
-			}
-
-			if actualWebSocketConfig.Command != test.expectedWebSocketConfig[j].Command {
-				t.Errorf("Test %d expected %dth WebSocket Config Command to be  %s  , but got %s",
-					i, j, test.expectedWebSocketConfig[j].Command, actualWebSocketConfig.Command)
-			}
-
-		}
-	}
-
-}

caddy/sigtrap.go

@@ -1,71 +0,0 @@
-package caddy
-
-import (
-	"log"
-	"os"
-	"os/signal"
-	"sync"
-
-	"github.com/mholt/caddy/server"
-)
-
-// TrapSignals create signal handlers for all applicable signals for this
-// system. If your Go program uses signals, this is a rather invasive
-// function; best to implement them yourself in that case. Signals are not
-// required for the caddy package to function properly, but this is a
-// convenient way to allow the user to control this package of your program.
-func TrapSignals() {
-	trapSignalsCrossPlatform()
-	trapSignalsPosix()
-}
-
-// trapSignalsCrossPlatform captures SIGINT, which triggers forceful
-// shutdown that executes shutdown callbacks first. A second interrupt
-// signal will exit the process immediately.
-func trapSignalsCrossPlatform() {
-	go func() {
-		shutdown := make(chan os.Signal, 1)
-		signal.Notify(shutdown, os.Interrupt)
-
-		for i := 0; true; i++ {
-			<-shutdown
-
-			if i > 0 {
-				log.Println("[INFO] SIGINT: Force quit")
-				if PidFile != "" {
-					os.Remove(PidFile)
-				}
-				os.Exit(1)
-			}
-
-			log.Println("[INFO] SIGINT: Shutting down")
-
-			if PidFile != "" {
-				os.Remove(PidFile)
-			}
-
-			go os.Exit(executeShutdownCallbacks("SIGINT"))
-		}
-	}()
-}
-
-// executeShutdownCallbacks executes the shutdown callbacks as initiated
-// by signame. It logs any errors and returns the recommended exit status.
-// This function is idempotent; subsequent invocations always return 0.
-func executeShutdownCallbacks(signame string) (exitCode int) {
-	shutdownCallbacksOnce.Do(func() {
-		serversMu.Lock()
-		errs := server.ShutdownCallbacks(servers)
-		serversMu.Unlock()
-
-		if len(errs) > 0 {
-			for _, err := range errs {
-				log.Printf("[ERROR] %s shutdown: %v", signame, err)
-			}
-			exitCode = 1
-		}
-	})
-	return
-}
-
-var shutdownCallbacksOnce sync.Once

caddy/sigtrap_posix.go

@@ -1,79 +0,0 @@
-// +build !windows
-
-package caddy
-
-import (
-	"io/ioutil"
-	"log"
-	"os"
-	"os/signal"
-	"syscall"
-)
-
-// trapSignalsPosix captures POSIX-only signals.
-func trapSignalsPosix() {
-	go func() {
-		sigchan := make(chan os.Signal, 1)
-		signal.Notify(sigchan, syscall.SIGTERM, syscall.SIGHUP, syscall.SIGQUIT, syscall.SIGUSR1)
-
-		for sig := range sigchan {
-			switch sig {
-			case syscall.SIGTERM:
-				log.Println("[INFO] SIGTERM: Terminating process")
-				if PidFile != "" {
-					os.Remove(PidFile)
-				}
-				os.Exit(0)
-
-			case syscall.SIGQUIT:
-				log.Println("[INFO] SIGQUIT: Shutting down")
-				exitCode := executeShutdownCallbacks("SIGQUIT")
-				err := Stop()
-				if err != nil {
-					log.Printf("[ERROR] SIGQUIT stop: %v", err)
-					exitCode = 1
-				}
-				if PidFile != "" {
-					os.Remove(PidFile)
-				}
-				os.Exit(exitCode)
-
-			case syscall.SIGHUP:
-				log.Println("[INFO] SIGHUP: Hanging up")
-				err := Stop()
-				if err != nil {
-					log.Printf("[ERROR] SIGHUP stop: %v", err)
-				}
-
-			case syscall.SIGUSR1:
-				log.Println("[INFO] SIGUSR1: Reloading")
-
-				var updatedCaddyfile Input
-
-				caddyfileMu.Lock()
-				if caddyfile == nil {
-					// Hmm, did spawing process forget to close stdin? Anyhow, this is unusual.
-					log.Println("[ERROR] SIGUSR1: no Caddyfile to reload (was stdin left open?)")
-					caddyfileMu.Unlock()
-					continue
-				}
-				if caddyfile.IsFile() {
-					body, err := ioutil.ReadFile(caddyfile.Path())
-					if err == nil {
-						updatedCaddyfile = CaddyfileInput{
-							Filepath: caddyfile.Path(),
-							Contents: body,
-							RealFile: true,
-						}
-					}
-				}
-				caddyfileMu.Unlock()
-
-				err := Restart(updatedCaddyfile)
-				if err != nil {
-					log.Printf("[ERROR] SIGUSR1: %v", err)
-				}
-			}
-		}
-	}()
-}