1471 Commits

Author SHA1 Message Date
Paulo Henrique
565c1c3054 autohttps: deterministic logic and strict bind checking on Linux (#7435)
* http: fix non-deterministic auto-https and improve Linux bind matching

* docs: restore historical context about Linux bind behavior
2026-01-16 08:51:23 -07:00
Mohammed Al Sahaf
e40bd019ff caddyfile: add observe_catchall_hosts option (#7434)
* caddyfile: add `observe_catchall_hosts` option

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* correct JSON field name and doc comment

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

---------

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2026-01-14 00:06:16 +00:00
Paulo Henrique
62134d65af reverseproxy: fix error when remote address is not an IP (#7429) 2026-01-13 19:52:56 +00:00
Francis Lavoie
90972fbebc chore: Dumb prealloc lint fix (#7430) 2026-01-13 14:13:43 -05:00
Tom Paulus
6a57142896 headers: Make ApplyTo nil-safe (#7426) 2026-01-06 17:39:58 -05:00
WeidiDeng
80f2ae92cd reverseproxy: make error chan bigger when reverse proxying websocket (#7419) 2026-01-06 04:55:47 -05:00
Felix Hildén
1f1be3f4fe tracing: Add span attributes to tracing module (#7269)
* WIP tracing span attributes

* better test

* only write attributes after other middleware (and request)

* Fix test to use header response placeholders
2025-12-31 11:33:18 -07:00
Francis Lavoie
decc8a4d6f logging: log_append Early option, Supports {http.response.body} (#7368)
* logging: `log_append` early option

* logging: `log_append` supports `{http.response.body}`

* Convenience auto-early for request body
2025-12-16 23:42:42 -05:00
Francis Lavoie
4037d05760 caddyhttp: {http.request.body_base64} placeholder (#7367) 2025-12-13 21:01:12 -07:00
Paul B
6a4296b1a4 caddytls: panic when using tls.ca_pool.source.http -> tls.ca (#7393) 2025-12-11 19:27:15 +00:00
Matt Holt
3c9c67e804 caddytls: ECH key rotation (#7356)
* caddytls: ECH key rotation

* Stop rotation goroutine on config unload

* Publish ECH keys after rotating
2025-12-10 11:50:35 -07:00
okrc
374b7a637f caddytls: fix preferred chains options by appending values instead of replacing (#7387) 2025-12-07 16:19:01 +00:00
WeidiDeng
6e0cbd0fa0 caddyhttp: create a placeholder for and log ech status (#7328)
Co-authored-by: Francis Lavoie <lavofr@gmail.com>
2025-12-07 16:01:58 +00:00
Steffen Busch
bfdb04912d docs: add maybe template function documentation (#7388) 2025-12-06 06:51:28 -05:00
vnxme
31960dc998 Introduce packet conn wrappers (#7180)
* packet_conn_wrappers: Initial changes

* packet_conn_wrappers: Unwrap a packet conn only if there are no wrappers

---------

Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2025-12-04 14:15:56 -07:00
Francis Lavoie
be5f49fbeb caddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true (#7372) 2025-12-03 18:46:11 +00:00
Herman Slatman
7ebe72bbfe caddypki: Add support for multiple intermediates in signing chain (#7057)
* caddypki: Add support for multiple intermediates in signing chain

* Move intermediate lifetime configuration check

In #7272 a check was changed to ensure that generated intermediate
certificates would always use a lifetime that falls within the
lifetime of the root. However, when a root and intermediate(s)
are supplied, the configuration value was being used instead of
the actual lifetimes of the certificates. The check was moved to
only be performed when an intermediate is generated; not when
loaded from disk.

* Add tests for `pemDecodeCertificateChain` and `pemDecodeCertificate`

* Use `crypto.Signer` instead of `any` in appropriate places

* Use latest Smallstep packages

---------

Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2025-12-03 11:30:00 -07:00
Petr
67a9e0657e reverseproxy: Fix retries for requests with bodies (#7360)
* capture the buffered body once, then reset clonedReq.Body before each retry

* no copy

* keep receiver name

* set the buf to nil after extraction and only return it to pool if not nil

---------

Co-authored-by: WeidiDeng <weidi_deng@icloud.com>
2025-11-24 12:03:18 -07:00
ledigang
2cb426776c encode: modernize, replace HasSuffix+TrimSuffix with CutSuffix (#7357)
Signed-off-by: ledigang <shuangcui@msn.com>
2025-11-21 15:30:26 -07:00
WeidiDeng
a6da1acdc8 reverse_proxy: use interfaces to modify the behaviors of the transports (#7353) 2025-11-17 09:51:37 -07:00
Kévin Dunglas
b3f2db233b core: custom slog handlers for modules (log contextual data) (#7346) 2025-11-12 13:29:47 -07:00
Marten Seemann
f2199d48b2 chore: update quic-go to v0.56.0, enable qlog for HTTP/3 (#7345) 2025-11-08 00:41:15 -05:00
Kévin Dunglas
8285eba842 caddyhttp: allow customizing the Server header (#7338) 2025-11-03 21:00:27 -07:00
Cooper de Nicola
895b56063a chore: fix golangci-lint error G602 in caddyhttp (#7334) 2025-11-03 03:04:55 +00:00
Mohammed Al Sahaf
ddec1838b3 caddytls: correct documentation of LeafFolderLoader (#7327)
* caddytls: correct documentation of `LeafFolderLoader`

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* fmt...

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

---------

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-11-01 18:29:55 +03:00
WeidiDeng
abe0acabb6 reverseproxy: set default values for keepalive if only some of them are set (#7318) 2025-10-25 05:15:55 -04:00
Philipp Keidel
b54e870b26 tracing: switch to autoexport for OpenTelemetry span exporter (#7317) 2025-10-23 17:54:50 -06:00
wyrapeseed
57587ed18e refactor: use reflect.TypeFor (#7313)
Signed-off-by: wyrapeseed <wyrapeseed@outlook.com>
2025-10-21 13:26:30 -06:00
WeidiDeng
1e21b660c4 reverseproxy: use http.Protocols to handle h2c requests (#6990) 2025-10-21 16:05:43 +00:00
Mohammed Al Sahaf
595aab8bc0 metrics: resolve per-host inifinite cardinality (#7306) 2025-10-21 06:06:56 +00:00
WeidiDeng
8aca108d2c reverseproxy: do not disable keepalive if proxy protocol is used (#7300) 2025-10-21 05:09:37 +00:00
WeidiDeng
a7885aabec intercept: use already buffered response if possible when intercepting (#7028) 2025-10-21 04:48:07 +00:00
Bashayer Alrumahi
f5f25d845a logging: fix multiple regexp filters on same field (fixes #7049) (#7061)
* logging: fix multiple regexp filters on same field (fixes #7049)

* fix: add proper error handling in MultiRegexpFilter tests

* fix: resolve linter and test issues - Fix GCI import formatting issues - Fix MultiRegexpFilter input size limit test by ensuring output doesn't exceed max length after each operation - All tests now pass and linter issues resolved

* fix: update integration test for proper JSON encoding - Fix expected JSON output to use Unicode escape sequence for ampersand character - Integration tests now pass
2025-10-16 05:08:53 +00:00
WeidiDeng
1ce2a13ad1 caddyhttp: wrap accepted connection to suppress tls.ConnectionState (#7247) 2025-10-16 03:13:40 +00:00
Chris Seufert
d7185fd002 caddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers (#7265) 2025-10-16 02:47:32 +00:00
Anthony Biondo
7fb39ec1e5 reverseproxy: Use http1.1 upgrade for websocket for extended connect of http2 and http3 (#7305)
Co-authored-by: WeidiDeng <weidi_deng@icloud.com>
2025-10-16 02:20:20 +00:00
aeris
10ac7da037 logging: Switch from lumberjack to timberjack, add time-rolling options (#7244)
Co-authored-by: Francis Lavoie <lavofr@gmail.com>
2025-10-15 17:11:10 -04:00
wyrapeseed
d115cd1042 chore: fix some comments (#7303) 2025-10-15 03:58:53 +00:00
joshuamcbeth
de6b78009b caddyhttp: Add server options keepalive_idle and keepalive_count (#7298)
* Add Server options KeepAliveIdle (keepalive_idle) and KeepAliveCount (keepalive_count)

Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com>

* Add Server option KeepAliveDisable (keepalive_disable)

Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com>

* Remove Server option KeepAliveDisable (keepalive_disable), disable when interval is negative

Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com>

* Add keepalive parameters to caddyfiletest

Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com>

---------

Signed-off-by: Joshua McBeth <joshua.mcbeth@gmail.com>
2025-10-14 12:03:23 -06:00
WeidiDeng
2ec28bca43 reverse_proxy: use http1 for outbound tls requests with placeholder that are likely websockets (#7296) 2025-10-09 10:36:49 -06:00
GreyXor
13a4ec7597 basicauth: Implement argon2id (#7186)
* feat: add argon2id hash-password command

* feat: ardon2id owasp safe value

* feat: add argon2id compare method

* chore: fmt argon2id

* docs: more argon2id docs

* chore: upgrade x/crypto dep

* revert: remove golangci

* refactor: argon2id decode

* chore: update deps

* refactor: simplify argon2id compare return

* chore: upgrade dependencies

* chore: upgrade dependencies
2025-10-06 17:27:06 -06:00
asttool
bc0e184130 caddyhttp: omit unnecessary reassignment (#7276)
Signed-off-by: asttool <asttool@outlook.com>
2025-09-26 10:44:58 -06:00
Y.Horie
1e82f9652e caddypki: check intermediate lifetime to actual root cert lifetime (#7272) 2025-09-26 10:24:52 -06:00
Mohammed Al Sahaf
25be2f26fc chore: ugh, lint fix... (#7275)
* chore: ugh, lint fix...

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* more lint fixes

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

---------

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-09-26 03:14:48 -04:00
Gilbert Gilb's
f5c3094050 cmd: prevent commas in header values from being split (#7268)
`pflag.GetStringSlice` treats commas as delimiters, which causes issues
when passing headers whose values contain commas (`X-Robots-Tag:
noindex, nofollow`). These are incorrectly split into multiple headers
and errors out:

- `X-Robots-Tag: noindex`
- ` nofollow`

Switch to `pflag.GetStringArray`, which does not split on commas[1].

Note that this changes behavior for cases where multiple headers were
provided in a single argument with commas (`--header-down "X-Foo:
Bar,X-Bar: Foo"`). Such cases will now be treated as a single header
value. If this breaking change is unacceptable, we will need a smarter
fallback mechanism.

[1] https://github.com/spf13/pflag/pull/90
2025-09-22 21:12:06 -06:00
WeidiDeng
b462615439 fileserver: set Content-Length for precompressed files (#7251)
* set Content-Length for precompressed files

* Update modules/caddyhttp/fileserver/staticfiles.go

Co-authored-by: Matt Holt <mholt@users.noreply.github.com>

---------

Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2025-09-10 22:48:03 -06:00
Pavel
d9cc24f3df caddypki: Disable internal auto-CA when auto_https is disabled (fix #7211) (#7238)
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2025-09-05 09:41:06 -06:00
Matthew Holt
38848f7f25 caddytls: Allow disabling distributed solving (except http-01) 2025-09-04 08:51:36 -06:00
Siomachkin
5473eb95d8 encode: fix response corruption when handle_errors is used (#7235)
* encode: fix response corruption when handle_errors is used

* Move disabled check before hdr assignment
2025-09-02 15:34:56 -06:00
Max Celant
3553cfb6ad caddyhttp: remove redundant middleware next copy (#7217) 2025-09-01 09:30:34 -06:00