Commit Graph

2281 Commits (cleanup-partial-reload)

Author SHA1 Message Date
Weidi Deng a66fce04b7 clean up new config if it failed to run 2025-06-14 20:17:53 +08:00
Mohammed Al Sahaf 1a0f168b6e
ci: add `{base,head}-ref` to dep review check (#7064)
Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-06-13 08:13:17 +03:00
Mohammed Al Sahaf 7a33f481f1
ci: add dep review, OSSF scorecard actions (#7063)
* ci: add dep review action

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* sprinkle permissions on Actions jobs

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* README: add OpenSSF best practices badge

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* add draft OpenSSF Scorecard workflow

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

---------

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-06-12 23:40:51 +00:00
Herman Slatman e633d013f6
cmd: fix `Commands` function not returning all registered commands (#7059) 2025-06-12 17:17:51 -06:00
Matt Holt fe26751491
Update SECURITY.md 2025-06-12 09:38:48 -06:00
dependabot[bot] 4b01d77b81
build(deps): bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 (#7058)
Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl) from 1.6.0 to 1.6.1.
- [Release notes](https://github.com/cloudflare/circl/releases)
- [Commits](https://github.com/cloudflare/circl/compare/v1.6.0...v1.6.1)

---
updated-dependencies:
- dependency-name: github.com/cloudflare/circl
  dependency-version: 1.6.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-12 11:44:26 +03:00
Hina🐣 | Developer 0f209f62eb
httpcaddyfile: reject blocks in log_skip directive (#7056) 2025-06-09 21:56:21 -06:00
Mohammed Al Sahaf 1481c0411a
caddytls: wire up client_auth leaf verifier Caddyfile (#6772)
* client_auth: wire up leaf verifier Caddyfile

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* review feedback + tests

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

---------

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-06-09 08:18:36 -06:00
Youness Farini 092913a7a5
httpcaddyfile: Prevent error handler from overriding sub-handler matchers (#6999)
Fixes: #6957
2025-06-06 11:46:39 -06:00
Laurin 7099892958
core: Check for nil event origin (#7047)
* fix: crash - null check on event origin

* chore: use accessor instead of property
2025-06-05 19:10:08 +00:00
dependabot[bot] 45c9341deb
build(deps): bump golangci/golangci-lint-action from 6 to 8 (#7044)
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 6 to 8.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](https://github.com/golangci/golangci-lint-action/compare/v6...v8)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-03 02:33:40 +03:00
Mohammed Al Sahaf e039a5bb5c
chore: upgrade .golangci.yml and workflow to v2 (#6924)
* chore: upgrade .golangci.yml and workflow to v2

run `golangci-lint fmt`

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* run `golangci-lint run --fix`

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* more lint fixes

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* bring back comments to .golangci.yml

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* appease the linter some more

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* oops

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* use embedded structs

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* use embedded structs where they were used before

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* disable rule  `-QF1006`

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* missed a spot

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

---------

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-06-03 02:24:32 +03:00
tongjicoder 5b2eb66418
Use slices.Contains to simplify code (#7039)
Signed-off-by: tongjicoder <tongjicoder@icloud.com>
2025-05-31 12:03:06 -06:00
eveneast a76d005a94
Use maps.Copy for simpler map handling (#7009)
Signed-off-by: eveneast <qcqs@foxmail.com>
2025-05-13 15:16:47 -06:00
WeidiDeng 8524386737
caddyhttp: Compare paths w/o wildcard if prefixes differ (#7015)
* fix route sort by comparing paths without wildcard if they don't share the same prefix

* sort lexically if paths have the same length
2025-05-13 13:17:52 -06:00
Jimmy Lipham 94147caf31
fileserver: map invalid path errors to fs.ErrInvalid, and return 400 for any invalid path errors. (close #7008) (#7017) 2025-05-13 07:43:27 -06:00
WeidiDeng 716d72e475
intercept: implement Unwrap for interceptedResponseHandler (#7016) 2025-05-12 12:15:34 -06:00
Mohammed Al Sahaf 44d078b670
acme_server: fix policy parsing in caddyfile (#7006)
Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-05-08 11:54:07 -06:00
Jimmy Lipham 051e73aefc
core: Replace admin server later in provisionContext (#7004) 2025-05-08 11:52:55 -06:00
Mohammed Al Sahaf 9f7148392a
log: default logger should respect `{in,ex}clude` (#6995)
* log: default logger should respect `{in,ex}clude`

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* add tests

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

---------

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-05-06 22:06:09 +00:00
Jimmy Lipham 320c57291d
admin: Make sure that any admin routers are provisioned when local/re… (#6997)
* admin: Make sure that any admin routers are provisioned when local/remote admin servers are replaced at runtime.

* admin: check for provisioning errors during admin server replacements
2025-05-06 15:28:38 -06:00
WeidiDeng aa3d20be3e
reverseproxy: Use DialTLSContext if ServerName has placeholder (#6955)
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2025-04-28 09:14:09 -06:00
Steffen Busch 54d03ced48
fileserver: Add support for .avif image format (#6988) 2025-04-28 08:32:59 -06:00
Indra Gunawan 89ed5f44de
fix: Remove nil arg from zapslog.NewHandler call (#6984) 2025-04-28 08:31:10 -06:00
Matthew Holt 105eee671c caddytls: Set local_ip, not remote_ip (#6952)
Follow-up on 35c8c2d92d where I was a dum-dum
2025-04-21 18:32:51 -06:00
Mohammed Al Sahaf 737936c06b
reverseproxy: reference correct field name in LoadModule (#6978)
Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-04-21 08:43:27 -06:00
Marten Seemann a6d488a15b
go.mod: update quic-go to v0.51.0 (#6972) 2025-04-20 07:39:00 -06:00
Matthew Holt fb22a26b1a
caddytls: Allow missing ECH meta file 2025-04-18 12:20:21 -06:00
Matt Holt 1bfa111552
caddytls: Prefer managed wildcard certs over individual subdomain certs (#6959)
* caddytls: Prefer managed wildcard certs over individual subdomain certs

* Repurpose force_automate as no_wildcard

* Fix a couple bugs

* Restore force_automate and use automate loader as wildcard override
2025-04-18 11:44:23 -06:00
Matthew Holt 35c8c2d92d
caddytls: Add remote_ip to HTTP cert manager (close #6952) 2025-04-17 16:43:06 -06:00
dependabot[bot] 0b2802faa4
build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#6960)
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/net/compare/v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.38.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-16 23:34:35 +00:00
Steffen Busch 5be77d07ab
caddyauth: Set authentication provider error in placeholder (#6932)
* caddyauth: Set authentication provider error in placeholder for handle_errors directive

* caddyauth: Simplify error placeholder setting for authentication provider
2025-04-15 22:32:08 +00:00
Matthew Holt 137711ae3e
go.mod: Upgrade acmez and certmagic 2025-04-15 15:08:12 -06:00
Matthew Holt f297bc0a04
admin: Remove host checking for UDS (close #6832)
The consensus is that host enforcement on unix sockets is ineffective, frustrating, and confusing. (Unix sockets have their own OS-level permissions system.)
2025-04-15 14:20:22 -06:00
Jesper Brix Rosenkilde 6c38ae7381
reverseproxy: Add valid Upstream to DialInfo in active health checks (#6949)
Currently if we extract the DialInfo from a Request Context during an active health check, then the Upstream in the DialInfo is nil.

This PR attempts to set the Upstream to a sensible value, based on wether or not the Upstream has been overriden in the active health check's config.
2025-04-15 08:44:53 -06:00
cui fliter def9db1f16
Fix the incorrect parameter order (#6951)
Signed-off-by: cuishuang <imcusg@gmail.com>
2025-04-12 21:19:32 -06:00
riyueguang ce926b87ed
chore: fix comment (#6950)
Signed-off-by: riyueguang <rustruby@outlook.com>
2025-04-12 04:24:17 +00:00
Matthew Holt b06a9496d1
caddyhttp: Document side effect of HTTP/3 early data (close #6936) 2025-04-08 13:59:02 -06:00
Matthew Holt 9becf61a9f
go.mod: Upgrade to libdns 1.0 beta APIs (requires upgraded DNS providers)
This is the only way we can properly, reliably support ECH.
2025-04-07 12:43:11 -06:00
Matt Holt 5a6b2f8d1d
events: Refactor; move Event into core, so core can emit events (#6930)
* events: Refactor; move Event into core, so core can emit events

Requires some slight trickery to invert dependencies. We can't have the caddy package import the caddyevents package, because caddyevents imports caddy. Interface to the rescue!

Also add two new events, experimentally: started, and stopping. At the request of a sponsor.

Also rename "Filesystems" to "FileSystems" to match Go convention (unrelated to events, was just bugging me when I noticed it).

* Coupla bug fixes

* lol whoops
2025-03-29 08:15:43 -06:00
Matthew Holt ea77a9ab67
caddytls: Temporarily treat "" and "@" as equivalent for DNS publication
Fixes https://github.com/caddyserver/caddy/issues/6895#issuecomment-2750111096
2025-03-25 16:24:16 -06:00
Matthew Holt 7672b7848f
go.mod: Upgrade CertMagic
Hotfix for wildcard certs (regression in beta 3)
2025-03-24 20:51:05 -06:00
Matthew Holt 86c620fb4e
go.mod: Minor dependency upgrades 2025-03-24 16:16:11 -06:00
Matthew Holt 782a3c7ac6
caddytls: Don't publish HTTPS record for CNAME'd domain (fix #6922) 2025-03-24 09:55:26 -06:00
Mohammed Al Sahaf 173573035c
core: add modular `network_proxy` support (#6399)
* core: add modular `network_proxy` support

Co-authored-by: @ImpostorKeanu
Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* move modules around

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* add caddyfile implementation

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* address feedbcak

* Apply suggestions from code review

Co-authored-by: Francis Lavoie <lavofr@gmail.com>

* adapt ForwardProxyURL to use the NetworkProxyRaw

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* remove redundant `url`  in log

Co-authored-by: Matt Holt <mholt@users.noreply.github.com>

* code review

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* remove `.source` from the module ID

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

---------

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
Co-authored-by: Francis Lavoie <lavofr@gmail.com>
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2025-03-21 17:06:15 +00:00
Marten Seemann 7b1f00c330
update quic-go to v0.50.1 (#6918) 2025-03-21 07:33:49 -06:00
Matthew Holt 8dc76676fb
chore: Modernize a couple for loops 2025-03-19 09:53:42 -06:00
Matthew Holt e276994174
caddytls: Initialize permission module earlier (fix #6901)
Bug introduced in 4ebcfed9c9
2025-03-17 12:02:23 -06:00
Ted b3e692ed09
caddyfile: Fix formatting for backquote wrapped braces (#6903) 2025-03-17 08:58:46 -06:00
Matthew Holt 55c89ccf2a
caddytls: Convert AP subjects to punycode
Fixes bugs related to TLS automation
2025-03-14 15:44:20 -06:00