2240 Commits

Author SHA1 Message Date
Matthew Holt
7672b7848f
go.mod: Upgrade CertMagic
Hotfix for wildcard certs (regression in beta 3)
v2.10.0-beta.4
2025-03-24 20:51:05 -06:00
Matthew Holt
86c620fb4e
go.mod: Minor dependency upgrades v2.10.0-beta.3 2025-03-24 16:16:11 -06:00
Matthew Holt
782a3c7ac6
caddytls: Don't publish HTTPS record for CNAME'd domain (fix ) 2025-03-24 09:55:26 -06:00
Mohammed Al Sahaf
173573035c
core: add modular network_proxy support ()
* core: add modular `network_proxy` support

Co-authored-by: @ImpostorKeanu
Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* move modules around

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* add caddyfile implementation

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* address feedbcak

* Apply suggestions from code review

Co-authored-by: Francis Lavoie <lavofr@gmail.com>

* adapt ForwardProxyURL to use the NetworkProxyRaw

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* remove redundant `url`  in log

Co-authored-by: Matt Holt <mholt@users.noreply.github.com>

* code review

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* remove `.source` from the module ID

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

---------

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
Co-authored-by: Francis Lavoie <lavofr@gmail.com>
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2025-03-21 17:06:15 +00:00
Marten Seemann
7b1f00c330
update quic-go to v0.50.1 () 2025-03-21 07:33:49 -06:00
Matthew Holt
8dc76676fb
chore: Modernize a couple for loops 2025-03-19 09:53:42 -06:00
Matthew Holt
e276994174
caddytls: Initialize permission module earlier (fix )
Bug introduced in 4ebcfed9c942c59f473f12f8108e1d0fa92e0855
2025-03-17 12:02:23 -06:00
Ted
b3e692ed09
caddyfile: Fix formatting for backquote wrapped braces () 2025-03-17 08:58:46 -06:00
Matthew Holt
55c89ccf2a
caddytls: Convert AP subjects to punycode
Fixes bugs related to TLS automation
2025-03-14 15:44:20 -06:00
Matthew Holt
1f8dab572c caddytls: Don't publish ECH configs if other records don't exist
Publishing a DNS record for a name that doesn't have any could make wildcards ineffective, which would be surprising for site owners and could lead to downtime.
2025-03-12 16:33:14 -06:00
Steffen Busch
2ac09fdb20
requestbody: Fix ContentLength calculation after body replacement () 2025-03-12 22:18:02 +00:00
Adrien Pensart
dccf3d8982
requestbody: Add set option to replace request body ()
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2025-03-12 19:38:51 +00:00
Matthew Holt
af2d33afbb
headers: Allow nil HeaderOps (fix ) 2025-03-11 08:52:15 -06:00
Matthew Holt
39262f8663 caddytls: Minor fixes for ECH 2025-03-11 08:12:48 -06:00
jjiang-stripe
49f9af9a4a
caddytls: Fix TrustedCACerts backwards compatibility ()
* add failing test

* fix ca pool provisioning

* remove unused param
2025-03-10 12:50:47 -06:00
Matthew Holt
d57ab215a2 caddytls: Pointer receiver (fix ) v2.10.0-beta.2 2025-03-08 14:19:06 -07:00
Steffen Busch
f4432a306a
caddyfile: add error handling for unrecognized subdirective/options in various modules () 2025-03-08 23:45:05 +03:00
WeidiDeng
220cd1c2bc
reverseproxy: more comments about buffering and add new tests ()
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2025-03-07 11:22:43 -07:00
Matthew Holt
1975408d89 chore: Remove unnecessary explicit type parameters 2025-03-07 11:18:00 -07:00
Matthew Holt
4ebcfed9c9 caddytls: Reorder provisioning steps (fix )
Also add a quick check to allow users to load their own certs for ECH (outer) domains.
2025-03-07 11:18:00 -07:00
Kévin Dunglas
d2a2311bfd
ci: fix Go matrix ()
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2025-03-07 10:40:51 -07:00
Matthew Holt
adbe7f87e6
caddytls: Only make DNS solver if not already set (fix ) 2025-03-07 09:46:43 -07:00
Matthew Holt
19876208c7
cmd: Promote undo maxProcs func to caller 2025-03-06 16:47:02 -07:00
Matthew Holt
a686f7c346
cmd: Only set memory/CPU limits on run (fix ) 2025-03-06 15:11:38 -07:00
Matthew Holt
84364ffcd0
caddypki: Remove lifetime check at Caddyfile parse (fix )
The same check is done at provision time of the ACME server, and that is the correct place to do it.
2025-03-06 11:40:03 -07:00
Matthew Holt
1641e76fd7
go.mod: Upgrade dependencies v2.10.0-beta.1 2025-03-06 09:52:02 -07:00
Matthew Holt
bc3d497739
caddytls: Fix broken refactor
Not sure how that happened...
2025-03-06 08:54:40 -07:00
Matthew Holt
a807fe0659
caddytls: Enhance ECH documentation 2025-03-06 08:52:52 -07:00
Matthew Holt
3207769232 Update min go version in readme 2025-03-06 06:51:21 -07:00
sashaphmn
481bc80d6e
readme: update Twitter name and link () 2025-03-06 08:21:30 +00:00
dependabot[bot]
3644ee31ca
build(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 ()
Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl) from 1.3.3 to 1.3.7.
- [Release notes](https://github.com/cloudflare/circl/releases)
- [Commits](https://github.com/cloudflare/circl/compare/v1.3.3...v1.3.7)

---
updated-dependencies:
- dependency-name: github.com/cloudflare/circl
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-05 17:11:11 -07:00
Matt Holt
d7764dfdbb
caddytls: Encrypted ClientHello (ECH) ()
* caddytls: Initial commit of Encrypted ClientHello (ECH)

* WIP Caddyfile

* Fill out Caddyfile support

* Enhance godoc comments

* Augment, don't overwrite, HTTPS records

* WIP

* WIP: publication history

* Fix republication logic

* Apply global DNS module to ACME challenges

This allows DNS challenges to be enabled without locally-configured DNS modules

* Ignore false positive from prealloc linter

* ci: Use only latest Go version (1.24 currently)

We no longer support older Go versions, for security benefits.

* Remove old commented code

Static ECH keys for now

* Implement SendAsRetry
2025-03-05 17:04:10 -07:00
dependabot[bot]
eacd7720e9
build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4 ()
Bumps [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from 3.0.3 to 3.0.4.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Changelog](https://github.com/go-jose/go-jose/blob/main/CHANGELOG.md)
- [Commits](https://github.com/go-jose/go-jose/compare/v3.0.3...v3.0.4)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-03 14:02:16 -07:00
Mohammed Al Sahaf
02e348f911
chore: upgrade cobra ()
Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-03-03 13:49:17 -07:00
Matthew Holt
ca37c0b05f Fix typo in TLS group x25519mlkem768 2025-03-03 10:26:42 -07:00
baruchyahalom
8861eae223
caddytest: Support configuration defaults override () 2025-03-03 14:35:54 +00:00
Marten Seemann
fd4de7e0ae
chore: update quic-go to v0.50.0 () 2025-02-20 12:45:52 +03:00
Ns2Kracy
0d7c63920d
go.mod: remove glog dependency ()
Co-authored-by: Mohammed Al Sahaf <msaa1990@gmail.com>
Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2025-02-17 15:08:39 +00:00
Mohammed Al Sahaf
6a8d4f1d60
chore: ci: upgrade Go version to 1.24 ()
Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-02-17 07:58:20 -07:00
Gaurav Dhameeja
d7621fdbe6
tests: tests for error handling & metrics in admin endpoints ()
* feat/tests: tests for error handling & metrics in admin endpoints

- TestAdminHandlerErrorHandling - Tests the handler.handleError()
   functionality by directly verifying error response formatting
- TestAdminHandlerBuiltinRouteErrors - Tests the error
   handling pathway by using real admin server routes and verifying
   both error responses and prometheus metrics increments
- provisionAdminRouters: add unit tests for admin handler registration and routing for admin.api
- TestAllowedOriginsUnixSocket: checks unix socket with default origins are added
- TestReplaceRemoteAdminServer: test for replaceRemoteAdminServer with certificate validation, custom origins and cleanup

* test: added test for manage manageIdentity

---------

Co-authored-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-02-12 11:39:47 +00:00
Matthew Holt
172136a0a0
caddytls: Support post-quantum key exchange mechanism X25519MLKEM768
Also bump minimum Go version to 1.24.
2025-02-11 22:43:54 -07:00
WeidiDeng
22563a70eb
file_server: use the UTC timezone for modified time ()
* use UTC timezone for modified time

* use http.ParseTime to handle If-Modified-Since

* use time.Compare to simplify comparison

* take the directory's modtime into consideration when calculating lastModified

* update comments about If-Modified-Since's handling
2025-02-10 08:39:43 -07:00
Matthew Holt
9b74a53e51
Revert "logging: Always set fields func; fix "
This reverts commit 932dac157a3c4693b80576477498bb86208b9b30.

Somehow the code I was looking at changed when I committed, without realizing it. This has already been fixed in .
2025-02-07 06:23:43 -07:00
Matthew Holt
932dac157a logging: Always set fields func; fix 2025-02-07 06:18:37 -07:00
Mahdi Mohammadi
96c5c554c1
admin: fix index validation for PUT requests () 2025-02-04 08:57:32 -07:00
Mohammed Al Sahaf
9283770f68
reverseproxy: ignore duplicate collector registration error ()
Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-02-04 10:55:30 +03:00
dependabot[bot]
9996d6a70b
build(deps): bump github.com/golang/glog from 1.2.2 to 1.2.4 ()
Bumps [github.com/golang/glog](https://github.com/golang/glog) from 1.2.2 to 1.2.4.
- [Release notes](https://github.com/golang/glog/releases)
- [Commits](https://github.com/golang/glog/compare/v1.2.2...v1.2.4)

---
updated-dependencies:
- dependency-name: github.com/golang/glog
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-28 17:25:11 -07:00
Sander Bruens
cfc3af6749
fix: update broken link to Ardan Labs () 2025-01-28 21:19:02 +00:00
Mohammed Al Sahaf
904a0fa368
reverse_proxy: re-add healthy upstreams metric ()
* reverse_proxy: re-add healthy upstreams metric

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

* lint

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>

---------

Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
2025-01-27 14:30:54 -07:00
vnxme
d7872c3bfa
caddytls: Refactor sni matcher () 2025-01-27 11:42:09 -07:00