Caddy 2.0.0 → 2.8.4
31 releases · 34 breaking changes · 4 security fixes · 0 advisories fixed
4security34breaking11deprecated226feature49fix
Breaking changes
- breaking ZeroSSL (#6229) (this is one overall change, but requires some explanation): in 2.8.0
- breaking Up to now, Caddy used both Let's Encrypt and ZeroSSL by default to get certificates without any configuration. In 2.8, this is changing slightly. Due to upcoming changes to ZeroSSL accounting policies, ZeroSSL now requires your email address to be able to access their free ACME endpoint. in 2.8.0
- breaking As such, Caddy will only implicitly add the ZeroSSL issuer to your config if you provide an email address in your Caddyfile using the email global option. (We have already recommended this for years.) If you already do this, you don't have to make any changes and you'll still get Let's Encrypt and… in 2.8.0
- breaking If you use JSON to configure certificate automation policies, you will need to ensure you use the acme issuer with your email filled out, and the ca field set to ZeroSSL's ACME server URL. If you want redundancy with Let's Encrypt, be sure to specify another acme issuer as well (defaults OK, but… in 2.8.0
- breaking The zerossl issuer module is no longer ACME-capable and is now exclusively for the ZeroSSL API. An API key from your ZeroSSL account is required. (The ZeroSSL ACME server can still be used with the acme module pointed to ZeroSSL's ACME server. You can provide your account email and/or EAB as… in 2.8.0
- breaking Faster response times in 2.8.0
- breaking IP certificates in 2.8.0
- breaking Management tools in your ZeroSSL account dashboard in 2.8.0
- breaking Technical support in 2.8.0
- breaking To clarify, Let's Encrypt is still a default issuer even if you don't provide an email address (but we have always strongly recommended to do so). in 2.8.0
- breaking You can still use ZeroSSL's ACME endpoint with your own External Account Binding (EAB) credentials. in 2.8.0
- breaking See notes in #6229 for some examples and further explanations. in 2.8.0
- breaking Removed support for the lego_deprecated DNS provider module. It has been deprecated for 4 years. Use caddy-dns modules instead; there are over 50 to choose from already. They are more flexible, compile much leaner, and are easier to implement and support. If yours is not supported it can be easily… in 2.8.0
- breaking On-demand TLS: The ask option in the JSON has been deprecated in favor of a permission module (Caddyfile unchanged) (#6055), and Caddyfile support for permission modules is added (6a02999) in 2.8.0
- breaking Admin API: Etag (used for concurrency control) is now a header, not a trailer. This is less efficient, but still virtually no clients properly implement trailer support. in 2.8.0
- breaking For consistency, the basicauth Caddyfile directive has been renamed to basic_auth (#6092), and skip_log has been renamed to log_skip. The old names will continue to work for now, with a deprecation warning in the logs. (#6066). in 2.8.0
- breaking The basic_auth handler no longer supports scrypt (deprecated for nearly two years) (#6091) in 2.8.0
- breaking The forwarded option has been deprecated for a long time and has now been removed from the remote_ip matcher. Use the client_ip matcher instead. (#6085) in 2.8.0
- breaking Reverse proxy: The buffer_requests, buffer_responses, and max_buffer_size settings have been removed after being deprecated for 14 months. Use request_buffers and response_buffers instead if you need buffering. in 2.8.0
- breaking Go API: If you called caddy.Context.AppIfConfigured(), it now returns an error, as part of a bug fix. (#6292) in 2.8.0
- breaking 30d63648 caddyauth: Drop support for scrypt (#6091) in 2.8.0
- breaking 654a3bb0 caddyhttp: remove duplicate strings.Count in path matcher (fixes #6233) (#6234) in 2.8.0
- breaking 3609a4af caddytls: Remove shim code supporting deprecated lego-dns (#6231) in 2.8.0
- breaking 1fc151fa caddytls: remove ClientHelloSNICtxKey (#6326) in 2.8.0
- breaking ac1f20b9 httpcaddyfile: Remove port from logger names (#5881) in 2.8.0
- breaking 9f97df22 reverseproxy: Remove long-deprecated buffering properties in 2.8.0
- breaking f0ea489d httpcaddyfile: Remove port from logger names (#5881) in 2.7.6
- breaking 94d41a9d fileserver: Remove trailing slash on fs filenames (#5417) in 2.7.3
- breaking 4636109c reverseproxy: Remove deprecated lookup_srv (#5396) in 2.7.3
- breaking 5e52bbb1 map: Remove infinite recursion check (#5094) in 2.6.2
- breaking 9864b138 reverseproxy: api: Remove misleading 'healthy' value in 2.5.2
- breaking warning: Logging: Removed the deprecated common_log field from HTTP access logs, and the single_field encoder. If you relied on this, you may use the transform encoder plugin to encode logs in Common Log format. in 2.5.0
- breaking 0eb0b60f logging: Remove common_log field and single_field encoder (#4149) (#4282) in 2.5.0
- breaking warning: In reverse_proxy, the max_idle_conns_per_host option has been removed (both Caddyfile and JSON). This may be a breaking change for a few of you, but it only breaks configs that relied on a bug. Instead of silently failing, you will get an error if you continue using the property. For… in 2.4.3
Security changes
- security cc0c0cf0 caddyhttp: Security enhancements for client IP parsing (#5805) in 2.8.0
- security 9fc55a97 go.mod: CVE-2023-45142 Update opentelemetry (#5908) in 2.8.0
- security b809ed71 go.mod: CVE-2023-45142 Update opentelemetry (#5908) in 2.7.6
- security shield: Security patch in the FastCGI transport that now sanitizes paths against directory traversal outside the site root. PR #4207. in 2.4.3
Deprecations
- deprecated 2fc620d3 caddyhttp: Fix linter warning about deprecation in 2.8.0
- deprecated c27425ef httpcaddyfile: Keep deprecated skip_log in directive order (#6153) in 2.8.0
- deprecated 3f20a7c9 acmeserver: Configurable resolvers, fix smallstep deprecations (#5500) in 2.7.3
- deprecated f20a8e7a cmd: replace deprecate func use (#5170) in 2.6.3
- deprecated Metrics are now opt-in. Due to multiple confirmed reports of non-trivial performance regressions with metrics, we are making them opt-in. (Technically, this is not a breaking change, as Caddy will still function normally and your old configs won't be rejected -- but your metrics will stop being… in 2.6.0
- deprecated The signature of caddy.Context.Logger() has changed, but in a backwards-compatible way. Modules use this function to obtain a logger they can use within Caddy; until now, modules had to pass themselves in as an argument. Now, the context can figure out which module to associate the logger with, so… in 2.6.0
- deprecated Basic auth deprecates scrypt because it was seldom used and error-prone; use bcrypt instead (#4720) in 2.6.0
- deprecated Several changes to experimental servers global options: removed the protocol sub-option, which has been replaced with the protocols sub-option; strict_sni_host is its own separate sub-option; allow_h2c and experimental_http3 have been removed, as both H2C (h2c) and HTTP/3 (h3) can be toggled in… in 2.6.0
- deprecated warning: Caddyfile: Deprecated paths in site addresses. Prefer using path matchers within your site block instead. in 2.5.0
- deprecated 3a1e0dbf httpcaddyfile: Deprecate paths in site addresses; use zap logs (#4728) in 2.5.0
- deprecated warning: The "issuer" field in TLS automation policies is deprecated and will be removed in the future, please switch to "issuers". in 2.3.0
Every release in between
fix7088605c cmd: fix regression in auto-detect of Caddyfile (#6362)
other01308b4b I'm so tired of typos
othera63767d3 build(deps): bump golangci/golangci-lint-action from 5 to 6 (#6361)
otherf8a2c602 caddyhttp: properly sanitize requests for root path (#6360)
featureb7280e69 caddytls: Implement certmagic.RenewalInfoGetter
fix15faeacb cmd: fix auto-detetction of .caddyfile extension (#6356)
fix40c582ce caddyhttp: Fix merging consecutive client_ip or remote_ip matchers (#6350)
othera52917a3 core: MkdirAll appDataDir in InstanceID with 0o700 (#6340)
breakingZeroSSL (#6229) (this is one overall change, but requires some explanation):
breakingUp to now, Caddy used both Let's Encrypt and ZeroSSL by default to get certificates without any configuration. In 2.8, this is changing slightly. Due to upcoming changes to ZeroSSL accounting policies, ZeroSSL now requires your email address to be able to access their free ACME endpoint.
breakingAs such, Caddy will only implicitly add the ZeroSSL issuer to your config if you provide an email address in your Caddyfile using the email global option. (We have already recommended this for years.) If you already do this, you don't have to make any changes and you'll still get Let's Encrypt and…
breakingIf you use JSON to configure certificate automation policies, you will need to ensure you use the acme issuer with your email filled out, and the ca field set to ZeroSSL's ACME server URL. If you want redundancy with Let's Encrypt, be sure to specify another acme issuer as well (defaults OK, but…
breakingThe zerossl issuer module is no longer ACME-capable and is now exclusively for the ZeroSSL API. An API key from your ZeroSSL account is required. (The ZeroSSL ACME server can still be used with the acme module pointed to ZeroSSL's ACME server. You can provide your account email and/or EAB as…
breakingFaster response times
breakingIP certificates
breakingManagement tools in your ZeroSSL account dashboard
breakingTechnical support
breakingTo clarify, Let's Encrypt is still a default issuer even if you don't provide an email address (but we have always strongly recommended to do so).
breakingYou can still use ZeroSSL's ACME endpoint with your own External Account Binding (EAB) credentials.
breakingSee notes in #6229 for some examples and further explanations.
breakingRemoved support for the lego_deprecated DNS provider module. It has been deprecated for 4 years. Use caddy-dns modules instead; there are over 50 to choose from already. They are more flexible, compile much leaner, and are easier to implement and support. If yours is not supported it can be easily…
breakingOn-demand TLS: The ask option in the JSON has been deprecated in favor of a permission module (Caddyfile unchanged) (#6055), and Caddyfile support for permission modules is added (6a02999)
breakingAdmin API: Etag (used for concurrency control) is now a header, not a trailer. This is less efficient, but still virtually no clients properly implement trailer support.
breakingFor consistency, the basicauth Caddyfile directive has been renamed to basic_auth (#6092), and skip_log has been renamed to log_skip. The old names will continue to work for now, with a deprecation warning in the logs. (#6066).
breakingThe basic_auth handler no longer supports scrypt (deprecated for nearly two years) (#6091)
breakingThe forwarded option has been deprecated for a long time and has now been removed from the remote_ip matcher. Use the client_ip matcher instead. (#6085)
breakingReverse proxy: The buffer_requests, buffer_responses, and max_buffer_size settings have been removed after being deprecated for 14 months. Use request_buffers and response_buffers instead if you need buffering.
breakingGo API: If you called caddy.Context.AppIfConfigured(), it now returns an error, as part of a bug fix. (#6292)
featureacme_server: Configurable allow/deny policies (#5796)
featurehttp: New fs directive can declare a file system plugin to use (#5057)
featurehttp: The log_append handler can add fields to the access logs (#6066)
featurehttp: Add uuid field to access logs when the {http.request.uuid} placeholder is used (#5859)
featurehttp: Changed PROXY protocol libraries add TLV support (#5915)
featurehttp: A new tracing mode writes each individual middleware handler to logs (#6313)
featurereplacer: A new {file.} global placeholder is available, where is a path to a file on disk which contains a value (generally used for secrets) (#5463)
featuretls: New local_ip connection matcher (#6074)
feature931656bd acmeserver: add policy field to define allow/deny rules (#5796)
featuree6f46c8d acmeserver: Add sign_with_root for Caddyfile (#6345)
breaking30d63648 caddyauth: Drop support for scrypt (#6091)
deprecated2fc620d3 caddyhttp: Fix linter warning about deprecation
securitycc0c0cf0 caddyhttp: Security enhancements for client IP parsing (#5805)
breaking654a3bb0 caddyhttp: remove duplicate strings.Count in path matcher (fixes #6233) (#6234)
breaking3609a4af caddytls: Remove shim code supporting deprecated lego-dns (#6231)
breaking1fc151fa caddytls: remove ClientHelloSNICtxKey (#6326)
security9fc55a97 go.mod: CVE-2023-45142 Update opentelemetry (#5908)
deprecatedc27425ef httpcaddyfile: Keep deprecated skip_log in directive order (#6153)
breakingac1f20b9 httpcaddyfile: Remove port from logger names (#5881)
breaking9f97df22 reverseproxy: Remove long-deprecated buffering properties
+200 more items in the release notesfeatureThe templates middleware is now officially extensible (experimentally). This means modules can add custom functions/actions for templates to execute.
otherTLS storage cleaning is now synchronized across the cluster and remembered across restarts. This should greatly lower costs for expensive storage backends like DynamoDB.
otherPlaceholders are now evaluated in config for certificate loaders.
fixNumerous bug fixes.
other65c489a0 Upgrade acmeserver to github.com/go-chi/chi/v5 (#5913)
fixae5e2d96 caddyfile: Fix variadic placeholder false positive when token contains : (#5883)
otherdb55da59 caddyhttp: Adjust scheme placeholder docs (#5910)
otherdf5edf6b caddytls: Context to DecisionFunc (#5923)
other6d9a8337 caddytls: Sync distributed storage cleaning (#5940)
feature11a082c0 cmd: Add newline character to version string in CLI output (#5895)
other979c413f cmd: upgrade: resolve symlink of the executable (#5891)
other64820706 core: Apply SO_REUSEPORT to UDP sockets (#5725)
other15adb893 core: quic listener will manage the underlying socket by itself (#5749)
feature801ec756 fileserver: Add .m4v for browse template icon
securityb809ed71 go.mod: CVE-2023-45142 Update opentelemetry (#5908)
otherb4c7313c go.mod: Upgrade quic-go to v0.39.1
other36fce3fa go.mod: update quic-go version to v0.40.0 (#5922)
fixec2de22a httpcaddyfile: Fix TLS automation policy merging with get_certificate (#5896)
breakingf0ea489d httpcaddyfile: Remove port from logger names (#5881)
other87f63b12 httpredirectlistener: Only set read limit for when request is HTTP (#5917)
feature16834d64 templates: Clarify include args docs, add .ClientIP (#5898)
other0259853a templates: Delete headers on httpError to reset to clean slate (#5905)
other2f7ceb57 templates: Offically make templates extensible (#5939)
other908e9569 tls: accept placeholders in string values of certificate loaders (#5963)
featureUpdated https://github.com/quic-go/quic-go from v0.37.5 to v0.39.0, including many performance improvements. GSO and ECN are now enabled by default, but you may turn them off by setting the QUIC_GO_DISABLE_GSO=true and QUIC_GO_DISABLE_ECN=true environment variables respectively, if they cause you…
featureThe file server's fileserver.BrowseTemplate is now exported, so it may be customized by programs embedding Caddy. (ed8bb13c5df7656647ca7fc1fd09237631a6767c)
featureEnvironment variables loaded with --envfile no longer override existing variables. (#5803)
featureThe encode handler now compresses application/wasm* content types by default. (#5869)
featureThe reverse_proxy handler can now emit very detailed logs for debugging streaming and buffering. To enable it, set the verbose_logs subdirective, and set logging to debug level. Since the logs from this are very noisy, using verbose_logs to opt-in is necessary. We may ask you to enable this when…
featureYou can now check the version with caddy -v, like most other CLI utilities! (#5874)
other0e204b73 admin: Respond with 4xx on non-existing config path (#5870)
other89c407aa build(deps): bump actions/checkout from 3 to 4 (#5846)
other1405683c build(deps): bump goreleaser/goreleaser-action from 4 to 5 (#5847)
other38a7b6b3 caddyfile: Adjust error formatting (#5765)
fix7103ea09 caddyfile: Fix case where heredoc marker is empty after newline (#5769)
other10053f75 caddyfile: Loosen heredoc parsing (#5761)
other58ab3a01 caddyhttp: Use LimitedReader for HTTPRedirectListener (thank you to Bartek Nowotarski for reporting)
fix9c419f1e cmd: Fix exiting with custom status code, add caddy -v (#5874)
otherf2ab7099 cmd: Prevent overwriting existing env vars with --envfile (#5803)
featuree0aaefab encode: Add application/wasm* to the default content types (#5869)
featurefa5a579b fileserver: Add command shortcuts -l and -a (#5854)
othered8bb13c fileserver: Export BrowseTemplate
other130f6d1f fileserver: Set canonical URL on browse template (#5867)
othera306c5f7 fileserver: browse template SVG icons and UI tweaks (#5812)
other0a6d3333 fileserver: docs: clarify the ability to produce JSON array with browse (#5751)
other82c356f2 fix: caddytest.AssertResponseCode error message (#5853)
other888c6d7e go.mod: Update quic-go to v0.38.0 (#5772)
other88b4fbf2 go.mod: Upgrade dependencies incl. x/net/http
otherdf995029 httpcaddyfile: Enable TLS for catch-all site if tls directive is specified (#5808)
other33d8d2c6 httpcaddyfile: Sort TLS SNI matcher for deterministic JSON output (#5860)
other288216e1 httpcaddyfile: Stricter errors for site and upstream address schemes (#5757)
fix2cac3c54 httpcaddyfile: fix placeholder shorthands in named routes (#5791)
otherc46ec3b5 logging: Clone array on log filters, prevent side-effects (#5786)
other1b73e386 logging: query filter for array of strings (#5779)
other4776f62c replacer: change timezone to UTC for "time.now.http" placeholders (#5774)
featurea8586b05 reverseproxy: Add logging for dynamic A upstreams (#5857)
feature3a3182fb reverseproxy: Add more debug logs (#5793)
feature4feac4d8 reverseproxy: Allow fallthrough for response handlers without routes (#5780)
fixe8b8d4a8 reverseproxy: Fix least_conn policy regression (#5862)
fix2a6859a5 reverseproxy: Fix retries on "upstreams unavailable" error (#5841)
fix1e0dea59 reverseproxy: fix nil pointer dereference in AUpstreams.GetUpstreams (#5811)
fixb245ecd3 reverseproxy: fix parsing Caddyfile fails for unlimited request/response buffers (#5828)
feature5653c36b templates: Add dummy RemoteAddr to httpInclude request, proxy compatibility (#5845)
feature289934f3 tls: Add X25519Kyber768Draft00 PQ "curve" behind build tag (#5852)
+1 more item in the release notesother080db938 caddytls: Update docs for on-demand config
otherd8135505 cmd: Require config for caddy validate (fix #5612) (#5614)
othera8492c06 fileserver: Don't repeat error for invalid method inside error context (#5705)
other2d7d806f fileserver: Slightly more fitting icons
otherf11c3c9f go.mod: Upgrade CertMagic and quic-go
other5b9c850a go.mod: Upgrade golang.org/x/net to 0.14.0 (#5718)
feature936ee918 reverseproxy: Always return new upstreams (fix #5736) (#5752)
fix431adc09 templates: Fix httpInclude (fix #5698)
featureThe in-memory TLS certificate cache is no longer purged and recreated during config reloads, making reloads extremely lightweight even when managing thousands of certificates.
featureSignificant HTTP/3 performance improvements (upstream in quic-go) including enabling 0-RTT. Caddy users should notice significantly better throughput for HTTP/3. Thanks for the fantastic work, @marten-seemann!
featureNew default template for the file server's "browse" listings - more modern, easier to use, grid view, filetype-specific icons, and better dark mode (see #5427 for more screenshots and info)
featureThe reverse proxy now supports the PROXY protocol. Using external modules is no longer required; specifically, the plugin by @mastercactapus is now built-in. (#5424)
featureCaddyfile now supports Heredoc syntax for long embedded strings/documents. (#5385)
feature@francislavoie implemented a suite of enhancements to bring you more reliable, trustworthy client IP information, even through proxies and CDNs (#5104)
featureCertificate private keys will no longer be reused when renewing certificates.
featureCaddyfile import arg placeholders support slice syntax, e.g. {args[2:]} (#5249)
featureCustomizable "fallback" policy for reverse proxy in case the primary policy isn't applicable. (#5488)
featureEtags are generated more sensibly for NixOS environments which all have Modified time of 1; and if you set your own Etag, it will not be overwritten.
featureEXPERIMENTAL: New short flags for the CLI. (#5379)
featureEXPERIMENTAL: The reverse proxy may be configured to keep hijacked connections (streams, WebSockets, etc.) open through config reloads. (#5567)
featureEXPERIMENTAL: Define "named routes" to reuse them without copying. Caddyfile snippets are useful for reusing config, but reusing the same HTTP routes involves lots of copied config and memory bloat. Named routes let you define a route once and reuse it throughout your HTTP server without copying.…
featureEXPERIMENTAL: You can specify permissions for unix sockets. (#4741)
featureMany many bug fixes you may or may not notice :upside_down_face:
featurewarning: The ask endpoint is now required to enable On-Demand TLS (b97c76fb4789b8da0b80f5a2c1c1c5bebba163b5) for catch-all or wildcard hosts. Our docs have always mentioned this is required in production environments, but now the code enforces it. The ask endpoint is not required for local-only or…
featurewarning: The on-demand config's throttle options are now deprecated because the 'ask' endpoint is required. Additionally, the 'ask' endpoint is checked and the throttle is applied before storage is queried for a certificate in order to limit load on the storage backend.
featurewarning: The long-deprecated lookup_srv feature of the reverse proxy has been removed. It was replaced with the dynamic upstreams feature in 2.6. (#5396)
featurewarning: The remote_ip forwarded matcher has been deprecated because it assumes trusting downstream proxies. Instead, the client_ip matcher should be used along with trusted_proxies configuration. (#5103 and #5104)
featurewarning: Placeholder syntax {args.0} is now deprecated in favor of {args[0]}.
featurewarning: Plugin authors will now need to use http.ResponseController to call Flush() or Hijack() on the response writer. (#5654)
deprecated3f20a7c9 acmeserver: Configurable resolvers, fix smallstep deprecations (#5500)
feature960150bb caddyfile: Implement heredoc support (#5385)
feature8bc05e59 caddyfile: Implement variadics for import args placeholders (#5249)
feature53b6fab1 caddyfile: Stricter parsing, error for brace on new line (#5505)
featurecfc85ae8 caddyhttp: Add a getter for Server.name (#5531)
featurecbf16f6d caddyhttp: Implement named routes, invoke directive (#5107)
featurea7af7c48 caddytls: Allow on-demand w/o ask for internal-only
featureb301a3df celmatcher: Implement pkix.Name conversion to string (#5492)
feature9e691955 cmd: Expand cobra support, add short flags (#5379)
feature078f130a cmd: Implement storage import/export (#5532)
feature22927e27 core: Add optional unix socket file permissions (#4741)
featuref66493ef core: Allow loopback hosts for admin endpoint (fix #5650) (#5664)
featuref9bd2d3e fileserver: Add color-scheme meta tag (#5475)
feature6cc3cbbc fileserver: New file browse template (#5427)
breaking94d41a9d fileserver: Remove trailing slash on fs filenames (#5417)
feature27bc16ab fileserver: add export-template sub-command to file-server (#5630)
featuree041962b fileserver: add lazy image loading (#5646)
featuree8352aef headers: Add > Caddyfile shortcut for enabling defer (#5535)
breaking4636109c reverseproxy: Remove deprecated lookup_srv (#5396)
+111 more items in the release notesotherDo not use this release, use v2.7.3 instead which contains several hot fixes.
otherDo not use this release; use v2.7.3 instead. It contains a hotfix for a WebSocket issue.
otherDo not use this release, use v2.7.3 instead which contains hot fixes.
otherbuffer_requests
otherbuffer_responses
othermax_buffer_size
otherrequest_buffers
otherresponse_buffers
other0db29e2c go.mod: Upgrade acmez and x/net
other4b119a47 reverseproxy: Don't buffer chunked requests (fix #5366) (#5367)
featureNew trusted_proxies global option (within servers) can be used to specify trusted proxy IP ranges globally. This is important if relying on headers for client IP addresses.
otherUnix sockets on Windows now supported as proxy upstreams.
otherProxied WebSocket connections are now logged with correct status code and "size" (bytes read + bytes written).
otherThe quic-go package has received significant optimizations, so HTTP/3 should be more efficient now.
otherbfaf2a82 acme_server: Configurable default lifetime for issued certificates (#5232)
featureac83b7e2 admin: Add CADDY_ADMIN env var to override the default (#5332)
fixac96455a admin: fix certificate renewal for admin (#5169)
other762b0278 admin: set certmagic cache logger (#5173)
other329af5ce build(deps): bump actions/cache from 2 to 3 (#5263)
other3b724a20 build(deps): bump actions/upload-artifact from 1 to 3 (#5262)
otheraf93517c build(deps): bump goreleaser/goreleaser-action from 2 to 4 (#5264)
othercd49847e build(deps): bump peter-evans/repository-dispatch from 1 to 2 (#5261)
other8d3a1b8b caddyauth: Use singleflight for basic auth (#5344)
fixbbe36631 caddyconfig: Fix httploader leak from unused responses (#5159)
feature7f2a93e6 caddyfile: Allow overriding server names (#5323)
feature223cbe3d caddyhttp: Add server-level trusted_proxies config (#5103)
other087f126c caddyhttp: Canonicalize header field names (#5176)
other12bcbe2c caddyhttp: Pluggable trusted proxy IP range sources (#5328)
featureed503118 caddyhttp: add placeholder {http.request.orig_uri.path.*} (#5161)
feature33fdea8f caddypki: Prefer user-configured root instead of generating new one (#5189)
other6f8fe01d caddypki: Use go.step.sm/crypto to generate the PKI (#5217)
other1fa4cb7b caddytest: Increased sleep between retries to reduce flakey tests in CI (#5160)
otherfef9cb3e caddytest: internalize init config into '.go' file (#5230)
feature55035d32 caddytls: Add dns_ttl config, improve Caddyfile tls options (#5287)
feature66ce0c5c caddytls: Add test cases for Caddyfile tls options (#5293)
other0a3efd16 caddytls: Debug log for ask endpoint
feature94b8d560 cmd: Add --envfile flag to validate command (#5350)
featurea999b707 cmd: Add missing \n to HelpTemplate (#5151)
otherc3b5b181 cmd: Avoid panic when printing version without build info (#5210)
other5805b3ca cmd: caddy fmt return code is 1 if not formatted (#5297)
other8c0b49bf cmd: fmt exit successfully after overwriting config file (#5351)
deprecatedf20a8e7a cmd: replace deprecate func use (#5170)
other536c28d4 core: Support Windows absolute paths for UDS proxy upstreams (#5114)
otherdac7cacd encode: Respect Cache-Control no-transform (#5257)
feature4e9ad50f fileserver: Add a couple test cases
other4bf6cb41 fileserver: Reject ADS and short name paths; trim trailing dots and spaces on Windows (#5148)
featured73660f7 httpcaddyfile: Add persist_config global option (#5339)
fixc38a040e httpcaddyfile: Fix handle grouping inside route (#5315)
featuree9d95ab2 reverseproxy: Add flag to short command to disable redirects (#5330)
fix845bc4d5 reverseproxy: Fix hanging for Transfer-Encoding: chunked (#5289)
+15 more items in the release notesother037dc23c admin: Use replacer on listen addresses (#5071)
feature498f32ba caddyconfig: Implement retries into HTTPLoader (#5077)
other9873ff99 caddyhttp: Remote IP prefix placeholders
other61822f12 caddyhttp: replace placeholders in map defaults (#5081)
othere07a2672 caddytest: Revise sleep durations
other253d97c9 core: Chdir to executable location on Windows (#5115)
fixab720fb7 core: Fix ListenQUIC listener key conflict
othere3e8aabb core: Refactor and improve listener logic (#5089)
othere4fac129 core: Set version manually via CustomVersion (#5072)
otherf7c1a51e fastcgi: Redirect using original URI path (fix #5073)
other2be56c52 fileserver: Treat invalid file path as NotFound (#5099)
otherb1d04f5b fileserver: better dark mode visited link contrast (#5105)
other33f60da9 fileserver: stop listing dir when request context is cancelled (#5131)
other2153a81e forwardauth: Canonicalize header fields (fix #5038) (#5097)
otherfe91de67 go.mod: Upgrade select dependencies
other70419700 headers: Support repeated WriteHeader if 1xx (fix #5074)
fixd46ba2e2 httpcaddyfile: Fix metrics global option parsing (#5126)
other6bad878a httpcaddyfile: Improve detection of indistinguishable TLS automation policies (#5120)
other2808de1e httpcaddyfile: Skip automate when auto_https off is specified (#5110)
other3e1fd2a8 httpcaddyfile: Wrap site block in subroute if host matcher used (#5130)
feature9e1d964b logging: Add time_local option to use local time instead of UTC (#5108)
other01e192ed logging: Better console encoder defaults (#5109)
fix99ffe933 logging: Fix skip_hosts with wildcards (#5102)
otherea58d519 logging: Perform filtering on arrays of strings (where possible) (#5101)
breaking5e52bbb1 map: Remove infinite recursion check (#5094)
otherb4e28af9 replacer: working directory global placeholder (#5127)
othere2991eb0 reverseproxy: On 103 don't delete own headers (#5091)
other2a8c458f reverseproxy: Parse humanized byte size (fix #5095)
fixd0556929 reverseproxy: fix upstream scheme handling in command (#5088)
other013b5103 rewrite: Only trim prefix if matched
other1426c97d core: Reuse unix sockets (UDS) and don't try to serve HTTP/3 over UDS (#5063)
other44ad0ced encode: don't WriteHeader unless called (#5060)
otherbeb7dcbf fileserver: Reinstate --debug flag
featureServe content from S3 or other blob/cloud storage services
featureServe dynamically-generated content that "feels" static
featureEmbed your site directly into your caddy binary and serve it from memory
featureServe content directly from an archive file (e.g. .zip or .tar.gz)
featureLoad files from a database instead of disk
featureNginx (and Caddy until now) always does path comparisons in unescaped/normalized space. This makes it impossible to route on literal escape sequences unless you double-encode your pattern, which violates specification.
featureApache outright rejects valid[^2] HTTP requests containing encoded slashes. This behavior can either be disabled completely (creating a security problem known as unsafe paths) or tweaked to never decode encoded slashes (creating ambiguities when comparing against route patterns).
featureLaravel, like nginx, always decodes slashes, but routing such requests mangles application data that contains slashes.
feature{http.shutting_down} placeholder equals true.
feature{http.time_until_shutdown} returns the duration that remains until server close.
featureMore efficient query matcher. (04a14ee37ac6192d734518fa9082d6eb93971bc6)
featureA new Caddyfile placeholder {cookie.*} grants easy access to cookie values. (#5001)
featureWindows service integration: Caddy can now be controlled with sc.exe. (#4790)
featureReplace net.IP type with leaner netip.Addr type. (#4966)
featureCaddyfile-configurable OCSP check interval with ocsp_interval global option. (#4980)
featureThe reverse proxy now supports retry_count as an alternative to try_duration; i.e. try backends up to a fixed number of times, rather than up to a time limit. (#4756)
featureThe reverse proxy closes both ends of "hijacked" connections when shutting down or reloading. (#4895)
featureThe reverse proxy gracefully closes both ends of websocket connections on shutdown or reload. (#4895)
featureThe reverse proxy emits metrics regarding the health of upstreams. (#4935)
featureThe reverse-proxy command can accept repeated --to flags and load balance. (#4693)
featureThe reverse proxy's HTTP transport now supports distinct read and write timeouts. (#4905)
featureSimpler and more reliable config reloads on Linux with SO_REUSEPORT. (#4705)
featureTemplates can access reverse proxy responses if used within handle_response. (#4871)
featureBuilds now include git revision information when using go build. (#4931)
featureThe file matcher (and try_files) now supports glob patterns. (#4993)
featureNamed matchers in the Caddyfile can use CEL expressions without specifying expression first. (#4976)
featureThe FastCGI transport can now capture and print stderr output. (#5004)
featureListeners can be provided by plugins, enabling new network types. (#5002)
featureCaddy can write TLS secrets to a file for debugging purposes. (#4808)
featureSites declared as http:// in the Caddyfile will no longer be overridden by auto-HTTPS redirects. (#5051)
featureConfig reloads no longer block while the prior servers are shutting down. (#5043)
deprecatedMetrics are now opt-in. Due to multiple confirmed reports of non-trivial performance regressions with metrics, we are making them opt-in. (Technically, this is not a breaking change, as Caddy will still function normally and your old configs won't be rejected -- but your metrics will stop being…
deprecatedThe signature of caddy.Context.Logger() has changed, but in a backwards-compatible way. Modules use this function to obtain a logger they can use within Caddy; until now, modules had to pass themselves in as an argument. Now, the context can figure out which module to associate the logger with, so…
deprecatedBasic auth deprecates scrypt because it was seldom used and error-prone; use bcrypt instead (#4720)
deprecatedSeveral changes to experimental servers global options: removed the protocol sub-option, which has been replaced with the protocols sub-option; strict_sni_host is its own separate sub-option; allow_h2c and experimental_http3 have been removed, as both H2C (h2c) and HTTP/3 (h3) can be toggled in…
featureNew /adapt admin endpoint: Use your installed config adapters via API in addition to the existing caddy adapt CLI command.
featureNew Etag/If-Match support for config API: Safely update your config concurrently and avoid collisions by using our unique Etag implementation.
featureRename copied headers from reverse_proxy: If you're using handle_response, you can more easily map headers to a different name for clients.
featureMany HTTP matchers have been added to CEL: You can now use the logic of our HTTP request matchers in CEL expressions.
featureNotable bug fixes: EAB reuse, various QUIC & HTTP/3 fixes, more specific HTTP status codes, various reverse proxy fixes.
feature660c59b6 admin: Implement /adapt endpoint (close #4465) (#4846)
otherad3a83fb admin: expect quoted ETags (#4879)
otherf259ed52 admin: support ETag on config endpoints (#4579)
other1498132e caddyhttp: Log error from CEL evaluation (fix #4832)
other0a14f97e caddytls: Make peer certificate verification pluggable (#4389)
other412dcc07 caddytls: Reuse issuer between PreCheck and Issue (#4866)
other499ad6d1 core: Micro-optim in run() (#4810)
otherc0f76e9e fileserver: Use safe redirects in file browser
fix58e05cab forwardauth: Fix case when copy_headers is omitted (#4856)
other0b6f7643 forwardauth: Support renaming copied headers, block support (#4783)
fix8bac134f go.mod: Bump up quic-go to v0.28.0, fixes for BC breaks (#4867)
other3d18bc56 go.mod: Update go-yaml to v3
other56013934 go.mod: Update some dependencies
other8e6bc360 go.mod: Upgrade some dependencies
other53c4d788 headers: Only replace known placeholders (#4880)
other0bcd02d5 headers: Support wildcards for delete ops (close #4830) (#4831)
feature58970cae httpcaddyfile: Add {err.*} placeholder shortcut (#4798)
otherb687d7b9 httpcaddyfile: Support multiple values for default_bind (#4774)
featurea9267791 reverseproxy: Add --internal-certs CLI flag #3589 (#4817)
featureaaf6794b reverseproxy: Add renegotiation param in TLS client (#4784)
feature54d1923c reverseproxy: Adjust new TLS Caddyfile directive names (#4872)
other7f9b1f43 reverseproxy: Correct the tls_server_name docs (#4827)
otherc82fe911 reverseproxy: Dynamic ServerName for TLS upstreams (#4836)
otherd6bc9e0b reverseproxy: Err 503 if all upstreams unavailable
fix98468af8 reverseproxy: Fix double headers in response handlers (#4847)
fix25f10511 reverseproxy: Fix panic when TLS is not configured (#4848)
other5e729c1e reverseproxy: HTTP 504 for upstream timeouts (#4824)
otherf9b42c37 reverseproxy: Make TLS renegotiation optional
otherb6e96fa3 reverseproxy: Skip TLS for certain configured ports (#4843)
other57d27c1b reverseproxy: Support http1.1>h2c (close #4777) (#4778)
breaking9864b138 reverseproxy: api: Remove misleading 'healthy' value
other693e9b52 rewrite: Handle fragment before query (fix #4775)
feature6891f7f4 templates: Add humanize function (#4767)
other9e760e2e templates: Documentation consistency (#4796)
featureFixed regression in Unix socket admin endpoints.
featureFixed regression in caddy trust commands.
featureHash-based load balancing policies (ip_hash, uri_hash, header, and cookie) use an improved highest-random-weight (HRW) algorithm for increased consistency. The new rendezvous hash will ensure a client or request is consistently mapped to a particular upstream even if the list of upstreams changes.
featureThe reverse proxy is now able to rewrite the method and URI on its internal copy of the request that goes to the upstream. Combined with new handle_response capabilities, this enables the reverse proxy to fire off "pre-check requests" (for lack of a better term) to make routing decisions based on…
fixcaddypki: Fix caddy trust command to use the correct API endpoint
otherreverseproxy: Improve hashing LB policies with HRW
featureAdd missing backticks
othercaddyhttp: Improve listen addr error message for IPv6
fixcmd: Fix unix socket addresses for admin API requests
otherlogging: Use RedirectStdLog
featurelogging: Implement rename filter, changes field key names
fixhttpcaddyfile: Fix duplicate access log when debug is on
fixreverseproxy: Fix Caddyfile support for replace_status
featuretemplates: Add custom template function registration
otherreverseproxy: Permit resolver addresses to not specify a port
othercaddyfile: Shortcut for remote_ip for private IP ranges
otherreverseproxy: Support performing pre-check requests
othermap: Prevent output destinations overlap with Caddyfile shorthands
otherec86a2f7 caddyfile: Shortcut for remote_ip for private IP ranges (#4753)
otherdcc98da4 caddyhttp: Improve listen addr error message for IPv6 (#4740)
fixd543ad1f caddypki: Fix caddy trust command to use the correct API endpoint (#4730)
fix2e4c0915 cmd: Fix unix socket addresses for admin API requests (#4742)
fixaf732151 httpcaddyfile: Fix duplicate access log when debug is on (#4746)
feature0be3d995 logging: Implement rename filter, changes field key names (#4745)
other3017b245 logging: Use RedirectStdLog to capture more stdlib logs (#4732)
otherf7be0ee1 map: Prevent output destinations overlap with Caddyfile shorthands (#4657)
fix4a223f52 reverseproxy: Fix Caddyfile support for replace_status (#4754)
other40b193fb reverseproxy: Improve hashing LB policies with HRW (#4724)
othere7fbee8c reverseproxy: Permit resolver addresses to not specify a port (#4760)
otherf6900fcf reverseproxy: Support performing pre-check requests (#4739)
featuree84e19a0 templates: Add custom template function registration (#4757)
feature3ab64838 templates: Add missing backticks in docs (#4737)
featureReverse proxy: :sparkles: Dynamic upstreams, which is the ability to get the list of upstreams at every request (more specifically, every iteration in the proxy loop of every request) rather than just once at config-load time. Dynamic upstream modules can be plugged in to provide Caddy with the…
featurewarning: This deprecates the lookup_srv JSON field for upstreams (and srv+ scheme prefix in the Caddyfile), which will be removed in the future.
featureAutomatic HTTPS: Caddy will automatically try to get relevant certificates from the local Tailscale instance (if running with permission to access the Tailscale socket). This makes services running on a Tailscale network automatically available over trusted HTTPS with Caddy.
featureTracing: New OpenTelemetry integration with the tracing handler module and associated tracing directive.
featureReverse proxy: When using the response handlers, a new handler copy_response is available to copy the proxy's response back to the client, and copy_response_headers may be used to selectively copy header values from the proxy's response.
featureAPI: Added new endpoints /pki/ca/ and /pki/ca//certificates for getting information about Caddy's managed CAs, including the chain of root and intermediate certificates.
featureReverse proxy: The default dial timeout for the HTTP transport has been adjusted down to 3s (was 10s), which should allow for more easily configuring load balancing retries.
breakingwarning: Logging: Removed the deprecated common_log field from HTTP access logs, and the single_field encoder. If you relied on this, you may use the transform encoder plugin to encode logs in Common Log format.
featureHTTP server: Requests can now be assigned a random and unique UUID from the new {http.request.uuid} placeholder.
featureHTTP server: New http_redirect listener wrapper which can be used to redirect HTTP requests that come in on a server listening for HTTPS requests to be redirected to https://.
deprecatedwarning: Caddyfile: Deprecated paths in site addresses. Prefer using path matchers within your site block instead.
featureCaddyfile: New default_bind global option lets you specify the default interface all sockets should bind to.
featureCaddyfile: New pki global option lets you configure the properties of the internal CAs managed by Caddy.
featureCaddyfile: New method directive allows rewriting the request method via Caddyfile.
featurewarning: Caddyfile: The reverse_proxy directive's handle_response subdirective has had its status replacement functionality moved to a new replace_status subdirective. This makes sure that the functionality of handle_response is not overloaded, and usage is clearer.
featureCaddyfile: New vars directive allows setting some variables during request handling for later use in another handler or matcher.
fix6e6ce2be caddyhttp: Fix HTTP->HTTPS redir not preferring HTTPS port if ambiguous (#4530)
feature180ae0cc caddyhttp: Implement http.request.uuid placeholder (#4285)
featurea79b4055 caddytls: Add internal Caddyfile lifetime, sign_with_root opts (#4513)
feature77a77c02 caddytls: Add propagation_delay, support propagation_timeout -1 (#4723)
feature09ba9e99 fileserver: Add pass_thru Caddyfile option (#4613)
feature1b7ff5d7 httpcaddyfile: Add default_bind global option (#4531)
featurea8bb4a66 httpcaddyfile: Add {vars.*} placeholder shortcut, reverse vars sort order (#4726)
feature5a071568 httpcaddyfile: Add pki app root and intermediate cert/key config (#4514)
deprecated3a1e0dbf httpcaddyfile: Deprecate paths in site addresses; use zap logs (#4728)
featurec921e082 logging: Add roll_local_time Caddyfile option (#4583)
breaking0eb0b60f logging: Remove common_log field and single_field encoder (#4149) (#4282)
feature8887adb0 logging: add a filter for cookies (#4425)
featurebcac2bee logging: add a filter for query parameters (#4424)
feature789efa5d logging: add a regexp filter (#4426)
featurea1b417c8 logging: add support for hashing data (#4434)
featurebbad6931 pki: Implement API endpoints for certs and caddy trust (#4443)
featurec50094fc reverseproxy: Implement trusted proxies for X-Forwarded-* headers (#4507)
featurebcb7a19c rewrite: Add method Caddyfile directive (#4528)
featured0b608af tracing: New OpenTelemetry module (#4361)
featurec5fffb4a caddyfile: Support for raw token values; improve map, expression (#4643)
feature6512832f cmd: Add --diff option for caddy fmt (#4695)
feature79cbe7bf httpcaddyfile: Add 'vars' directive
feature7d229665 logging: Caddyfile support for duration_format (#4684)
feature3e3bb002 reverseproxy: Add _ms placeholders for proxy durations (#4666)
+106 more items in the release notesotherPath matchers unescape/clean URI paths to normalize match space
fixFix regex matching in map handler
featuretry_files can now accept =nnn (e.g. =404) to yield a status code instead of a file.
featureTemplate actions httpError (stop eval and return HTTP error) and import (like include but changes template context) were added
featureNew placeholder {http.request.tls.client.certificate_der_base64}
fixA hotfix for a regression introduced in v2.4.4 related to combining the encode and reverse_proxy directives. Please see the v2.4.4 release notes for a more complete changelog.
other9f6393c6 cmd: export CaddyVersion(), Commands() (#4316) 4ebf100f encode: ignore flushing until after first write (#4318) 46ab93be go.mod: Update CertMagic
fixThis release contains numerous bug fixes, updated dependencies, and QoL improvements.
fixUpdate: This release contains a known regression in the combination of encode and reverse_proxy modules; please use v2.4.5 instead.
otherThanks to all contributors, and a special thanks to @francislavoie and @Mohammed90 for their dedication in helping to maintain the project and help others.
breakingwarning: In reverse_proxy, the max_idle_conns_per_host option has been removed (both Caddyfile and JSON). This may be a breaking change for a few of you, but it only breaks configs that relied on a bug. Instead of silently failing, you will get an error if you continue using the property. For…
securityshield: Security patch in the FastCGI transport that now sanitizes paths against directory traversal outside the site root. PR #4207.
fixbug: Fix canonicalization redirects in file_server. v2.4.2 introduced a bugfix (#4179) for these redirects when used inside handle_path (i.e. rewriting the path by stripping a prefix), but caused a regression for many other use cases. This release includes a proper fix for all known, tested cases.…
fixA few enhancements and bug fixes. Thanks to all who contributed to this release!
fix323ffd20 admin: Replace admin cert cache when reloading (fix #4184) 4c2da188 caddytls: Add Caddyfile support for propagation_timeout (#4178) 76913b19 fileserver: Fix browse not redirecting query parameters (#4196) f9b54454 fileserver: Redirect within the original URL (#4179) ecd5eeab go.mod:…
otherA small patch release that contains a few noncritical but pleasant fixes (unless you're using /id/ endpoints in the admin API; then you should definitely get this update).
fix7f26a6b3 admin: Reinstate internal redirect for /id/ requests b82db994 caddyfile: Add parse error on site address with trailing { (#4163) 2aefe156 cmd: upgrade: inherit the permissions of the original executable (#4160) dbe164d9 httpcaddyfile: Fix automation policy consolidation again (fix #4161)…
featureSecure remote management. You can now enable secure remote access to Caddy's admin API! It uses TLS mutual authentication, and you can even define permissions for different users. PR #3994
featureConfig pull at start. Caddy can be configured to load a different config at startup. This is useful if your config is federated through a separate system that doesn't have the ability to push configs to Caddy. This feature is modular, so configurations can be loaded different ways! PR #3994
featureServer identity management. Caddy can automatically manage its own server identity certificate, which can be used when negotiating TLS connections with peers. This is required when enabling the secure admin API. PR #3994
featureSelf-upgrade command. The new caddy upgrade command will replace the current Caddy binary with an upgraded one from our website, with all the same modules installed, including third-party plugins that are registered on our site! (We can use this code to add/remove modules later, too.)
featureConfigure other apps from the HTTP Caddyfile. The global options block of the Caddyfile now allows configuration of Caddy apps other than HTTP (for example, dynamic_dns to keep DNS records pointed at your server with a dynamic IP address).
featureCaddyfile fmt lint check. When running with a Caddyfile, Caddy will emit a warning if the Caddyfile is not formatted with caddy fmt.
featureNew abort directive. The abort directive is a special case of the static_response HTTP handler that prevents an HTTP response by aborting the handler chain immediately and forcefully closing the connection.
featureNew error directive. The error directive returns internal error values in the HTTP handler chain, as if an HTTP error had occurred, causing your error routes to be invoked.
featureConfigure response interception from Caddyfile. The reverse_proxy is capable of intercepting responses from the backend, and now this is exposed in the Caddyfile with handle_response.
featureBetter caddy list-modules output. Now modules are organized by standard and non-standard modules, so you can easily see if a Caddy build has been customized.
featureConfigure logging from Caddyfile. The process logs can now be configured from the global options of the Caddyfile.
featureBetter content negotiation. The file server can now be configured to serve precompressed sidecar files, and content encoding preferences are better configured and honored.
featureDark mode in directory listings. The file server's "browse" file listings now has a dark mode.
featurewarning: Removed the logfmt log encoder. It was broken anyways, and its deprecation has been warned in previous releases.
featurewarning: Deprecated common_log format. It will be removed in a future release. Issue #4148
featurewarning: Deprecated health_path in reverse_proxy directive. It has been replaced with health_uri and will be removed in the future.
featureNumerous bug fixes and improvements. Thanks for the detailed, helpful bug reports! We appreciate your collaboration in making Caddy better.
featureMulti-issuer support. Caddy can now get certificates from multiple issuers for redundancy; if one fails, another will be tried. Caddy's new defaults are Let's Encrypt and ZeroSSL. You can customize these, including adding local/self-signed certificates as a last resort if desired. Caddy is the…
fixImproved on-demand TLS. On-demand TLS is an operating mode by which certificate obtain/renew operations are triggered on a TLS handshake that requires them, rather than happening at config-load time. We've moved a lot of the processing to the background where possible (e.g. when an existing…
featureSupport for alternate certificate chains. You can now customize which certificate chains to download from ACME servers that offer more than one.
featureNew map handler is ready for production use. (Caddyfile docs) It's been in Caddy for a few versions now but it's finally ready for production, with enhanced efficiency and functionality. We have been using this handler with a customer in production for a while now, on an instance that is handling…
otherCustomize servers and listeners with the Caddyfile. The Caddyfile structure is oriented around sites for convenience, so customizing servers has not been possible until now. You can now use global options to configure servers and their listeners (for example, protocol options, socket read options,…
otherwarning: The remote_ip matcher no longer reads the X-Forwarded-For header by default. This was undocumented behavior, and an unsafe default. If you happened to be relying on this, please enable forwarded (in the Caddyfile, just put forwarded as the first argument before the ranges) to maintain…
otherwarning: The experimental_http3 global option in the Caddyfile has been replaced with global server options, one of which is the experimental_http3 protocol. Docs will be updated shortly. This is still an unstable feature until HTTP/3 is finalized and our upstream QUIC/H3 lib is stable and we've…
deprecatedwarning: The "issuer" field in TLS automation policies is deprecated and will be removed in the future, please switch to "issuers".
fixThis patch release contains a number of bug fixes. Thanks for the reports and the help in debugging them!
otherUpdate: December 2020: This tag is the same as v2.2.3. Somehow, an unauthorized tag v2.2.2 was released from a fork. Because the Go module proxy is append-only, we created the v2.2.3 tag so that v2.2.1 would remain the default "latest" until v2.3.0 stable is released in a few weeks.
fix85152679 admin: lower log level to Debug for /metrics requests (#3749) a33e4b54 caddyfile: Add support for vars and vars_regexp matchers (#3730) 385adf5d caddyhttp: Restore original request params before error handlers (#3781) 0fc47e83 map: Apply default if mapped output is nil ef8a372a map: Bug…
featureFull support for ZeroSSL, a new ACME CA that is a viable alternative to Let's Encrypt. Its ACME endpoint is free to use and might even be a better fit for your deployment depending on your requirements (for example, it does not have tight rate limits and does not require the DNS challenge for…
featureWe now have full control over our ACME stack! By replacing our previous underlying ACME library (lego) with ACMEz, Caddy can offer:
featurefaster config reloads
featuremore efficient cert management at scale
featurea more intuitive configuration experience
featurelighter builds
featurestructured logs that are consistent with Caddy's other logs (which you have fine-grained control over).
feature(we no longer suffer from the limitations still shared by other lego-based ACME clients)
featureIntegrated support for Prometheus metrics. We decided that emitting metrics is something the core of the server has to do, rather than only a separate module. We will continue improving this with time. Huge thanks to @hairyhenderson for his skillful contributions.
featureHTTP/2 server push has been re-introduced, this time better than it was in Caddy 1.
featureCaddyfile enhancements, including:
featureFully customize certificate issuers from the Caddyfile. Up until now, you could only customize certain parts of the ACME issuer or choose the Internal issuer from the Caddyfile; now you have full control.
featureNamed matchers can be defined inside route blocks.
featureCustomize log encoders.
featuredns property for issuer subdirective of tls directive that allows full customization of DNS challenge (those providers which support the Caddyfile)
featureBug fixes
feature⚠️ The logfmt log encoder has been deprecated and will be removed. (It is already broken since it does not encode objects, so if you used it you probably stopped using it anyway.)
featureCustomizable DNS resolver for reverse proxy
featureLatest HTTP/3 version
featureNumerous bug fixes and other enhancements! Notable bug fixes related to:
featureACME DNS challenge providers
featureCustom resolvers for the DNS challenge
featureACME EAB (External Account Binding)
featurePanic recovery
featureStartup time when managing lots of certificates
featureCorrect port for active health checks (reverse_proxy module)
featureWindows paths
featureFile hiding logic (file_server module)
featureBidirectional streaming (reverse_proxy module; specifically benefits v2ray use)
featureMore consistent, structured error logging when produced from HTTP code in Go's standard library
featureNew placeholders and log fields, especially pertaining to TLS, ACME, and HTTP
fixVersion 2.1.1 fixes a minor regression in v2.1 related to the CEL (expression) matcher, as well as eliminating the warning about pb.proto. Both regressions were unfortunately introduced by patch updates on dependencies. This version also adds support for placeholders in the query matcher, and a…
fix6004d3f7 caddyhttp: Add 'map' handler (#3199) 77f233a4 caddyhttp: Corrected host label index check (fix #3502) ddd690de caddyhttp: Support placeholders in query matcher (#3521) d7dbf855 cel: fix validation of expression result type (#3526)
featureFully automated mTLS certificates. Caddy 2.1 can fully manage all its TLS certificates -- including TLS client certificates -- using any ACME endpoint you configure. New in this version, the reverse proxy module can be configured to present an automated client certificate, just by providing its…
featureEmbedded ACME server (powered by Smallstep). This allows other ACME clients to use Caddy as an ACME endpoint. The idea here is to replace one-off self-signed, generated certificates with proper, short-lived, auto-renewing certificates for local development and internal deployments. In other words,…
otherH2C support. Although discouraged in the general case, HTTP/2 over Cleartext HTTP (h2c) can be useful when serving or proxying gRPC locally/internally on trusted networks; and due to current poor TLS support in gRPC services currently, h2c might even be required in some cases. Caddy can now serve…
featureNew handle_path Caddyfile directive. This works the exact same as handle, but it only accepts a path prefix matcher and it strips the matched portion of the path before executing the directives contained in its block. It's a shortcut for using handle and uri strip_prefix together, which was a…
otherAuto HTTPS can be configured in the Caddyfile. You can use the auto_https global option to disable it entirely, or disable only HTTP->HTTPS redirects. This is useful if you don't want to bind to any HTTP port at all.
otherVarious other Caddyfile improvements. Several quality-of-life improvements for the Caddyfile, including one-line named matchers such as @foo not path /foobar/*, and the ability to use backticks (`) to enclose strings where double quotes (") are inconvenient.
featureReverse proxy response interception. The reverse proxy can now intercept and handle the response from upstream based on the response status code and/or headers. This allows you to invoke custom, arbitrary HTTP logic based on the response from a backend.
fixMany bug fixes and other enhancements. We always say this, I know, but just look at that changelog.