Caddy 2.6.3 → 2.10.2
17 releases · 39 breaking changes · 6 security fixes · 0 advisories fixed
6security39breaking5deprecated136feature49fix
Breaking changes
- breaking 89ed5f44de61fcb0c3b7ce93bfefbb8e775d1964 fix: Remove nil arg from zapslog.NewHandler call (#6984) in 2.10.1
- breaking Wildcards used by default: Previously, Caddy would obtain individual certificates for every domain in your config literally; now wildcards, if present, will be utilized for subdomains, rather than obtaining individual certificates. This change was motivated by the novel possibility for subdomain… in 2.10.0
- breaking 0d7c63920daecec510202c42816c883fd2dbe047 go.mod: remove glog dependency (#6838) in 2.10.0
- breaking 84364ffcd06e35a93c9bb08ed80617bde72d4f74 caddypki: Remove lifetime check at Caddyfile parse (fix #6878) in 2.10.0
- breaking f297bc0a04dcab6c2585b47f3672d045c4f6b54b admin: Remove host checking for UDS (close #6832) in 2.10.0
- breaking remove glog dependency in 2.10.0
- breaking eddbccd298f637c4785c891f5f96dbf103580fa8 fastcgi: remove dir redirection when useless in php_fastcgi (#6698) in 2.9.0
- breaking cmd: remove zealous check of Caddyfile auto-detection in 2.9.0
- breaking fileserver: Remove newline characters from precomputed etags in 2.9.0
- breaking doc: remove docs of deprecated directives in 2.9.0
- breaking ZeroSSL (#6229) (this is one overall change, but requires some explanation): in 2.8.0
- breaking Up to now, Caddy used both Let's Encrypt and ZeroSSL by default to get certificates without any configuration. In 2.8, this is changing slightly. Due to upcoming changes to ZeroSSL accounting policies, ZeroSSL now requires your email address to be able to access their free ACME endpoint. in 2.8.0
- breaking As such, Caddy will only implicitly add the ZeroSSL issuer to your config if you provide an email address in your Caddyfile using the email global option. (We have already recommended this for years.) If you already do this, you don't have to make any changes and you'll still get Let's Encrypt and… in 2.8.0
- breaking If you use JSON to configure certificate automation policies, you will need to ensure you use the acme issuer with your email filled out, and the ca field set to ZeroSSL's ACME server URL. If you want redundancy with Let's Encrypt, be sure to specify another acme issuer as well (defaults OK, but… in 2.8.0
- breaking The zerossl issuer module is no longer ACME-capable and is now exclusively for the ZeroSSL API. An API key from your ZeroSSL account is required. (The ZeroSSL ACME server can still be used with the acme module pointed to ZeroSSL's ACME server. You can provide your account email and/or EAB as… in 2.8.0
- breaking Faster response times in 2.8.0
- breaking IP certificates in 2.8.0
- breaking Management tools in your ZeroSSL account dashboard in 2.8.0
- breaking Technical support in 2.8.0
- breaking To clarify, Let's Encrypt is still a default issuer even if you don't provide an email address (but we have always strongly recommended to do so). in 2.8.0
- breaking You can still use ZeroSSL's ACME endpoint with your own External Account Binding (EAB) credentials. in 2.8.0
- breaking See notes in #6229 for some examples and further explanations. in 2.8.0
- breaking Removed support for the lego_deprecated DNS provider module. It has been deprecated for 4 years. Use caddy-dns modules instead; there are over 50 to choose from already. They are more flexible, compile much leaner, and are easier to implement and support. If yours is not supported it can be easily… in 2.8.0
- breaking On-demand TLS: The ask option in the JSON has been deprecated in favor of a permission module (Caddyfile unchanged) (#6055), and Caddyfile support for permission modules is added (6a02999) in 2.8.0
- breaking Admin API: Etag (used for concurrency control) is now a header, not a trailer. This is less efficient, but still virtually no clients properly implement trailer support. in 2.8.0
- breaking For consistency, the basicauth Caddyfile directive has been renamed to basic_auth (#6092), and skip_log has been renamed to log_skip. The old names will continue to work for now, with a deprecation warning in the logs. (#6066). in 2.8.0
- breaking The basic_auth handler no longer supports scrypt (deprecated for nearly two years) (#6091) in 2.8.0
- breaking The forwarded option has been deprecated for a long time and has now been removed from the remote_ip matcher. Use the client_ip matcher instead. (#6085) in 2.8.0
- breaking Reverse proxy: The buffer_requests, buffer_responses, and max_buffer_size settings have been removed after being deprecated for 14 months. Use request_buffers and response_buffers instead if you need buffering. in 2.8.0
- breaking Go API: If you called caddy.Context.AppIfConfigured(), it now returns an error, as part of a bug fix. (#6292) in 2.8.0
- breaking 30d63648 caddyauth: Drop support for scrypt (#6091) in 2.8.0
- breaking 654a3bb0 caddyhttp: remove duplicate strings.Count in path matcher (fixes #6233) (#6234) in 2.8.0
- breaking 3609a4af caddytls: Remove shim code supporting deprecated lego-dns (#6231) in 2.8.0
- breaking 1fc151fa caddytls: remove ClientHelloSNICtxKey (#6326) in 2.8.0
- breaking ac1f20b9 httpcaddyfile: Remove port from logger names (#5881) in 2.8.0
- breaking 9f97df22 reverseproxy: Remove long-deprecated buffering properties in 2.8.0
- breaking f0ea489d httpcaddyfile: Remove port from logger names (#5881) in 2.7.6
- breaking 94d41a9d fileserver: Remove trailing slash on fs filenames (#5417) in 2.7.3
- breaking 4636109c reverseproxy: Remove deprecated lookup_srv (#5396) in 2.7.3
Security changes
- security Security in 2.9.0
- security browse: add Content-Security-Policy w/ nonce in 2.9.0
- security browse: fix Content-Security-Policy warnings in Firefox in 2.9.0
- security cc0c0cf0 caddyhttp: Security enhancements for client IP parsing (#5805) in 2.8.0
- security 9fc55a97 go.mod: CVE-2023-45142 Update opentelemetry (#5908) in 2.8.0
- security b809ed71 go.mod: CVE-2023-45142 Update opentelemetry (#5908) in 2.7.6
Deprecations
- deprecated d7564d632fbed209e81978c5c2c529a7bf1836f7 caddytls: Drop rate_limit and burst, has been deprecated (#6611) in 2.9.0
- deprecated caddytls: Drop rate_limit and burst, has been deprecated in 2.9.0
- deprecated 2fc620d3 caddyhttp: Fix linter warning about deprecation in 2.8.0
- deprecated c27425ef httpcaddyfile: Keep deprecated skip_log in directive order (#6153) in 2.8.0
- deprecated 3f20a7c9 acmeserver: Configurable resolvers, fix smallstep deprecations (#5500) in 2.7.3
Every release in between
otherhttp: Make logger first, before TLS provisioning
fixhttpcaddyfile: Fix acme_dns regression
fixcaddyfile: Fix importing nested tokens for {block}
fix551f793700fe1550845c824470b623fd1aa03d36 caddyfile: Fix importing nested tokens for {block} (#7189)
other16fe83c7afe2152b0bb53ae35078a28f87e6dcf2 http: Make logger first, before TLS provisioning (#7198)
fix4564261d8350f8010b7e001e646e260e9bba5746 httpcaddyfile: Fix acme_dns regression (#7199)
otherupdate quic-go to v0.51.0
otherforwardproxy: reference correct field name in LoadModule
fixfix: Remove nil arg from zapslog.NewHandler call
featurefileserver: Add support for .avif image format
otherreverseproxy: use DialTLSContext for TLS if servername has placeholder
otheradmin: Make sure that any admin routers are provisioned when local/re…
otherlog: default logger should respect {in,ex}clude
fixacme_server: fix policy parsing in caddyfile
featureimplement Unwrap for interceptedResponseHandler
fixcaddyhttp: fix route sort by comparing paths without wildcard if they don't shar…
fixfix: crash - null check on event origin
fixfix: prevent error handler from overriding sub handler matchers
fixcmd: fix Commands function not returning all registered commands
featurecore: clean up new config if it failed to run
feature[ADD] sort buttons in grid mode
fixFix: Support placeholders in header replacement search patterns
fixfix dead link
fixfix(provisioning): Context.App or Context.AppIfConfigured will return (val, nil) even if the app failed to provision or validate the first time
featurecmd: Allow caddy adapt to read from stdin
featurefeat: add bcrypt cost parameter to hash-password
fixfix typo in bcrypt cost flag name
fixcaddytls: fix regression in external certificate manager support
featurereverse_proxy: use the new KeepAliveConfig to set probe interval
featuredoc: Add a few lines about Etag file content
featurecaddyhttp: use the new http.Protocols to handle h1, h2 and h2c requests
fix44d078b6705c7abcabb2a60f501568ff7f5a57a1 acme_server: fix policy parsing in caddyfile (#7006)
feature49dac61b078a704b3e98566134c108d6def19450 bcrypt: add cost parameter to hash-password (#7149)
feature14a63a26b9a673857fc37cba37aedc35a10ce634 caddyhttp: use the new http.Protocols to handle h1, h2 and h2c requests (#6961)
fixb898873b90b5cb804400888ec2f2994f6a2dd270 caddytls: fix regression in external certificate manager support (#7179)
feature19ff47a63b9ff2ae424790b02548d9ba4afc56ba cmd: Allow caddy adapt to read from stdin (#7163)
fixe633d013f64d057f462786ccf4a430cd27817d4d cmd: fix Commands function not returning all registered commands (#7059)
feature3d0b4fac5a583d615fe411a4af9a24a7bcc3bee3 core: Clean up new config if it failed to run (#7068)
featureb9710c6af4f764b463a8e0c080783f2b7fb15ce0 fileserver: Add a few doc lines about Etag file content (#7173)
feature3b4d966fba069e9895980dbbf05f84bf818968ba fileserver: Add sort buttons in grid mode (#7089)
feature54d03ced48a8ed2264ae9248c81f00a1c2648d82 fileserver: Add support for .avif image format (#6988)
breaking89ed5f44de61fcb0c3b7ce93bfefbb8e775d1964 fix: Remove nil arg from zapslog.NewHandler call (#6984)
feature5b727bde2992e7cb9987208453db42ae6e1c6e1e httpcaddyfile: Allow naked acme_dns if dns is set (fix #7091)
fix0badb071efc38bb9cc055076f0a48d1725fe8cc8 httpcaddyfile: Fix generated config related to ACME global options
feature716d72e47538cc4f7bab43b1d973e0f8aa0a9fba intercept: implement Unwrap for interceptedResponseHandler (#7016)
feature1c596e3c5a1cd0b52febb1506ffe471918bd1128 reverse_proxy: use the new KeepAliveConfig to set probe interval (#7157)
+72 more items in the release notesfeatureEncrypted ClientHello (ECH): This new technology encrypts the last plaintext portion of a TLS connection: the ClientHello, which includes the domain name being connected to. The draft spec for ECH is almost finalized, so we can now support this privacy feature for TLS. This is a powerful but…
featureACME profiles: ACME profiles are an experimental draft that allow you to choose properties of your certificates with more flexibility than traditional CSR methods. For example, Let's Encrypt will issue 6-day certificates under a certain profile. Caddy may eventually use that profile by default.
breakingWildcards used by default: Previously, Caddy would obtain individual certificates for every domain in your config literally; now wildcards, if present, will be utilized for subdomains, rather than obtaining individual certificates. This change was motivated by the novel possibility for subdomain…
featurelibdns 1.0 APIs: Many of you use DNS provider modules to solve ACME DNS challenges or to enable dynamic DNS. They implement interfaces defined by libdns to get, set, append, and delete DNS records. After 5 years of production experience, including lessons learned with ECH, libdns APIs have been…
featureGlobal dns config: Now that several components of Caddy configuration may affect DNS records (ACME challenges, ECH publication, etc.), there is a new dns global option that can be used to specify your DNS provider config in a single place. This prevents repetition of credentials for servers where…
fix96c5c554c1241430ac9ddea6f4b68948adcc961b admin: fix index validation for PUT requests (#6824)
fixbc3d497739444a5ce550696b7b0da36e6e3bc777 caddytls: Fix broken refactor
fix7b8f3505e33139de0d542566478e98b361bb84bf caddytls: Fix sni_regexp matcher to obtain layer4 contexts (#6804)
feature2c4295ee48f494bc8dda5fa09b37612d520c8b3b caddytls: Initial support for ACME profiles
breaking0d7c63920daecec510202c42816c883fd2dbe047 go.mod: remove glog dependency (#6838)
fix9e0e5a4b4c2babda81c58f28fe61adfa91d04524 logging: Fix crash if logging error is not HandlerError (#6777)
feature904a0fa368b7eacac3c7156ce4a1f6ced8f61f34 reverse_proxy: re-add healthy upstreams metric (#6806)
featuref4432a306ac59feee1fc45c8efefad3619e37629 caddyfile: add error handling for unrecognized subdirective/options in various modules (#6884)
breaking84364ffcd06e35a93c9bb08ed80617bde72d4f74 caddypki: Remove lifetime check at Caddyfile parse (fix #6878)
feature220cd1c2bcecc07bcf6a0141069538c1b1109907 reverseproxy: more comments about buffering and add new tests (#6778)
fixb3e692ed09f8ba15b741621c4b16d8bfee38f8a1 caddyfile: Fix formatting for backquote wrapped braces (#6903)
fix49f9af9a4ab2a28fa5c445630017f5284a5afa48 caddytls: Fix TrustedCACerts backwards compatibility (#6889)
fix39262f86632401ae4915600b042ef5a28141d3d5 caddytls: Minor fixes for ECH
feature173573035c7484bb4aad4498a90bf5a1cf1bb5be core: add modular network_proxy support (#6399)
featureaf2d33afbb52389cda139a6a0fd8a9d65f558676 headers: Allow nil HeaderOps (fix #6893)
featuredccf3d8982d1b428e840d43f71fa5c3becf6ea8f requestbody: Add set option to replace request body (#5795)
fix2ac09fdb2046957597e17096adf6335a6d589a2f requestbody: Fix ContentLength calculation after body replacement (#6896)
breakingf297bc0a04dcab6c2585b47f3672d045c4f6b54b admin: Remove host checking for UDS (close #6832)
feature35c8c2d92d26208642cea0d1549c77a00124e154 caddytls: Add remote_ip to HTTP cert manager (close #6952)
featurefb22a26b1a08a2fa3b2526d1852467904ee140f6 caddytls: Allow missing ECH meta file
feature6c38ae7381b3338b173c59706673d11783091dee reverseproxy: Add valid Upstream to DialInfo in active health checks (#6949)
fixFixes crash if logging error is not HandlerError
fixcaddytls: Fix sni_regexp matcher to obtain layer4 contexts
featurefeat: automatically set GOMEMLIMIT
featurereverse_proxy: re-add healthy upstreams metric
fixfix: update broken link to Ardan Labs
fixfix: fix index validation for PUT requests
breakingremove glog dependency
featureAdd error handling for unrecognized subdirective/options
fixFix TrustedCACerts backwards compatibility
featurerequestbody: Add replace for optional body replacement
fixrequestbody: Fix ContentLength calculation after body replacement
fixFix caddy fmt breaks backquote wrapped braces in template
featurecore: add modular network_proxy support
featureAdd a valid Upstream to the DialInfo when doing active health checks
+64 more items in the release notesother34cff4af7db1365bba6decc647ccfb6bf1b21afd core: Only initiate exit once (should fix #6707)
other50778b55425d378f709599c0d424b0138af592f4 fix: disable h3 for unix domain socket (#6769)
other0e570e0cc717f02cf3800ae741df70cd074c7275 go.mod: Upgrade CertMagic to 0.21.6 (fix ARI handshake maintenance)
othere48b75843b7eff2948b573391fb41535b5e333ef header: match subdirective for response matching (#6765)
other1f927d6b07d52d7cf46f1f3020c1ea5993a3e5e8 log: Only chmod if permission bits differ; make log dir (#6761)
other1bd567d7ad41d5509e2aa60cf36e749f195ad83c reverseproxy: buffer requests for fastcgi by default (#6759)
otherreverse proxy: fastcgi buffer requests for fastcgi by default
fixfix: disable h3 for unix domain socket
otherlog: Only chmod if permission bits differ
otherheader: match subdirective for response matching
securitySecurity
featureb116dcea3d022cd2b060a978c499ac17e5d0a2e1 caddyhttp: Add {?query} placeholder (#6714)
featurec216cf551dcbd2de1da1b9fe8a7e179b76827753 caddyhttp: Allow matching Transfer-Encoding, add to access logs (#6629)
feature09b2cbcf4d839adec91b189fea549d64a69e0595 caddyhttp: Add MatchWithError to replace SetVar hack (#6596)
feature5c8dc344181c49bc7feade4a293bb4eed882b838 caddytls: Allow disabling storage cleaning, avoids writing two files (#6593)
deprecatedd7564d632fbed209e81978c5c2c529a7bf1836f7 caddytls: Drop rate_limit and burst, has been deprecated (#6611)
featured398898b352a6a7e8ac5c24da01dd948fc334d77 cmd: Allow add-package to select version of package (#6665)
feature315715e90ffa25c4ad0d8a96e828dbdf6f638583 core: Implement FastAbs to avoid repeated os.Getwd calls (#6687)
breakingeddbccd298f637c4785c891f5f96dbf103580fa8 fastcgi: remove dir redirection when useless in php_fastcgi (#6698)
featureefd9251ad38a4fd9f7d900445400ac3c8e564c28 fileserver: Add first_exist_fallback strategy for try_files (#6699)
feature290cfea08f2486fb86dbc11eec96d79751180eda fileserver: add a test for precompressed defaults (#6743)
featurecc23ad6402e6dace30b04f0d9113530a4d9541a9 fileserver: Add file_limit option for browse (to be experimental) (#6648)
featureafa778ae05503f563af0d1015cdf7e5e78b1eeec httpcaddyfile: Implement experimental force_automate option (#6712)
featureb183aec83c2d467706583ad9ea0e4e9c56077c55 httpcaddyfile: Implement log sampling config (#6682)
feature1d106fa14d7bc150acb1107ea7d034d669f9f80d metrics: add go and process collectors (#6704)
feature825fe48e0654dc6e4e065df364a51ea79488e44b reverseproxy: Allow 0 as weights for weighted_round_robin (#6681)
feature5823eccf99d9fc6b4ffba8a78acfdb59c4ec0c97 rewrite: Don't add / in Caddyfile, do it after replacer (#6662)
feature669fc41e6321115df554d5f7d8eb55fdfbdaab18 tracing: Add spanID field to access logs and http.vars.span_id placeholder (#6646)
featurecaddyhttp: Add test case to corpus
breakingcmd: remove zealous check of Caddyfile auto-detection
featurelogging: Allow setting log file permissions
featurereverseproxy: add Max-Age option to sticky cookie
breakingfileserver: Remove newline characters from precomputed etags
featurereverseproxy: Add placeholder for host in active health check headers
securitybrowse: add Content-Security-Policy w/ nonce
securitybrowse: fix Content-Security-Policy warnings in Firefox
featurereverseproxy: Add placeholder for networkAddr in active health check headers
featureAdd option to set which HTTP method to use for active health checks
featurereverseproxy: Caddyfile support for health_method
featurereverseproxy: add health_upstream subdirective
featureCaddyfile support for TLS handshake matchers
featureCaddyfile support for TLS connection and certificate selection policies
featurefileserver: add sort options
featurereverseproxy: allow user to define source address
featurereverse_proxy: add placeholder http.reverse_proxy.retries
featurecaddytls: Add sni_regexp matcher
featureperf: use zap's Check() to prevent useless allocs
breakingdoc: remove docs of deprecated directives
featureImplement issue #6296 passing FDs / socket activation
deprecatedcaddytls: Drop rate_limit and burst, has been deprecated
+153 more items in the release notesfix7088605c cmd: fix regression in auto-detect of Caddyfile (#6362)
other01308b4b I'm so tired of typos
othera63767d3 build(deps): bump golangci/golangci-lint-action from 5 to 6 (#6361)
otherf8a2c602 caddyhttp: properly sanitize requests for root path (#6360)
featureb7280e69 caddytls: Implement certmagic.RenewalInfoGetter
fix15faeacb cmd: fix auto-detetction of .caddyfile extension (#6356)
fix40c582ce caddyhttp: Fix merging consecutive client_ip or remote_ip matchers (#6350)
othera52917a3 core: MkdirAll appDataDir in InstanceID with 0o700 (#6340)
breakingZeroSSL (#6229) (this is one overall change, but requires some explanation):
breakingUp to now, Caddy used both Let's Encrypt and ZeroSSL by default to get certificates without any configuration. In 2.8, this is changing slightly. Due to upcoming changes to ZeroSSL accounting policies, ZeroSSL now requires your email address to be able to access their free ACME endpoint.
breakingAs such, Caddy will only implicitly add the ZeroSSL issuer to your config if you provide an email address in your Caddyfile using the email global option. (We have already recommended this for years.) If you already do this, you don't have to make any changes and you'll still get Let's Encrypt and…
breakingIf you use JSON to configure certificate automation policies, you will need to ensure you use the acme issuer with your email filled out, and the ca field set to ZeroSSL's ACME server URL. If you want redundancy with Let's Encrypt, be sure to specify another acme issuer as well (defaults OK, but…
breakingThe zerossl issuer module is no longer ACME-capable and is now exclusively for the ZeroSSL API. An API key from your ZeroSSL account is required. (The ZeroSSL ACME server can still be used with the acme module pointed to ZeroSSL's ACME server. You can provide your account email and/or EAB as…
breakingFaster response times
breakingIP certificates
breakingManagement tools in your ZeroSSL account dashboard
breakingTechnical support
breakingTo clarify, Let's Encrypt is still a default issuer even if you don't provide an email address (but we have always strongly recommended to do so).
breakingYou can still use ZeroSSL's ACME endpoint with your own External Account Binding (EAB) credentials.
breakingSee notes in #6229 for some examples and further explanations.
breakingRemoved support for the lego_deprecated DNS provider module. It has been deprecated for 4 years. Use caddy-dns modules instead; there are over 50 to choose from already. They are more flexible, compile much leaner, and are easier to implement and support. If yours is not supported it can be easily…
breakingOn-demand TLS: The ask option in the JSON has been deprecated in favor of a permission module (Caddyfile unchanged) (#6055), and Caddyfile support for permission modules is added (6a02999)
breakingAdmin API: Etag (used for concurrency control) is now a header, not a trailer. This is less efficient, but still virtually no clients properly implement trailer support.
breakingFor consistency, the basicauth Caddyfile directive has been renamed to basic_auth (#6092), and skip_log has been renamed to log_skip. The old names will continue to work for now, with a deprecation warning in the logs. (#6066).
breakingThe basic_auth handler no longer supports scrypt (deprecated for nearly two years) (#6091)
breakingThe forwarded option has been deprecated for a long time and has now been removed from the remote_ip matcher. Use the client_ip matcher instead. (#6085)
breakingReverse proxy: The buffer_requests, buffer_responses, and max_buffer_size settings have been removed after being deprecated for 14 months. Use request_buffers and response_buffers instead if you need buffering.
breakingGo API: If you called caddy.Context.AppIfConfigured(), it now returns an error, as part of a bug fix. (#6292)
featureacme_server: Configurable allow/deny policies (#5796)
featurehttp: New fs directive can declare a file system plugin to use (#5057)
featurehttp: The log_append handler can add fields to the access logs (#6066)
featurehttp: Add uuid field to access logs when the {http.request.uuid} placeholder is used (#5859)
featurehttp: Changed PROXY protocol libraries add TLV support (#5915)
featurehttp: A new tracing mode writes each individual middleware handler to logs (#6313)
featurereplacer: A new {file.} global placeholder is available, where is a path to a file on disk which contains a value (generally used for secrets) (#5463)
featuretls: New local_ip connection matcher (#6074)
feature931656bd acmeserver: add policy field to define allow/deny rules (#5796)
featuree6f46c8d acmeserver: Add sign_with_root for Caddyfile (#6345)
breaking30d63648 caddyauth: Drop support for scrypt (#6091)
deprecated2fc620d3 caddyhttp: Fix linter warning about deprecation
securitycc0c0cf0 caddyhttp: Security enhancements for client IP parsing (#5805)
breaking654a3bb0 caddyhttp: remove duplicate strings.Count in path matcher (fixes #6233) (#6234)
breaking3609a4af caddytls: Remove shim code supporting deprecated lego-dns (#6231)
breaking1fc151fa caddytls: remove ClientHelloSNICtxKey (#6326)
security9fc55a97 go.mod: CVE-2023-45142 Update opentelemetry (#5908)
deprecatedc27425ef httpcaddyfile: Keep deprecated skip_log in directive order (#6153)
breakingac1f20b9 httpcaddyfile: Remove port from logger names (#5881)
breaking9f97df22 reverseproxy: Remove long-deprecated buffering properties
+200 more items in the release notesfeatureThe templates middleware is now officially extensible (experimentally). This means modules can add custom functions/actions for templates to execute.
otherTLS storage cleaning is now synchronized across the cluster and remembered across restarts. This should greatly lower costs for expensive storage backends like DynamoDB.
otherPlaceholders are now evaluated in config for certificate loaders.
fixNumerous bug fixes.
other65c489a0 Upgrade acmeserver to github.com/go-chi/chi/v5 (#5913)
fixae5e2d96 caddyfile: Fix variadic placeholder false positive when token contains : (#5883)
otherdb55da59 caddyhttp: Adjust scheme placeholder docs (#5910)
otherdf5edf6b caddytls: Context to DecisionFunc (#5923)
other6d9a8337 caddytls: Sync distributed storage cleaning (#5940)
feature11a082c0 cmd: Add newline character to version string in CLI output (#5895)
other979c413f cmd: upgrade: resolve symlink of the executable (#5891)
other64820706 core: Apply SO_REUSEPORT to UDP sockets (#5725)
other15adb893 core: quic listener will manage the underlying socket by itself (#5749)
feature801ec756 fileserver: Add .m4v for browse template icon
securityb809ed71 go.mod: CVE-2023-45142 Update opentelemetry (#5908)
otherb4c7313c go.mod: Upgrade quic-go to v0.39.1
other36fce3fa go.mod: update quic-go version to v0.40.0 (#5922)
fixec2de22a httpcaddyfile: Fix TLS automation policy merging with get_certificate (#5896)
breakingf0ea489d httpcaddyfile: Remove port from logger names (#5881)
other87f63b12 httpredirectlistener: Only set read limit for when request is HTTP (#5917)
feature16834d64 templates: Clarify include args docs, add .ClientIP (#5898)
other0259853a templates: Delete headers on httpError to reset to clean slate (#5905)
other2f7ceb57 templates: Offically make templates extensible (#5939)
other908e9569 tls: accept placeholders in string values of certificate loaders (#5963)
featureUpdated https://github.com/quic-go/quic-go from v0.37.5 to v0.39.0, including many performance improvements. GSO and ECN are now enabled by default, but you may turn them off by setting the QUIC_GO_DISABLE_GSO=true and QUIC_GO_DISABLE_ECN=true environment variables respectively, if they cause you…
featureThe file server's fileserver.BrowseTemplate is now exported, so it may be customized by programs embedding Caddy. (ed8bb13c5df7656647ca7fc1fd09237631a6767c)
featureEnvironment variables loaded with --envfile no longer override existing variables. (#5803)
featureThe encode handler now compresses application/wasm* content types by default. (#5869)
featureThe reverse_proxy handler can now emit very detailed logs for debugging streaming and buffering. To enable it, set the verbose_logs subdirective, and set logging to debug level. Since the logs from this are very noisy, using verbose_logs to opt-in is necessary. We may ask you to enable this when…
featureYou can now check the version with caddy -v, like most other CLI utilities! (#5874)
other0e204b73 admin: Respond with 4xx on non-existing config path (#5870)
other89c407aa build(deps): bump actions/checkout from 3 to 4 (#5846)
other1405683c build(deps): bump goreleaser/goreleaser-action from 4 to 5 (#5847)
other38a7b6b3 caddyfile: Adjust error formatting (#5765)
fix7103ea09 caddyfile: Fix case where heredoc marker is empty after newline (#5769)
other10053f75 caddyfile: Loosen heredoc parsing (#5761)
other58ab3a01 caddyhttp: Use LimitedReader for HTTPRedirectListener (thank you to Bartek Nowotarski for reporting)
fix9c419f1e cmd: Fix exiting with custom status code, add caddy -v (#5874)
otherf2ab7099 cmd: Prevent overwriting existing env vars with --envfile (#5803)
featuree0aaefab encode: Add application/wasm* to the default content types (#5869)
featurefa5a579b fileserver: Add command shortcuts -l and -a (#5854)
othered8bb13c fileserver: Export BrowseTemplate
other130f6d1f fileserver: Set canonical URL on browse template (#5867)
othera306c5f7 fileserver: browse template SVG icons and UI tweaks (#5812)
other0a6d3333 fileserver: docs: clarify the ability to produce JSON array with browse (#5751)
other82c356f2 fix: caddytest.AssertResponseCode error message (#5853)
other888c6d7e go.mod: Update quic-go to v0.38.0 (#5772)
other88b4fbf2 go.mod: Upgrade dependencies incl. x/net/http
otherdf995029 httpcaddyfile: Enable TLS for catch-all site if tls directive is specified (#5808)
other33d8d2c6 httpcaddyfile: Sort TLS SNI matcher for deterministic JSON output (#5860)
other288216e1 httpcaddyfile: Stricter errors for site and upstream address schemes (#5757)
fix2cac3c54 httpcaddyfile: fix placeholder shorthands in named routes (#5791)
otherc46ec3b5 logging: Clone array on log filters, prevent side-effects (#5786)
other1b73e386 logging: query filter for array of strings (#5779)
other4776f62c replacer: change timezone to UTC for "time.now.http" placeholders (#5774)
featurea8586b05 reverseproxy: Add logging for dynamic A upstreams (#5857)
feature3a3182fb reverseproxy: Add more debug logs (#5793)
feature4feac4d8 reverseproxy: Allow fallthrough for response handlers without routes (#5780)
fixe8b8d4a8 reverseproxy: Fix least_conn policy regression (#5862)
fix2a6859a5 reverseproxy: Fix retries on "upstreams unavailable" error (#5841)
fix1e0dea59 reverseproxy: fix nil pointer dereference in AUpstreams.GetUpstreams (#5811)
fixb245ecd3 reverseproxy: fix parsing Caddyfile fails for unlimited request/response buffers (#5828)
feature5653c36b templates: Add dummy RemoteAddr to httpInclude request, proxy compatibility (#5845)
feature289934f3 tls: Add X25519Kyber768Draft00 PQ "curve" behind build tag (#5852)
+1 more item in the release notesother080db938 caddytls: Update docs for on-demand config
otherd8135505 cmd: Require config for caddy validate (fix #5612) (#5614)
othera8492c06 fileserver: Don't repeat error for invalid method inside error context (#5705)
other2d7d806f fileserver: Slightly more fitting icons
otherf11c3c9f go.mod: Upgrade CertMagic and quic-go
other5b9c850a go.mod: Upgrade golang.org/x/net to 0.14.0 (#5718)
feature936ee918 reverseproxy: Always return new upstreams (fix #5736) (#5752)
fix431adc09 templates: Fix httpInclude (fix #5698)
featureThe in-memory TLS certificate cache is no longer purged and recreated during config reloads, making reloads extremely lightweight even when managing thousands of certificates.
featureSignificant HTTP/3 performance improvements (upstream in quic-go) including enabling 0-RTT. Caddy users should notice significantly better throughput for HTTP/3. Thanks for the fantastic work, @marten-seemann!
featureNew default template for the file server's "browse" listings - more modern, easier to use, grid view, filetype-specific icons, and better dark mode (see #5427 for more screenshots and info)
featureThe reverse proxy now supports the PROXY protocol. Using external modules is no longer required; specifically, the plugin by @mastercactapus is now built-in. (#5424)
featureCaddyfile now supports Heredoc syntax for long embedded strings/documents. (#5385)
feature@francislavoie implemented a suite of enhancements to bring you more reliable, trustworthy client IP information, even through proxies and CDNs (#5104)
featureCertificate private keys will no longer be reused when renewing certificates.
featureCaddyfile import arg placeholders support slice syntax, e.g. {args[2:]} (#5249)
featureCustomizable "fallback" policy for reverse proxy in case the primary policy isn't applicable. (#5488)
featureEtags are generated more sensibly for NixOS environments which all have Modified time of 1; and if you set your own Etag, it will not be overwritten.
featureEXPERIMENTAL: New short flags for the CLI. (#5379)
featureEXPERIMENTAL: The reverse proxy may be configured to keep hijacked connections (streams, WebSockets, etc.) open through config reloads. (#5567)
featureEXPERIMENTAL: Define "named routes" to reuse them without copying. Caddyfile snippets are useful for reusing config, but reusing the same HTTP routes involves lots of copied config and memory bloat. Named routes let you define a route once and reuse it throughout your HTTP server without copying.…
featureEXPERIMENTAL: You can specify permissions for unix sockets. (#4741)
featureMany many bug fixes you may or may not notice :upside_down_face:
featurewarning: The ask endpoint is now required to enable On-Demand TLS (b97c76fb4789b8da0b80f5a2c1c1c5bebba163b5) for catch-all or wildcard hosts. Our docs have always mentioned this is required in production environments, but now the code enforces it. The ask endpoint is not required for local-only or…
featurewarning: The on-demand config's throttle options are now deprecated because the 'ask' endpoint is required. Additionally, the 'ask' endpoint is checked and the throttle is applied before storage is queried for a certificate in order to limit load on the storage backend.
featurewarning: The long-deprecated lookup_srv feature of the reverse proxy has been removed. It was replaced with the dynamic upstreams feature in 2.6. (#5396)
featurewarning: The remote_ip forwarded matcher has been deprecated because it assumes trusting downstream proxies. Instead, the client_ip matcher should be used along with trusted_proxies configuration. (#5103 and #5104)
featurewarning: Placeholder syntax {args.0} is now deprecated in favor of {args[0]}.
featurewarning: Plugin authors will now need to use http.ResponseController to call Flush() or Hijack() on the response writer. (#5654)
deprecated3f20a7c9 acmeserver: Configurable resolvers, fix smallstep deprecations (#5500)
feature960150bb caddyfile: Implement heredoc support (#5385)
feature8bc05e59 caddyfile: Implement variadics for import args placeholders (#5249)
feature53b6fab1 caddyfile: Stricter parsing, error for brace on new line (#5505)
featurecfc85ae8 caddyhttp: Add a getter for Server.name (#5531)
featurecbf16f6d caddyhttp: Implement named routes, invoke directive (#5107)
featurea7af7c48 caddytls: Allow on-demand w/o ask for internal-only
featureb301a3df celmatcher: Implement pkix.Name conversion to string (#5492)
feature9e691955 cmd: Expand cobra support, add short flags (#5379)
feature078f130a cmd: Implement storage import/export (#5532)
feature22927e27 core: Add optional unix socket file permissions (#4741)
featuref66493ef core: Allow loopback hosts for admin endpoint (fix #5650) (#5664)
featuref9bd2d3e fileserver: Add color-scheme meta tag (#5475)
feature6cc3cbbc fileserver: New file browse template (#5427)
breaking94d41a9d fileserver: Remove trailing slash on fs filenames (#5417)
feature27bc16ab fileserver: add export-template sub-command to file-server (#5630)
featuree041962b fileserver: add lazy image loading (#5646)
featuree8352aef headers: Add > Caddyfile shortcut for enabling defer (#5535)
breaking4636109c reverseproxy: Remove deprecated lookup_srv (#5396)
+111 more items in the release notesotherDo not use this release, use v2.7.3 instead which contains several hot fixes.
otherDo not use this release; use v2.7.3 instead. It contains a hotfix for a WebSocket issue.
otherDo not use this release, use v2.7.3 instead which contains hot fixes.
otherbuffer_requests
otherbuffer_responses
othermax_buffer_size
otherrequest_buffers
otherresponse_buffers
other0db29e2c go.mod: Upgrade acmez and x/net
other4b119a47 reverseproxy: Don't buffer chunked requests (fix #5366) (#5367)