Caddy 2.7.3 → 2.8.0
4 releases · 27 breaking changes · 3 security fixes · 0 advisories fixed
3security27breaking2deprecated28feature11fix
Breaking changes
- breaking ZeroSSL (#6229) (this is one overall change, but requires some explanation): in 2.8.0
- breaking Up to now, Caddy used both Let's Encrypt and ZeroSSL by default to get certificates without any configuration. In 2.8, this is changing slightly. Due to upcoming changes to ZeroSSL accounting policies, ZeroSSL now requires your email address to be able to access their free ACME endpoint. in 2.8.0
- breaking As such, Caddy will only implicitly add the ZeroSSL issuer to your config if you provide an email address in your Caddyfile using the email global option. (We have already recommended this for years.) If you already do this, you don't have to make any changes and you'll still get Let's Encrypt and… in 2.8.0
- breaking If you use JSON to configure certificate automation policies, you will need to ensure you use the acme issuer with your email filled out, and the ca field set to ZeroSSL's ACME server URL. If you want redundancy with Let's Encrypt, be sure to specify another acme issuer as well (defaults OK, but… in 2.8.0
- breaking The zerossl issuer module is no longer ACME-capable and is now exclusively for the ZeroSSL API. An API key from your ZeroSSL account is required. (The ZeroSSL ACME server can still be used with the acme module pointed to ZeroSSL's ACME server. You can provide your account email and/or EAB as… in 2.8.0
- breaking Faster response times in 2.8.0
- breaking IP certificates in 2.8.0
- breaking Management tools in your ZeroSSL account dashboard in 2.8.0
- breaking Technical support in 2.8.0
- breaking To clarify, Let's Encrypt is still a default issuer even if you don't provide an email address (but we have always strongly recommended to do so). in 2.8.0
- breaking You can still use ZeroSSL's ACME endpoint with your own External Account Binding (EAB) credentials. in 2.8.0
- breaking See notes in #6229 for some examples and further explanations. in 2.8.0
- breaking Removed support for the lego_deprecated DNS provider module. It has been deprecated for 4 years. Use caddy-dns modules instead; there are over 50 to choose from already. They are more flexible, compile much leaner, and are easier to implement and support. If yours is not supported it can be easily… in 2.8.0
- breaking On-demand TLS: The ask option in the JSON has been deprecated in favor of a permission module (Caddyfile unchanged) (#6055), and Caddyfile support for permission modules is added (6a02999) in 2.8.0
- breaking Admin API: Etag (used for concurrency control) is now a header, not a trailer. This is less efficient, but still virtually no clients properly implement trailer support. in 2.8.0
- breaking For consistency, the basicauth Caddyfile directive has been renamed to basic_auth (#6092), and skip_log has been renamed to log_skip. The old names will continue to work for now, with a deprecation warning in the logs. (#6066). in 2.8.0
- breaking The basic_auth handler no longer supports scrypt (deprecated for nearly two years) (#6091) in 2.8.0
- breaking The forwarded option has been deprecated for a long time and has now been removed from the remote_ip matcher. Use the client_ip matcher instead. (#6085) in 2.8.0
- breaking Reverse proxy: The buffer_requests, buffer_responses, and max_buffer_size settings have been removed after being deprecated for 14 months. Use request_buffers and response_buffers instead if you need buffering. in 2.8.0
- breaking Go API: If you called caddy.Context.AppIfConfigured(), it now returns an error, as part of a bug fix. (#6292) in 2.8.0
- breaking 30d63648 caddyauth: Drop support for scrypt (#6091) in 2.8.0
- breaking 654a3bb0 caddyhttp: remove duplicate strings.Count in path matcher (fixes #6233) (#6234) in 2.8.0
- breaking 3609a4af caddytls: Remove shim code supporting deprecated lego-dns (#6231) in 2.8.0
- breaking 1fc151fa caddytls: remove ClientHelloSNICtxKey (#6326) in 2.8.0
- breaking ac1f20b9 httpcaddyfile: Remove port from logger names (#5881) in 2.8.0
- breaking 9f97df22 reverseproxy: Remove long-deprecated buffering properties in 2.8.0
- breaking f0ea489d httpcaddyfile: Remove port from logger names (#5881) in 2.7.6
Security changes
- security cc0c0cf0 caddyhttp: Security enhancements for client IP parsing (#5805) in 2.8.0
- security 9fc55a97 go.mod: CVE-2023-45142 Update opentelemetry (#5908) in 2.8.0
- security b809ed71 go.mod: CVE-2023-45142 Update opentelemetry (#5908) in 2.7.6
Deprecations
- deprecated 2fc620d3 caddyhttp: Fix linter warning about deprecation in 2.8.0
- deprecated c27425ef httpcaddyfile: Keep deprecated skip_log in directive order (#6153) in 2.8.0
Every release in between
breakingZeroSSL (#6229) (this is one overall change, but requires some explanation):
breakingUp to now, Caddy used both Let's Encrypt and ZeroSSL by default to get certificates without any configuration. In 2.8, this is changing slightly. Due to upcoming changes to ZeroSSL accounting policies, ZeroSSL now requires your email address to be able to access their free ACME endpoint.
breakingAs such, Caddy will only implicitly add the ZeroSSL issuer to your config if you provide an email address in your Caddyfile using the email global option. (We have already recommended this for years.) If you already do this, you don't have to make any changes and you'll still get Let's Encrypt and…
breakingIf you use JSON to configure certificate automation policies, you will need to ensure you use the acme issuer with your email filled out, and the ca field set to ZeroSSL's ACME server URL. If you want redundancy with Let's Encrypt, be sure to specify another acme issuer as well (defaults OK, but…
breakingThe zerossl issuer module is no longer ACME-capable and is now exclusively for the ZeroSSL API. An API key from your ZeroSSL account is required. (The ZeroSSL ACME server can still be used with the acme module pointed to ZeroSSL's ACME server. You can provide your account email and/or EAB as…
breakingFaster response times
breakingIP certificates
breakingManagement tools in your ZeroSSL account dashboard
breakingTechnical support
breakingTo clarify, Let's Encrypt is still a default issuer even if you don't provide an email address (but we have always strongly recommended to do so).
breakingYou can still use ZeroSSL's ACME endpoint with your own External Account Binding (EAB) credentials.
breakingSee notes in #6229 for some examples and further explanations.
breakingRemoved support for the lego_deprecated DNS provider module. It has been deprecated for 4 years. Use caddy-dns modules instead; there are over 50 to choose from already. They are more flexible, compile much leaner, and are easier to implement and support. If yours is not supported it can be easily…
breakingOn-demand TLS: The ask option in the JSON has been deprecated in favor of a permission module (Caddyfile unchanged) (#6055), and Caddyfile support for permission modules is added (6a02999)
breakingAdmin API: Etag (used for concurrency control) is now a header, not a trailer. This is less efficient, but still virtually no clients properly implement trailer support.
breakingFor consistency, the basicauth Caddyfile directive has been renamed to basic_auth (#6092), and skip_log has been renamed to log_skip. The old names will continue to work for now, with a deprecation warning in the logs. (#6066).
breakingThe basic_auth handler no longer supports scrypt (deprecated for nearly two years) (#6091)
breakingThe forwarded option has been deprecated for a long time and has now been removed from the remote_ip matcher. Use the client_ip matcher instead. (#6085)
breakingReverse proxy: The buffer_requests, buffer_responses, and max_buffer_size settings have been removed after being deprecated for 14 months. Use request_buffers and response_buffers instead if you need buffering.
breakingGo API: If you called caddy.Context.AppIfConfigured(), it now returns an error, as part of a bug fix. (#6292)
featureacme_server: Configurable allow/deny policies (#5796)
featurehttp: New fs directive can declare a file system plugin to use (#5057)
featurehttp: The log_append handler can add fields to the access logs (#6066)
featurehttp: Add uuid field to access logs when the {http.request.uuid} placeholder is used (#5859)
featurehttp: Changed PROXY protocol libraries add TLV support (#5915)
featurehttp: A new tracing mode writes each individual middleware handler to logs (#6313)
featurereplacer: A new {file.} global placeholder is available, where is a path to a file on disk which contains a value (generally used for secrets) (#5463)
featuretls: New local_ip connection matcher (#6074)
feature931656bd acmeserver: add policy field to define allow/deny rules (#5796)
featuree6f46c8d acmeserver: Add sign_with_root for Caddyfile (#6345)
breaking30d63648 caddyauth: Drop support for scrypt (#6091)
deprecated2fc620d3 caddyhttp: Fix linter warning about deprecation
securitycc0c0cf0 caddyhttp: Security enhancements for client IP parsing (#5805)
breaking654a3bb0 caddyhttp: remove duplicate strings.Count in path matcher (fixes #6233) (#6234)
breaking3609a4af caddytls: Remove shim code supporting deprecated lego-dns (#6231)
breaking1fc151fa caddytls: remove ClientHelloSNICtxKey (#6326)
security9fc55a97 go.mod: CVE-2023-45142 Update opentelemetry (#5908)
deprecatedc27425ef httpcaddyfile: Keep deprecated skip_log in directive order (#6153)
breakingac1f20b9 httpcaddyfile: Remove port from logger names (#5881)
breaking9f97df22 reverseproxy: Remove long-deprecated buffering properties
+200 more items in the release notesfeatureThe templates middleware is now officially extensible (experimentally). This means modules can add custom functions/actions for templates to execute.
otherTLS storage cleaning is now synchronized across the cluster and remembered across restarts. This should greatly lower costs for expensive storage backends like DynamoDB.
otherPlaceholders are now evaluated in config for certificate loaders.
fixNumerous bug fixes.
other65c489a0 Upgrade acmeserver to github.com/go-chi/chi/v5 (#5913)
fixae5e2d96 caddyfile: Fix variadic placeholder false positive when token contains : (#5883)
otherdb55da59 caddyhttp: Adjust scheme placeholder docs (#5910)
otherdf5edf6b caddytls: Context to DecisionFunc (#5923)
other6d9a8337 caddytls: Sync distributed storage cleaning (#5940)
feature11a082c0 cmd: Add newline character to version string in CLI output (#5895)
other979c413f cmd: upgrade: resolve symlink of the executable (#5891)
other64820706 core: Apply SO_REUSEPORT to UDP sockets (#5725)
other15adb893 core: quic listener will manage the underlying socket by itself (#5749)
feature801ec756 fileserver: Add .m4v for browse template icon
securityb809ed71 go.mod: CVE-2023-45142 Update opentelemetry (#5908)
otherb4c7313c go.mod: Upgrade quic-go to v0.39.1
other36fce3fa go.mod: update quic-go version to v0.40.0 (#5922)
fixec2de22a httpcaddyfile: Fix TLS automation policy merging with get_certificate (#5896)
breakingf0ea489d httpcaddyfile: Remove port from logger names (#5881)
other87f63b12 httpredirectlistener: Only set read limit for when request is HTTP (#5917)
feature16834d64 templates: Clarify include args docs, add .ClientIP (#5898)
other0259853a templates: Delete headers on httpError to reset to clean slate (#5905)
other2f7ceb57 templates: Offically make templates extensible (#5939)
other908e9569 tls: accept placeholders in string values of certificate loaders (#5963)
featureUpdated https://github.com/quic-go/quic-go from v0.37.5 to v0.39.0, including many performance improvements. GSO and ECN are now enabled by default, but you may turn them off by setting the QUIC_GO_DISABLE_GSO=true and QUIC_GO_DISABLE_ECN=true environment variables respectively, if they cause you…
featureThe file server's fileserver.BrowseTemplate is now exported, so it may be customized by programs embedding Caddy. (ed8bb13c5df7656647ca7fc1fd09237631a6767c)
featureEnvironment variables loaded with --envfile no longer override existing variables. (#5803)
featureThe encode handler now compresses application/wasm* content types by default. (#5869)
featureThe reverse_proxy handler can now emit very detailed logs for debugging streaming and buffering. To enable it, set the verbose_logs subdirective, and set logging to debug level. Since the logs from this are very noisy, using verbose_logs to opt-in is necessary. We may ask you to enable this when…
featureYou can now check the version with caddy -v, like most other CLI utilities! (#5874)
other0e204b73 admin: Respond with 4xx on non-existing config path (#5870)
other89c407aa build(deps): bump actions/checkout from 3 to 4 (#5846)
other1405683c build(deps): bump goreleaser/goreleaser-action from 4 to 5 (#5847)
other38a7b6b3 caddyfile: Adjust error formatting (#5765)
fix7103ea09 caddyfile: Fix case where heredoc marker is empty after newline (#5769)
other10053f75 caddyfile: Loosen heredoc parsing (#5761)
other58ab3a01 caddyhttp: Use LimitedReader for HTTPRedirectListener (thank you to Bartek Nowotarski for reporting)
fix9c419f1e cmd: Fix exiting with custom status code, add caddy -v (#5874)
otherf2ab7099 cmd: Prevent overwriting existing env vars with --envfile (#5803)
featuree0aaefab encode: Add application/wasm* to the default content types (#5869)
featurefa5a579b fileserver: Add command shortcuts -l and -a (#5854)
othered8bb13c fileserver: Export BrowseTemplate
other130f6d1f fileserver: Set canonical URL on browse template (#5867)
othera306c5f7 fileserver: browse template SVG icons and UI tweaks (#5812)
other0a6d3333 fileserver: docs: clarify the ability to produce JSON array with browse (#5751)
other82c356f2 fix: caddytest.AssertResponseCode error message (#5853)
other888c6d7e go.mod: Update quic-go to v0.38.0 (#5772)
other88b4fbf2 go.mod: Upgrade dependencies incl. x/net/http
otherdf995029 httpcaddyfile: Enable TLS for catch-all site if tls directive is specified (#5808)
other33d8d2c6 httpcaddyfile: Sort TLS SNI matcher for deterministic JSON output (#5860)
other288216e1 httpcaddyfile: Stricter errors for site and upstream address schemes (#5757)
fix2cac3c54 httpcaddyfile: fix placeholder shorthands in named routes (#5791)
otherc46ec3b5 logging: Clone array on log filters, prevent side-effects (#5786)
other1b73e386 logging: query filter for array of strings (#5779)
other4776f62c replacer: change timezone to UTC for "time.now.http" placeholders (#5774)
featurea8586b05 reverseproxy: Add logging for dynamic A upstreams (#5857)
feature3a3182fb reverseproxy: Add more debug logs (#5793)
feature4feac4d8 reverseproxy: Allow fallthrough for response handlers without routes (#5780)
fixe8b8d4a8 reverseproxy: Fix least_conn policy regression (#5862)
fix2a6859a5 reverseproxy: Fix retries on "upstreams unavailable" error (#5841)
fix1e0dea59 reverseproxy: fix nil pointer dereference in AUpstreams.GetUpstreams (#5811)
fixb245ecd3 reverseproxy: fix parsing Caddyfile fails for unlimited request/response buffers (#5828)
feature5653c36b templates: Add dummy RemoteAddr to httpInclude request, proxy compatibility (#5845)
feature289934f3 tls: Add X25519Kyber768Draft00 PQ "curve" behind build tag (#5852)
+1 more item in the release notesother080db938 caddytls: Update docs for on-demand config
otherd8135505 cmd: Require config for caddy validate (fix #5612) (#5614)
othera8492c06 fileserver: Don't repeat error for invalid method inside error context (#5705)
other2d7d806f fileserver: Slightly more fitting icons
otherf11c3c9f go.mod: Upgrade CertMagic and quic-go
other5b9c850a go.mod: Upgrade golang.org/x/net to 0.14.0 (#5718)
feature936ee918 reverseproxy: Always return new upstreams (fix #5736) (#5752)
fix431adc09 templates: Fix httpInclude (fix #5698)