container/link-validator
Archived
1
0
Fork 0
Code Issues Pull Requests Releases 35 Activity

chore(deps): update dependency caddyserver/caddy to v2.6.2 #89

Merged
xoxys merged 1 commits from renovate/caddyserver-caddy-2.x into main 2022-10-13 19:33:35 +00:00
Conversation 0 Commits 1 Files Changed 1 +1 -1
renovator commented 2022-09-20 21:03:27 +00:00
Member
Copy Link

This PR contains the following updates:

Package Update Change
caddyserver/caddy minor v2.5.2 -> v2.6.2

Release Notes

caddyserver/caddy

v2.6.2

Compare Source

This release brings a number of bug fixes and minor enhancements. All users should upgrade after testing and verifying their setups. Thank you to all who contributed!

If you are coming from < 2.6, please see the 2.6 release notes because a lot is new!

Changelog

New Contributors

Full Changelog: https://github.com/caddyserver/caddy/compare/v2.6.1...v2.6.2

v2.6.1

Compare Source

Hotfix for unix sockets, the encode handler, and the caddy file-server command. Please see the release notes for v2.6.0 for other important information if you're coming from < 2.6!

Changelog

  • 1426c97 core: Reuse unix sockets (UDS) and don't try to serve HTTP/3 over UDS (#​5063)
  • 44ad0ce encode: don't WriteHeader unless called (#​5060)
  • beb7dcb fileserver: Reinstate --debug flag

v2.6.0

Compare Source

Caddy 2.6

This is our biggest release since Caddy 2.

Caddy 2 changed the way the world serves the Web. By providing an online config API, automatic HTTPS, unlimited extensibility, certificate automation at scale, modern protocols, sane defaults, and an unrivaled developer experience, we boldly raised the bar for web servers.

Now with Caddy 2.6, we're doing it again. Caddy 2.6 is the first general-purpose web server to seamlessly enable the newly-standardized HTTP/3 protocol for all configurations by default. We've virtualized the file system so you can serve content from anywhere or anything. New event features let you observe and control Caddy's internals with custom actions. Caddy is more useful than ever for developers with its enhanced CLI tooling and features. And it's faster than ever with non-trivial performance improvements. We think you will love this release.

UPDATE: Please use v2.6.1 for hotfixes related to unix sockets, encode, and caddy file-server.

Watch the livestream

Special dedication

This release is dedicated to the late Peter Eckersley, who passed away September 2, 2022. Peter is one of the brilliant minds behind Let's Encrypt; his work has benefited billions of people. I met Peter at the Let's Encrypt launch party in a little bar in San Francisco in 2015 and have never forgotten that occasion. He later co-authored a published research paper called Let’s Encrypt: An Automated Certificate Authority to Encrypt the Entire Web, which highly espoused Caddy's ACME integration: "We hope to see other popular server software follow Caddy’s lead."

We look forward to when other servers do that, and we hope to honor Peter's work and influence which will live on through his memory and the encrypted Web he made possible.

Sponsors

ZeroSSL remains Caddy's executive sponsor.

We were thrilled to welcome Stripe recently as an enterprise sponsor!

Other notable sponsors include AppCove, Dukaan, Suborbital, Tailscale, plus Bubble and GitHub which both made generous one-time donations.

We have many other vital sponsors and donors on which we also rely. Our sponsors come from all over the world and include independent professionals, startups, and small companies -- and they are the absolute best. Thank you for making a more secure Web possible!

Personal note from Matt: Recent life upgrades mean that your sponsorships now sustain a family of 5 so that I can continue to maintain Caddy. Two years ago, I don't think I would have taken this risk because I'd need to find other work to provide for a family. Thank you for coming together as a professional community to make the Caddy project possible!

We strongly recommend that companies who -- or companies whose customers -- use or benefit from Caddy become a sponsor to ensure ongoing maintenance, priority development, private support, and more. Sponsorship tiers can be tailored to your requirements!

Highlights

⚠️ Don't miss deprecations / breaking changes at the bottom. Notably, if you use metrics, you will now need to turn them on.

HTTP/3 is here (#​4707)

Caddy now enables RFC 9114-compliant HTTP/3 by default. The experimental_http3 option has graduated and been removed. We've removed another experimental option, allow_h2c, and individual HTTP versions (h1 h2 h2c h3) can now be toggled with the new protocols setting.

Note that HTTP/3 utilizes the QUIC transport, which requires UDP. If your network or firewall configuration only allows TCP, HTTP/3 connections will fail and clients (should) fall back to HTTP/2. For servers with properly-configured UDP networks, HTTP/3 should "just work" for enabled clients.

HTTP/3 clients can connect by reading Caddy's Alt-Svc header to know how to connect to Caddy via UDP. This header is now emitted automatically and by default. Other than that, there are no other changes needed to existing servers, as Caddy opens a separate UDP socket for HTTP/3.

Our HTTP/3 server attempts to mitigate amplification and reflection attacks by requiring address validation when the server is under load. This adds one round-trip for clients, but is only done as a defensive measure when necessary.

Serious thanks to @​marten-seemann who builds and maintains the quic-go library we depend on for this. (Go has not announced any plans to officially support or implement HTTP/3.) We expect numerous QUIC and HTTP/3 improvements to come as implementations and best practices mature with more production experience.

Virtual file systems (#​4909)

Caddy's file_server module now supports virtual file systems. We've replaced all hard-coded os.Open(), os.Stat(), etc. calls with Go's relatively new io/fs package, and introduced a new Caddy module namespace caddy.fs for implementations of such file systems.

Some examples of what is possible:

  • Serve content from S3 or other blob/cloud storage services
  • Serve dynamically-generated content that "feels" static
  • Embed your site directly into your caddy binary and serve it from memory
  • Serve content directly from an archive file (e.g. .zip or .tar.gz)
  • Load files from a database instead of disk

Basically, instead of serving files from the local disk, you can have Caddy serve the "files" from somewhere or something else. The default is still the local file system.

Note that this feature isn't limited to just Caddy's file_server module. Potentially any module that reads the local disk may benefit from using caddy.fs modules instead.

I wrote a module that lets you embed your site within your caddy binary -- wherever your server goes, your site goes!

We encourage the community to implement and publish new file system modules for Caddy. (From an early tweet there seems to be quite high demand.)

Events (#​4912 and #​4984)

Not surprisingly, many people prefer Caddy to automate certificates used with other software/services. Until now, there hasn't been a great way to know when Caddy has obtained or renewed a certificate (deferred in part by our opinion that certificate management should be baked into the software using the certificate in the first place). Cron jobs generally work for reloading new certificates into services because certificate expiry is mostly predictable, but now there is a better way with one of our most requested features: events!

We thought about events in general for a long time and discussed questions like, "What makes an event different from a log?" "Are events synchronous?" "Do self-initiated events get emitted before or after their code (are they past-tense or future-tense) -- or both? or neither (asynchronous)?" "What do we like from existing event systems?" "What do we wish event systems did differently?"

While we think we have pretty good answers to these questions now, we won't be sure until we gather more production experience. For this reason, events are implemented as an experimental app module -- not as part of the core. (Remember, Caddy's core currently only loads config and sets up logging/storage.) This means that Caddy's core cannot emit events.[^1] So even though our event implementation may change, it is likely to be only slight and gradual changes; and we encourage anyone and everyone to start using events as soon as possible and to give us your feedback. We think we have the start of a great event system, but we need you to prove it!

Caddy modules can emit events when interesting things happen. For example, the reverse proxy emits healthy and unhealthy events when backends go up and down. The TLS app emits cert_obtaining, cert_obtained, and cert_failed before and after obtaining a certificate or after the operation failed, respectively; and cert_ocsp_revoked after a certificate is discovered to be revoked by OCSP. There are several more events already, with even more to be added later.

Events can have data associated with them. For example, healthy/unhealthy come with the address of the host; cert_obtained has the domain name, issuer, and storage path. You can access this from config in placeholders, e.g. {event.data.identifier}.

Caddy modules can subscribe to events by specifying the name(s) of events to bind to, and the Caddy module ID(s) or namespace(s) to watch. When an event is emitted, it propagates from the module that emitted it up the provisioning heirarchy. This means that an event emitted by http.handlers.reverse_proxy will fire for http.handlers and http as well, similar to the DOM in HTML/JavaScript.

Event handlers are invoked synchronously. We chose this for several reasons. First, despite how easy Go makes concurrency, there are many subtleties to concurrency in a server. Goroutines may be lightweight, but their operations might not be; and if event goroutines are starting more quickly than they are stopping, we either drop events arbitrarily or run out of memory/CPU. Also, we think one of the qualities that differentiates events from logs is the ability for an event to influence the emitting code's flow: a true "hook" in that sense. Instead of simply observing that something is happening (which is what a log tells you), you can influence its behavior. Maybe you want to run a command before a certificate is obtained to see if it should be obtained. Or maybe you want to change how a TLS handshake is completed on-the-fly. Asynchronous event handlers cannot do this. For simple behavioral changes, synchronous events can be a powerful and useful tool for customizing your server.

The new event app lets you easily configure subscriptions and event handlers. Event handling is modular, so you will need to plug in a module that does what you want: run a command, reload a service, make an HTTP request, or anything else!

Because this feature is experimental and new, we don't yet know how people will be using it, so currently, Caddy does not ship with any event handler plugins. However, we're pretty sure based on feedback over the years that many of you would like to run commands on certain events (one of our top feature requests is to trigger a daemon reload after certificate renewals). So I went ahead and implemented an exec event handler plugin that can run commands. We almost included it in Caddy's standard distribution, but out of an abundance of caution we decided to keep it a separate plugin for now until we learn more about real production use cases from experience.

Here's an example of handling events. In JSON, you configure the events app:

{
	"apps": {
		"events": {
			"subscriptions": [
				{
					"events": ["cert_obtained"],
					"handlers": [
						{
							"handler": "exec",
							"command": "systemctl",
							"args": ["reload", "mydaemon"]
						}
					]
				}
			]
		}
	}
}

or the equivalent Caddyfile global option:

{
	events {
		on cert_obtained exec systemctl reload mydaemon
	}
}

It's that simple! Just make sure you have your event handler modules plugged in.

We hope you will provide feedback, report bugs, and request features related to events.

^1]: Compilation fails with an import cycle. If Caddy core uses any feature of Caddy, it must also be in the core or another package not imported by any modules!

##### Smarter path matching and rewriting ([#&#8203;4948](https://github.com/caddyserver/caddy/issues/4948))

Is the URI path `/a/b/c` the same as `/a/b%2Fc`? What about `/a/b//c`? Turns out, *it depends.* What these questions illustrate is a famously frustrating problem, and has largely gone unsolved until now. All existing solutions I investigated in other products were unsatisfactory:

-   Nginx (and Caddy until now) always does path comparisons in unescaped/normalized space. This makes it impossible to route on literal escape sequences unless you double-encode your pattern, which violates specification.
-   Apache outright rejects valid\[^2] HTTP requests containing encoded slashes. This behavior can either be disabled completely (creating a security problem known as unsafe paths) or tweaked to never decode encoded slashes (creating ambiguities when comparing against route patterns).
-   Laravel, like nginx, always decodes slashes, but routing such requests [mangles application data](https://github.com/laravel/framework/issues/22125) that contains slashes.

The process of decoding a URI and collapsing slashes in the path is called normalization. Normalization has to occur for safe, reliable routing (imagine `//secret` bypassing auth checks configured for `/secret`), but at the same time, raw paths are sometimes needed to preserve application data (imagine a route `/bands/:name` which succeeds for `/bands/AC&2fDC` but fails for the normalized `/bands/AC/DC`). And it's not just routing; servers like Caddy often rewrite/manipulate paths. Because normalizing URIs creates a Many:1 mapping (there are multiple encoded forms of a single URI), normalizing is inherently lossy: the original input cannot be recovered with certainty, so we can't reconstruct the original or intended URI with complete fidelity.

Other solutions with coarse on-off knobs can't balance both security and application correctness: it seems you have to trade one for the other. The crux of the problem seems to be that the server/framework/router doesn't know which parts of the path are application data and which parts are path components, so it just "plays it safe" and decodes the whole thing.

I think Caddy's solution to this is quite novel. **Our solution is to interpret encoded characters and multiple slashes in a path pattern literally as a hint of the developer's intent.**

For example, if you write a path matcher `/a/b/c`, it will still match `/a/b/c` and `/a/b%2Fc`. However, if your path matcher is `/a/b%2Fc`, Caddy will *only* match `/a/b%2Fc`. This extends to wildcards with our new "escape-wildcard" feature: `/bands/%*/` will match `/bands/AC%2fDC` but `/bands/*/` won't. This works for multiple slashes too. If your path matcher uses `//`, Caddy will require the request path to contain those slashes literally at that position.

We've also implemented this for prefix and suffix manipulations. For example, if you wanted to strip a prefix of `//prefix` from `//prefix/foo`, it will now work, whereas before it wouldn't because it would look at a fully-normalized URI.

Essentially, we use the configured path pattern as a cue for whether to decode/merge a character or leave it raw when normalizing.

This is a complex and subtle change, so please be sure to read the full PR in [#&#8203;4948](https://github.com/caddyserver/caddy/issues/4948) and the linked Laravel issue. It's very informative!

\[^2]: The "validity" of such a URI based on spec compliance is debatable. RFC 9110 says, "distinct resources SHOULD NOT be identified by HTTP URIs that are equivalent after normalization."

##### HTTP 103 Early Hints ([#&#8203;4882](https://github.com/caddyserver/caddy/issues/4882) and [#&#8203;5006](https://github.com/caddyserver/caddy/issues/5006))

HTTP Early Hints ([RFC 8297](https://datatracker.ietf.org/doc/rfc8297/)) is the effective successor to HTTP/2 Server Push. When 103 is emitted with relevant Link headers, web pages will load faster than normal. 1xx responses are precursors to the final response; clients must be able to support receiving multiple responses to a single request (nearly all modern clients do; and it almost certainly shouldn't break any HTTP/2 clients). Early hints are a great way to speed up page loads where the main content may take a while to generate (a slow DB query, for example) but the subresources can start being loaded right away. In those cases it is often beneficial to send early hints.

Caddy can both originate and proxy 103 responses.

To send early hints from Caddy, simply set the `Link` headers as the hints, then write the response with a 103 status code:

    route /slow-pages/* {
    	header  +Link "</style.css>; rel=preload; as=style"
    	header  +Link "</script.js>; rel=preload; as=script"
    	respond 103
    }

Unlike normal responses, after writing HTTP 103, Caddy's middleware chain will *continue* to execute and invoke the next handlers (for example, `reverse_proxy`) since 103 is not the final response. Multiple 103s can be sent.

Caddy's reverse proxy also supports HTTP 103 responses, meaning that backends can send early hints and Caddy will proxy them to the client immediately as you'd expect.,

Note that browser support is still limited (only Chrome implements it at this time) and Caddy must be built with Go 1.19 (our builds use the latest Go version; but we still support Go 1.18 for now).

Thank you to [@&#8203;dunglas](https://github.com/dunglas) with API Platform for contributing this feature to both Go and Caddy!

##### Improved command line interface ([#&#8203;4565](https://github.com/caddyserver/caddy/issues/4565) and [#&#8203;4994](https://github.com/caddyserver/caddy/issues/4994))

Caddy has always used Go's standard `flag` package for its CLI, which has served us quite well. However, recent improvements in the [Cobra](https://github.com/spf13/cobra) library make it possible for our CLI to gain worthwhile features without incurring a heavy dependency.

The new `caddy manpage` command generates man pages, and the `caddy completion` command generates shell completions. Both are installed automatically as part of our official Linux packages, so your next `apt upgrade` (etc.) should take care of that. Additionally, short options (e.g. `-c`) are now supported. And if you typo a command, Caddy will helpfully suggest a correction (e.g. `caddy adpt` will suggest `caddy adapt`).

Note that long-form flags must now use double-hyphen syntax (e.g. `--config`) even though the single-hyphen syntax (`-config`) was previously accepted. The standard library's flag parser treats `-` and `--` the same, but Cobra's does not. Our online documentation has always used `--` for flags, so we do not consider this a breaking change, but it's good to be aware of this change if you're used to how Go's parser works.

Very many thanks to [@&#8203;mohammed90](https://github.com/mohammed90) for contributing these features!

##### New `caddy respond` command ([#&#8203;4870](https://github.com/caddyserver/caddy/issues/4870))

For rapid development needing a local HTTP server, the [`caddy respond` command](https://caddyserver.com/docs/command-line#caddy-respond) might be just what you need: hard-coded HTTP responses for one or more servers so that you can effortlessly have a custom HTTP endpoint to test with.

A plain `caddy respond` command will listen on a random port and reply with HTTP 200. (The port or address is printed to the terminal for you.)

You can set a custom status code like `caddy respond 401` or a custom body like `caddy respond "Hello world!"` -- or both: `caddy respond --status 401 "Hello world!"`

Or you can pipe in a response body, for example serving a maintenance page:

```bash
$ cat maintenance.html | caddy respond --status 503 --header "Content-Type: text/html; charset=utf-8"
```

You can even spin up multiple servers at once and use basic template features to configure each server with a different response:

```bash
$ echo "I'm server {{.N}} on port {{.Port}}" | caddy respond --listen :2000-2004

Server address: [::]:2000
Server address: [::]:2001
Server address: [::]:2002
Server address: [::]:2003
Server address: [::]:2004

$ curl 127.0.0.1:2002
I'm server 2 on port 2002
```

You can debug HTTP clients easier by enabling access logging with the `--access-log` flag. The `--header` flag can be used multiple times to set custom HTTP headers, and `--debug` enables debug mode for more verbose logging. We hope you find this feature useful!

##### Multiple dynamic upstream sources ([`5fb5b81`](https://github.com/caddyserver/caddy/commit/5fb5b81))

In Caddy 2.5(.1) we introduced dynamic upstreams, which allow you to configure the `reverse_proxy` to get the list of backends on-the-fly during requests. This very popular feature's development was sponsored by Stripe, who we are thrilled to welcome as an enterprise sponsor. Stripe uses Caddy heavily for their internal systems, and for greater redundancy they need to be able to fail over to secondary upstreams if a primary cluster is down.

This is where the new `multi` dynamic upstreams module comes in. Now you can configure, for example, two SRV lookups for aggregated results:

```json
{
	"handler": "reverse_proxy",
	"dynamic_upstreams": {
		"source": "multi",
		"sources": [
			{
				"source": "srv",
				"name": "primary"
			},
			{
				"source": "srv",
				"name": "secondary"
			}
		]
	}
}
```

This appends the backends returned from the secondary SRV lookup to the results of the primary SRV lookup (order preserved). To implement failover, simply use the `first` load balancing policy which chooses the first available upstream.

##### Configurable shutdown delay ([#&#8203;4906](https://github.com/caddyserver/caddy/issues/4906))

A shutdown can now be scheduled for a later time using the `shutdown_delay` option. This is useful for giving advance notice to health checkers that this server will be closing soon. The shutdown delay happens *before* the grace period where new connections are no longer accepted and existing ones are gracefully closed. During the shutdown delay, the server operates normally with the exception of the value of two placeholders. During the delay:

-   `{http.shutting_down}` placeholder equals `true`.
-   `{http.time_until_shutdown}` returns the duration that remains until server close.

This allows health check endpoints to announce that they will soon be going down so that this instance can be moved out of the rotation or a replacement instance can be spun up in the meantime. For example:

    {
    	shutdown_delay 10s
    }

    example.com {
    	handle /health-check {
    		@&#8203;goingDown `{http.shutting_down}`
    		respond @&#8203;goingDown "Bye-bye in {http.time_until_shutdown}" 503
    		respond 200
    	}
    }

By the way, the syntax of that `@goingDown` named matcher is new in 2.6: if a named matcher consists only of a CEL expression string, the type of matcher can be omitted; i.e. what you see above is equivalent to `@goingDown expression "{http.shutting_down} == true"`.

(A shutdown is defined as a config unload where there is no new config to load, or the new config does not have a server configured at the same address as the current server. In other words, a shutdown of a server means a particular HTTP socket will be closed.)

Speaking of grace periods, config changes no longer block while waiting on servers' grace periods. This means faster, more responsive config reloads; just beware that, depending on the length of your grace period, your reload command or config API request may return before the old servers have completely finished shutting down.

##### Faster FastCGI transport ([#&#8203;4978](https://github.com/caddyserver/caddy/issues/4978))

PHP apps, rejoice! The round-trip between Caddy and php-fpm just got a lot faster. Thanks to contributions by [@&#8203;WeidiDeng](https://github.com/WeidiDeng), the FastCGI transport has been rewritten to be more efficient.

This is some of the oldest and most unique code in Caddy's code base. When Caddy was rewritten for v2 in 2019, *everything* was rewritten or refactored... except this, the FastCGI transport. This is the first time this part of the code has been improved since it was first implemented\[^3] in 2014!

During tests, profiling showed the new code spends 86% less CPU time in GC (`gcDrain`) thanks to significantly fewer allocations. This is largely in part due to pooling buffers, which required a non-trivial refactoring to implement.

![CPU profile](https://user-images.githubusercontent.com/1128849/188224782-572c877d-42ea-4241-927f-346000512a75.png)

A very rough benchmark using `php_info()` yielded a 25% increase in requests per second. Before the rewrite, Caddy almost always performed worse than nginx even with `fastcgi_keep_conn off`. Our new code performs competitively with nginx, and in some tests Caddy even outperformed nginx with `fastcgi_keep_conn on` -- and we have not implemented connection pooling/reuse into the new transport yet.

Because every setup is different, your actual results will vary. In general though, you can expect busy servers to handle PHP faster.

\[^3]: I didn't know how to write a FastCGI client back then (I'm still too scared to do much with it myself); Go's standard library implements only the responder role, not the web server (client). Fortunately there was a [random repository on BitBucket](http://bitbucket.org/PinIdea/fcgi_client) that was forked from [a random repository on Google Code written in 2012](https://code.google.com/archive/p/go-fastcgi-client/) that modified the Go std lib's `fcgi` package. It was rough around the edges, but with a little TLC we got it to do what we needed. The copyright had the name Junqing Tan in it, which we still retain in our source code to this day.

##### Faster file server ([#&#8203;5022](https://github.com/caddyserver/caddy/issues/5022))

In a patch contributed by [@&#8203;flga](https://github.com/flga), we've reduced copying between buffers and even eliminated it altogether in some cases using [`sendfile(2)`](https://man7.org/linux/man-pages/man2/sendfile.2.html). This has shown to have a 25-50% performance boost. It's automatic and no configuration is required to benefit. In [some tests](https://blog.tjll.net/reverse-proxy-hot-dog-eating-contest-caddy-vs-nginx/), Caddy's new defaults are even faster than optimized nginx.

Static files over 512 bytes being served over plaintext HTTP sockets may now be served directly by the Linux kernel, which is much faster than copying the file to user-space.

Static files are faster over HTTPS, too. In addition to sendfile (which we can't\[^4] use over TLS), we now utilize the `io.ReaderFrom` interface to reuse existing buffers and further reduce copying within user space. Our tests show that this significantly enhances performance even over TLS.

\[^4]: This is possible with kTLS, but [the Go standard library doesn't support it](https://github.com/golang/go/issues/44506) and it's [a bit tedious](https://words.filippo.io/playing-with-kernel-tls-in-linux-4-13-and-go/) to make it work, although [@&#8203;FiloSottile](https://github.com/FiloSottile) was successful with his [spike code](https://github.com/FiloSottile/go/commit/dbed9972d9947eb0001e9f5b639e0df05acec8bd).

##### Signed release assets

Thanks to heroic efforts by [@&#8203;mohammed90](https://github.com/mohammed90), our [GitHub release](https://github.com/caddyserver/caddy/releases) assets are now signed and certified. Mohammed [wrote an excellent Twitter thread](https://twitter.com/MohammedSahaf/status/1572022375247663105) explaining the whole thing better than I can here!

So if you're wondering why the number of assets shot from 28 to 134... that's why.

## Other notable enhancements

-   More efficient `query` matcher. ([`04a14ee`](https://github.com/caddyserver/caddy/commit/04a14ee37ac6192d734518fa9082d6eb93971bc6))
-   A new Caddyfile placeholder `{cookie.*}` grants easy access to cookie values. ([#&#8203;5001](https://github.com/caddyserver/caddy/issues/5001))
-   Windows service integration: Caddy can now be controlled with `sc.exe`. ([#&#8203;4790](https://github.com/caddyserver/caddy/issues/4790))
-   Replace `net.IP` type with leaner `netip.Addr` type. ([#&#8203;4966](https://github.com/caddyserver/caddy/issues/4966))
-   Caddyfile-configurable OCSP check interval with `ocsp_interval` global option. ([#&#8203;4980](https://github.com/caddyserver/caddy/issues/4980))
-   The reverse proxy now supports `retry_count` as an alternative to `try_duration`; i.e. try backends up to a fixed number of times, rather than up to a time limit. ([#&#8203;4756](https://github.com/caddyserver/caddy/issues/4756))
-   The reverse proxy closes both ends of "hijacked" connections when shutting down or reloading. ([#&#8203;4895](https://github.com/caddyserver/caddy/issues/4895))
-   The reverse proxy gracefully closes both ends of websocket connections on shutdown or reload. ([#&#8203;4895](https://github.com/caddyserver/caddy/issues/4895))
-   The reverse proxy emits metrics regarding the health of upstreams. ([#&#8203;4935](https://github.com/caddyserver/caddy/issues/4935))
-   The reverse-proxy command can accept repeated --to flags and load balance. ([#&#8203;4693](https://github.com/caddyserver/caddy/issues/4693))
-   The reverse proxy's HTTP transport now supports distinct read and write timeouts. ([#&#8203;4905](https://github.com/caddyserver/caddy/issues/4905))
-   Simpler and more reliable config reloads on Linux with SO_REUSEPORT. ([#&#8203;4705](https://github.com/caddyserver/caddy/issues/4705))
-   Templates can access reverse proxy responses if used within `handle_response`. ([#&#8203;4871](https://github.com/caddyserver/caddy/issues/4871))
-   Builds now include git revision information when using `go build`. ([#&#8203;4931](https://github.com/caddyserver/caddy/issues/4931))
-   The file matcher (and `try_files`) now supports glob patterns. ([#&#8203;4993](https://github.com/caddyserver/caddy/issues/4993))
-   Named matchers in the Caddyfile can use CEL expressions without specifying `expression` first. ([#&#8203;4976](https://github.com/caddyserver/caddy/issues/4976))
-   The FastCGI transport can now capture and print stderr output. ([#&#8203;5004](https://github.com/caddyserver/caddy/issues/5004))
-   Listeners can be provided by plugins, enabling new network types. ([#&#8203;5002](https://github.com/caddyserver/caddy/issues/5002))
-   Caddy can write TLS secrets to a file for debugging purposes. ([#&#8203;4808](https://github.com/caddyserver/caddy/issues/4808))
-   Sites declared as `http://` in the Caddyfile will no longer be overridden by auto-HTTPS redirects. ([#&#8203;5051](https://github.com/caddyserver/caddy/issues/5051))
-   Config reloads no longer block while the prior servers are shutting down. ([#&#8203;5043](https://github.com/caddyserver/caddy/issues/5043))

#### :warning: Deprecations/breaks

-   **Metrics are now opt-in.** Due to [multiple confirmed reports](https://github.com/caddyserver/caddy/issues/4644) of non-trivial performance regressions with metrics, we are making them opt-in. (Technically, this is not a breaking change, as Caddy will still function normally and your old configs won't be rejected -- but your metrics will stop being produced unless you enable them.) If you rely on metrics, you can enable them globally in the Caddyfile with global options:
        {
        	servers {
        		metrics
        	}
        }
    As with other server-scoped global options, you can selectively customize which servers to enable metrics (e.g. `servers :8080`). *Note that this change is experimental and might be temporary: if we can reduce the performance impact or find a better way to enable and configure metrics, this could change.*
-   The signature of `caddy.Context.Logger()` has changed, but in a backwards-compatible way. Modules use this function to obtain a logger they can use within Caddy; until now, modules had to pass themselves in as an argument. Now, the context can figure out which module to associate the logger with, so the sole parameter has been made variadic. It may be removed in the future. Plugins should update their code to not pass in a pointer to themselves.
-   Basic auth deprecates `scrypt` because it was seldom used and error-prone; use `bcrypt` instead ([#&#8203;4720](https://github.com/caddyserver/caddy/issues/4720))
-   Several changes to experimental `servers` global options: removed the `protocol` sub-option, which has been replaced with the `protocols` sub-option; `strict_sni_host` is its own separate sub-option; `allow_h2c` and `experimental_http3` have been removed, as both H2C (`h2c`) and HTTP/3 (`h3`) can be toggled in `protocols` (HTTP/3 is now enabled by default and no longer experimental).

As a reminder, features, parameters, and APIs marked as experimental are subject to change or removal. We strive to keep breaking changes of stable features to a minimum and gracefully deprecate whenever possible with emphasis in release notes, warnings in logs, etc. Most breaking changes are motivated or necessitated by bugs/regressions, security, or wrong/unclear documentation.

## Thank you

As usual, a huge thank-you to all our [sponsors](https://github.com/sponsors/mholt) and those who contributed both code and feedback. We also acknowledge the many people who participated in discussions and helped others on the forum. Thank you!

#### New Contributors

-   [@&#8203;WingLim](https://github.com/WingLim) made their first contribution in https://github.com/caddyserver/caddy/pull/4790
-   [@&#8203;WilczynskiT](https://github.com/WilczynskiT) made their first contribution in https://github.com/caddyserver/caddy/pull/4930
-   [@&#8203;chir4gm](https://github.com/chir4gm) made their first contribution in https://github.com/caddyserver/caddy/pull/4932
-   [@&#8203;lewandowski-stripe](https://github.com/lewandowski-stripe) made their first contribution in https://github.com/caddyserver/caddy/pull/4937
-   [@&#8203;abdusco](https://github.com/abdusco) made their first contribution in https://github.com/caddyserver/caddy/pull/4963
-   [@&#8203;jedy](https://github.com/jedy) made their first contribution in https://github.com/caddyserver/caddy/pull/4975
-   [@&#8203;benburkert](https://github.com/benburkert) made their first contribution in https://github.com/caddyserver/caddy/pull/4980
-   [@&#8203;WeidiDeng](https://github.com/WeidiDeng) made their first contribution in https://github.com/caddyserver/caddy/pull/4964
-   [@&#8203;david-szabo97](https://github.com/david-szabo97) made their first contribution in https://github.com/caddyserver/caddy/pull/4935
-   [@&#8203;Abirdcfly](https://github.com/Abirdcfly) made their first contribution in https://github.com/caddyserver/caddy/pull/4986
-   [@&#8203;flga](https://github.com/flga) made their first contribution in https://github.com/caddyserver/caddy/pull/5004
-   [@&#8203;Malankar](https://github.com/Malankar) made their first contribution in https://github.com/caddyserver/caddy/pull/4972
-   [@&#8203;stapelberg](https://github.com/stapelberg) made their first contribution in https://github.com/caddyserver/caddy/pull/4950
-   [@&#8203;parrotmac](https://github.com/parrotmac) made their first contribution in https://github.com/caddyserver/caddy/pull/4693
-   [@&#8203;Manouchehri](https://github.com/Manouchehri) made their first contribution in https://github.com/caddyserver/caddy/pull/4808

**Full Changelog**: https://github.com/caddyserver/caddy/compare/v2.5.2...v2.6.0

***

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzMi4xOTQuNSIsInVwZGF0ZWRJblZlciI6IjMyLjIxMy4wIn0=-->
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [caddyserver/caddy](https://github.com/caddyserver/caddy) | minor | `v2.5.2` -> `v2.6.2` | --- ### Release Notes <details> <summary>caddyserver/caddy</summary> ### [`v2.6.2`](https://github.com/caddyserver/caddy/releases/tag/v2.6.2) [Compare Source](https://github.com/caddyserver/caddy/compare/v2.6.1...v2.6.2) This release brings a number of bug fixes and minor enhancements. All users should upgrade after testing and verifying their setups. Thank you to all who contributed! If you are coming from < 2.6, please see [the 2.6 release notes](https://github.com/caddyserver/caddy/releases/tag/v2.6.0) because a lot is new! #### Changelog - [`037dc23`](https://github.com/caddyserver/caddy/commit/037dc23c) admin: Use replacer on listen addresses ([#&#8203;5071](https://github.com/caddyserver/caddy/issues/5071)) - [`498f32b`](https://github.com/caddyserver/caddy/commit/498f32ba) caddyconfig: Implement retries into HTTPLoader ([#&#8203;5077](https://github.com/caddyserver/caddy/issues/5077)) - [`9873ff9`](https://github.com/caddyserver/caddy/commit/9873ff99) caddyhttp: Remote IP prefix placeholders - [`61822f1`](https://github.com/caddyserver/caddy/commit/61822f12) caddyhttp: replace placeholders in map defaults ([#&#8203;5081](https://github.com/caddyserver/caddy/issues/5081)) - [`e07a267`](https://github.com/caddyserver/caddy/commit/e07a2672) caddytest: Revise sleep durations - [`253d97c`](https://github.com/caddyserver/caddy/commit/253d97c9) core: Chdir to executable location on Windows ([#&#8203;5115](https://github.com/caddyserver/caddy/issues/5115)) - [`ab720fb`](https://github.com/caddyserver/caddy/commit/ab720fb7) core: Fix ListenQUIC listener key conflict - [`e3e8aab`](https://github.com/caddyserver/caddy/commit/e3e8aabb) core: Refactor and improve listener logic ([#&#8203;5089](https://github.com/caddyserver/caddy/issues/5089)) - [`e4fac12`](https://github.com/caddyserver/caddy/commit/e4fac129) core: Set version manually via CustomVersion ([#&#8203;5072](https://github.com/caddyserver/caddy/issues/5072)) - [`f7c1a51`](https://github.com/caddyserver/caddy/commit/f7c1a51e) fastcgi: Redirect using original URI path (fix [#&#8203;5073](https://github.com/caddyserver/caddy/issues/5073)) - [`2be56c5`](https://github.com/caddyserver/caddy/commit/2be56c52) fileserver: Treat invalid file path as NotFound ([#&#8203;5099](https://github.com/caddyserver/caddy/issues/5099)) - [`b1d04f5`](https://github.com/caddyserver/caddy/commit/b1d04f5b) fileserver: better dark mode visited link contrast ([#&#8203;5105](https://github.com/caddyserver/caddy/issues/5105)) - [`33f60da`](https://github.com/caddyserver/caddy/commit/33f60da9) fileserver: stop listing dir when request context is cancelled ([#&#8203;5131](https://github.com/caddyserver/caddy/issues/5131)) - [`2153a81`](https://github.com/caddyserver/caddy/commit/2153a81e) forwardauth: Canonicalize header fields (fix [#&#8203;5038](https://github.com/caddyserver/caddy/issues/5038)) ([#&#8203;5097](https://github.com/caddyserver/caddy/issues/5097)) - [`fe91de6`](https://github.com/caddyserver/caddy/commit/fe91de67) go.mod: Upgrade select dependencies - [`7041970`](https://github.com/caddyserver/caddy/commit/70419700) headers: Support repeated WriteHeader if 1xx (fix [#&#8203;5074](https://github.com/caddyserver/caddy/issues/5074)) - [`d46ba2e`](https://github.com/caddyserver/caddy/commit/d46ba2e2) httpcaddyfile: Fix `metrics` global option parsing ([#&#8203;5126](https://github.com/caddyserver/caddy/issues/5126)) - [`6bad878`](https://github.com/caddyserver/caddy/commit/6bad878a) httpcaddyfile: Improve detection of indistinguishable TLS automation policies ([#&#8203;5120](https://github.com/caddyserver/caddy/issues/5120)) - [`2808de1`](https://github.com/caddyserver/caddy/commit/2808de1e) httpcaddyfile: Skip `automate` when `auto_https off` is specified ([#&#8203;5110](https://github.com/caddyserver/caddy/issues/5110)) - [`3e1fd2a`](https://github.com/caddyserver/caddy/commit/3e1fd2a8) httpcaddyfile: Wrap site block in subroute if host matcher used ([#&#8203;5130](https://github.com/caddyserver/caddy/issues/5130)) - [`9e1d964`](https://github.com/caddyserver/caddy/commit/9e1d964b) logging: Add `time_local` option to use local time instead of UTC ([#&#8203;5108](https://github.com/caddyserver/caddy/issues/5108)) - [`01e192e`](https://github.com/caddyserver/caddy/commit/01e192ed) logging: Better `console` encoder defaults ([#&#8203;5109](https://github.com/caddyserver/caddy/issues/5109)) - [`99ffe93`](https://github.com/caddyserver/caddy/commit/99ffe933) logging: Fix `skip_hosts` with wildcards ([#&#8203;5102](https://github.com/caddyserver/caddy/issues/5102)) - [`ea58d51`](https://github.com/caddyserver/caddy/commit/ea58d519) logging: Perform filtering on arrays of strings (where possible) ([#&#8203;5101](https://github.com/caddyserver/caddy/issues/5101)) - [`5e52bbb`](https://github.com/caddyserver/caddy/commit/5e52bbb1) map: Remove infinite recursion check ([#&#8203;5094](https://github.com/caddyserver/caddy/issues/5094)) - [`b4e28af`](https://github.com/caddyserver/caddy/commit/b4e28af9) replacer: working directory global placeholder ([#&#8203;5127](https://github.com/caddyserver/caddy/issues/5127)) - [`e2991eb`](https://github.com/caddyserver/caddy/commit/e2991eb0) reverseproxy: On 103 don't delete own headers ([#&#8203;5091](https://github.com/caddyserver/caddy/issues/5091)) - [`2a8c458`](https://github.com/caddyserver/caddy/commit/2a8c458f) reverseproxy: Parse humanized byte size (fix [#&#8203;5095](https://github.com/caddyserver/caddy/issues/5095)) - [`d055692`](https://github.com/caddyserver/caddy/commit/d0556929) reverseproxy: fix upstream scheme handling in command ([#&#8203;5088](https://github.com/caddyserver/caddy/issues/5088)) - [`013b510`](https://github.com/caddyserver/caddy/commit/013b5103) rewrite: Only trim prefix if matched #### New Contributors - [@&#8203;lemmi](https://github.com/lemmi) made their first contribution in https://github.com/caddyserver/caddy/pull/5088 - [@&#8203;willnorris](https://github.com/willnorris) made their first contribution in https://github.com/caddyserver/caddy/pull/5081 - [@&#8203;yroc92](https://github.com/yroc92) made their first contribution in https://github.com/caddyserver/caddy/pull/5071 - [@&#8203;iliana](https://github.com/iliana) made their first contribution in https://github.com/caddyserver/caddy/pull/5105 - [@&#8203;TobiX](https://github.com/TobiX) made their first contribution in https://github.com/caddyserver/caddy/pull/5106 - [@&#8203;likev](https://github.com/likev) made their first contribution in https://github.com/caddyserver/caddy/pull/5099 - [@&#8203;cherouvim](https://github.com/cherouvim) made their first contribution in https://github.com/caddyserver/caddy/pull/5121 **Full Changelog**: https://github.com/caddyserver/caddy/compare/v2.6.1...v2.6.2 ### [`v2.6.1`](https://github.com/caddyserver/caddy/releases/tag/v2.6.1) [Compare Source](https://github.com/caddyserver/caddy/compare/v2.6.0...v2.6.1) Hotfix for unix sockets, the `encode` handler, and the `caddy file-server` command. Please see [the release notes for v2.6.0](https://github.com/caddyserver/caddy/releases/tag/v2.6.0) for other important information if you're coming from < 2.6! #### Changelog - [`1426c97`](https://github.com/caddyserver/caddy/commit/1426c97d) core: Reuse unix sockets (UDS) and don't try to serve HTTP/3 over UDS ([#&#8203;5063](https://github.com/caddyserver/caddy/issues/5063)) - [`44ad0ce`](https://github.com/caddyserver/caddy/commit/44ad0ced) encode: don't WriteHeader unless called ([#&#8203;5060](https://github.com/caddyserver/caddy/issues/5060)) - [`beb7dcb`](https://github.com/caddyserver/caddy/commit/beb7dcbf) fileserver: Reinstate --debug flag ### [`v2.6.0`](https://github.com/caddyserver/caddy/releases/tag/v2.6.0) [Compare Source](https://github.com/caddyserver/caddy/compare/v2.5.2...v2.6.0) # Caddy 2.6 This is our biggest release since Caddy 2. Caddy 2 changed the way the world serves the Web. By providing an online config API, automatic HTTPS, unlimited extensibility, certificate automation at scale, modern protocols, sane defaults, and an unrivaled developer experience, we boldly raised the bar for web servers. Now with Caddy 2.6, we're doing it again. Caddy 2.6 is the first general-purpose web server to seamlessly enable the newly-standardized HTTP/3 protocol for all configurations by default. We've virtualized the file system so you can serve content from anywhere or anything. New event features let you observe and control Caddy's internals with custom actions. Caddy is more useful than ever for developers with its enhanced CLI tooling and features. And it's faster than ever with non-trivial performance improvements. We think you will love this release. **UPDATE: Please use [v2.6.1](https://github.com/caddyserver/caddy/releases/tag/v2.6.1) for hotfixes related to unix sockets, `encode`, and `caddy file-server`.** [Watch the livestream](https://youtu.be/iJZqFpY2D14) ## Special dedication This release is dedicated to the late Peter Eckersley, who passed away September 2, 2022. Peter is one of the brilliant minds behind Let's Encrypt; his work has benefited billions of people. I met Peter at the Let's Encrypt launch party in a little bar in San Francisco in 2015 and have never forgotten that occasion. He later co-authored a published research paper called [*Let’s Encrypt: An Automated Certificate Authority to Encrypt the Entire Web*](https://jhalderm.com/pub/papers/letsencrypt-ccs19.pdf), which highly espoused Caddy's ACME integration: "We hope to see other popular server software follow Caddy’s lead." We look forward to when other servers do that, and we hope to honor Peter's work and influence which will live on through his memory and the encrypted Web he made possible. *** ## [Sponsors](https://github.com/sponsors/mholt) [ZeroSSL](https://zerossl.com) remains Caddy's executive sponsor. [We were thrilled](https://twitter.com/caddyserver/status/1559591673511813120) to welcome [Stripe](https://stripe.com) recently as an enterprise sponsor! Other notable sponsors include [AppCove](https://appcove.com/), [Dukaan](https://mydukaan.io/), [Suborbital](https://suborbital.dev), [Tailscale](https://tailscale.com), plus [Bubble](https://bubble.io/) and [GitHub](https://github.com) which both made generous one-time donations. We have many other vital sponsors and donors on which we also rely. [Our sponsors](https://github.com/sponsors/mholt) come from all over the world and include independent professionals, startups, and small companies -- and they are the absolute best. Thank you for making a more secure Web possible! *Personal note from Matt: Recent life upgrades mean that your sponsorships now sustain a family of 5 so that I can continue to maintain Caddy. Two years ago, I don't think I would have taken this risk because I'd need to find other work to provide for a family. Thank you for coming together as a professional community to make the Caddy project possible!* We strongly recommend that companies who -- or companies whose customers -- use or benefit from Caddy [become a sponsor](https://github.com/sponsors/mholt) to ensure ongoing maintenance, priority development, private support, and more. Sponsorship tiers can be tailored to your requirements! ## Highlights :warning: ***Don't miss deprecations / breaking changes at the bottom. Notably, if you use metrics, you will now need to turn them on.*** ##### HTTP/3 is here ([#&#8203;4707](https://github.com/caddyserver/caddy/issues/4707)) Caddy now enables [RFC 9114](https://datatracker.ietf.org/doc/rfc9114/)-compliant HTTP/3 by default. The `experimental_http3` option has graduated and been removed. We've removed another experimental option, `allow_h2c`, and individual HTTP versions (`h1 h2 h2c h3`) can now be toggled with the new `protocols` setting. Note that HTTP/3 utilizes the QUIC transport, which requires UDP. If your network or firewall configuration only allows TCP, HTTP/3 connections will fail and clients (should) fall back to HTTP/2. For servers with properly-configured UDP networks, HTTP/3 should "just work" for enabled clients. HTTP/3 clients can connect by reading Caddy's Alt-Svc header to know how to connect to Caddy via UDP. This header is now emitted automatically and by default. Other than that, there are no other changes needed to existing servers, as Caddy opens a separate UDP socket for HTTP/3. Our HTTP/3 server attempts to mitigate amplification and reflection attacks by requiring address validation when the server is under load. This adds one round-trip for clients, but is only done as a defensive measure when necessary. Serious thanks to [@&#8203;marten-seemann](https://github.com/marten-seemann) who builds and maintains the [quic-go](https://github.com/lucas-clemente/quic-go) library we depend on for this. (Go has not announced any plans to officially support or implement HTTP/3.) We expect numerous QUIC and HTTP/3 improvements to come as implementations and best practices mature with more production experience. ##### Virtual file systems ([#&#8203;4909](https://github.com/caddyserver/caddy/issues/4909)) Caddy's `file_server` module now supports *virtual* file systems. We've replaced all hard-coded `os.Open()`, `os.Stat()`, etc. calls with Go's relatively new `io/fs` package, and introduced a new Caddy module namespace `caddy.fs` for implementations of such file systems. Some examples of what is possible: - Serve content from S3 or other blob/cloud storage services - Serve dynamically-generated content that "feels" static - [Embed your site directly into your `caddy` binary](https://github.com/mholt/caddy-embed) and serve it from memory - Serve content directly from an archive file (e.g. `.zip` or `.tar.gz`) - Load files from a database instead of disk Basically, instead of serving files from the local disk, you can have Caddy serve the "files" from somewhere or something else. The default is still the local file system. Note that this feature isn't limited to just Caddy's `file_server` module. Potentially any module that reads the local disk may benefit from using `caddy.fs` modules instead. I wrote [a module that lets you embed your site](https://github.com/mholt/caddy-embed) within your `caddy` binary -- wherever your server goes, your site goes! We encourage the community to implement and publish new file system modules for Caddy. (From an [early tweet](https://twitter.com/mholt6/status/1551434889358032897) there seems to be quite high demand.) ##### Events ([#&#8203;4912](https://github.com/caddyserver/caddy/issues/4912) and [#&#8203;4984](https://github.com/caddyserver/caddy/issues/4984)) Not surprisingly, many people prefer Caddy to automate certificates used with other software/services. Until now, there hasn't been a great way to know when Caddy has obtained or renewed a certificate (deferred in part by our opinion that certificate management should be baked into the software using the certificate in the first place). Cron jobs generally work for reloading new certificates into services because certificate expiry is *mostly* predictable, but now there is a better way with one of our most requested features: events! We thought about events in general for a long time and discussed questions like, "What makes an event different from a log?" "Are events synchronous?" "Do self-initiated events get emitted before or after their code (are they past-tense or future-tense) -- or both? or neither (asynchronous)?" "What do we like from existing event systems?" "What do we wish event systems did differently?" While we think we have pretty good answers to these questions now, we won't be sure until we gather more production experience. For this reason, events are implemented as an experimental app module -- not as part of the core. (Remember, Caddy's core currently only loads config and sets up logging/storage.) This means that Caddy's core cannot emit events.\[^1] So even though our event implementation may change, it is likely to be only slight and gradual changes; and we encourage anyone and everyone to start using events as soon as possible and to **give us your feedback**. We think we have the start of a great event system, but we need you to prove it! Caddy modules can emit events when interesting things happen. For example, the reverse proxy emits `healthy` and `unhealthy` events when backends go up and down. The TLS app emits `cert_obtaining`, `cert_obtained`, and `cert_failed` before and after obtaining a certificate or after the operation failed, respectively; and `cert_ocsp_revoked` after a certificate is discovered to be revoked by OCSP. There are several more events already, with even more to be added later. Events can have data associated with them. For example, `healthy`/`unhealthy` come with the address of the host; `cert_obtained` has the domain name, issuer, and storage path. You can access this from config in placeholders, e.g. `{event.data.identifier}`. Caddy modules can subscribe to events by specifying the name(s) of events to bind to, and the Caddy module ID(s) or namespace(s) to watch. When an event is emitted, it propagates from the module that emitted it up the provisioning heirarchy. This means that an event emitted by `http.handlers.reverse_proxy` will fire for `http.handlers` and `http` as well, similar to the DOM in HTML/JavaScript. Event handlers are invoked synchronously. We chose this for several reasons. First, despite how easy Go makes concurrency, there are many subtleties to concurrency in a server. Goroutines may be lightweight, but their operations might not be; and if event goroutines are starting more quickly than they are stopping, we either drop events arbitrarily or run out of memory/CPU. Also, we think one of the qualities that differentiates events from logs is the ability for an event to influence the emitting code's flow: a true "hook" in that sense. Instead of simply observing that something is happening (which is what a log tells you), you can influence its behavior. Maybe you want to run a command before a certificate is obtained to see if it *should* be obtained. Or maybe you want to change how a TLS handshake is completed on-the-fly. Asynchronous event handlers cannot do this. For simple behavioral changes, synchronous events can be a powerful and useful tool for customizing your server. The new `event` app lets you easily configure subscriptions and event handlers. Event handling is modular, so you will need to plug in a module that does what you want: run a command, reload a service, make an HTTP request, or anything else! Because this feature is experimental and new, we don't yet know how people will be using it, so currently, Caddy does not ship with any event handler plugins. However, we're pretty sure based on feedback over the years that many of you would like to run commands on certain events (one of our top feature requests is to trigger a daemon reload after certificate renewals). So I went ahead and implemented an [`exec` event handler plugin](https://github.com/mholt/caddy-events-exec) that can run commands. We almost included it in Caddy's standard distribution, but out of an abundance of caution we decided to keep it a separate plugin for now until we learn more about real production use cases from experience. Here's an example of handling events. In JSON, you configure the `events` app: ```json { "apps": { "events": { "subscriptions": [ { "events": ["cert_obtained"], "handlers": [ { "handler": "exec", "command": "systemctl", "args": ["reload", "mydaemon"] } ] } ] } } } ``` or the equivalent Caddyfile global option: { events { on cert_obtained exec systemctl reload mydaemon } } It's that simple! Just make sure you have your event handler modules plugged in. **We hope you will provide feedback, report bugs, and request features related to events.** \[^1]: Compilation fails with an import cycle. If Caddy core uses any feature of Caddy, it must also be in the core or another package not imported by any modules! ##### Smarter path matching and rewriting ([#&#8203;4948](https://github.com/caddyserver/caddy/issues/4948)) Is the URI path `/a/b/c` the same as `/a/b%2Fc`? What about `/a/b//c`? Turns out, *it depends.* What these questions illustrate is a famously frustrating problem, and has largely gone unsolved until now. All existing solutions I investigated in other products were unsatisfactory: - Nginx (and Caddy until now) always does path comparisons in unescaped/normalized space. This makes it impossible to route on literal escape sequences unless you double-encode your pattern, which violates specification. - Apache outright rejects valid\[^2] HTTP requests containing encoded slashes. This behavior can either be disabled completely (creating a security problem known as unsafe paths) or tweaked to never decode encoded slashes (creating ambiguities when comparing against route patterns). - Laravel, like nginx, always decodes slashes, but routing such requests [mangles application data](https://github.com/laravel/framework/issues/22125) that contains slashes. The process of decoding a URI and collapsing slashes in the path is called normalization. Normalization has to occur for safe, reliable routing (imagine `//secret` bypassing auth checks configured for `/secret`), but at the same time, raw paths are sometimes needed to preserve application data (imagine a route `/bands/:name` which succeeds for `/bands/AC&2fDC` but fails for the normalized `/bands/AC/DC`). And it's not just routing; servers like Caddy often rewrite/manipulate paths. Because normalizing URIs creates a Many:1 mapping (there are multiple encoded forms of a single URI), normalizing is inherently lossy: the original input cannot be recovered with certainty, so we can't reconstruct the original or intended URI with complete fidelity. Other solutions with coarse on-off knobs can't balance both security and application correctness: it seems you have to trade one for the other. The crux of the problem seems to be that the server/framework/router doesn't know which parts of the path are application data and which parts are path components, so it just "plays it safe" and decodes the whole thing. I think Caddy's solution to this is quite novel. **Our solution is to interpret encoded characters and multiple slashes in a path pattern literally as a hint of the developer's intent.** For example, if you write a path matcher `/a/b/c`, it will still match `/a/b/c` and `/a/b%2Fc`. However, if your path matcher is `/a/b%2Fc`, Caddy will *only* match `/a/b%2Fc`. This extends to wildcards with our new "escape-wildcard" feature: `/bands/%*/` will match `/bands/AC%2fDC` but `/bands/*/` won't. This works for multiple slashes too. If your path matcher uses `//`, Caddy will require the request path to contain those slashes literally at that position. We've also implemented this for prefix and suffix manipulations. For example, if you wanted to strip a prefix of `//prefix` from `//prefix/foo`, it will now work, whereas before it wouldn't because it would look at a fully-normalized URI. Essentially, we use the configured path pattern as a cue for whether to decode/merge a character or leave it raw when normalizing. This is a complex and subtle change, so please be sure to read the full PR in [#&#8203;4948](https://github.com/caddyserver/caddy/issues/4948) and the linked Laravel issue. It's very informative! \[^2]: The "validity" of such a URI based on spec compliance is debatable. RFC 9110 says, "distinct resources SHOULD NOT be identified by HTTP URIs that are equivalent after normalization." ##### HTTP 103 Early Hints ([#&#8203;4882](https://github.com/caddyserver/caddy/issues/4882) and [#&#8203;5006](https://github.com/caddyserver/caddy/issues/5006)) HTTP Early Hints ([RFC 8297](https://datatracker.ietf.org/doc/rfc8297/)) is the effective successor to HTTP/2 Server Push. When 103 is emitted with relevant Link headers, web pages will load faster than normal. 1xx responses are precursors to the final response; clients must be able to support receiving multiple responses to a single request (nearly all modern clients do; and it almost certainly shouldn't break any HTTP/2 clients). Early hints are a great way to speed up page loads where the main content may take a while to generate (a slow DB query, for example) but the subresources can start being loaded right away. In those cases it is often beneficial to send early hints. Caddy can both originate and proxy 103 responses. To send early hints from Caddy, simply set the `Link` headers as the hints, then write the response with a 103 status code: route /slow-pages/* { header +Link "</style.css>; rel=preload; as=style" header +Link "</script.js>; rel=preload; as=script" respond 103 } Unlike normal responses, after writing HTTP 103, Caddy's middleware chain will *continue* to execute and invoke the next handlers (for example, `reverse_proxy`) since 103 is not the final response. Multiple 103s can be sent. Caddy's reverse proxy also supports HTTP 103 responses, meaning that backends can send early hints and Caddy will proxy them to the client immediately as you'd expect., Note that browser support is still limited (only Chrome implements it at this time) and Caddy must be built with Go 1.19 (our builds use the latest Go version; but we still support Go 1.18 for now). Thank you to [@&#8203;dunglas](https://github.com/dunglas) with API Platform for contributing this feature to both Go and Caddy! ##### Improved command line interface ([#&#8203;4565](https://github.com/caddyserver/caddy/issues/4565) and [#&#8203;4994](https://github.com/caddyserver/caddy/issues/4994)) Caddy has always used Go's standard `flag` package for its CLI, which has served us quite well. However, recent improvements in the [Cobra](https://github.com/spf13/cobra) library make it possible for our CLI to gain worthwhile features without incurring a heavy dependency. The new `caddy manpage` command generates man pages, and the `caddy completion` command generates shell completions. Both are installed automatically as part of our official Linux packages, so your next `apt upgrade` (etc.) should take care of that. Additionally, short options (e.g. `-c`) are now supported. And if you typo a command, Caddy will helpfully suggest a correction (e.g. `caddy adpt` will suggest `caddy adapt`). Note that long-form flags must now use double-hyphen syntax (e.g. `--config`) even though the single-hyphen syntax (`-config`) was previously accepted. The standard library's flag parser treats `-` and `--` the same, but Cobra's does not. Our online documentation has always used `--` for flags, so we do not consider this a breaking change, but it's good to be aware of this change if you're used to how Go's parser works. Very many thanks to [@&#8203;mohammed90](https://github.com/mohammed90) for contributing these features! ##### New `caddy respond` command ([#&#8203;4870](https://github.com/caddyserver/caddy/issues/4870)) For rapid development needing a local HTTP server, the [`caddy respond` command](https://caddyserver.com/docs/command-line#caddy-respond) might be just what you need: hard-coded HTTP responses for one or more servers so that you can effortlessly have a custom HTTP endpoint to test with. A plain `caddy respond` command will listen on a random port and reply with HTTP 200. (The port or address is printed to the terminal for you.) You can set a custom status code like `caddy respond 401` or a custom body like `caddy respond "Hello world!"` -- or both: `caddy respond --status 401 "Hello world!"` Or you can pipe in a response body, for example serving a maintenance page: ```bash $ cat maintenance.html | caddy respond --status 503 --header "Content-Type: text/html; charset=utf-8" ``` You can even spin up multiple servers at once and use basic template features to configure each server with a different response: ```bash $ echo "I'm server {{.N}} on port {{.Port}}" | caddy respond --listen :2000-2004 Server address: [::]:2000 Server address: [::]:2001 Server address: [::]:2002 Server address: [::]:2003 Server address: [::]:2004 $ curl 127.0.0.1:2002 I'm server 2 on port 2002 ``` You can debug HTTP clients easier by enabling access logging with the `--access-log` flag. The `--header` flag can be used multiple times to set custom HTTP headers, and `--debug` enables debug mode for more verbose logging. We hope you find this feature useful! ##### Multiple dynamic upstream sources ([`5fb5b81`](https://github.com/caddyserver/caddy/commit/5fb5b81)) In Caddy 2.5(.1) we introduced dynamic upstreams, which allow you to configure the `reverse_proxy` to get the list of backends on-the-fly during requests. This very popular feature's development was sponsored by Stripe, who we are thrilled to welcome as an enterprise sponsor. Stripe uses Caddy heavily for their internal systems, and for greater redundancy they need to be able to fail over to secondary upstreams if a primary cluster is down. This is where the new `multi` dynamic upstreams module comes in. Now you can configure, for example, two SRV lookups for aggregated results: ```json { "handler": "reverse_proxy", "dynamic_upstreams": { "source": "multi", "sources": [ { "source": "srv", "name": "primary" }, { "source": "srv", "name": "secondary" } ] } } ``` This appends the backends returned from the secondary SRV lookup to the results of the primary SRV lookup (order preserved). To implement failover, simply use the `first` load balancing policy which chooses the first available upstream. ##### Configurable shutdown delay ([#&#8203;4906](https://github.com/caddyserver/caddy/issues/4906)) A shutdown can now be scheduled for a later time using the `shutdown_delay` option. This is useful for giving advance notice to health checkers that this server will be closing soon. The shutdown delay happens *before* the grace period where new connections are no longer accepted and existing ones are gracefully closed. During the shutdown delay, the server operates normally with the exception of the value of two placeholders. During the delay: - `{http.shutting_down}` placeholder equals `true`. - `{http.time_until_shutdown}` returns the duration that remains until server close. This allows health check endpoints to announce that they will soon be going down so that this instance can be moved out of the rotation or a replacement instance can be spun up in the meantime. For example: { shutdown_delay 10s } example.com { handle /health-check { @&#8203;goingDown `{http.shutting_down}` respond @&#8203;goingDown "Bye-bye in {http.time_until_shutdown}" 503 respond 200 } } By the way, the syntax of that `@goingDown` named matcher is new in 2.6: if a named matcher consists only of a CEL expression string, the type of matcher can be omitted; i.e. what you see above is equivalent to `@goingDown expression "{http.shutting_down} == true"`. (A shutdown is defined as a config unload where there is no new config to load, or the new config does not have a server configured at the same address as the current server. In other words, a shutdown of a server means a particular HTTP socket will be closed.) Speaking of grace periods, config changes no longer block while waiting on servers' grace periods. This means faster, more responsive config reloads; just beware that, depending on the length of your grace period, your reload command or config API request may return before the old servers have completely finished shutting down. ##### Faster FastCGI transport ([#&#8203;4978](https://github.com/caddyserver/caddy/issues/4978)) PHP apps, rejoice! The round-trip between Caddy and php-fpm just got a lot faster. Thanks to contributions by [@&#8203;WeidiDeng](https://github.com/WeidiDeng), the FastCGI transport has been rewritten to be more efficient. This is some of the oldest and most unique code in Caddy's code base. When Caddy was rewritten for v2 in 2019, *everything* was rewritten or refactored... except this, the FastCGI transport. This is the first time this part of the code has been improved since it was first implemented\[^3] in 2014! During tests, profiling showed the new code spends 86% less CPU time in GC (`gcDrain`) thanks to significantly fewer allocations. This is largely in part due to pooling buffers, which required a non-trivial refactoring to implement. ![CPU profile](https://user-images.githubusercontent.com/1128849/188224782-572c877d-42ea-4241-927f-346000512a75.png) A very rough benchmark using `php_info()` yielded a 25% increase in requests per second. Before the rewrite, Caddy almost always performed worse than nginx even with `fastcgi_keep_conn off`. Our new code performs competitively with nginx, and in some tests Caddy even outperformed nginx with `fastcgi_keep_conn on` -- and we have not implemented connection pooling/reuse into the new transport yet. Because every setup is different, your actual results will vary. In general though, you can expect busy servers to handle PHP faster. \[^3]: I didn't know how to write a FastCGI client back then (I'm still too scared to do much with it myself); Go's standard library implements only the responder role, not the web server (client). Fortunately there was a [random repository on BitBucket](http://bitbucket.org/PinIdea/fcgi_client) that was forked from [a random repository on Google Code written in 2012](https://code.google.com/archive/p/go-fastcgi-client/) that modified the Go std lib's `fcgi` package. It was rough around the edges, but with a little TLC we got it to do what we needed. The copyright had the name Junqing Tan in it, which we still retain in our source code to this day. ##### Faster file server ([#&#8203;5022](https://github.com/caddyserver/caddy/issues/5022)) In a patch contributed by [@&#8203;flga](https://github.com/flga), we've reduced copying between buffers and even eliminated it altogether in some cases using [`sendfile(2)`](https://man7.org/linux/man-pages/man2/sendfile.2.html). This has shown to have a 25-50% performance boost. It's automatic and no configuration is required to benefit. In [some tests](https://blog.tjll.net/reverse-proxy-hot-dog-eating-contest-caddy-vs-nginx/), Caddy's new defaults are even faster than optimized nginx. Static files over 512 bytes being served over plaintext HTTP sockets may now be served directly by the Linux kernel, which is much faster than copying the file to user-space. Static files are faster over HTTPS, too. In addition to sendfile (which we can't\[^4] use over TLS), we now utilize the `io.ReaderFrom` interface to reuse existing buffers and further reduce copying within user space. Our tests show that this significantly enhances performance even over TLS. \[^4]: This is possible with kTLS, but [the Go standard library doesn't support it](https://github.com/golang/go/issues/44506) and it's [a bit tedious](https://words.filippo.io/playing-with-kernel-tls-in-linux-4-13-and-go/) to make it work, although [@&#8203;FiloSottile](https://github.com/FiloSottile) was successful with his [spike code](https://github.com/FiloSottile/go/commit/dbed9972d9947eb0001e9f5b639e0df05acec8bd). ##### Signed release assets Thanks to heroic efforts by [@&#8203;mohammed90](https://github.com/mohammed90), our [GitHub release](https://github.com/caddyserver/caddy/releases) assets are now signed and certified. Mohammed [wrote an excellent Twitter thread](https://twitter.com/MohammedSahaf/status/1572022375247663105) explaining the whole thing better than I can here! So if you're wondering why the number of assets shot from 28 to 134... that's why. ## Other notable enhancements - More efficient `query` matcher. ([`04a14ee`](https://github.com/caddyserver/caddy/commit/04a14ee37ac6192d734518fa9082d6eb93971bc6)) - A new Caddyfile placeholder `{cookie.*}` grants easy access to cookie values. ([#&#8203;5001](https://github.com/caddyserver/caddy/issues/5001)) - Windows service integration: Caddy can now be controlled with `sc.exe`. ([#&#8203;4790](https://github.com/caddyserver/caddy/issues/4790)) - Replace `net.IP` type with leaner `netip.Addr` type. ([#&#8203;4966](https://github.com/caddyserver/caddy/issues/4966)) - Caddyfile-configurable OCSP check interval with `ocsp_interval` global option. ([#&#8203;4980](https://github.com/caddyserver/caddy/issues/4980)) - The reverse proxy now supports `retry_count` as an alternative to `try_duration`; i.e. try backends up to a fixed number of times, rather than up to a time limit. ([#&#8203;4756](https://github.com/caddyserver/caddy/issues/4756)) - The reverse proxy closes both ends of "hijacked" connections when shutting down or reloading. ([#&#8203;4895](https://github.com/caddyserver/caddy/issues/4895)) - The reverse proxy gracefully closes both ends of websocket connections on shutdown or reload. ([#&#8203;4895](https://github.com/caddyserver/caddy/issues/4895)) - The reverse proxy emits metrics regarding the health of upstreams. ([#&#8203;4935](https://github.com/caddyserver/caddy/issues/4935)) - The reverse-proxy command can accept repeated --to flags and load balance. ([#&#8203;4693](https://github.com/caddyserver/caddy/issues/4693)) - The reverse proxy's HTTP transport now supports distinct read and write timeouts. ([#&#8203;4905](https://github.com/caddyserver/caddy/issues/4905)) - Simpler and more reliable config reloads on Linux with SO_REUSEPORT. ([#&#8203;4705](https://github.com/caddyserver/caddy/issues/4705)) - Templates can access reverse proxy responses if used within `handle_response`. ([#&#8203;4871](https://github.com/caddyserver/caddy/issues/4871)) - Builds now include git revision information when using `go build`. ([#&#8203;4931](https://github.com/caddyserver/caddy/issues/4931)) - The file matcher (and `try_files`) now supports glob patterns. ([#&#8203;4993](https://github.com/caddyserver/caddy/issues/4993)) - Named matchers in the Caddyfile can use CEL expressions without specifying `expression` first. ([#&#8203;4976](https://github.com/caddyserver/caddy/issues/4976)) - The FastCGI transport can now capture and print stderr output. ([#&#8203;5004](https://github.com/caddyserver/caddy/issues/5004)) - Listeners can be provided by plugins, enabling new network types. ([#&#8203;5002](https://github.com/caddyserver/caddy/issues/5002)) - Caddy can write TLS secrets to a file for debugging purposes. ([#&#8203;4808](https://github.com/caddyserver/caddy/issues/4808)) - Sites declared as `http://` in the Caddyfile will no longer be overridden by auto-HTTPS redirects. ([#&#8203;5051](https://github.com/caddyserver/caddy/issues/5051)) - Config reloads no longer block while the prior servers are shutting down. ([#&#8203;5043](https://github.com/caddyserver/caddy/issues/5043)) #### :warning: Deprecations/breaks - **Metrics are now opt-in.** Due to [multiple confirmed reports](https://github.com/caddyserver/caddy/issues/4644) of non-trivial performance regressions with metrics, we are making them opt-in. (Technically, this is not a breaking change, as Caddy will still function normally and your old configs won't be rejected -- but your metrics will stop being produced unless you enable them.) If you rely on metrics, you can enable them globally in the Caddyfile with global options: { servers { metrics } } As with other server-scoped global options, you can selectively customize which servers to enable metrics (e.g. `servers :8080`). *Note that this change is experimental and might be temporary: if we can reduce the performance impact or find a better way to enable and configure metrics, this could change.* - The signature of `caddy.Context.Logger()` has changed, but in a backwards-compatible way. Modules use this function to obtain a logger they can use within Caddy; until now, modules had to pass themselves in as an argument. Now, the context can figure out which module to associate the logger with, so the sole parameter has been made variadic. It may be removed in the future. Plugins should update their code to not pass in a pointer to themselves. - Basic auth deprecates `scrypt` because it was seldom used and error-prone; use `bcrypt` instead ([#&#8203;4720](https://github.com/caddyserver/caddy/issues/4720)) - Several changes to experimental `servers` global options: removed the `protocol` sub-option, which has been replaced with the `protocols` sub-option; `strict_sni_host` is its own separate sub-option; `allow_h2c` and `experimental_http3` have been removed, as both H2C (`h2c`) and HTTP/3 (`h3`) can be toggled in `protocols` (HTTP/3 is now enabled by default and no longer experimental). As a reminder, features, parameters, and APIs marked as experimental are subject to change or removal. We strive to keep breaking changes of stable features to a minimum and gracefully deprecate whenever possible with emphasis in release notes, warnings in logs, etc. Most breaking changes are motivated or necessitated by bugs/regressions, security, or wrong/unclear documentation. ## Thank you As usual, a huge thank-you to all our [sponsors](https://github.com/sponsors/mholt) and those who contributed both code and feedback. We also acknowledge the many people who participated in discussions and helped others on the forum. Thank you! #### New Contributors - [@&#8203;WingLim](https://github.com/WingLim) made their first contribution in https://github.com/caddyserver/caddy/pull/4790 - [@&#8203;WilczynskiT](https://github.com/WilczynskiT) made their first contribution in https://github.com/caddyserver/caddy/pull/4930 - [@&#8203;chir4gm](https://github.com/chir4gm) made their first contribution in https://github.com/caddyserver/caddy/pull/4932 - [@&#8203;lewandowski-stripe](https://github.com/lewandowski-stripe) made their first contribution in https://github.com/caddyserver/caddy/pull/4937 - [@&#8203;abdusco](https://github.com/abdusco) made their first contribution in https://github.com/caddyserver/caddy/pull/4963 - [@&#8203;jedy](https://github.com/jedy) made their first contribution in https://github.com/caddyserver/caddy/pull/4975 - [@&#8203;benburkert](https://github.com/benburkert) made their first contribution in https://github.com/caddyserver/caddy/pull/4980 - [@&#8203;WeidiDeng](https://github.com/WeidiDeng) made their first contribution in https://github.com/caddyserver/caddy/pull/4964 - [@&#8203;david-szabo97](https://github.com/david-szabo97) made their first contribution in https://github.com/caddyserver/caddy/pull/4935 - [@&#8203;Abirdcfly](https://github.com/Abirdcfly) made their first contribution in https://github.com/caddyserver/caddy/pull/4986 - [@&#8203;flga](https://github.com/flga) made their first contribution in https://github.com/caddyserver/caddy/pull/5004 - [@&#8203;Malankar](https://github.com/Malankar) made their first contribution in https://github.com/caddyserver/caddy/pull/4972 - [@&#8203;stapelberg](https://github.com/stapelberg) made their first contribution in https://github.com/caddyserver/caddy/pull/4950 - [@&#8203;parrotmac](https://github.com/parrotmac) made their first contribution in https://github.com/caddyserver/caddy/pull/4693 - [@&#8203;Manouchehri](https://github.com/Manouchehri) made their first contribution in https://github.com/caddyserver/caddy/pull/4808 **Full Changelog**: https://github.com/caddyserver/caddy/compare/v2.5.2...v2.6.0 *** </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, click this checkbox. --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzMi4xOTQuNSIsInVwZGF0ZWRJblZlciI6IjMyLjIxMy4wIn0=-->
renovator force-pushed renovate/caddyserver-caddy-2.x from f777877e26 to 9ab1e05cb6 2022-09-21 23:03:20 +00:00 Compare
renovator changed title from chore(deps): update dependency caddyserver/caddy to v2.6.0 to chore(deps): update dependency caddyserver/caddy to v2.6.1 2022-09-21 23:03:21 +00:00
renovator force-pushed renovate/caddyserver-caddy-2.x from 9ab1e05cb6 to 318fd226ed 2022-10-13 19:03:32 +00:00 Compare
renovator changed title from chore(deps): update dependency caddyserver/caddy to v2.6.1 to chore(deps): update dependency caddyserver/caddy to v2.6.2 2022-10-13 19:03:33 +00:00
xoxys merged commit 9acd8c30ff into main 2022-10-13 19:33:35 +00:00
xoxys deleted branch renovate/caddyserver-caddy-2.x 2022-10-13 19:33:35 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No reviewers
Labels
Clear labels
No items
No Label
Milestone
Clear milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
1 Participants
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: container/link-validator#89
No description provided.
Delete Branch "renovate/caddyserver-caddy-2.x"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?