summaryrefslogtreecommitdiff
path: root/caddyconfig/httpcaddyfile
AgeCommit message (Collapse)Author
2020-04-02httpcaddyfile: Refactor site key parsing; detect conflicting schemesMatthew Holt
We now store the parsed site/server block keys with the server block, rather than parsing the addresses every time we read them. Also detect conflicting schemes, i.e. TLS and non-TLS cannot be served from the same server (natively -- modules could be built for it). Also do not add site subroutes (subroutes generated specifically from site blocks in the Caddyfile) that are empty.
2020-04-01caddytls: Refactor certificate selection policies (close #1575)Matthew Holt
Certificate selection used to be a module, but this seems unnecessary, especially since the built-in CustomSelectionPolicy allows quite complex selection logic on a number of fields in certs. If we need to extend that logic, we can, but I don't think there are SO many possibilities that we need modules. This update also allows certificate selection to choose between multiple matching certs based on client compatibility and makes a number of other improvements in the default cert selection logic, both here and in the latest CertMagic. The hardest part of this was the conn policy consolidation logic (Caddyfile only, of course). We have to merge connection policies that we can easily combine, because if two certs are manually loaded in a Caddyfile site block, that produces two connection policies, and each cert is tagged with a different tag, meaning only the first would ever be selected. So given the same matchers, we can merge the two, but this required improving the Tag selection logic to support multiple tags to choose from, hence "tags" changed to "any_tag" or "all_tags" (but we use any_tag in our Caddyfile logic). Combining conn policies with conflicting settings is impossible, so that should return an error if two policies with the exact same matchers have non-empty settings that are not the same (the one exception being any_tag which we can merge because the logic for them is to OR them). It was a bit complicated. It seems to work in numerous tests I've conducted, but we'll see how it pans out in the release candidates.
2020-04-01caddytls: Update cipher suite names and curve namesMatthew Holt
Now using IANA-compliant names and Go 1.14's CipherSuites() function so we don't have to maintain our own mapping of currently-secure cipher suites.
2020-03-30httpcaddyfile: Include non-standard ports when mapping logger namesMatthew Holt
If a site block has a key like "http://localhost:2016", then the log for that site must be mapped to "localhost:2016" and not just "localhost" because "localhost:2016" will be the value of the Host header of requests. But a key like "localhost:80" does not include the port since the Host header will not include ":80" because it is a standard port. Fixes https://caddy.community/t/v2-common-log-format-not-working/7352?u=matt
2020-03-28httpcaddyfile: Put root directive first, before redir and rewriteMatthew Holt
See https://caddy.community/t/v2-match-any-path-but-files/7326/8?u=matt If rewrites (or redirects, for that matter) match on file existence, the file matcher would need to know the root of the site. Making this change implies that root directives that depend on rewritten URIs will not work as expected. However, I think this is very uncommon, and am not sure I have ever seen that. Usually, dynamic roots are based on host, not paths or query strings. I suspect that rewrites based on file existence will be more common than roots based on rewritten URIs, so I am moving root to be the first in the list. Users can always override this ordering with the 'order' global option.
2020-03-26ci: fuzz: switch engine from libfuzzer to native go-fuzz (#3194)Mohammed Al Sahaf
2020-03-26caddytls: Remove ManageSyncMatthew Holt
This seems unnecessary for now and we can always add it in later if people have a good reason to need it.
2020-03-24caddyhttp: Specify default access log for a server (fix #3185)Matthew Holt
2020-03-23httpcaddyfile: Allow php_fastcgi to be used in route directiveMatthew Holt
Fixes https://caddy.community/t/v2-help-to-set-up-a-yourls-instance/7260/22
2020-03-22httpcaddyfile: Fix little typo (Next -> NextArg)Matthew Holt
2020-03-22httpcaddyfile: Move header before redir (fixes #3148)Matthew Holt
2020-03-20httpcaddyfile: Simplify 'root' directive parsingMatthew Holt
I must have written that one before the helper function `RegisterHandlerDirective`.
2020-03-20httpcaddyfile: Append access logger name to log's includes (fix #3110)Matthew Holt
2020-03-19httpcaddyfile: Unify strip_prefix, strip_suffix, uri_replace directives (#3157)Matt Holt
* rewrite: strip_prefix, strip_suffix, uri_replace -> uri (closes #3140) * Add period, to satisfy @whitestrake :) and my own OCD * Restore implied / prefix
2020-03-19httpcaddyfile: 'bind' properly parses unix sockets (fixes #2999)Matthew Holt
2020-03-18Little tweaky tweaksMatthew Holt
2020-03-18httpcaddyfile: Prevent rewrite routes from consolidating (fix #3108)Matthew Holt
It's hard to say whether this was actually a bug, but the linked issue shows why the old behavior was confusing. Basically, we infer that a rewrite handler is supposed to act as an internal redirect, which likely means it will no longer match the matcher(s) it did before the rewrite. So if the rewrite directive shares a matcher with any adjacent route or directive, it can be confusing/misleading if we consolidate the rewrite into the same route as the next handler, which shouldn't (probably) match after the rewrite is complete. This is kiiiind of a hacky workaround to a quirky problem. For edge cases like these, it is probably "cleaner" to just use handle blocks instead, to group handlers under the same matcher, nginx-style.
2020-03-17httpcaddyfile: Many tls-related improvements including on-demand supportMatthew Holt
Holy heck this was complicated
2020-03-17caddyhttp: Add default SNI tests (#3146)Mark Sargent
* added sni tests * set the default sni when there is no host to match * removed invalid sni test. Disabled tests that rely on host headers. * readded SNI tests. Added logging of config load times
2020-03-15caddytls: Clean up some code related to automationMatthew Holt
2020-03-13Some hotfixes for beta 16Matthew Holt
2020-03-13caddyhttp: Fix default SNI for default conn policy (#3141)Mark Sargent
* add integration tests * removed SNI test * remove integration test condition * minor edit * fix sni when using static certificates Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2020-03-13v2: Implement 'pki' app powered by Smallstep for localhost certificates (#3125)Matt Holt
* pki: Initial commit of PKI app (WIP) (see #2502 and #3021) * pki: Ability to use root/intermediates, and sign with root * pki: Fix benign misnamings left over from copy+paste * pki: Only install root if not already trusted * Make HTTPS port the default; all names use auto-HTTPS; bug fixes * Fix build - what happened to our CI tests?? * Fix go.mod
2020-03-10httpcaddyfile: error for wrong arg count of admin opt (#3126) (#3131)Francis Lavoie
2020-03-06Merge branch 'certmagic-refactor' into v2Matthew Holt
2020-03-06Refactor for CertMagic v0.10; prepare for PKI appMatthew Holt
This is a breaking change primarily in two areas: - Storage paths for certificates have changed - Slight changes to JSON config parameters Huge improvements in this commit, to be detailed more in the release notes. The upcoming PKI app will be powered by Smallstep libraries.
2020-03-04httpcaddyfile: remove certificate tags from global state (#3111)Mark Sargent
* remove the certificate tag tracking from global state * refactored helper state, added log counter * moved state initialisation close to where it is used. * added helper state comment
2020-02-28Simplify the logic in the previous commitMatthew Holt
2020-02-28httpcaddyfile: Treat no matchers as 0-len path matchers (fix #3100)Matthew Holt
+ a couple other minor changes from linter
2020-02-27httpcaddyfile: Allow "admin off" optionMatthew Holt
2020-02-27Refactor ExtractMatcherSet()Matthew Holt
2020-02-27Fix typos (#3087)Success Go
* Fix typo * Fix typo, thanks for Spell Checker under VS Code
2020-02-26Initial implementation of global default SNI option (#3047)Mark Sargent
* add global default sni * fixed grammar * httpcaddyfile: Reduce some duplicated code * Um, re-commit already-committed commit, I guess? (sigh) Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
2020-02-25v2: 'log' directive for Caddyfile, and debug mode (#3052)Matt Holt
* httpcaddyfile: Begin implementing log directive, and debug mode For now, debug mode just sets the log level for all logs to DEBUG (unless a level is specified explicitly). * httpcaddyfile: Finish 'log' directive Also rename StringEncoder -> SingleFieldEncoder * Fix minor bug in replacer (when vals are empty)
2020-02-25httpcaddyfile: Matchers can now be embedded into a nested scopeMatthew Holt
This is useful in 'handle' and 'route' directives, for instance, if you want to keep your matcher definitions by the directives that use them.
2020-02-25Expose TLS placeholders (#2982)Cameron Moore
* caddytls: Add CipherSuiteName and ProtocolName functions The cipher_suites.go file is derived from a commit to the Go master branch that's slated for Go 1.14. Once Go 1.14 is released, this file can be removed. * caddyhttp: Use commonLogEmptyValue in common_log replacer * caddyhttp: Add TLS placeholders * caddytls: update unsupportedProtocols Don't export unsupportedProtocols and update its godoc to mention that it's used for logging only. * caddyhttp: simplify getRegTLSReplacement signature getRegTLSReplacement should receive a string instead of a pointer. * caddyhttp: Remove http.request.tls.client.cert replacer The previous behavior of printing the raw certificate bytes was ported from Caddy 1, but the usefulness of that approach is suspect. Remove the client cert replacer from v2 until a use case is presented. * caddyhttp: Use tls.CipherSuiteName from Go 1.14 Remove ported version of CipherSuiteName in the process.
2020-02-20httpcaddyfile: tls: Load repeated cert files only once, with one tagMatthew Holt
See end of issue #3004. Loading the same certificate file multiple times with different tags will result in it being de-duplicated in the in- memory cache, because of course they all have the same bytes. This meant that any certs of the same filename loaded with different tags would be overwritten by the next certificate of the same filename, and any conn policies looking for the tags of the previous ones would never find them, causing connections to fail. So, now we remember cert filenames and their tags, instead of loading them multiple times and overwriting previous ones. A user crafting their own JSON might make this error too... maybe we won't see it happen. But if it does, one possibility is, when loading a duplicate cert, instead of discarding it completely, merge the tag list into the one that's already stored in the cache, then discard.
2020-02-20httpcaddyfile: Combine repeated cert loaders (fix #3004)Matthew Holt
Also only append 1 catch-all TLS connection policy to a server, even if multiple site blocks contribute to that server.
2020-02-18httpcaddyfile: Properly add all cert loaders across sites (fixes #3056)Matthew Holt
2020-02-16httpcaddyfile: 'handle_errors' directiveMatthew Holt
Not sure I love the name of the directive; might change it later.
2020-02-16httpcaddyfile: Refactor global options parsing; prevent duplicate keysMatthew Holt
2020-02-16http: Remove redundant test fileMatthew Holt
Forgot to delete this when I moved its test into a different file
2020-02-14tls: Avoid duplication AutomationPolicies for large quantities of namesMatthew Holt
This should greatly reduce memory usage at scale. Part of an overall effort between Caddy 2 and CertMagic to optimize for large numbers of names.
2020-02-14caddyfile: Refactor; NewFromNextSegment(); fix repeated matchersMatthew Holt
Now multiple instances of the same matcher can be used within a named matcher without overwriting previous ones.
2020-02-12tls: Add acme_ca_root and tls/ca_root to caddyfile (#3040)Mark Sargent
2020-02-08httpcaddyfile: Add support for DNS challenge solversMatthew Holt
Configuration via the Caddyfile requires use of env variables, but an upstream issue is currently blocking that: https://github.com/go-acme/lego/issues/1054 Providers will need to be retrofitted upstream in order to support env var configuration.
2020-02-06caddyfile: tls: Ensure there is always a catch-all conn policy (#3005)Matthew Holt
If user provides their own certs or makes any hostname-specific TLS connection policy, it means that no TLS connection would be served for any other hostnames, even though you'd expect that TLS is enabled for them, too. So now we append a catch-all conn policy if none exist, which allows all ClientHellos to be matched and served. We also fix the consolidation of automation policies, which previously gobbled up automation policies without hosts in favor of automation policies with hosts. Instead of a host-specific policy eating up an identical catch-all policy, the catch-all policy eats up the identical host-specific policy, ensuring that the policy is applied to all hosts which need it. See also: https://caddy.community/t/v2-automatic-https-certificate-errors/6847/9?u=matt
2020-02-06caddyfile: tls: Tag manual certificates (#2588)Matthew Holt
This ensure that if there are multiple certs that match a particular ServerName or other parameter, then specifically the one the user provided in the Caddyfile will be used.
2020-02-04httpcaddyfile: Add {remote} shorthand placeholdersMatthew Holt
Also sort the list
2020-02-04httpcaddyfile: Make root directive mutually exclusiveMatthew Holt
See https://caddy.community/t/caddyfile-and-v2/6766/22?u=matt
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-03 19:06:15 +0000