summaryrefslogtreecommitdiff
path: root/modules
AgeCommit message (Collapse)Author
2020-03-06Refactor for CertMagic v0.10; prepare for PKI appMatthew Holt
This is a breaking change primarily in two areas: - Storage paths for certificates have changed - Slight changes to JSON config parameters Huge improvements in this commit, to be detailed more in the release notes. The upcoming PKI app will be powered by Smallstep libraries.
2020-02-23reverse_proxy: Health checks: Don't cross the streamsMatthew Holt
Fixes https://caddy.community/t/v2-health-checks-are-going-to-the-wrong-upstream/7084?u=matt ... I think
2020-02-20caddyhttp: Add handler for unhandled errors in errorChain (#3063)Robin Lambertz
* Add handler for unhandled errors in errorChain Currently, when an error chain is defined, the default error handler is bypassed entirely - even if the error chain doesn't handle every error. This results in pages returning a blank 200 OK page. For instance, it's possible for an error chain to match on the error status code and only handle a certain subtype of errors (like 403s). In this case, we'd want any other errors to still go through the default handler and return an empty page with the status code. This PR changes the "suffix handler" passed to errorChain.Compile to set the status code of the response to the error status code. Fixes #3053 * Move the errorHandlerChain middleware to variable * Style fix
2020-02-20caddyhttp: Fixes for header and header_regexp directives (#3061)Gilbert Gilb's
* Fix crash when specifying "*" to header directive. Fixes #3060 * Look Host header in header and header_regexp. Also, if more than one header is provided, header_regexp now looks for extra headers values to reflect the behavior from header. Fixes #3059 * Fix parsing of named header_regexp in Caddyfile. See #3059
2020-02-18http: Close HTTP/3 servers and listeners; upstream bug irreproducibleMatthew Holt
See https://github.com/lucas-clemente/quic-go/issues/2103 and https://github.com/caddyserver/caddy/pull/2727
2020-02-18tls: Fix panic loading automation management modules (fix #3004)Matthew Holt
When AutomationPolicy was turned into a pointer, we continued passing a double pointer to LoadModule, oops.
2020-02-17basicauth: default hash to bcrypt (#3050)Robin Lambertz
The documentation specifies that the hash algorithm defaults to bcrypt. However, the implementation returns an error in provision if no hash is provided. Fix this inconsistency by *actually* defaulting to bcrypt.
2020-02-14tls: Avoid duplication AutomationPolicies for large quantities of namesMatthew Holt
This should greatly reduce memory usage at scale. Part of an overall effort between Caddy 2 and CertMagic to optimize for large numbers of names.
2020-02-14Minor tweaks to docs/commentsMatthew Holt
2020-02-14caddyfile: Refactor; NewFromNextSegment(); fix repeated matchersMatthew Holt
Now multiple instances of the same matcher can be used within a named matcher without overwriting previous ones.
2020-02-08browse: allow filter init via `filter` query param (#3027)Jeremy Lin
This allows creating links that display only a subset of files in a directory.
2020-02-08v2: Implement RegExp Vars Matcher (#2997)Mohammed Al Sahaf
* implement regexp var matcher * use subtests pattern for tests * be more consistent with naming: MatchVarRE -> MatchVarsRE, var_regexp -> vars_regexp
2020-02-07tls: Slight adjustment to how DNS provider modules are loadedMatthew Holt
We don't load the provider directly, because the lego provider types aren't designed for JSON configuration and they are not implemented as Caddy modules (there are some setup steps which a Provision call would need to do, but they do not have Provision methods, they have their own constructor functions that we have to wrap). Instead of loading the challenge providers directly, the modules are simple wrappers over the challenge providers, to facilitate the JSON config structure and to provide a consistent experience. This also lets us swap out the underlying challenge providers transparently if needed; it acts as a layer of abstraction.
2020-02-06Remove Starlark, for nowMatthew Holt
This is temporary as we prepare for a stable v2 release. We don't want to make promises we don't know we can keep, and the Starlark integration deserves much more focused attention which resources and funding do not currently permit. When the project is financially stable, I will be able to revisit this properly and add flexible, robust Starlark scripting support to Caddy 2.
2020-02-06caddyfile: tls: Tag manual certificates (#2588)Matthew Holt
This ensure that if there are multiple certs that match a particular ServerName or other parameter, then specifically the one the user provided in the Caddyfile will be used.
2020-02-05http: Split 2-phase auto-HTTPS into 3 phasesMatthew Holt
This is necessary to avoid a race for sockets. Both the HTTP servers and CertMagic solvers will try to bind the HTTP/HTTPS ports, but we need to make sure that our HTTP servers bind first. This is kind of a new thing now that management is async in Caddy 2. Also update to CertMagic 0.9.2, which fixes some async use cases at scale.
2020-02-04caddyhttp: Fix orig_uri placeholder docs (#3002)Francis Lavoie
Fixes #3001
2020-02-04header: caddyfile: Defer header operations for deletions or manuallyMatthew Holt
See https://caddy.community/t/caddy-server-that-returns-only-ip-address-as-text/6928/6?u=matt In most cases, we will want to apply header operations immediately, rather than waiting until the response is written. The exceptions are generally going to be if we are deleting a header field or if a field is to be overwritten. We now automatically defer header ops if deleting a header field, and allow the user to manually enable deferred mode with the defer subdirective.
2020-02-03v2: only compare TLS protocol versions if both are set (#3005)Mohammed Al Sahaf
2020-01-22http: Fix vars matcherMatthew Holt
2020-01-22rewrite: Prepend "/" if missing from strip path prefixMatthew Holt
Paths always begin with a slash, and omitting the leading slash could be convenient to avoid confusion with a path matcher in the Caddyfile. I do not think there would be any harm to implicitly add the leading slash.
2020-01-22reverseproxy: Fix casing of RootCAPEMFilesMatthew Holt
2020-01-22reverseproxy: Accept integer values for flush_interval (fix #2996)Matthew Holt
2020-01-22httpcaddyfile: Rename 'headers' directive to 'header'Matthew Holt
2020-01-22httpcaddyfile: Update directive docs; put root after rewriteMatthew Holt
2020-01-18Merge pull request #2980 from moorereason/bugfix-ciphersuite-loggingZaq? Wiedmann
v2: http: Fix ciphersuite logging
2020-01-18reverse_proxy: CB docs; rename type -> factor (#2986)Mohammed Al Sahaf
* v2: add documentation for circuit breaker config and "random selection" load balancing policy * v2: rename circuit breaker config inline key from `type` to `breaker` to avoid json key clash between the `circuit_breaker` type and the `type` field of the generic circuit breaker Config struct used by circuit breaking implementations * v2: restore the circuit breaker inline key to `type` and rename the name circuit breaker config field from `Type` to `Factor`
2020-01-17caddyhttp: Improve docs, and Caddyfile for respond directiveMatthew Holt
2020-01-16httpcaddyfile: Fix nested blocks; add handle directive; refactorMatthew Holt
The fix that was initially put forth in #2971 was good, but only for up to one layer of nesting. The real problem was that we forgot to increment nesting when already inside a block if we saw another open curly brace that opens another block (dispenser.go L157-158). The new 'handle' directive allows HTTP Caddyfiles to be designed more like nginx location blocks if the user prefers. Inside a handle block, directives are still ordered just like they are outside of them, but handler blocks at a given level of nesting are mutually exclusive. This work benefitted from some refactoring and cleanup.
2020-01-16http: Fix ciphersuite loggingCameron Moore
2020-01-16httpcaddyfile: Group try_files routes together (#2891)Matthew Holt
This ensures that only the first matching route is used.
2020-01-15rewrite: Make URI modifications more transactional (#2891)Matthew Holt
Before, modifying the path might have affected how a new query string was built if the query string relied on the path. Now, we build each component in isolation and only change the URI on the request later. Also, prevent trailing & in query string.
2020-01-13http: Refactor automatic HTTPS (fixes #2972)Matthew Holt
This splits automatic HTTPS into two phases. The first provisions the route matchers and uses them to build the domain set and configure auto HTTP->HTTPS redirects. This happens before the rest of the provisioning does. The second phase takes place at the beginning of the app start. It attaches pointers to the tls app to each server, and begins certificate management for the domains that were found in the first phase.
2020-01-12http: Fix subroutes, ensure that next handlers can still be calledMatthew Holt
2020-01-12http: Fix empty responsesMatthew Holt
Sigh... this is what I get for writing code when I'm tired and sick. See https://github.com/caddyserver/caddy/commit/8be1f0ea668492000cdefbd937e0359bdc24bfc1#r36764627
2020-01-11http: A little more polish on rewrite handler and try_files directiveMatthew Holt
2020-01-11rewrite: Fix query string logicMatthew Holt
2020-01-11http: Ensure primary routes always get compiled (fix #2972)Matthew Holt
Including servers for HTTP->HTTPS redirects which do not get provisioned like the rest.
2020-01-10http: Remove {...query_string} placeholder, in favor of {...query}Matthew Holt
I am not sure if the query_string one is necessary or useful yet. We can always add it later if needed.
2020-01-10rewrite: Rename parameters; implement custom query string parserMatthew Holt
Our new parser also preserves original parameter order, rather than re-encoding using the std lib (which sorts). The renamed parameters are a breaking change but they're new enough that I don't think anyone is using them.
2020-01-09http: Don't use a Host matcher for HTTP->HTTPS redirectsMatthew Holt
In case on-demand TLS is enabled, in that case we don't know the only names that have automatic HTTPS. See https://caddy.community/t/v2-http-to-https-redirects-fail-for-on-demand-ssl-certs/6742?u=matt
2020-01-09Update docs for couple of Caddyfile directivesMatthew Holt
2020-01-09v2: Implement Caddyfile enhancements (breaking changes) (#2960)Matt Holt
* http: path matcher: exact match by default; substring matches (#2959) This is a breaking change. * caddyfile: Change "matcher" directive to "@matcher" syntax (#2959) * cmd: Assume caddyfile adapter for config files named Caddyfile * Sub-sort handlers by path matcher length (#2959) Caddyfile-generated subroutes have handlers, which are sorted first by directive order (this is unchanged), but within directives we now sort by specificity of path matcher in descending order (longest path first, assuming that longest path is most specific). This only applies if there is only one matcher set, and the path matcher in that set has only one path in it. Path matchers with two or more paths are not sorted like this; and routes with more than one matcher set are not sorted like this either, since specificity is difficult or impossible to infer correctly. This is a special case, but definitely a very common one, as a lot of routing decisions are based on paths. * caddyfile: New 'route' directive for appearance-order handling (#2959) * caddyfile: Make rewrite directives mutually exclusive (#2959) This applies only to rewrites in the top-level subroute created by the HTTP caddyfile.
2020-01-09http: Change routes to sequential matcher evaluation (#2967)Matt Holt
Previously, all matchers in a route would be evaluated before any handlers were executed, and a composite route of the matching routes would be created. This made rewrites especially tricky, since the only way to defer later matchers' evaluation was to wrap them in a subroute, or to invoke a "rehandle" which often caused bugs. Instead, this new sequential design evaluates each route's matchers then its handlers in lock-step; matcher-handlers-matcher-handlers... If the first matching route consists of a rewrite, then the second route will be evaluated against the rewritten request, rather than the original one, and so on. This should do away with any need for rehandling. I've also taken this opportunity to avoid adding new values to the request context in the handler chain, as this creates a copy of the Request struct, which may possibly lead to bugs like it has in the past (see PR #1542, PR #1481, and maybe issue #2463). We now add all the expected context values in the top-level handler at the server, then any new values can be added to the variable table via the VarsCtxKey context key, or just the GetVar/SetVar functions. In particular, we are using this facility to convey dial information in the reverse proxy. Had to be careful in one place as the middleware compilation logic has changed, and moved a bit. We no longer compile a middleware chain per- request; instead, we can compile it at provision-time, and defer only the evaluation of matchers to request-time, which should slightly improve performance. Doing this, however, we take advantage of multiple function closures, and we also changed the use of HandlerFunc (function pointer) to Handler (interface)... this led to a situation where, if we aren't careful, allows one request routed a certain way to permanently change the "next" handler for all/most other requests! We avoid this by making a copy of the interface value (which is a lightweight pointer copy) and using exclusively that within our wrapped handlers. This way, the original stack frame is preserved in a "read-only" fashion. The comments in the code describe this phenomenon. This may very well be a breaking change for some configurations, however I do not expect it to impact many people. I will make it clear in the release notes that this change has occurred.
2020-01-08http: Always set status code via response recorderMatthew Holt
Fixes panic if no upstream handler wrote anything to the response
2020-01-07reverse_proxy: Add tls_trusted_ca_certs to Caddyfile (#2936)Zaq? Wiedmann
Allows specifying ca certs with by filename in `reverse_proxy.transport`. Example ``` reverse_proxy /api api:443 { transport http { tls tls_trusted_ca_certs certs/rootCA.pem } } ```
2020-01-07basicauth: Accept placeholders; move base64 decoding to provisionMatthew Holt
See https://caddy.community/t/v2-basicauth-bug/6738?u=matt
2020-01-06A few miscellaneous, minor fixesMatthew Holt
2020-01-03logging: Add doc about which fields can't be filteredMatthew Holt
2020-01-03v2: housekeeping: address minor lint complaints (#2957)Mohammed Al Sahaf
* v2: housekeeping: update tools * v2: housekeeping: adhere to US locale in spelling * v2: housekeeping: simplify code