Caddy is a powerful, enterprise-ready, open source web server with automatic
HTTPS written in Go.
Features:
- Easy configuration with the Caddyfile
- Powerful configuration with JSON config
- Dynamic configuration with a JSON API
- Config adapters if you don't like JSON
- Automatic HTTPS by default
- ACME (Let's Encrypt) for public sites
- Fully-managed local CA for internal names and IPs
- Can coordinate with other Caddy instances in a cluster
- HTTP/1.1, HTTP/2, and HTTP/3 support
- Actually fun to use
Reason:
The default admin endpoint has changed from localhost:2019 to
/var/run/caddy/caddy.sock. Using a Unix socket is more secure,
allowing it to be secured by filesystem permissions rather than
requiring a firewall.
If you only control caddy from the rc(8) script (service caddy ...),
you don't need to do anything. If you access the API yourself, you
will want to update your scripts to use the new socket.
To use the old endpoint, add the following to /etc/rc.conf:
caddy_admin="localhost:2019"
Reason:
The default locations for caddy runtime files have changed.
- Caddy's runtime log is now /var/log/caddy/caddy.log
(was /var/log/caddy.log)
- Automatic SSL certs are now stored in /var/db/caddy/data/caddy
(was /root/.local/share/caddy)
- Configuration autosaves are now stored in /var/db/caddy/config/caddy
(was /root/.config/caddy)
You can change these defaults. See /usr/local/etc/rc.d/caddy for the
list of settings.
www/caddy: Update to 2.11.6
Changes: https://github.com/caddyserver/caddy/releases/tag/v2.11.6
There are some breaking changes in this release, so you should read
that list. They are primarily security-tightening changes and should
be invisible to most users. If you were relying on uploading files in
headers rather than the body, you'll want to make some changes.
www/caddy: Update to 2.11.4 (security)
Changes:
Security-related patches:
- caddyhttp: Normalize Windows backslashes in path matcher (thanks
@Vincent550102)
- rewrite: Prevent placeholder re-expansion in injected query
(thanks @WhiskerEnt)
- templates: Improved stripHTML action to more reliably remove
malformed HTML (thanks to @jmrcsnchz)
- caddyhttp: Ignore header fields with underscores to prevent
collisions (thanks @Vincent550102 for the report and @dunglas for
the patch)
NB: These security patches may be breaking if your application
(Only the first 15 lines of the commit message are shown above )
www/caddy: Update to 2.11.2
Changes:
Caddy 2.11.2 contains numerous bug fixes and enhancements! I know
that's a lame summary but it's really all over the place.
Highlights:
- Reverse proxy got a lot of love with certain edge cases related to
PROXY protocol, health check port, and closing body on retries.
Dynamic upstreams are now tracked which enables passive health
checking.
- Performance improvements for metrics.
- New tls_resolvers global option to control DNS resolvers for all
sites when using the ACME DNS challenge.
(Only the first 15 lines of the commit message are shown above )
go: Bump go124-dependent ports
Earlier I bumped the default Go to 1.24. Ports that specify a lower
version will still build with those lower version (for now), so they
don't need a bumping. Instead I'm bumping anything that (now) has go124
as a dependency.
www/caddy, www/caddy-custom: Fix rc(8) instructions
I had 'service enable caddy' instead of 'service caddy enable' in
caddy.in, because I get it wrong so often that I had to write a
wrapper service() function in my shell.
Ludovic submitted a patch for this 5 months ago, but it went into
the same cerebral black hole as the order of service arguments.
PR: 280127
Reported by: Ludovic Hirlimann
www/caddy{,-custom}: chown caddy.log to caddy user/group
We have set caddy.log to root:wheel, which works for the default case
of running caddy as root.
When caddy is run as a non-root users, caddy.log can't actually be
written to. Instead, chown caddy.log to the caddy user/group so that
it can be written to.
PR: 276150
www/caddy{,-custom}: Fix start/stop with admin API disabled
Caddy largely relies on the admin API for state control, like
start/stop/reload. However, the admin API endpoints are inherently
a security risk.
Although the admin API is enabled by default, many users may choose
to disable it. However, the rc(8) script then needs an alternative
approach to controlling the daemon.
We already sortof supported signal-based control, but it didn't always
work, because there are multiple error messages that indicate that
the admin API is disabled (and none of them actually say that in a clear
way).
This commit fixes start and stop with the admin API disabled. The
reload command (and reloadssl) still require the admin API to be
enabled and will fail if the admin API is disabled.
PR: 255106
Submitted by: scf
www/caddy: Secure the default admin API endpoint
Caddy's default of localhost:2019, particularly combined with the port
defaulting to root:wheel, can be a significant security risk.
Mitigate this by setting the default to /var/run/caddy/caddy.sock, which
will be protected by filesystem permissions. Prior behaviour can be
restored with 'sysrc caddy_admin=localhost:2019'
Additionally, help users prepare for a change to running Caddy as
www:www by default using the new security/portacl-rc port in an update
message, and by extending the comments in the rc script.
www/caddy: Add reloadssl rc(8) command
`service caddy reloadssl` instructs Caddy to reload its TLS
certificates. This is useful when using Caddy with ACME DNS
providers, as it allows for the renewal of certificates without
manually deleting the old ones and restarting Caddy.
PR: 274085
www/caddy{,-custom}: Fix startup with JSON configuration
Caddy supports a wide number of configuration file formats, including
its built-in "Caddyfile" format, and the "native" format is JSON.
When anything other than the native JSON format is used, caddy needs to
be passed the --adapter [formatname] flag (though it automatically
handles the case where the config filename is Caddyfile). However, as
JSON is the native format, there is no "json" adapter.
The added patch drops the --adapter flag when caddy_adapter is "json".
PR: 270120
www/caddy: Update to 2.6.4
Changes:
This release contains a hotfix for a regression in v2.6.3 related to
proxying chunked requests. We recommend that all users who do so upgrade
to v2.6.4.
Note that, in an effort to make error-prone configs less likely, we have
deprecated the reverse proxy options:
buffer_requests
buffer_responses
max_buffer_size
and have introduced 2 new ones which take a size argument to enable
buffering:
request_buffers <size>
response_buffers <size>
The deprecated options will be removed in a later version of Caddy, so
please start using the new parameters instead.
www/caddy: Update to 2.6.3
Major changes:
* New trusted_proxies global option (within servers) can be used to
specify trusted proxy IP ranges globally. This is important if relying
on headers for client IP addresses.
* Proxied WebSocket connections are now logged with correct status code
and "size" (bytes read + bytes written).
* The quic-go package has received significant optimizations, so HTTP/3
should be more efficient now.
www/caddy: Pin Go version to 1.19
vendor/github.com/lucas-clemente/quic-go/internal/qtls/go120.go:5:13: cannot use
"The version of quic-go you're using can't be built on Go 1.20 yet.
quic-go doesn't support go1.20 yet, keep building this port with go1.19
for now.
PR: 269289
Reported by: exp-run
www/(x)caddy: Fix rc(8) script
rc.subr(8) needs $command to be set or it can't inspect the pidfile.
Without it, rc.d/caddy never believes that caddy is running which
impedes stopping.
Thanks to scf for figuring out what was going wrong here.
www/xcaddy: Add rc(8) script
Bring in the rc(8) script from caddy to xcaddy so that xcaddy users
can control caddy like an adult.
Add CONFLICTS between xcaddy and caddy because they now install the
same rc(8) script. There's no reason to change the install path here
because, as olgeni put it, "xcaddy with plugins is more caddy than
caddy".
Suggested by: bdrewery
Approved by: olgeni (xcaddy maintainer)
www/caddy: Provide a version string
When build from ports, `caddy version` returns an empty string.
Upstream likes caddy to be built from their xcaddy command, for which
FreeBSD has a port (www/xcaddy) and a package (pkg install xcaddy).
However, our package builders cannot use xcaddy itself, as it needs
external network access. Caddy itself contains no ability to set the
version without the extensive patching that xcaddy performs.
This commit adds a version string to allow the version to be set.
When built with xcaddy, the version string can contain a checksum of
some sort, but we are just using ${DISTVERSIONFULL} here (e.g. v2.6.1).
The lack of a version string has been brought up a number of times to
me, so I'm happy to put this issue to bed.
See https://github.com/caddyserver/caddy/issues/5065 for the latest
discussion about it.
www/caddy: Update to 2.6.0
Also, improve the rc(8) script with updates by scf, allowing proper
daemon shutdown regardless of whether the admin API is enabled.
2.6.0 is a significant update, bringing automatic HTTP/3 (QUIC) support,
a fully abstracted fileserver (serve static files from a database, a
tarball, a script, etc.), and lots more.
Extensive update notes: https://github.com/caddyserver/caddy/releases/tag/v2.6.0
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
www: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
*
* <hvo.pm@xs4all.nl>
* Aaron Dalton <aaron@FreeBSD.org>
* Aaron Dalton <aaron@daltons.ca>
* Aaron LI <aly@aaronly.me>
* Aaron Zauner <az_mail@gmx.at>
* Abel Chow <achow@transoft.net>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Adrian Steinmann <ast@marabu.ch>
* Akinori MUSHA aka knu <knu@idaemons.org>
(Only the first 15 lines of the commit message are shown above )
www/caddy: Update to 2.5.2
Changes:
This patch release fixes bugs, adds some new features, and makes
worthwhile enhancements. We recommend everyone test and upgrade!
Many improvements have been made to the reverse_proxy module.
Highlights:
New /adapt admin endpoint: Use your installed config adapters via
API in addition to the existing caddy adapt CLI command.
New Etag/If-Match support for config API: Safely update your config
concurrently and avoid collisions by using our unique Etag
implementation.
Rename copied headers from reverse_proxy: If you're using
handle_response, you can more easily map headers to a different name
for clients.
Many HTTP matchers have been added to CEL: You can now use the logic
of our HTTP request matchers in CEL expressions.
www/caddy: Update to 2.5.0
Changes:
Highlights
* Reverse proxy: ✨ Dynamic upstreams, which is the ability to get the
list of upstreams at every request (more specifically, every iteration
in the proxy loop of every request) rather than just once at
config-load time. Dynamic upstream modules can be plugged in to
provide Caddy with the latest list of backends in real-time. Two
standard modules have been implemented which can get upstreams from
SRV and A/AAAA record lookups.
*⚠️This deprecates the lookup_srv JSON field for upstreams (and srv+
(Only the first 15 lines of the commit message are shown above )
net/geoipupdate, www/caddy: Remove ca_root_nss
Now that 12.3 is the minimum supported, remove ca_root_nss hard
deps. For systems that have caroot, ca_root_nss is to my knowledge
vestigial and unused, and does nothing except install things.
www/caddy: Update to 2.4.4
Changes:
* acmeserver: Don't set host for directory links by default
* acmeserver: Trim slashes from path prefix
* admin: Implement load_interval to pull config on a timer (#4246)
* admin: Sync server variables (fix #4260) (#4274)
* caddyfile: Better error message for missing site block braces (#4301)
* caddyfile: Error on invalid site addresses containing comma (#4302)
* caddyfile: keep error chain info in Dispenser.Errf (#4233)
* caddyhttp: Fix edgecase with auto HTTP->HTTPS logic (#4243)
* caddyhttp: Fix incorrect determination of gRPC protocol (#4236)
* caddyhttp: Updated the documentation for MatchQuery (#4295)
* caddytls: Remove "IssuerRaw" field
* cmd: Fix paths when using an env file (#4296)
(Only the first 15 lines of the commit message are shown above )
www/caddy: Update to 2.4.1
Changes:
A small patch release that contains a few noncritical but pleasant
fixes (unless you're using /id/ endpoints in the admin API; then you
should definitely get this update).
admin: Reinstate internal redirect for /id/ requests
caddyfile: Add parse error on site address with trailing {
cmd: upgrade: inherit the permissions of the original executable
httpcaddyfile: Fix automation policy consolidation again
logging: Implement dial timeout for net writer
reverseproxy: Set the headers in the replacer before handle_response
Number of commits found: 123 (showing only 100 on this page)
