all: Bump after lang/go121 update

MFH:		2024Q2

lang/go: Change DEFAULT to 1.21

PR:		277776
Approved by:	portmgr (exp-run)

all: Bump PORTREVISION after lang/go* update

PR:		276530

www/caddy{,-custom}: chown caddy.log to caddy user/group

We have set caddy.log to root:wheel, which works for the default case
of running caddy as root.

When caddy is run as a non-root users, caddy.log can't actually be
written to. Instead, chown caddy.log to the caddy user/group so that
it can be written to.

PR:		276150

www/caddy{,-custom}: Fix start/stop with admin API disabled

Caddy largely relies on the admin API for state control, like
start/stop/reload. However, the admin API endpoints are inherently
a security risk.

Although the admin API is enabled by default, many users may choose
to disable it. However, the rc(8) script then needs an alternative
approach to controlling the daemon.

We already sortof supported signal-based control, but it didn't always
work, because there are multiple error messages that indicate that
the admin API is disabled (and none of them actually say that in a clear
way).

This commit fixes start and stop with the admin API disabled. The
reload command (and reloadssl) still require the admin API to be
enabled and will fail if the admin API is disabled.

PR:		255106
Submitted by:	scf

www/caddy: Update to 2.7.6

all: Bump PORTREVISION after lang/go* update

PR:		274405

www/caddy: Correct typo in pkg-message

www/caddy: Secure the default admin API endpoint

Caddy's default of localhost:2019, particularly combined with the port
defaulting to root:wheel, can be a significant security risk.

Mitigate this by setting the default to /var/run/caddy/caddy.sock, which
will be protected by filesystem permissions.  Prior behaviour can be
restored with 'sysrc caddy_admin=localhost:2019'

Additionally, help users prepare for a change to running Caddy as
www:www by default using the new security/portacl-rc port in an update
message, and by extending the comments in the rc script.

www/caddy: Add reloadssl rc(8) command

`service caddy reloadssl` instructs Caddy to reload its TLS
certificates. This is useful when using Caddy with ACME DNS
providers, as it allows for the renewal of certificates without
manually deleting the old ones and restarting Caddy.

PR:		274085

www/caddy: Update to 2.7.5

all: Bump PORTREVISION after lang/go* update

www/caddy: Update to 2.7.4

www/caddy: Update to 2.7.3

all: Bump PORTREVISION after lang/go{119,120} update

www/caddy: Update to 2.7.2

www/caddy: Update to 2.7.0

all: Bump PORTREVISION after lang/go{119,120} update

www/caddy{,-custom}: Fix startup with JSON configuration

Caddy supports a wide number of configuration file formats, including
its built-in "Caddyfile" format, and the "native" format is JSON.

When anything other than the native JSON format is used, caddy needs to
be passed the --adapter [formatname] flag (though it automatically
handles the case where the config filename is Caddyfile). However, as
JSON is the native format, there is no "json" adapter.

The added patch drops the --adapter flag when caddy_adapter is "json".

PR:		270120

all: Bump PORTREVISION after Go ports update

all: Bump PORTREVISION after lang/go{119,120} update

www/caddy: Update to 2.6.4

Changes:
This release contains a hotfix for a regression in v2.6.3 related to
proxying chunked requests. We recommend that all users who do so upgrade
to v2.6.4.

Note that, in an effort to make error-prone configs less likely, we have
deprecated the reverse proxy options:

    buffer_requests
    buffer_responses
    max_buffer_size

and have introduced 2 new ones which take a size argument to enable
buffering:

    request_buffers <size>
    response_buffers <size>

The deprecated options will be removed in a later version of Caddy, so
please start using the new parameters instead.

all: Bump PORTREVISION after GO_DEFAULT update.

www/caddy: Update to 2.6.3

Major changes:

* New trusted_proxies global option (within servers) can be used to
  specify trusted proxy IP ranges globally. This is important if relying
  on headers for client IP addresses.

* Proxied WebSocket connections are now logged with correct status code
  and "size" (bytes read + bytes written).

* The quic-go package has received significant optimizations, so HTTP/3
  should be more efficient now.

www/caddy: Pin Go version to 1.19

vendor/github.com/lucas-clemente/quic-go/internal/qtls/go120.go:5:13: cannot use
"The version of quic-go you're using can't be built on Go 1.20 yet.

quic-go doesn't support go1.20 yet, keep building this port with go1.19
for now.

PR:		269289
Reported by:	exp-run

all: Bump PORTVERSION after lang/go{118,119} update

all: Bump PORTREVISION after lang/go{118,119} update

www/caddy: Update to v2.6.2

Changes: https://github.com/caddyserver/caddy/releases/tag/v2.6.2

www/caddy: Conflict with caddy-custom, not xcaddy

all: Bump PORTREVISION after lang/go{118,119} update

www/(x)caddy: Fix rc(8) script

rc.subr(8) needs $command to be set or it can't inspect the pidfile.
Without it, rc.d/caddy never believes that caddy is running which
impedes stopping.

Thanks to scf for figuring out what was going wrong here.

www/xcaddy: Add rc(8) script

Bring in the rc(8) script from caddy to xcaddy so that xcaddy users
can control caddy like an adult.

Add CONFLICTS between xcaddy and caddy because they now install the
same rc(8) script. There's no reason to change the install path here
because, as olgeni put it, "xcaddy with plugins is more caddy than
caddy".

Suggested by:	bdrewery
Approved by:	olgeni (xcaddy maintainer)

www/caddy: Allow setting the path to the caddy binary

This will make the rc(8) script more usable for users who build
caddy with xcaddy (www/xcaddy).

www/caddy: Provide a version string

When build from ports, `caddy version` returns an empty string.

Upstream likes caddy to be built from their xcaddy command, for which
FreeBSD has a port (www/xcaddy) and a package (pkg install xcaddy).
However, our package builders cannot use xcaddy itself, as it needs
external network access. Caddy itself contains no ability to set the
version without the extensive patching that xcaddy performs.

This commit adds a version string to allow the version to be set.
When built with xcaddy, the version string can contain a checksum of
some sort, but we are just using ${DISTVERSIONFULL} here (e.g. v2.6.1).

The lack of a version string has been brought up a number of times to
me, so I'm happy to put this issue to bed.

See https://github.com/caddyserver/caddy/issues/5065 for the latest
discussion about it.

www/caddy: Update to 2.6.1

www/caddy: Update to 2.6.0

Also, improve the rc(8) script with updates by scf, allowing proper
daemon shutdown regardless of whether the admin API is enabled.

2.6.0 is a significant update, bringing automatic HTTP/3 (QUIC) support,
a fully abstracted fileserver (serve static files from a database, a
tarball, a script, etc.), and lots more.

Extensive update notes: https://github.com/caddyserver/caddy/releases/tag/v2.6.0

all: Bump PORTREVISION after lang/go{118,119} update

Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)

Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

www/caddy: Support go117 and go119

all: Bump PORTREVISION after Go update

Bump Go ports PORTREVISION after GO_DEFAULT and lang/go118 update.

www: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *
  *  <hvo.pm@xs4all.nl>
  *  Aaron Dalton <aaron@FreeBSD.org>
  *  Aaron Dalton <aaron@daltons.ca>
  *  Aaron LI <aly@aaronly.me>
  *  Aaron Zauner <az_mail@gmx.at>
  *  Abel Chow <achow@transoft.net>
  *  Adam Weinberger <adamw@FreeBSD.org>
  *  Ade Lovett <ade@FreeBSD.org>
  *  Adrian Steinmann <ast@marabu.ch>
  *  Akinori MUSHA aka knu <knu@idaemons.org>

all: Bump PORTREVISION after lang/go{117,118} update

www/caddy: Update to 2.5.2

Changes:
This patch release fixes bugs, adds some new features, and makes
worthwhile enhancements. We recommend everyone test and upgrade!

Many improvements have been made to the reverse_proxy module.

Highlights:

    New /adapt admin endpoint: Use your installed config adapters via
    API in addition to the existing caddy adapt CLI command.

    New Etag/If-Match support for config API: Safely update your config
    concurrently and avoid collisions by using our unique Etag
    implementation.

    Rename copied headers from reverse_proxy: If you're using
    handle_response, you can more easily map headers to a different name
    for clients.

    Many HTTP matchers have been added to CEL: You can now use the logic
    of our HTTP request matchers in CEL expressions.

*/*: Bump port revisons after lang/go{117,118} update

www/caddy: Update to 2.5.1

www/caddy: Update to 2.5.0

Changes:

Highlights

* Reverse proxy: ✨ Dynamic upstreams, which is the ability to get the
  list of upstreams at every request (more specifically, every iteration
  in the proxy loop of every request) rather than just once at
  config-load time. Dynamic upstream modules can be plugged in to
  provide Caddy with the latest list of backends in real-time. Two
  standard modules have been implemented which can get upstreams from
  SRV and A/AAAA record lookups.

   *⚠️This deprecates the lookup_srv JSON field for upstreams (and srv+

net/geoipupdate, www/caddy: Remove ca_root_nss

Now that 12.3 is the minimum supported, remove ca_root_nss hard
deps. For systems that have caroot, ca_root_nss is to my knowledge
vestigial and unused, and does nothing except install things.

*/*: Bump PORTREVISION after lang/go 1.18 update

www/caddy: Update packages

This fixes build with go 1.18.

www/caddy: Update to 2.4.6

www/caddy: Add CPE information

Approved by:	portmgr (blanket)

www/caddy: Update to 2.4.5

Changes:
 - cmd: export CaddyVersion(), Commands() (#4316)
 - encode: ignore flushing until after first write (#4318)
 - go.mod: Update CertMagic

*: Clean up some things

- Fix typos
- Remove duplicate variables
- Remove nop or unreferenced variables
- Add missing ports to the build
- Clean up commented PORTREVISION
- Add missing USES

Reported by:	portscan

www/caddy: Update to 2.4.4

Changes:
  *  acmeserver: Don't set host for directory links by default
  *  acmeserver: Trim slashes from path prefix
  *  admin: Implement load_interval to pull config on a timer (#4246)
  *  admin: Sync server variables (fix #4260) (#4274)
  *  caddyfile: Better error message for missing site block braces (#4301)
  *  caddyfile: Error on invalid site addresses containing comma (#4302)
  *  caddyfile: keep error chain info in Dispenser.Errf (#4233)
  *  caddyhttp: Fix edgecase with auto HTTP->HTTPS logic (#4243)
  *  caddyhttp: Fix incorrect determination of gRPC protocol (#4236)
  *  caddyhttp: Updated the documentation for MatchQuery (#4295)
  *  caddytls: Remove "IssuerRaw" field
  *  cmd: Fix paths when using an env file (#4296)

www/caddy: Update to 2.4.3

www/caddy: Update to 2.4.1

Changes:

  A small patch release that contains a few noncritical but pleasant
  fixes (unless you're using /id/ endpoints in the admin API; then you
  should definitely get this update).

  admin: Reinstate internal redirect for /id/ requests
  caddyfile: Add parse error on site address with trailing {
  cmd: upgrade: inherit the permissions of the original executable
  httpcaddyfile: Fix automation policy consolidation again
  logging: Implement dial timeout for net writer
  reverseproxy: Set the headers in the replacer before handle_response

www/caddy: Use go:modules to reduce the massive GH_TUPLE

www/caddy: Update to 2.4.0

Changes:

* Secure remote management. You can now enable secure remote access to
  Caddy's admin API! It uses TLS mutual authentication, and you can even
  define permissions for different users. PR #3994
* Config pull at start. Caddy can be configured to load a different
  config at startup. This is useful if your config is federated through
  a separate system that doesn't have the ability to push configs to
  Caddy. This feature is modular, so configurations can be loaded
  different ways! PR #3994
* Server identity management. Caddy can automatically manage its own
  server identity certificate, which can be used when negotiating TLS
  connections with peers. This is required when enabling the secure

all: Remove all other $FreeBSD keywords.

Remove # $FreeBSD$ from Makefiles.

www/caddy: Change all caddy runtime locations

Thanks to work by scf, the caddy rc(8) script has been completely
rewritten and substantially improved, though this necessitated
changing all runtime locations.

Most importantly:
- The runtime log now lives in /var/log/caddy/ instead of /var/log,
  so that the logdir can be null-mounted

- Automatic SSL certs are now stored in /var/db/caddy/data/caddy,
  instead of /root/.local/share/caddy

Caddy uses freedesktop.org's XDG base dir specification, which
conflicts quite spectacularly with FreeBSD's hier(7). The most
sensible thing to do was to put the runtime data stores into
/var/db/caddy, though XDG needs XDG_DATA_HOME and XDG_CONFIG_HOME
to be separate dirs and caddy will create a .../caddy subdir in
each of them.

www/caddy: Sort GH_TUPLE

www/caddy: Fix fetch

No idea how I wound up listing the same package 5 times
with two different versions, but here we are.

www/caddy: Update to 2.3.0 and take maintainership

Thanks to Daniel Tihanyi for all his work maintaining this port!

While here, a number of cleanups:
- Simplify Makefile
- Remove pkg-message whose instructions were superseded by @sample
- Re-enable cgo. It seems to work fine now.
- Rename the rc(8) 'validate' subcommand to 'configtest' for clarity and
consistency
- Add a little more info to the sample Caddyfile
- Point to instructions for getting access logs working

Changes: https://github.com/caddyserver/caddy/releases/tag/v2.3.0

PR:		254436
Approved by:	Daniel Tihanyi (outgoing maintainer)

www/caddy: Update to 2.2.1

PR:		250447
Submitted by:	Daniel Tihanyi <daniel.tihanyi@tetragir.com> (maintainer)

www/caddy: fix build when archivers/zstd is installed

www/caddy ships with an obsoleted go wrapper for zstd. We need a newer one or
the build will fail if archivers/zstd is installed.

PR:	248547
Submitted by:	riedre@ya.ru
Reviewed by:	daniel.tihanyi@tetragir.com (maintainer)

www/caddy: upgrade 1.0.4 -> 2.1.1

- previous version was deprecated by upstream
- submitter becomes maintainer

PR:		246623
Submitted by:	daniel.tihanyi@tetragir.com
Reviewed by:	basil.hendroff@gmail.com, dan@familybrown.org
Approved by:	fabian.freyer@physik.tu-berlin.de (maintainer timeout)
Relnotes:	https://caddyserver.com/v2

www/caddy: Update to 1.0.4

- While here, unbreak on aarch64
(https://github.com/caddyserver/caddy/pull/2956)

PR:		242441
Submitted by:	Shawn Wilsher <me@shawnwilsher.com>
Reviewed by:	GremL1N <viktor.dvz@gmail.com>, dmgk
Approved by:	maintainer timeout (fabian.freyer@physik.tu-berlin.de, 1 month)

Bump PORTREVISION after r517743 to force relinking.

Approved by:	araujo (mentor)
Differential Revision:	https://reviews.freebsd.org/D21854

Go ports: cleanup, finish transition to USES=go started with r505321 (cat.
sysutils-x11)

- Remove custom build/install targets left in place after r505321
- Switch to the new GO_TARGET tuple syntax introduced in r512001

Reviewed by:	tobik
Approved by:	araujo (mentor), portmgr (adamw)
Differential Revision:	https://reviews.freebsd.org/D21744

Convert to UCL & cleanup pkg-message (categories w)

Add missing run dependency to security/ca_root_nss

Caddy has a feature for automatic Certification installation
from let's encrypt for HTTPS.
Without security/ca_root_nss certificates are impossible to
install, because root certificate is missing.

Bump PORTREVISION.

PR:		237293
Submitted by:	Pwny Tail <pwnytail@bsd.services>
Approved by:	 Fabian Freyer <fabian.freyer@physik.tu-berlin.de> (maintainer)
MFH:		2019Q2

Upgrade www/caddy from v0.11.1 to vO.11.5

Changelogs:
  * https://github.com/mholt/caddy/releases/tag/v0.11.5
  * https://github.com/mholt/caddy/releases/tag/v0.11.4
  * https://github.com/mholt/caddy/releases/tag/v0.11.3
  * https://github.com/mholt/caddy/releases/tag/v0.11.2

PR:		236834
Submitted by:	Mohamed Akram <mohd.akram@outlook.com>
Approved by:	Fabian Freyer <fabian.freyer@physik.tu-berlin.de> (maintainer)

www/caddy: Update to 0.11.1

PR:		234629
Submitted by:	Fabian Freyer <fabian.freyer@physik.tu-berlin.de> (maintainer)

www/caddy: Update to 0.11.0

PR:		228158
Submitted by:	Fabian Freyer <fabian.freyer@physik.tu-berlin.de> (maintainer)

www/caddy: update to 0.10.14

PR:		227764
Submitted by:	maintainer

Update www/caddy to 0.10.12

PR:	27089
Submitted by:	fabian.freyer@physik.tu-berlin.de
Approved by:	tcberner (mentor)
Differential Revision:	https://reviews.freebsd.org/D14903

www/caddy: Update to 0.10.11

Additional port chanegs:
* Added pkg-message
* Removed STRIP= because it is safe to strip go executables
* Improved do-build

PR:		226131
Submitted by:	Fabian Freyer <fabian.freyer@physik.tu-berlin.de> (maintainer)
Approved by:	tcberner (mentor, implicit)
Differential Revision:	https://reviews.freebsd.org/D14475

Add caddy 0.10.10, fast, cross-platform HTTP/2 web server with automatic
HTTPS.

PR:		222938
Submitted by:	fabian.freyer@physik.tu-berlin.de