Caddy is a powerful, enterprise-ready, open source web server with automatic
HTTPS written in Go.
Features:
- Easy configuration with the Caddyfile
- Powerful configuration with JSON config
- Dynamic configuration with a JSON API
- Config adapters if you don't like JSON
- Automatic HTTPS by default
- ACME (Let's Encrypt) for public sites
- Fully-managed local CA for internal names and IPs
- Can coordinate with other Caddy instances in a cluster
- HTTP/1.1, HTTP/2, and HTTP/3 support
- Actually fun to use
Reason:
The default admin endpoint has changed from localhost:2019 to
/var/run/caddy/caddy.sock. Using a Unix socket is more secure,
allowing it to be secured by filesystem permissions rather than
requiring a firewall.
If you only control caddy from the rc(8) script (service caddy ...),
you don't need to do anything. If you access the API yourself, you
will want to update your scripts to use the new socket.
To use the old endpoint, add the following to /etc/rc.conf:
caddy_admin="localhost:2019"
Reason:
The default locations for caddy runtime files have changed.
- Caddy's runtime log is now /var/log/caddy/caddy.log
(was /var/log/caddy.log)
- Automatic SSL certs are now stored in /var/db/caddy/data/caddy
(was /root/.local/share/caddy)
- Configuration autosaves are now stored in /var/db/caddy/config/caddy
(was /root/.config/caddy)
You can change these defaults. See /usr/local/etc/rc.d/caddy for the
list of settings.
www/caddy: Update to 2.4.1
Changes:
A small patch release that contains a few noncritical but pleasant
fixes (unless you're using /id/ endpoints in the admin API; then you
should definitely get this update).
admin: Reinstate internal redirect for /id/ requests
caddyfile: Add parse error on site address with trailing {
cmd: upgrade: inherit the permissions of the original executable
httpcaddyfile: Fix automation policy consolidation again
logging: Implement dial timeout for net writer
reverseproxy: Set the headers in the replacer before handle_response
www/caddy: Update to 2.4.0
Changes:
* Secure remote management. You can now enable secure remote access to
Caddy's admin API! It uses TLS mutual authentication, and you can even
define permissions for different users. PR #3994
* Config pull at start. Caddy can be configured to load a different
config at startup. This is useful if your config is federated through
a separate system that doesn't have the ability to push configs to
Caddy. This feature is modular, so configurations can be loaded
different ways! PR #3994
* Server identity management. Caddy can automatically manage its own
server identity certificate, which can be used when negotiating TLS
connections with peers. This is required when enabling the secure
(Only the first 15 lines of the commit message are shown above )
www/caddy: Change all caddy runtime locations
Thanks to work by scf, the caddy rc(8) script has been completely
rewritten and substantially improved, though this necessitated
changing all runtime locations.
Most importantly:
- The runtime log now lives in /var/log/caddy/ instead of /var/log,
so that the logdir can be null-mounted
- Automatic SSL certs are now stored in /var/db/caddy/data/caddy,
instead of /root/.local/share/caddy
Caddy uses freedesktop.org's XDG base dir specification, which
conflicts quite spectacularly with FreeBSD's hier(7). The most
sensible thing to do was to put the runtime data stores into
/var/db/caddy, though XDG needs XDG_DATA_HOME and XDG_CONFIG_HOME
to be separate dirs and caddy will create a .../caddy subdir in
each of them.
www/caddy: Update to 2.3.0 and take maintainership
Thanks to Daniel Tihanyi for all his work maintaining this port!
While here, a number of cleanups:
- Simplify Makefile
- Remove pkg-message whose instructions were superseded by @sample
- Re-enable cgo. It seems to work fine now.
- Rename the rc(8) 'validate' subcommand to 'configtest' for clarity and
consistency
- Add a little more info to the sample Caddyfile
- Point to instructions for getting access logs working
Changes: https://github.com/caddyserver/caddy/releases/tag/v2.3.0
PR: 254436
Approved by: Daniel Tihanyi (outgoing maintainer)
www/caddy: fix build when archivers/zstd is installed
www/caddy ships with an obsoleted go wrapper for zstd. We need a newer one or
the build will fail if archivers/zstd is installed.
PR: 248547
Submitted by: riedre@ya.ru
Reviewed by: daniel.tihanyi@tetragir.com (maintainer)
Go ports: cleanup, finish transition to USES=go started with r505321 (cat.
sysutils-x11)
- Remove custom build/install targets left in place after r505321
- Switch to the new GO_TARGET tuple syntax introduced in r512001
Reviewed by: tobik
Approved by: araujo (mentor), portmgr (adamw)
Differential Revision: https://reviews.freebsd.org/D21744
Add missing run dependency to security/ca_root_nss
Caddy has a feature for automatic Certification installation
from let's encrypt for HTTPS.
Without security/ca_root_nss certificates are impossible to
install, because root certificate is missing.
Bump PORTREVISION.
PR: 237293
Submitted by: Pwny Tail <pwnytail@bsd.services>
Approved by: Fabian Freyer <fabian.freyer@physik.tu-berlin.de> (maintainer)
MFH: 2019Q2
