Caddy

Caddy 2.11.2 contains numerous bug fixes and enhancements! I know that's a lame summary but it's really all over the place.

Highlights

• Reverse proxy got a lot of love with certain edge cases related to PROXY protocol, health check port, and closing body on retries. Dynamic upstreams are now tracked which enables passive health checking.
• Performance improvements for metrics.
• New tls_resolvers global option to control DNS resolvers for all sites when using the ACME DNS challenge.
• Log rolling now supports zstd compression; deprecated roll_gzip, which will be removed in the future. Use roll_compression instead.
• Refined logging and some error messages.
• Fixed a bug in rewrite handler that could cause some URIs to not be rewritten when URI pa

Our community is pleased to announce Caddy 2.11! Of note are new features, numerous bug fixes including several security patches, and various QoL ("quality-of-life") enhancements.

There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1.

Special Sponsor Shoutout

Extra big thanks to our major sponsors:

• ZeroSSL
• Stripe
• Railway

They, along with dozens of smaller sponsors, make this project and new releases possible, together with our maintainer team. Thank you all!

Notable changes

• Encrypted ClientHello (ECH) keys are rotated automatically.
• Time-rolling options for logs.
• SIGUSR1

Welcome to the second beta version of 2.11. We are closer to a final release. This includes some minor new features and enhancements, and a fix for the ZeroSSL API issuer.

Thank you to everyone who contributed!

Changelog

• 8a87bb3 build(deps): bump github.com/smallstep/certificates (#7381)
• 7b031e1 build(deps): bump the all-updates group across 1 directory with 12 updates (#7421)
• be5f49f caddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true (#7372)
• 6e0cbd0 caddyhttp: create a placeholder for and log ech status (#7328)
<

Welcome to the beta version of 2.11. This is the first release made by our new, automated release process developed by @mohammed90 that was carried out and approved entirely by our maintainer team (together with @francislavoie) without intervention from @mholt, the original Caddy author. This represents a significant step forward in project autonomy and growth, ensuring that the project's stability and longevity is not reliant upon a single person.

This first beta release was primarily to test our new workflow, so there's still a couple things left to do before the stable release.

Featured here are numerous, mostly minor, bug fixes and enhancements, mostly affecting edge c

This is a hotfix release to fix a couple critical issues from v2.10.1

What's Changed

• http: Make logger first, before TLS provisioning by @francislavoie in #7198
• httpcaddyfile: Fix acme_dns regression by @francislavoie in #7199
• caddyfile: Fix importing nested tokens for {block} by @BeeJay28 in #7189

Changelog

• 551f793 caddyfile: Fix importing nested tokens for {block} (#7189)
• 16fe83c http: Make logger first, before TLS provisioning (#7198)
• 4564261 httpcaddyfile: Fix acme_dns regression (#7199)

Ne

This is probably our biggest patch release ever -- not that lots of things were broken, but there's lots of refinement happening thanks to broader adoption and contributions from many more people. Just look at the New Contributors below!

Anyway, this release does contain some bug fixes and dependency upgrades which we hope will serve you well. Let us know if there's any issues! And thank you to all who contributed, especially our reliable maintainer team!

What's Changed

• update quic-go to v0.51.0 by @marten-seemann in #6972
• forwardproxy: reference correct field name in LoadModule by @mohammed90 in #6978
• fix: Remove nil arg from zapslog.NewHandler call by @IndraGunawan in #6984
• fileserver: Add

Caddy 2.10 is here! Aside from bug fixes, this release features:

• Encrypted ClientHello (ECH): This new technology encrypts the last plaintext portion of a TLS connection: the ClientHello, which includes the domain name being connected to. The draft spec for ECH is almost finalized, so we can now support this privacy feature for TLS. This is a powerful but nuanced capability; we highly recommend reading the ECH documentation on our website.
• Post-quantum (PQC) key exchange: Caddy now supports the standardized x25519mlkem768 cryptographic group by default.
• ACME profiles: ACME profiles are an experimental draft that allow you to choose properties of your certificates with more flexibility than traditional CSR methods. For example, Let's Encryp

Welcome to the pre-release versions for Caddy 2.10! We hope you will try these betas in your production environments after verifying them in testing/staging, and offer your feedback so the stable release will be better.

We're excited for 2.10, as it will bring many improvements, new features, and fixes to your web server. Expect several beta versions as we work through a backlog of issues and pull requests.

Aside from many bug fixes, this beta already features:

• Encrypted ClientHello (ECH): The draft spec for ECH is almost finalized, so we can now support this privacy feature for TLS. This is a powerful but nuanced capability; see below (and docs on the website) for details.
• P

Welcome to the pre-release versions for Caddy 2.10! We hope you will try these betas in your production environments after verifying them in testing/staging, and offer your feedback so the stable release will be better.

We're excited for 2.10, as it will bring many improvements, new features, and fixes to your web server. Expect several beta versions as we work through a backlog of issues and pull requests.

Aside from many bug fixes, this beta already features:

• Encrypted ClientHello (ECH): The draft spec for ECH is almost finalized, so we can now support this privacy feature for TLS. This is a powerful but nuanced capability; see below (and docs on the website) for details.
• P

Welcome to the pre-release versions for Caddy 2.10! We hope you will try these betas in your production environments after verifying them in testing/staging, and offer your feedback so the stable release will be better.

We're excited for 2.10, as it will bring many improvements, new features, and fixes to your web server. Expect several beta versions as we work through a backlog of issues and pull requests.

Aside from many bug fixes, this beta already features:

• Encrypted ClientHello (ECH): The draft spec for ECH is almost finalized, so we can now support this privacy feature for TLS. This is a powerful but nuanced capability; see below (and docs on the website) for details.
• P

Welcome to the pre-release versions for Caddy 2.10! We hope you will try these betas in your production environments after verifying them in testing/staging, and offer your feedback so the stable release will be better.

We're excited for 2.10, as it will bring many improvements, new features, and fixes to your web server. Expect several beta versions as we work through a backlog of issues and pull requests.

Aside from many bug fixes, this first beta already features:

• Encrypted ClientHello (ECH): The draft spec for ECH is almost finalized, so we can now support this privacy feature for TLS. This is a powerful but nuanced capability; see below (and docs on the website) for details.