Skip to content

Commit 04ac46e

Browse files
authored
Merge branch 'caddyserver:master' into fix/admin-warnings-in-response
2 parents 106f1ec + 3c003de commit 04ac46e

40 files changed

+503
-120
lines changed

.github/workflows/ci.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -65,15 +65,15 @@ jobs:
6565
actions: write # to allow uploading artifacts and cache
6666
steps:
6767
- name: Harden the runner (Audit all outbound calls)
68-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
68+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
6969
with:
7070
egress-policy: audit
7171

7272
- name: Checkout code
7373
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
7474

7575
- name: Install Go
76-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
76+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
7777
with:
7878
go-version: ${{ matrix.GO_SEMVER }}
7979
check-latest: true
@@ -162,7 +162,7 @@ jobs:
162162
continue-on-error: true # August 2020: s390x VM is down due to weather and power issues
163163
steps:
164164
- name: Harden the runner (Audit all outbound calls)
165-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
165+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
166166
with:
167167
egress-policy: audit
168168
allowed-endpoints: ci-s390x.caddyserver.com:22
@@ -221,7 +221,7 @@ jobs:
221221
if: github.event.pull_request.head.repo.full_name == 'caddyserver/caddy' && github.actor != 'dependabot[bot]'
222222
steps:
223223
- name: Harden the runner (Audit all outbound calls)
224-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
224+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
225225
with:
226226
egress-policy: audit
227227

@@ -233,7 +233,7 @@ jobs:
233233
version: latest
234234
args: check
235235
- name: Install Go
236-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
236+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
237237
with:
238238
go-version: "~1.25"
239239
check-latest: true

.github/workflows/cross-build.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,15 +51,15 @@ jobs:
5151
continue-on-error: true
5252
steps:
5353
- name: Harden the runner (Audit all outbound calls)
54-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
54+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
5555
with:
5656
egress-policy: audit
5757

5858
- name: Checkout code
5959
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
6060

6161
- name: Install Go
62-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
62+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
6363
with:
6464
go-version: ${{ matrix.GO_SEMVER }}
6565
check-latest: true

.github/workflows/lint.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -45,12 +45,12 @@ jobs:
4545

4646
steps:
4747
- name: Harden the runner (Audit all outbound calls)
48-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
48+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
4949
with:
5050
egress-policy: audit
5151

5252
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
53-
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
53+
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
5454
with:
5555
go-version: '~1.25'
5656
check-latest: true
@@ -73,7 +73,7 @@ jobs:
7373
runs-on: ubuntu-latest
7474
steps:
7575
- name: Harden the runner (Audit all outbound calls)
76-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
76+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
7777
with:
7878
egress-policy: audit
7979

@@ -90,14 +90,14 @@ jobs:
9090
pull-requests: write
9191
steps:
9292
- name: Harden the runner (Audit all outbound calls)
93-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
93+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
9494
with:
9595
egress-policy: audit
9696

9797
- name: 'Checkout Repository'
9898
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
9999
- name: 'Dependency Review'
100-
uses: actions/dependency-review-action@595b5aeba73380359d98a5e087f648dbb0edce1b # v4.7.3
100+
uses: actions/dependency-review-action@56339e523c0409420f6c2c9a2f4292bbb3c07dd3 # v4.8.0
101101
with:
102102
comment-summary-in-pr: on-failure
103103
# https://github.com/actions/dependency-review-action/issues/430#issuecomment-1468975566

.github/workflows/release.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939

4040
steps:
4141
- name: Harden the runner (Audit all outbound calls)
42-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
42+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
4343
with:
4444
egress-policy: audit
4545

@@ -49,7 +49,7 @@ jobs:
4949
fetch-depth: 0
5050

5151
- name: Install Go
52-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
52+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
5353
with:
5454
go-version: ${{ matrix.GO_SEMVER }}
5555
check-latest: true
@@ -109,11 +109,11 @@ jobs:
109109
git verify-tag "${{ steps.vars.outputs.version_tag }}" || exit 1
110110
111111
- name: Install Cosign
112-
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # main
112+
uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # main
113113
- name: Cosign version
114114
run: cosign version
115115
- name: Install Syft
116-
uses: anchore/sbom-action/download-syft@da167eac915b4e86f08b264dbdbc867b61be6f0c # main
116+
uses: anchore/sbom-action/download-syft@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # main
117117
- name: Syft version
118118
run: syft version
119119
- name: Install xcaddy

.github/workflows/release_published.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,20 +24,20 @@ jobs:
2424

2525
# See https://github.com/peter-evans/repository-dispatch
2626
- name: Harden the runner (Audit all outbound calls)
27-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
27+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
2828
with:
2929
egress-policy: audit
3030

3131
- name: Trigger event on caddyserver/dist
32-
uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
32+
uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4.0.0
3333
with:
3434
token: ${{ secrets.REPO_DISPATCH_TOKEN }}
3535
repository: caddyserver/dist
3636
event-type: release-tagged
3737
client-payload: '{"tag": "${{ github.event.release.tag_name }}"}'
3838

3939
- name: Trigger event on caddyserver/caddy-docker
40-
uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
40+
uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4.0.0
4141
with:
4242
token: ${{ secrets.REPO_DISPATCH_TOKEN }}
4343
repository: caddyserver/caddy-docker

.github/workflows/scorecard.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737

3838
steps:
3939
- name: Harden the runner (Audit all outbound calls)
40-
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
40+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
4141
with:
4242
egress-policy: audit
4343

@@ -47,7 +47,7 @@ jobs:
4747
persist-credentials: false
4848

4949
- name: "Run analysis"
50-
uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
50+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
5151
with:
5252
results_file: results.sarif
5353
results_format: sarif
@@ -81,6 +81,6 @@ jobs:
8181
# Upload the results to GitHub's code scanning dashboard (optional).
8282
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
8383
- name: "Upload to code-scanning"
84-
uses: github/codeql-action/upload-sarif@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d # v3.29.5
84+
uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.29.5
8585
with:
8686
sarif_file: results.sarif

admin.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1029,6 +1029,13 @@ func handleConfig(w http.ResponseWriter, r *http.Request) error {
10291029
return err
10301030
}
10311031

1032+
// If this request changed the config, clear the last
1033+
// config info we have stored, if it is different from
1034+
// the original source.
1035+
ClearLastConfigIfDifferent(
1036+
r.Header.Get("Caddy-Config-Source-File"),
1037+
r.Header.Get("Caddy-Config-Source-Adapter"))
1038+
10321039
default:
10331040
return APIError{
10341041
HTTPStatus: http.StatusMethodNotAllowed,

caddy.go

Lines changed: 88 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -975,11 +975,11 @@ func Version() (simple, full string) {
975975
if CustomVersion != "" {
976976
full = CustomVersion
977977
simple = CustomVersion
978-
return
978+
return simple, full
979979
}
980980
full = "unknown"
981981
simple = "unknown"
982-
return
982+
return simple, full
983983
}
984984
// find the Caddy module in the dependency list
985985
for _, dep := range bi.Deps {
@@ -1059,7 +1059,7 @@ func Version() (simple, full string) {
10591059
}
10601060
}
10611061

1062-
return
1062+
return simple, full
10631063
}
10641064

10651065
// Event represents something that has happened or is happening.
@@ -1197,6 +1197,91 @@ var (
11971197
rawCfgMu sync.RWMutex
11981198
)
11991199

1200+
// lastConfigFile and lastConfigAdapter remember the source config
1201+
// file and adapter used when Caddy was started via the CLI "run" command.
1202+
// These are consulted by the SIGUSR1 handler to attempt reloading from
1203+
// the same source. They are intentionally not set for other entrypoints
1204+
// such as "caddy start" or subcommands like file-server.
1205+
var (
1206+
lastConfigMu sync.RWMutex
1207+
lastConfigFile string
1208+
lastConfigAdapter string
1209+
)
1210+
1211+
// reloadFromSourceFunc is the type of stored callback
1212+
// which is called when we receive a SIGUSR1 signal.
1213+
type reloadFromSourceFunc func(file, adapter string) error
1214+
1215+
// reloadFromSourceCallback is the stored callback
1216+
// which is called when we receive a SIGUSR1 signal.
1217+
var reloadFromSourceCallback reloadFromSourceFunc
1218+
1219+
// errReloadFromSourceUnavailable is returned when no reload-from-source callback is set.
1220+
var errReloadFromSourceUnavailable = errors.New("reload from source unavailable in this process") //nolint:unused
1221+
1222+
// SetLastConfig records the given source file and adapter as the
1223+
// last-known external configuration source. Intended to be called
1224+
// only when starting via "caddy run --config <file> --adapter <adapter>".
1225+
func SetLastConfig(file, adapter string, fn reloadFromSourceFunc) {
1226+
lastConfigMu.Lock()
1227+
lastConfigFile = file
1228+
lastConfigAdapter = adapter
1229+
reloadFromSourceCallback = fn
1230+
lastConfigMu.Unlock()
1231+
}
1232+
1233+
// ClearLastConfigIfDifferent clears the recorded last-config if the provided
1234+
// source file/adapter do not match the recorded last-config. If both srcFile
1235+
// and srcAdapter are empty, the last-config is cleared.
1236+
func ClearLastConfigIfDifferent(srcFile, srcAdapter string) {
1237+
if (srcFile != "" || srcAdapter != "") && lastConfigMatches(srcFile, srcAdapter) {
1238+
return
1239+
}
1240+
SetLastConfig("", "", nil)
1241+
}
1242+
1243+
// getLastConfig returns the last-known config file and adapter.
1244+
func getLastConfig() (file, adapter string, fn reloadFromSourceFunc) {
1245+
lastConfigMu.RLock()
1246+
f, a, cb := lastConfigFile, lastConfigAdapter, reloadFromSourceCallback
1247+
lastConfigMu.RUnlock()
1248+
return f, a, cb
1249+
}
1250+
1251+
// lastConfigMatches returns true if the provided source file and/or adapter
1252+
// matches the recorded last-config. Matching rules (in priority order):
1253+
// 1. If srcAdapter is provided and differs from the recorded adapter, no match.
1254+
// 2. If srcFile exactly equals the recorded file, match.
1255+
// 3. If both sides can be made absolute and equal, match.
1256+
// 4. If basenames are equal, match.
1257+
func lastConfigMatches(srcFile, srcAdapter string) bool {
1258+
lf, la, _ := getLastConfig()
1259+
1260+
// If adapter is provided, it must match.
1261+
if srcAdapter != "" && srcAdapter != la {
1262+
return false
1263+
}
1264+
1265+
// Quick equality check.
1266+
if srcFile == lf {
1267+
return true
1268+
}
1269+
1270+
// Try absolute path comparison.
1271+
sAbs, sErr := filepath.Abs(srcFile)
1272+
lAbs, lErr := filepath.Abs(lf)
1273+
if sErr == nil && lErr == nil && sAbs == lAbs {
1274+
return true
1275+
}
1276+
1277+
// Final fallback: basename equality.
1278+
if filepath.Base(srcFile) == filepath.Base(lf) {
1279+
return true
1280+
}
1281+
1282+
return false
1283+
}
1284+
12001285
// errSameConfig is returned if the new config is the same
12011286
// as the old one. This isn't usually an actual, actionable
12021287
// error; it's mostly a sentinel value.

caddyconfig/httpcaddyfile/builtins.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -481,7 +481,7 @@ func parseTLS(h Helper) ([]ConfigValue, error) {
481481
// Validate DNS challenge config: any DNS challenge option except "dns" requires a DNS provider
482482
if acmeIssuer != nil && acmeIssuer.Challenges != nil && acmeIssuer.Challenges.DNS != nil {
483483
dnsCfg := acmeIssuer.Challenges.DNS
484-
providerSet := dnsCfg.ProviderRaw != nil || h.Option("dns") != nil
484+
providerSet := dnsCfg.ProviderRaw != nil || h.Option("dns") != nil || h.Option("acme_dns") != nil
485485
if len(dnsOptionsSet) > 0 && !providerSet {
486486
return nil, h.Errf(
487487
"setting DNS challenge options [%s] requires a DNS provider (set with the 'dns' subdirective or 'acme_dns' global option)",

caddyconfig/httpcaddyfile/tlsapp.go

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -564,23 +564,22 @@ func fillInGlobalACMEDefaults(issuer certmagic.Issuer, options map[string]any) e
564564
if globalACMECARoot != nil && !slices.Contains(acmeIssuer.TrustedRootsPEMFiles, globalACMECARoot.(string)) {
565565
acmeIssuer.TrustedRootsPEMFiles = append(acmeIssuer.TrustedRootsPEMFiles, globalACMECARoot.(string))
566566
}
567-
if globalACMEDNSok {
567+
if globalACMEDNSok && (acmeIssuer.Challenges == nil || acmeIssuer.Challenges.DNS == nil || acmeIssuer.Challenges.DNS.ProviderRaw == nil) {
568568
globalDNS := options["dns"]
569-
if globalDNS != nil {
570-
// If global `dns` is set, do NOT set provider in issuer, just set empty dns config
571-
acmeIssuer.Challenges = &caddytls.ChallengesConfig{
572-
DNS: &caddytls.DNSChallengeConfig{},
573-
}
574-
} else if globalACMEDNS != nil {
575-
// Set a global DNS provider if `acme_dns` is set and `dns` is NOT set
576-
acmeIssuer.Challenges = &caddytls.ChallengesConfig{
577-
DNS: &caddytls.DNSChallengeConfig{
578-
ProviderRaw: caddyconfig.JSONModuleObject(globalACMEDNS, "name", globalACMEDNS.(caddy.Module).CaddyModule().ID.Name(), nil),
579-
},
580-
}
581-
} else {
569+
if globalDNS == nil && globalACMEDNS == nil {
582570
return fmt.Errorf("acme_dns specified without DNS provider config, but no provider specified with 'dns' global option")
583571
}
572+
if acmeIssuer.Challenges == nil {
573+
acmeIssuer.Challenges = new(caddytls.ChallengesConfig)
574+
}
575+
if acmeIssuer.Challenges.DNS == nil {
576+
acmeIssuer.Challenges.DNS = new(caddytls.DNSChallengeConfig)
577+
}
578+
// If global `dns` is set, do NOT set provider in issuer, just set empty dns config
579+
if globalDNS == nil && acmeIssuer.Challenges.DNS.ProviderRaw == nil {
580+
// Set a global DNS provider if `acme_dns` is set and `dns` is NOT set
581+
acmeIssuer.Challenges.DNS.ProviderRaw = caddyconfig.JSONModuleObject(globalACMEDNS, "name", globalACMEDNS.(caddy.Module).CaddyModule().ID.Name(), nil)
582+
}
584583
}
585584
if globalACMEEAB != nil && acmeIssuer.ExternalAccount == nil {
586585
acmeIssuer.ExternalAccount = globalACMEEAB.(*acme.EAB)

0 commit comments

Comments
 (0)