caddy/dist/CHANGES.txt

CHANGES


0.11.2 (January 16, 2019)
- Extracted automagic TLS code into CertMagic library
- Add support for new clustering plugins
- New placeholder: '{when_iso_local}'
- New third-party plugins: s3browser, filebrowser
- Removed third-party plugins: jekyll, hugo
- bind: Support multiple interface values
- import: Can now be used within directive blocks
- proxy: Status 499 when clients close connection early
- templates: No longer emit ETag and Last-Modified headers
- tls: Support for the ACME TLS-ALPN-01 challenge
- KNOWN/UNRESOLVED REGRESSIONS: #2356, #2414
- Several bug fixes and minor improvements


0.11.1 (November 12, 2018)
- New -env-file flag to load environment from file
- New event type 'instancerestart'
- fastcgi: Strip PATH_INFO from SCRIPT_FILENAME
- fastcgi: Add REQUEST_SCHEME to environment
- gzip: Compress .m3u and .m3u8 files by default
- telemetry: Honor CADDY_UUID_FILE env variable
- templates: New .TLSVersion action
- tls: Remove remaining RSA_CBC cipher suites from defaults
- tls: Raise alert if no certificate matches exactly
- Numerous other bug fixes and improvements


0.11 (May 10, 2018)
- Built with Go 1.10.2
- Integrated optional telemetry client
- proxy: Fixed file descriptor leak


0.10.14 (April 19, 2018)
- tls: Fix error handling bug when obtaining certificates


0.10.13 (April 18, 2018)
- New third-party plugin: supervisor
- Updated QUIC
- proxy: Fix transparent pass-thru of X-Forwarded-For
- proxy: Configurable timeout to upstream
- rewrite: Now supports regular expressions on single-line
- tls: StrictHostMatching mode to prevent client auth bypass
- tls: Disable client auth when using QUIC
- tls: Require same client auth cert pools per hostname
- tls: Prevent On-Demand TLS directory traversal
- tls: Fix empty files when using ACME fails to obtain cert
- Fixed test broken by 1.1.1.1 resolving
- Improved Caddyfile parser robustness by fuzzing


0.10.12 (March 27, 2018)
- Switch to Let's Encrypt ACMEv2 production endpoint
- Support for automated wildcard certificates
- Support distributed solving of HTTP-01 challenge
- New {labelN}, {tls_cipher}, and {tls_version} placeholders
- Curly braces can now be escaped when not used as placeholders
- New third-party plugin: geoip
- Updated QUIC
- fastcgi: Add SSL_CIPHER and SSL_PROTOCOL environment variables
- log: New 'except' subdirective to exempt paths from logging
- startup/shutdown: Removed in favor of 'on'
- tls: Default minimum version is TLS 1.2
- tls: Revert to fallback cert if no cert matches SNI
- tls: New 'wildcard' subdirective to force automated wildcard cert
- Several significant bug fixes and improvements!


0.10.11 (February 20, 2018)
- Built with Go 1.10
- Reusable snippets for the Caddyfile
- Updated QUIC
- Auto-HTTPS certificates may be shared by multiple instances
- Expand globbed values in -conf flag
- Swap behavior of SIGTERM and SIGQUIT; ignore SIGHUP
- 9 new DNS provider plugins for the ACME DNS challenge
- New placeholder for {<Response-Header} values
- basicauth: Username put in {user} placeholder
- fastcgi: GET requests can now send a body
- proxy: Service discovery with DNS SRV load balancing
- request_id: Allow reusing request ID from header field
- tls: Improved efficiency of many certificates and reloads
- tls: Raise error if conflicting TLS configurations collide
- tls: Raise TLS alert if SNI used and no cert matched
- tls: Reject OCSP responses that expire after the certificate
- tls: Clients can use SNI to request a specific certificate
- tls: Add option for backend to approve on-demand certificate
- tls: Synchronize maintenance of shared, managed certificates
- Numerous fabulous bug fixes


0.10.10 (October 9, 2017)
- Built with Go 1.9.1
- Removed Caddy-Sponsors header
- New 'on' directive that deprecates 'startup' and 'shutdown'
- Changed CASE_SENSITIVE_PATH default to false
- fastcgi: Support for SRV upstreams
- redir: Rules with if statements are not checked for duplicates
- Several minor bug fixes


0.10.9 (September 12, 2017)
- EULA bundled with official binaries
- Caddy-Sponsors header to indicate personal-use license
- proxy: Support for QUIC backends
- templates: Write proper status code if proxied
- tls: Fix bug related to cert renewals


0.10.8 (September 8, 2017)
- NACL compilation support
- Merge multiple consecutive slashes when comparing paths
- A few other bug fixes


0.10.7 (August 25, 2017)
- Built with Go 1.9
- New 3rd-party plugin directives: jekyll, awses, forwardproxy
- Different exit codes
- Plan 9 support
- Graceful binary upgrades with SIGUSR2
- internal: Support X-Accel-Redir without paths to protect
- templates: Can execute templates loaded by other middleware
- A few really good bug fixes


0.10.6 (July 28, 2017)
- fastcgi: Fix runtime error for 32-bit and ARM architectures


0.10.5 (July 27, 2017)
- Renamed requestid directive to request_id
- Set default idle timeout of 5 minutes
- New 3rd-party plugin directives: cache, nobots, webdav
- New Unix timestamp placeholder {when_unix}
- Improved MITM detection on iOS clients
- errors, log: Fix log rolling parsing
- gzip: Convert any ETag header to weak etag
- fastcgi: Reverted persistent connections (issue #1736)
- proxy: Added header loaded balancing policy
- proxy: Fix hang on chunked WebSockets (e.g. with HomeAssistant)
- Several other bug fixes and minor internal improvements


0.10.4 (June 28, 2017)
- Vendor all dependencies
- Improve MITM detection, add experimental Tor browser support
- New requestid directive to add request IDs to each request
- New HTTP plugins supported: authz, grpc, gopkg, reauth, restic
- browse: Refreshed default UI and added symlink indicators
- errors, log: Added rotate_compress directive to compress rolled logs
- markdown: Template files loaded at each request instead of just once
- proxy: Allow multiple Server header fields on downstream response
- proxy: Perform health checks by body substring
- rewrite,redir: Added 'not_starts_with' and 'not_ends_with' operators
- tls: New ca subdirective to specify CA endpoint per-site
- Several bug fixes


0.10.3 (May 19, 2017)
- Replace 'maxrequestbody' directive with 'limits' directive
- proxy: Configurable port for health check
- proxy: New load balance policy: uri_hash
- templates: Renamed .Push context action to .AddLink
- tls: Allow narrower certificate renewal window at startup (#1680)
- tls: Prefer ChaCha20 if hardware does not have AES-NI


0.10.2 (May 2, 2017)
- Hot fix for rule paths of "/" so that they match every request
- fastcgi: Match request paths that don't start with "/" even if rule does


0.10.1 (May 1, 2017)
- Reduced memory usage for gzip, templates, and MITM detection
- Fixed automatic HTTP->HTTPS redirects for sites with wildcard labels
- proxy: Fix 'without' subdirective
- A few other minor bug fixes and improvements


0.10 (April 20, 2017)
- Built on Go 1.8.1
- HTTPS interception detection
- Updated QUIC
- SIGUSR1 (reload) now works with QUIC servers
- New 'push' directive for HTTP/2 server push
- New 'index' directive to change the names of index files
- New -http-port and -https-port flags to change protocol ports
- New -disable-http-challenge and -disable-tls-sni-challenge flags
- New event hook plugin type
- New listener middleware plugin type
- New placeholders for cookie, query, and rewritten URI values
- basicauth: Ability to customize realm
- browse: Default template now sorts by name with directories first
- errors, log: Roll all logs by default
- errors, log: Ability to write to remote syslog
- errors, log: Standardized, simplified directive syntax
- log: Patched common log format by adding missing "-"
- proxy: New 'max_conns' setting to limit connections to upstreams
- proxy: New 'first' load balancing policy for first available host
- proxy: Health checks respect Host and insecure_skip_verify settings
- templates: New .RandomString action to add random padding to page
- timeouts: Disabled default HTTP timeouts
- tls: Settings now apply per-site rather than for entire listener
- tls: New 'alpn' setting to disable either HTTP/2 or HTTP/1.1 on per-site basis
- tls: Added curve X25519
- tls: Added ChaCha20-Poly1305 cipher suites
- tls: Renamed muststaple to must_staple
- tls: Setting max_certs obtains certs during handshakes for all hostnames
- Dozens of miscellaneous bug fixes and improvements
- New website
- New build infrastructure
- New deployment system


0.9.5 (January 24, 2017)
- New -validate flag to only check a Caddyfile, then exit
- New {when_iso} placeholder for timestamp ISO 8601 in UTC
- New {rewrite_path} and {rewrite_path_escaped} placeholders
- New 'timeouts' directive to configure or disable HTTP timeouts
- HTTP-level timeouts enabled by default
- basicauth: Authorization header stripped upon successful login
- browse: Added textbox to filter listing in default template
- browse: Sanitize file names and links in default template
- browse: Ensure active Caddyfile is hidden regardless of cwd
- fastcgi: New 'root' property, mainly for use with containers
- markdown: Apply some front matter fields as <meta> tags
- proxy: Fixed HTTP/2 upstream to backend; honors -http CLI flag
- proxy: Fixed websockets over HTTPS
- proxy: Reduced memory usage and improved performance
- proxy: Added support for HTTP trailers
- tls: Fixed deadlock that affected some background renewals
- Several other smaller bugs squashed and improvements made


0.9.4 (December 21, 2016)
- Updated QUIC
- New maxrequestbody directive to limit size of request body
- New {latency_ms} placeholder for latency always in ms
- Serve statically compressed .gz and .br files
- fastcgi: Support for multiple backends with basic load balancing
- proxy: Fixed handling of encoded 'without' paths
- proxy: Preserve trailing slash if present in request
- proxy: Fix HTTP/2 upstreams
- templates: New .Files action to list files in a directory
- templates: .Include can now pass arguments to included file
- tls: Added ability to customize preferred curves
- tls: Added support for Must-Staple on managed certificates
- tls: Fixed subtle edge case bug with TLS-SNI challenge
- Lots of minor fixes and improvements


0.9.3 (September 28, 2016)
- Updated QUIC to newer version
- import: Glob pattern matching 0 files is no longer an error
- fastcgi: Fixed persistent connections (disabled by default)
- fastcgi: Configurable connection pool size parameter
- proxy: Improved failover load balancing logic
- proxy: Avoids duplicating header fields that would be confusing
- proxy: New try_duration and try_interval parameters
- proxy: Fix for IP hash policy when downed hosts come back up
- Several other bug fixes and new tests


0.9.2 (September 20, 2016)
- New -catimeout option to customize ACME CA HTTP timeout
- import: Fix nested import absolute/relative paths
- log: Fix multiple log outputs
- proxy: Fix for keepalive in certain cases
- tls: Fix for PreferServerCipherSuites
- Numerous other bug fixes and internal improvements


0.9.1 (August 17, 2016)
- New {request_body} placeholder to log request body
- {remote} placeholder no longer uses X-Forwarded-For header
- {latency} placeholder rounds to nice looking number
- Add support for ratelimit plugin
- basicauth: Declaring realm named "Restricted"
- errors: Define catch-all/default error page with * character
- header: More control to add, set, or remove headers
- proxy: New keepalive setting to help accommodate busy servers
- proxy: New load balancing policy ip_hash
- proxy: Fixed WebSocket connections
- proxy: Fixed broken header logic
- proxy: Reuse existing connection for Upgrade requests
- proxy: Support for basic auth from header or upstream address
- templates: New .Env action to access environment variables
- tls: OCSP staples persisted to disk
- tls: ACME challenges honor bind directive
- tls: Fix default protocol version (minimum TLS 1.1)
- tls: Consume challenge requests only for names Caddy is solving for
- tls: The protocol syntax allows just one value if desired
- tls: Scoped max_certs limit to site instead of global maximum
- Many other bug fixes and minor enhancements


0.9 (July 18, 2016)
- New core
- New experimental QUIC support with -quic flag (HTTPS only)
- New -type option to specify other server types
- Moved ~/.caddy/letsencrypt to ~/.caddy/acme and reorganized assets
- Moved caddy package to top level folder, and pushed main to subfolder
- New {request} placeholder to dump entire request (without body)
- New {hostonly} placeholder for only hostname portion of host value
- Site addresses can have paths
- Site addresses can make some use of wildcards in domains
- Renamed -directives flag to -plugins
- Restarting no longer requires spawning a new process
- Removed -restart option
- fastcgi: Env variables now support placeholders
- import: Import paths now relative to Caddyfile, not current working dir
- markdown: Overhauled; removed site generation features
- proxy: More control of headers; deprecating proxy_header subdirective
- proxy: Specify multiple upstreams with optional port ranges
- proxy: New preset 'transparent' to simplify common pass-thru headers
- proxy: Chooses longest matching path; order declared is irrelevant
- redir: Added if and if_op subdirectives to make conditional redirects
- rewrite: Support for if_op to change how conditions are evaluated
- tls: Generate self-signed certificates in memory
- tls: Support for ACME DNS challenge with 10 providers
- tls: Support for TLS-SNI challenge during restarts
- Various bug fixes and enhancements


0.8.3 (April 26, 2016)
- Built with Go 1.6.2
- New pprof middleware for exposing process profiling endpoints
- New expvar middleware for exposing memory/GC performance
- New -restart option to force in-process restarts on Unix systems
- Only fail to start if managed certificate is expired (issue #642)
- Toggle case-sensitive path matching with environment variable
- File server now adds ETag header for static files
- browse: Replace .LinkedPath action with .BreadcrumbMap
- fastcgi: New except clause to exclude paths
- proxy: New max_conns setting to limit max connections per upstream
- proxy: New replaceable value for name of upstream host
- templates: New utility actions for dealing with strings
- tls: Customize certificate key with key_type (+ECC)
- tls: Session ticket keys are now rotated
- Many other minor internal improvements and bug fixes


0.8.2 (February 25, 2016)
- On-demand TLS can obtain certificates during handshakes
- Built with Go 1.6
- Process log (-log) is rotated when it gets large
- Managed certificates get renewed 30 days early instead of just 14
- fastcgi: Allow scheme prefix before address
- markdown: Support for definition lists
- proxy: Allow proxy to insecure HTTPS backends
- proxy: Support proxy to unix socket
- rewrite: Status code can be 2xx or 4xx
- templates: New .Markdown action to interpret included file as Markdown
- templates: .Truncate now truncates from end of string when length is negative
- tls: Set hard limit for certificates obtained with on-demand TLS
- tls: Load certificates from directory
- tls: Add SHA384 cipher suites
- Multiple bug fixes and internal changes


0.8.1 (January 12, 2016)
- Improved OCSP stapling
- Better graceful reload when new hosts need certificates from Let's Encrypt
- Current pidfile is now deleted when Caddy exits
- browse: New default template
- gzip: Added min_length setting
- import: Support for glob patterns (*) to import multiple files
- rewrite: New complex rules with conditions, regex captures, and status code
- tls: Removed DES ciphers from default cipher suite list
- tls: All supported certificates are OCSP-stapled
- tls: Allow custom configuration without specifying certificate and key
- tls: No longer allow HTTPS over port 80
- Dozens of bug fixes, improvements, and more tests across the board


0.8 (December 4, 2015)
- HTTPS by default via Let's Encrypt (certs & keys are fully managed)
- Graceful restarts (on POSIX-compliant systems)
- Major internal refactoring to allow use of Caddy as library
- New directive 'mime' to customize Content-Type based on file extension
- New -accept flag to accept Let's Encrypt SA without prompt
- New -email flag to customize default email used for ACME transactions
- New -ca flag to customize ACME CA server URL
- New -revoke flag to revoke a certificate
- New -log flag to enable process log
- New -pidfile flag to enable writing pidfile
- New -grace flag to customize the graceful shutdown timeout
- New support for SIGHUP, SIGTERM, and SIGQUIT signals
- browse: Render filenames with multiple whitespace properly
- core: Use environment variables in Caddyfile
- markdown: Include Last-Modified header in response
- markdown: Render tables, strikethrough, and fenced code blocks
- proxy: Ability to exclude/ignore paths from proxying
- startup, shutdown: Better Windows support
- templates: Bug fix for .Host when port is absent
- templates: Include Last-Modified header in response
- templates: Support for custom delimiters
- tls: For non-local hosts, default port is now 443 unless specified
- tls: Force-disable HTTPS
- tls: Specify Let's Encrypt email address
- Many, many more tests and numerous bug fixes and improvements


0.7.6 (September 28, 2015)
- Pass in simple Caddyfile as command line arguments
- basicauth: Support for legacy htpasswd files
- browse: JSON response with file listing
- core: Caddyfile as command line argument
- errors: Can write full stack trace to HTTP response for debugging
- errors, log: Roll log files after certain size or age
- proxy: Fix for 32-bit architectures
- rewrite: Better compatibility with fastcgi and PHP apps
- templates: Added .StripExt and .StripHTML methods
- Internal improvements and minor bug fixes


0.7.5 (August 5, 2015)
- core: All listeners bind to 0.0.0.0 unless 'bind' directive is used
- fastcgi: Set HTTPS env variable if connection is secure
- log: Output to system log (except Windows)
- markdown: Added dev command to disable caching during development
- markdown: Fixed error reporting during initial site generation
- markdown: Fixed crash if path does not exist when server starts
- markdown: Fixed site generation and link indexing when files change
- templates: Added .NowDate for use in date-related functions
- Several bug fixes related to startup and shutdown functions


0.7.4 (July 30, 2015)
- browse: Sorting preference persisted in cookie
- browse: Added index.txt and default.txt to list of default files
- browse: Template files may now use Caddy template actions
- markdown: Template files may now use Caddy template actions
- markdown: Several bug fixes, especially for large and empty Markdown files
- markdown: Generate index pages to link to markdown pages (sitegen only)
- markdown: Flatten structure of front matter, changed template variables
- redir: Can use variables (placeholders) like log formats can
- redir: Catch-all redirects no longer preserve path; use {uri} instead
- redir: Syntax supports redirect tables by opening a block
- templates: Renamed .Date to .Now and added .Truncate, .Replace actions
- Other minor internal improvements and more tests


0.7.3 (July 15, 2015)
- errors: Error log now shows timestamp with each entry
- gzip: Fixed; Default filtering is by extension; removed MIME type filter
- import: Fixed; works inside and outside server blocks
- redir: Query string preserved on catch-all redirects
- templates: Proper 403 or 404 errors for restricted or missing files


0.7.2 (July 1, 2015)
- Custom builds through caddyserver.com - extend Caddy by writing addons
- browse: Sort by clicking column heading or using query string
- core: Serving hostname that doesn't resolve issues warning then listens on 0.0.0.0
- errors: Missing error page during parse time is warning, not error
- ext: Extension only appended if request path does not end in /
- fastcgi: Fix for backend responding without status text
- fastcgi: Fix PATH_TRANSLATED when PATH_INFO is empty (RFC 3875)
- git: Removed from core (available as add-on)
- gzip: Enable by file path and/or extension
- gzip: Customize compression level
- log: Fix for missing status in log entry when error unhandled
- proxy: Strip prefix from path for proxy to path
- redir: Meta tag redirects
- templates: Support for nested includes
- Internal improvements and more tests


0.7.1 (June 2, 2015)
- basicauth: Patched timing vulnerability
- proxy: Support for WebSocket backends
- tls: Client authentication


0.7 (May 25, 2015)
- New directive 'internal' to protect resources with X-Accel-Redirect
- New -version flag to show program name and version
- core: Fixed escaped backslash characters inside quoted strings
- core: Fixed parsing Caddyfile for IPv6 addresses missing ports
- core: A notice is shown when non-local address resolves to loopback interface
- core: Warns if file descriptor limit is too low for production site (Mac/Linux)
- fastcgi: Support for Unix sockets
- git: Fixed issue that prevented pulling at designated interval
- header: Remove a header field by prefixing field name with "-"
- markdown: Simple static site generation
- markdown: Support for metadata ("front matter") at beginning of files
- rewrite: Experimental support for regular expressions
- tls: Customize cipher suites and protocols
- tls: Removed RC4 ciphers
- Other internal improvements that are not user-facing (more tests, etc.)


0.6 (May 7, 2015)
- New directive 'git' to automatically pull changes
- New directive 'bind' to override host server binds to
- New -root flag to specify root path to default site
- Ability to receive config data piped through stdin
- core: Warning if root directory doesn't exist at startup
- core: Entire process dies if any server fails to start
- gzip: Fixed Content-Length value when proxying requests
- errors: Error log now includes file and line number of panics
- fastcgi: Pass custom environment variables
- fastcgi: Support for HEAD, OPTIONS, PUT, PATCH, and DELETE methods
- fastcgi: Fixed SERVER_SOFTWARE variables
- markdown: Support for index files when URL points to a directory
- proxy: Load balancing with multiple backends, health checks, failovers, and multiple policies
- proxy: Add custom headers
- startup/shutdown: Run command in background with '&' at end
- templates: Added .tpl and .tmpl as default extensions
- templates: Support for index files when URL points to a directory
- templates: Changed .RemoteAddr to .IP and stripped out remote port
- tls: TLS disabled (with warning) for servers that are explicitly http://
- websocket: Fixed SERVER_SOFTWARE and GATEWAY_INTERFACE variables
- Many internal improvements


0.5.1 (April 30, 2015)
- Default host is now 0.0.0.0 (wildcard)
- New -host and -port flags to override default host and port
- core: Support for binding to 0.0.0.0
- core: Graceful error handling during heavy load; proper error responses
- errors: Fixed file path handling
- errors: Fixed panic due to nil log file
- fastcgi: Support for index files
- fastcgi: Fix for handling errors that come from responder


0.5 (April 28, 2015)
- Initial release