.editorconfig

@@ -1,5 +0,0 @@
-[*]
-end_of_line = lf
-
-[caddytest/integration/caddyfile_adapt/*.caddyfiletest]
-indent_style = tab

.gitattributes

@@ -1 +0,0 @@
-*.go text eol=lf

.github/CONTRIBUTING.md

@@ -1,197 +0,0 @@
-Contributing to Caddy
-=====================
-
-Welcome! Thank you for choosing to be a part of our community. Caddy wouldn't be nearly as excellent without your involvement!
-
-For starters, we invite you to join [the Caddy forum](https://caddy.community) where you can hang out with other Caddy users and developers.
-
-## Common Tasks
-
-- [Contributing code](#contributing-code)
-- [Writing a Caddy module](#writing-a-caddy-module)
-- [Asking or answering questions for help using Caddy](#getting-help-using-caddy)
-- [Reporting a bug](#reporting-bugs)
-- [Suggesting an enhancement or a new feature](#suggesting-features)
-- [Improving documentation](#improving-documentation)
-
-Other menu items:
-
-- [Values](#values)
-- [Coordinated Disclosure](#coordinated-disclosure)
-- [Thank You](#thank-you)
-
-
-### Contributing code
-
-You can have a huge impact on the project by helping with its code. To contribute code to Caddy, first submit or comment in an issue to discuss your contribution, then open a [pull request](https://github.com/caddyserver/caddy/pulls) (PR). If you're new to our community, that's okay: **we gladly welcome pull requests from anyone, regardless of your native language or coding experience.** You can get familiar with Caddy's code base by using [code search at Sourcegraph](https://sourcegraph.com/github.com/caddyserver/caddy).
-
-We hold contributions to a high standard for quality :bowtie:, so don't be surprised if we ask for revisions—even if it seems small or insignificant. Please don't take it personally. :blue_heart: If your change is on the right track, we can guide you to make it mergeable.
-
-Here are some of the expectations we have of contributors:
-
-- **Open an issue to propose your change first.** This way we can avoid confusion, coordinate what everyone is working on, and ensure that any changes are in-line with the project's goals and the best interests of its users. We can also discuss the best possible implementation. If there's already an issue about it, comment on the existing issue to claim it. A lot of valuable time can be saved by discussing a proposal first.
-
-- **Keep pull requests small.** Smaller PRs are more likely to be merged because they are easier to review! We might ask you to break up large PRs into smaller ones. [An example of what we want to avoid.](https://twitter.com/iamdevloper/status/397664295875805184)
-
-- **Keep related commits together in a PR.** We do want pull requests to be small, but you should also keep multiple related commits in the same PR if they rely on each other.
-
-- **Write tests.** Good, automated tests are very valuable! Written properly, they ensure your change works, and that other changes in the future won't break your change. CI checks should pass.
-
-- **Benchmarks should be included for optimizations.** Optimizations sometimes make code harder to read or have changes that are less than obvious. They should be proven with benchmarks and profiling.
-
-- **[Squash](http://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html) insignificant commits.** Every commit should be significant. Commits which merely rewrite a comment or fix a typo can be combined into another commit that has more substance. Interactive rebase can do this, or a simpler way is `git reset --soft <diverging-commit>` then `git commit -s`.
-
-- **Be responsible for and maintain your contributions.** Caddy is a growing project, and it's much better when individual contributors help maintain their change after it is merged.
-
-- **Use comments properly.** We expect good godoc comments for package-level functions, types, and values. Comments are also useful whenever the purpose for a line of code is not obvious.
-
-- **Pull requests may still get closed.** The longer a PR stays open and idle, the more likely it is to be closed. If we haven't reviewed it in a while, it probably means the change is not a priority. Please don't take this personally, we're trying to balance a lot of tasks! If nobody else has commented or reacted to the PR, it likely means your change is useful only to you. The reality is this happens quite a lot. We don't tend to accept PRs that aren't generally helpful. For these reasons or others, the PR may get closed even after a review. We are not obligated to accept all proposed changes, even if the best justification we can give is something vague like, "It doesn't sit right." Sometimes PRs are just the wrong thing or the wrong time. Because it is open source, you can always build your own modified version of Caddy with a change you need, even if we reject it in the official repo. Plus, because Caddy is extensible, it's possible your feature could make a great plugin instead!
-
-- **You certify that you wrote and comprehend the code you submit.** The Caddy project welcomes original contributions that comply with [our CLA](https://cla-assistant.io/caddyserver/caddy), meaning that authors must be able to certify that they created or have rights to the code they are contributing. In addition, we require that code is not simply copy-pasted from Q/A sites or AI language models without full comprehension and rigorous testing. In other words: contributors are allowed to refer to communities for assistance and use AI tools such as language models for inspiration, but code which originates from or is assisted by these resources MUST be:
-
-	- Licensed for you to freely share
-	- Fully comprehended by you (be able to explain every line of code)
-	- Verified by automated tests when feasible, or thorough manual tests otherwise
-
-	We have found that current language models (LLMs, like ChatGPT) may understand code syntax and even problem spaces to an extent, but often fail in subtle ways to convey true knowledge and produce correct algorithms. Integrated tools such as GitHub Copilot and Sourcegraph Cody may be used for inspiration, but code generated by these tools still needs to meet our criteria for licensing, human comprehension, and testing. These tools may be used to help write code comments and tests as long as you can certify they are accurate and correct. Note that it is often more trouble than it's worth to certify that Copilot (for example) is not giving you code that is possibly plagiarised, unlicensed, or licensed with incompatible terms -- as the Caddy project cannot accept such contributions. If that's too difficult for you (or impossible), then we recommend using these resources only for inspiration and write your own code. Ultimately, you (the contributor) are responsible for the code you're submitting.
-
-	As a courtesy to reviewers, we kindly ask that you disclose when contributing code that was generated by an AI tool or copied from another website so we can be aware of what to look for in code review.
-
-We often grant [collaborator status](#collaborator-instructions) to contributors who author one or more significant, high-quality PRs that are merged into the code base.
-
-
-#### HOW TO MAKE A PULL REQUEST TO CADDY
-
-Contributing to Go projects on GitHub is fun and easy. After you have proposed your change in an issue, we recommend the following workflow:
-
-1. [Fork this repo](https://github.com/caddyserver/caddy). This makes a copy of the code you can write to.
-
-2. If you don't already have this repo (caddyserver/caddy.git) repo on your computer, clone it down: `git clone https://github.com/caddyserver/caddy.git`
-
-3. Tell git that it can push the caddyserver/caddy.git repo to your fork by adding a remote: `git remote add myfork https://github.com/<your-username>/caddy.git`
-
-4. Make your changes in the caddyserver/caddy.git repo on your computer.
-
-5. Push your changes to your fork: `git push myfork`
-
-6. [Create a pull request](https://github.com/caddyserver/caddy/pull/new/master) to merge your changes into caddyserver/caddy @ master. (Click "compare across forks" and change the head fork.)
-
-This workflow is nice because you don't have to change import paths. You can get fancier by using different branches if you want.
-
-
-### Writing a Caddy module
-
-Caddy can do more with modules! Anyone can write one. Caddy modules are Go libraries that get compiled into Caddy, extending its feature set. They can add directives to the Caddyfile, add new configuration adapters, and even implement new server types (e.g. HTTP, DNS).
-
-[Learn how to write a module here](https://caddyserver.com/docs/extending-caddy). You should also share and discuss your module idea [on the forums](https://caddy.community) to have people test it out. We don't use the Caddy issue tracker for third-party modules.
-
-
-### Getting help using Caddy
-
-If you have a question about using Caddy, [ask on our forum](https://caddy.community)! There will be more people there who can help you than just the Caddy developers who follow our issue tracker. Issues are not the place for usage questions.
-
-Many people on the forums could benefit from your experience and expertise, too. Once you've been helped, consider giving back by answering other people's questions and participating in other discussions.
-
-
-### Reporting bugs
-
-Like every software, Caddy has its flaws. If you find one, [search the issues](https://github.com/caddyserver/caddy/issues) to see if it has already been reported. If not, [open a new issue](https://github.com/caddyserver/caddy/issues/new) and describe the bug, and somebody will look into it! (This repository is only for Caddy and its standard modules.)
-
-**You can help us fix bugs!** Speed up the patch by identifying the bug in the code. This can sometimes be done by adding `fmt.Println()` statements (or similar) in relevant code paths to narrow down where the problem may be. It's a good way to [introduce yourself to the Go language](https://tour.golang.org), too.
-
-We may reply with an issue template. Please follow the template so we have all the needed information. Unredacted&mdash;yes, actual values matter. We need to be able to repeat the bug using your instructions. Please simplify the issue as much as possible. If you don't, we might close your report. The burden is on you to make it easily reproducible and to convince us that it is actually a bug in Caddy. This is easiest to do when you write clear, concise instructions so we can reproduce the behavior (even if it seems obvious). The more detailed and specific you are, the faster we will be able to help you!
-
-We suggest reading [How to Report Bugs Effectively](http://www.chiark.greenend.org.uk/~sgtatham/bugs.html).
-
-Please be kind. :smile: Remember that Caddy comes at no cost to you, and you're getting free support when we fix your issues. If we helped you, please consider helping someone else!
-
-#### Bug reporting expectations
-
-Maintainers---or more generally, developers---need three things to act on bugs:
-
-1. To agree or be convinced that it's a bug (reporter's responsibility).
-	- A bug is unintentional, undesired, or surprising behavior which violates documentation or relevant spec. It might be either a mistake in the documentation or a bug in the code.
-	- This project usually does not work around bugs in other software, systems, and dependencies; instead, we recommend that those bugs are fixed at their source. This sometimes means we close issues or reject PRs that attempt to fix, workaround, or hide bugs in other projects.
-
-2. To be able to understand what is happening (mostly reporter's responsibility).
-	- If the reporter can provide satisfactory instructions such that a developer can reproduce the bug, the developer will likely be able to understand the bug, write a test case, and implement a fix. This is the least amount of work for everyone and path to the fastest resolution.
-	- Otherwise, the burden is on the reporter to test possible solutions. This is less preferable because it loosens the feedback loop, slows down debugging efforts, obscures the true nature of the problem from the developers, and is unlikely to result in new test cases.
-
-3. A solution, or ideas toward a solution (mostly maintainer's responsibility).
-	- Sometimes the best solution is a documentation change.
-	- Usually the developers have the best domain knowledge for inventing a solution, but reporters may have ideas or preferences for how they would like the software to work.
-	- Security, correctness, and project goals/vision all take priority over a user's preferences.
-	- It's simply good business to yield a solution that satisfies the users, and it's even better business to leave them impressed.
-
-Thus, at the very least, the reporter is expected to:
-
-1. Convince the reader that it's a bug in Caddy (if it's not obvious).
-2. Reduce the problem down to the minimum specific steps required to reproduce it.
-
-The maintainer is usually able to do the rest; but of course the reporter may invest additional effort to speed up the process.
-
-
-
-### Suggesting features
-
-First, [search to see if your feature has already been requested](https://github.com/caddyserver/caddy/issues). If it has, you can add a :+1: reaction to vote for it. If your feature idea is new, open an issue to request the feature. Please describe your idea thoroughly so that we know how to implement it! Really vague requests may not be helpful or actionable and, without clarification, will have to be closed.
-
-While we really do value your requests and implement many of them, not all features are a good fit for Caddy. Most of those [make good modules](#writing-a-caddy-module), which can be made by anyone! But if a feature is not in the best interest of the Caddy project or its users in general, we may politely decline to implement it into Caddy core. Additionally, some features are bad ideas altogether (for either obvious or non-obvious reasons) which may be rejected. We'll try to explain why we reject a feature, but sometimes the best we can do is, "It's not a good fit for the project."
-
-
-### Improving documentation
-
-Caddy's documentation is available at [https://caddyserver.com/docs](https://caddyserver.com/docs) and its source is in the [website repo](https://github.com/caddyserver/website). If you would like to make a fix to the docs, please submit an issue there describing the change to make.
-
-Note that third-party module documentation is not hosted by the Caddy website, other than basic usage examples. They are managed by the individual module authors, and you will have to contact them to change their documentation.
-
-Our documentation is scoped to the Caddy project only: it is not for describing how other software or systems work, even if they relate to Caddy or web servers. That kind of content [can be found in our community wiki](https://caddy.community/c/wiki/13), however.
-
-## Collaborator Instructions
-
-Collaborators have push rights to the repository. We grant this permission after one or more successful, high-quality PRs are merged! We thank them for their help. The expectations we have of collaborators are:
-
-- **Help review pull requests.** Be meticulous, but also kind. We love our contributors, but we critique the contribution to make it better. Multiple, thorough reviews make for the best contributions! Here are some questions to consider:
-	- Can the change be made more elegant?
-	- Is this a maintenance burden?
-	- What assumptions does the code make?
-	- Is it well-tested?
-	- Is the change a good fit for the project?
-	- Does it actually fix the problem or is it creating a special case instead?
-	- Does the change incur any new dependencies? (Avoid these!)
-
-- **Answer issues.** If every collaborator helped out with issues, we could count the number of open issues on two hands. This means getting involved in the discussion, investigating the code, and yes, debugging it. It's fun. Really! :smile: Please, please help with open issues. Granted, some issues need to be done before others. And of course some are larger than others: you don't have to do it all yourself. Work with other collaborators as a team!
-
-- **Do not merge pull requests until they have been approved by one or two other collaborators.** If a project owner approves the PR, it can be merged (as long as the conversation has finished too).
-
-- **Prefer squashed commits over a messy merge.** If there are many little commits, please [squash the commits](https://stackoverflow.com/a/11732910/1048862) so we don't clutter the commit history.
-
-- **Don't accept new dependencies lightly.** Dependencies can make the world crash and burn, but they are sometimes necessary. Choose carefully. Extremely small dependencies (a few lines of code) can be inlined. The rest may not be needed. For those that are, Caddy uses [go modules](https://github.com/golang/go/wiki/Modules). All external dependencies must be installed as modules, and _Caddy must not export any types defined by those dependencies_. Check this diligently!
-
-- **Be extra careful in some areas of the code.** There are some critical areas in the Caddy code base that we review extra meticulously: the `caddyhttp` and `caddytls` packages especially.
-
-- **Make sure tests test the actual thing.** Double-check that the tests fail without the change, and pass with it. It's important that they assert what they're purported to assert.
-
-- **Recommended reading**
-	- [CodeReviewComments](https://github.com/golang/go/wiki/CodeReviewComments) for an idea of what we look for in good, clean Go code
-	- [Linus Torvalds describes a good commit message](https://gist.github.com/matthewhudson/1475276)
-	- [Best Practices for Maintainers](https://opensource.guide/best-practices/)
-	- [Shrinking Code Review](https://alexgaynor.net/2015/dec/29/shrinking-code-review/)
-
-
-
-## Values (WIP)
-
-- A person is always more important than code. People don't like being handled "efficiently". But we can still process issues and pull requests efficiently while being kind, patient, and considerate.
-
-- The ends justify the means, if the means are good. A good tree won't produce bad fruit. But if we cut corners or are hasty in our process, the end result will not be good.
-
-
-## Security Policy
-
-If you think you've found a security vulnerability, please refer to our [Security Policy](https://github.com/caddyserver/caddy/security/policy) document.
-
-
-## Thank you
-
-Thanks for your help! Caddy would not be what it is today without your contributions.

.github/FUNDING.yml

@@ -1,12 +0,0 @@
-# These are supported funding model platforms
-
-github: [mholt] # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
-patreon: # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
-ko_fi: # Replace with a single Ko-fi username
-tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-liberapay: # Replace with a single Liberapay username
-issuehunt: # Replace with a single IssueHunt username
-otechie: # Replace with a single Otechie username
-custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

.github/SECURITY.md

@@ -1,59 +0,0 @@
-# Security Policy
-
-The Caddy project would like to make sure that it stays on top of all practically-exploitable vulnerabilities.
-
-
-## Supported Versions
-
-| Version  | Supported |
-| -------- | ----------|
-| 2.latest | ✔️        |
-| 1.x      | :x:       |
-| < 1.x    | :x:       |
-
-
-## Acceptable Scope
-
-A security report must demonstrate a security bug in the source code from this repository.
-
-Some security problems are the result of interplay between different components of the Web, rather than a vulnerability in the web server itself. Please only report vulnerabilities in the web server itself, as we cannot coerce the rest of the Web to be fixed (for example, we do not consider IP spoofing, BGP hijacks, or missing/misconfigured HTTP headers a vulnerability in the Caddy web server).
-
-Vulnerabilities caused by misconfigurations are out of scope. Yes, it is entirely possible to craft and use a configuration that is unsafe, just like with every other web server; we recommend against doing that.
-
-We do not accept reports if the steps imply or require a compromised system or third-party software, as we cannot control those. We expect that users secure their own systems and keep all their software patched. For example, if untrusted users are able to upload/write/host arbitrary files in the web root directory, it is NOT a security bug in Caddy if those files get served to clients; however, it _would_ be a valid report if a bug in Caddy's source code unintentionally gave unauthorized users the ability to upload unsafe files or delete files without relying on an unpatched system or piece of software.
-
-Client-side exploits are out of scope. In other words, it is not a bug in Caddy if the web browser does something unsafe, even if the downloaded content was served by Caddy. (Those kinds of exploits can generally be mitigated by proper configuration of HTTP headers.) As a general rule, the content served by Caddy is not considered in scope because content is configurable by the site owner or the associated web application.
-
-Security bugs in code dependencies (including Go's standard library) are out of scope. Instead, if a dependency has patched a relevant security bug, please feel free to open a public issue or pull request to update that dependency in our code.
-
-
-## Reporting a Vulnerability
-
-We get a lot of difficult reports that turn out to be invalid. Clear, obvious reports tend to be the most credible (but are also rare).
-
-First please ensure your report falls within the accepted scope of security bugs (above).
-
-We'll need enough information to verify the bug and make a patch. To speed things up, please include:
-
-- Most minimal possible config (without redactions!)
-- Command(s)
-- Precise HTTP requests (`curl -v` and its output please)
-- Full log output (please enable debug mode)
-- Specific minimal steps to reproduce the issue from scratch
-- A working patch
-
-Please DO NOT use containers, VMs, cloud instances or services, or any other complex infrastructure in your steps. Always prefer `curl -v` instead of web browsers.
-
-We consider publicly-registered domain names to be public information. This necessary in order to maintain the integrity of certificate transparency, public DNS, and other public trust systems. Do not redact domain names from your reports. The actual content of your domain name affects Caddy's behavior, so we need the exact domain name(s) to reproduce with, or your report will be ignored.
-
-It will speed things up if you suggest a working patch, such as a code diff, and explain why and how it works. Reports that are not actionable, do not contain enough information, are too pushy/demanding, or are not able to convince us that it is a viable and practical attack on the web server itself may be deferred to a later time or possibly ignored, depending on available resources. Priority will be given to credible, responsible reports that are constructive, specific, and actionable. (We get a lot of invalid reports.) Thank you for understanding.
-
-When you are ready, please email Matt Holt (the author) directly: matt at dyanim dot com.
-
-Please don't encrypt the email body. It only makes the process more complicated.
-
-Please also understand that due to our nature as an open source project, we do not have a budget to award security bounties. We can only thank you.
-
-If your report is valid and a patch is released, we will not reveal your identity by default. If you wish to be credited, please give us the name to use and/or your GitHub username. If you don't provide this we can't credit you.
-
-Thanks for responsibly helping Caddy&mdash;and thousands of websites&mdash;be more secure!

.github/dependabot.yml

@@ -1,7 +0,0 @@
----
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "monthly"

.github/workflows/ci.yml

@@ -1,220 +0,0 @@
-# Used as inspiration: https://github.com/mvdan/github-actions-golang
-
-name: Tests
-
-on:
-  push:
-    branches:
-      - master
-      - 2.*
-  pull_request:
-    branches:
-      - master
-      - 2.*
-
-env:
-  # https://github.com/actions/setup-go/issues/491
-  GOTOOLCHAIN: local
-
-jobs:
-  test:
-    strategy:
-      # Default is true, cancels jobs for other platforms in the matrix if one fails
-      fail-fast: false
-      matrix:
-        os:
-          - linux
-          - mac
-          - windows
-        go:
-          - '1.24'
-
-        include:
-        # Set the minimum Go patch version for the given Go minor
-        # Usable via ${{ matrix.GO_SEMVER }}
-        - go: '1.24'
-          GO_SEMVER: '~1.24.1'
-
-        # Set some variables per OS, usable via ${{ matrix.VAR }}
-        # OS_LABEL: the VM label from GitHub Actions (see https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#standard-github-hosted-runners-for-public-repositories)
-        # CADDY_BIN_PATH: the path to the compiled Caddy binary, for artifact publishing
-        # SUCCESS: the typical value for $? per OS (Windows/pwsh returns 'True')
-        - os: linux
-          OS_LABEL: ubuntu-latest
-          CADDY_BIN_PATH: ./cmd/caddy/caddy
-          SUCCESS: 0
-
-        - os: mac
-          OS_LABEL: macos-14
-          CADDY_BIN_PATH: ./cmd/caddy/caddy
-          SUCCESS: 0
-
-        - os: windows
-          OS_LABEL: windows-latest
-          CADDY_BIN_PATH: ./cmd/caddy/caddy.exe
-          SUCCESS: 'True'
-
-    runs-on: ${{ matrix.OS_LABEL }}
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Install Go
-      uses: actions/setup-go@v5
-      with:
-        go-version: ${{ matrix.GO_SEMVER }}
-        check-latest: true
-
-    # These tools would be useful if we later decide to reinvestigate
-    # publishing test/coverage reports to some tool for easier consumption
-    # - name: Install test and coverage analysis tools
-    #   run: |
-    #     go get github.com/axw/gocov/gocov
-    #     go get github.com/AlekSi/gocov-xml
-    #     go get -u github.com/jstemmer/go-junit-report
-    #     echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-
-    - name: Print Go version and environment
-      id: vars
-      shell: bash
-      run: |
-        printf "Using go at: $(which go)\n"
-        printf "Go version: $(go version)\n"
-        printf "\n\nGo environment:\n\n"
-        go env
-        printf "\n\nSystem environment:\n\n"
-        env
-        printf "Git version: $(git version)\n\n"
-        # Calculate the short SHA1 hash of the git commit
-        echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
-
-    - name: Get dependencies
-      run: |
-        go get -v -t -d ./...
-        # mkdir test-results
-
-    - name: Build Caddy
-      working-directory: ./cmd/caddy
-      env:
-        CGO_ENABLED: 0
-      run: |
-        go build -tags nobadger,nomysql,nopgx -trimpath -ldflags="-w -s" -v
-
-    - name: Smoke test Caddy
-      working-directory: ./cmd/caddy
-      run: |
-        ./caddy start
-        ./caddy stop
-
-    - name: Publish Build Artifact
-      uses: actions/upload-artifact@v4
-      with:
-        name: caddy_${{ runner.os }}_go${{ matrix.go }}_${{ steps.vars.outputs.short_sha }}
-        path: ${{ matrix.CADDY_BIN_PATH }}
-        compression-level: 0
-
-    # Commented bits below were useful to allow the job to continue
-    # even if the tests fail, so we can publish the report separately
-    # For info about set-output, see https://stackoverflow.com/questions/57850553/github-actions-check-steps-status
-    - name: Run tests
-      # id: step_test
-      # continue-on-error: true
-      run: |
-        # (go test -v -coverprofile=cover-profile.out -race ./... 2>&1) > test-results/test-result.out
-        go test -tags nobadger,nomysql,nopgx -v -coverprofile="cover-profile.out" -short -race ./...
-        # echo "status=$?" >> $GITHUB_OUTPUT
-
-    # Relevant step if we reinvestigate publishing test/coverage reports
-    # - name: Prepare coverage reports
-    #   run: |
-    #     mkdir coverage
-    #     gocov convert cover-profile.out > coverage/coverage.json
-    #     # Because Windows doesn't work with input redirection like *nix, but output redirection works.
-    #     (cat ./coverage/coverage.json | gocov-xml) > coverage/coverage.xml
-
-    # To return the correct result even though we set 'continue-on-error: true'
-    # - name: Coerce correct build result
-    #   if: matrix.os != 'windows' && steps.step_test.outputs.status != ${{ matrix.SUCCESS }}
-    #   run: |
-    #     echo "step_test ${{ steps.step_test.outputs.status }}\n"
-    #     exit 1
-
-  s390x-test:
-    name: test (s390x on IBM Z)
-    runs-on: ubuntu-latest
-    if: github.event.pull_request.head.repo.full_name == 'caddyserver/caddy' && github.actor != 'dependabot[bot]'
-    continue-on-error: true  # August 2020: s390x VM is down due to weather and power issues
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: Run Tests
-        run: |
-          set +e
-          mkdir -p ~/.ssh && echo -e "${SSH_KEY//_/\\n}" > ~/.ssh/id_ecdsa && chmod og-rwx ~/.ssh/id_ecdsa
-
-          # short sha is enough?
-          short_sha=$(git rev-parse --short HEAD)
-
-          # To shorten the following lines
-          ssh_opts="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
-          ssh_host="$CI_USER@ci-s390x.caddyserver.com"
-
-          # The environment is fresh, so there's no point in keeping accepting and adding the key.
-          rsync -arz -e "ssh $ssh_opts" --progress --delete --exclude '.git' . "$ssh_host":/var/tmp/"$short_sha"
-          ssh $ssh_opts -t "$ssh_host" bash <<EOF
-          cd /var/tmp/$short_sha
-          go version
-          go env
-          printf "\n\n"
-          retries=3
-          exit_code=0
-          while ((retries > 0)); do
-            CGO_ENABLED=0 go test -p 1 -tags nobadger,nomysql,nopgx -v ./...
-            exit_code=$?
-            if ((exit_code == 0)); then
-              break
-            fi
-            echo "\n\nTest failed: \$exit_code, retrying..."
-            ((retries--))
-          done
-          echo "Remote exit code: \$exit_code"
-          exit \$exit_code
-          EOF
-          test_result=$?
-
-          # There's no need leaving the files around
-          ssh $ssh_opts "$ssh_host" "rm -rf /var/tmp/'$short_sha'"
-
-          echo "Test exit code: $test_result"
-          exit $test_result
-        env:
-          SSH_KEY: ${{ secrets.S390X_SSH_KEY }}
-          CI_USER: ${{ secrets.CI_USER }}
-
-  goreleaser-check:
-    runs-on: ubuntu-latest
-    if: github.event.pull_request.head.repo.full_name == 'caddyserver/caddy' && github.actor != 'dependabot[bot]'
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      
-      - uses: goreleaser/goreleaser-action@v6
-        with:
-          version: latest
-          args: check
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: "~1.24"
-          check-latest: true
-      - name: Install xcaddy
-        run: |
-          go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
-          xcaddy version
-      - uses: goreleaser/goreleaser-action@v6
-        with:
-          version: latest
-          args: build --single-target --snapshot
-        env:
-          TAG: ${{ github.head_ref || github.ref_name }}

.github/workflows/cross-build.yml

@@ -1,73 +0,0 @@
-name: Cross-Build
-
-on:
-  push:
-    branches:
-      - master
-      - 2.*
-  pull_request:
-    branches:
-      - master
-      - 2.*
-
-env:
-  # https://github.com/actions/setup-go/issues/491
-  GOTOOLCHAIN: local
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        goos:
-          - 'aix'
-          - 'linux'
-          - 'solaris'
-          - 'illumos'
-          - 'dragonfly'
-          - 'freebsd'
-          - 'openbsd'
-          - 'windows'
-          - 'darwin'
-          - 'netbsd'
-        go:
-          - '1.24'
-
-        include:
-        # Set the minimum Go patch version for the given Go minor
-        # Usable via ${{ matrix.GO_SEMVER }}
-        - go: '1.24'
-          GO_SEMVER: '~1.24.1'
-
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.GO_SEMVER }}
-          check-latest: true
-
-      - name: Print Go version and environment
-        id: vars
-        run: |
-          printf "Using go at: $(which go)\n"
-          printf "Go version: $(go version)\n"
-          printf "\n\nGo environment:\n\n"
-          go env
-          printf "\n\nSystem environment:\n\n"
-          env
-
-      - name: Run Build
-        env:
-          CGO_ENABLED: 0
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goos == 'aix' && 'ppc64' || 'amd64' }}
-        shell: bash
-        continue-on-error: true
-        working-directory: ./cmd/caddy
-        run: |
-          GOOS=$GOOS GOARCH=$GOARCH go build -tags=nobadger,nomysql,nopgx -trimpath -o caddy-"$GOOS"-$GOARCH 2> /dev/null

.github/workflows/lint.yml

@@ -1,71 +0,0 @@
-name: Lint
-
-on:
-  push:
-    branches:
-      - master
-      - 2.*
-  pull_request:
-    branches:
-      - master
-      - 2.*
-
-permissions:
-  contents: read
-
-env:
-  # https://github.com/actions/setup-go/issues/491
-  GOTOOLCHAIN: local
-
-jobs:
-  # From https://github.com/golangci/golangci-lint-action
-  golangci:
-    permissions:
-      contents: read # for actions/checkout to fetch code
-      pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
-    name: lint
-    strategy:
-      matrix:
-        os:
-          - linux
-          - mac
-          - windows
-
-        include:
-        - os: linux
-          OS_LABEL: ubuntu-latest
-
-        - os: mac
-          OS_LABEL: macos-14
-
-        - os: windows
-          OS_LABEL: windows-latest
-
-    runs-on: ${{ matrix.OS_LABEL }}
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '~1.24'
-          check-latest: true
-
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
-        with:
-          version: latest
-
-          # Windows times out frequently after about 5m50s if we don't set a longer timeout.
-          args: --timeout 10m
-
-          # Optional: show only new issues if it's a pull request. The default value is `false`.
-          # only-new-issues: true
-
-  govulncheck:
-    runs-on: ubuntu-latest
-    steps:
-      - name: govulncheck
-        uses: golang/govulncheck-action@v1
-        with:
-          go-version-input: '~1.24.1'
-          check-latest: true

.github/workflows/release.yml

@@ -1,182 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*.*.*'
-
-env:
-  # https://github.com/actions/setup-go/issues/491
-  GOTOOLCHAIN: local
-
-jobs:
-  release:
-    name: Release
-    strategy:
-      matrix:
-        os: 
-          - ubuntu-latest
-        go: 
-          - '1.24'
-
-        include:
-        # Set the minimum Go patch version for the given Go minor
-        # Usable via ${{ matrix.GO_SEMVER }}
-        - go: '1.24'
-          GO_SEMVER: '~1.24.1'
-
-    runs-on: ${{ matrix.os }}
-    # https://github.com/sigstore/cosign/issues/1258#issuecomment-1002251233
-    # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings
-    permissions:
-      id-token: write
-      # https://docs.github.com/en/rest/overview/permissions-required-for-github-apps#permission-on-contents
-      # "Releases" is part of `contents`, so it needs the `write`
-      contents: write
-
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Install Go
-      uses: actions/setup-go@v5
-      with:
-        go-version: ${{ matrix.GO_SEMVER }}
-        check-latest: true
-
-    # Force fetch upstream tags -- because 65 minutes
-    # tl;dr: actions/checkout@v4 runs this line:
-    #   git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +ebc278ec98bb24f2852b61fde2a9bf2e3d83818b:refs/tags/
-    # which makes its own local lightweight tag, losing all the annotations in the process. Our earlier script ran:
-    #   git fetch --prune --unshallow
-    # which doesn't overwrite that tag because that would be destructive.
-    # Credit to @francislavoie for the investigation.
-    # https://github.com/actions/checkout/issues/290#issuecomment-680260080
-    - name: Force fetch upstream tags
-      run: git fetch --tags --force
-
-    # https://github.community/t5/GitHub-Actions/How-to-get-just-the-tag-name/m-p/32167/highlight/true#M1027
-    - name: Print Go version and environment
-      id: vars
-      run: |
-        printf "Using go at: $(which go)\n"
-        printf "Go version: $(go version)\n"
-        printf "\n\nGo environment:\n\n"
-        go env
-        printf "\n\nSystem environment:\n\n"
-        env
-        echo "version_tag=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT
-        echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
-
-        # Add "pip install" CLI tools to PATH
-        echo ~/.local/bin >> $GITHUB_PATH
-
-        # Parse semver
-        TAG=${GITHUB_REF/refs\/tags\//}
-        SEMVER_RE='[^0-9]*\([0-9]*\)[.]\([0-9]*\)[.]\([0-9]*\)\([0-9A-Za-z\.-]*\)'
-        TAG_MAJOR=`echo ${TAG#v} | sed -e "s#$SEMVER_RE#\1#"`
-        TAG_MINOR=`echo ${TAG#v} | sed -e "s#$SEMVER_RE#\2#"`
-        TAG_PATCH=`echo ${TAG#v} | sed -e "s#$SEMVER_RE#\3#"`
-        TAG_SPECIAL=`echo ${TAG#v} | sed -e "s#$SEMVER_RE#\4#"`
-        echo "tag_major=${TAG_MAJOR}" >> $GITHUB_OUTPUT
-        echo "tag_minor=${TAG_MINOR}" >> $GITHUB_OUTPUT
-        echo "tag_patch=${TAG_PATCH}" >> $GITHUB_OUTPUT
-        echo "tag_special=${TAG_SPECIAL}" >> $GITHUB_OUTPUT
-
-    # Cloudsmith CLI tooling for pushing releases
-    # See https://help.cloudsmith.io/docs/cli
-    - name: Install Cloudsmith CLI
-      run: pip install --upgrade cloudsmith-cli
-
-    - name: Validate commits and tag signatures
-      run: |
-        
-        # Import Matt Holt's key
-        curl 'https://github.com/mholt.gpg' | gpg --import
-
-        echo "Verifying the tag: ${{ steps.vars.outputs.version_tag }}"
-        # tags are only accepted if signed by Matt's key
-        git verify-tag "${{ steps.vars.outputs.version_tag }}" || exit 1
-
-    - name: Install Cosign
-      uses: sigstore/cosign-installer@main
-    - name: Cosign version
-      run: cosign version
-    - name: Install Syft
-      uses: anchore/sbom-action/download-syft@main
-    - name: Syft version
-      run: syft version
-    - name: Install xcaddy
-      run: |
-        go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
-        xcaddy version
-    # GoReleaser will take care of publishing those artifacts into the release
-    - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@v6
-      with:
-        version: latest
-        args: release --clean --timeout 60m
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        TAG: ${{ steps.vars.outputs.version_tag }}
-        COSIGN_EXPERIMENTAL: 1
-
-    # Only publish on non-special tags (e.g. non-beta)
-    # We will continue to push to Gemfury for the foreseeable future, although
-    # Cloudsmith is probably better, to not break things for existing users of Gemfury.
-    # See https://gemfury.com/caddy/deb:caddy
-    - name: Publish .deb to Gemfury
-      if: ${{ steps.vars.outputs.tag_special == '' }}
-      env:
-        GEMFURY_PUSH_TOKEN: ${{ secrets.GEMFURY_PUSH_TOKEN }}
-      run: |
-        for filename in dist/*.deb; do
-          # armv6 and armv7 are both "armhf" so we can skip the duplicate
-          if [[ "$filename" == *"armv6"* ]]; then
-            echo "Skipping $filename"
-            continue
-          fi
-
-          curl -F package=@"$filename" https://${GEMFURY_PUSH_TOKEN}:@push.fury.io/caddy/
-        done
-
-    # Publish only special tags (unstable/beta/rc) to the "testing" repo
-    # See https://cloudsmith.io/~caddy/repos/testing/
-    - name: Publish .deb to Cloudsmith (special tags)
-      if: ${{ steps.vars.outputs.tag_special != '' }}
-      env:
-        CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
-      run: |
-        for filename in dist/*.deb; do
-          # armv6 and armv7 are both "armhf" so we can skip the duplicate
-          if [[ "$filename" == *"armv6"* ]]; then
-            echo "Skipping $filename"
-            continue
-          fi
-
-          echo "Pushing $filename to 'testing'"
-          cloudsmith push deb caddy/testing/any-distro/any-version $filename
-        done
-
-    # Publish stable tags to Cloudsmith to both repos, "stable" and "testing"
-    # See https://cloudsmith.io/~caddy/repos/stable/
-    - name: Publish .deb to Cloudsmith (stable tags)
-      if: ${{ steps.vars.outputs.tag_special == '' }}
-      env:
-        CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
-      run: |
-        for filename in dist/*.deb; do
-          # armv6 and armv7 are both "armhf" so we can skip the duplicate
-          if [[ "$filename" == *"armv6"* ]]; then
-            echo "Skipping $filename"
-            continue
-          fi
-
-          echo "Pushing $filename to 'stable'"
-          cloudsmith push deb caddy/stable/any-distro/any-version $filename
-
-          echo "Pushing $filename to 'testing'"
-          cloudsmith push deb caddy/testing/any-distro/any-version $filename
-        done

.github/workflows/release_published.yml

@@ -1,35 +0,0 @@
-name: Release Published
-
-# Event payload: https://developer.github.com/webhooks/event-payloads/#release
-on:
-  release:
-    types: [published]
-
-jobs:
-  release:
-    name: Release Published
-    strategy:
-      matrix:
-        os: 
-          - ubuntu-latest
-    runs-on: ${{ matrix.os }}
-
-    steps:
-
-    # See https://github.com/peter-evans/repository-dispatch
-    - name: Trigger event on caddyserver/dist
-      uses: peter-evans/repository-dispatch@v3
-      with:
-        token: ${{ secrets.REPO_DISPATCH_TOKEN }}
-        repository: caddyserver/dist
-        event-type: release-tagged
-        client-payload: '{"tag": "${{ github.event.release.tag_name }}"}'
-
-    - name: Trigger event on caddyserver/caddy-docker
-      uses: peter-evans/repository-dispatch@v3
-      with:
-        token: ${{ secrets.REPO_DISPATCH_TOKEN }}
-        repository: caddyserver/caddy-docker
-        event-type: release-tagged
-        client-payload: '{"tag": "${{ github.event.release.tag_name }}"}'
-

.gitignore

@@ -1,31 +1,16 @@
-_gitignore/
-*.log
-Caddyfile
-Caddyfile.*
-!caddyfile/
-!caddyfile.go
-
-# artifacts from pprof tooling
-*.prof
-*.test
-
-# build artifacts and helpers
-cmd/caddy/caddy
-cmd/caddy/caddy.exe
-cmd/caddy/tmp/*.exe
-cmd/caddy/.env
-
-# mac specific
 .DS_Store
+Thumbs.db
+_gitignore/
+Vagrantfile
+.vagrant/
 
-# go modules
-vendor
+dist/builds/
+dist/release/
 
-# goreleaser artifacts
-dist
-caddy-build
-caddy-dist
+error.log
+access.log
 
-# IDE files
-.idea/
-.vscode/
+/*.conf
+Caddyfile
+
+og_static/

.golangci.yml

@@ -1,182 +0,0 @@
-linters-settings:
-  errcheck:
-    exclude-functions:
-      - fmt.*
-      - (go.uber.org/zap/zapcore.ObjectEncoder).AddObject
-      - (go.uber.org/zap/zapcore.ObjectEncoder).AddArray
-  gci:
-    sections:
-      - standard # Standard section: captures all standard packages.
-      - default # Default section: contains all imports that could not be matched to another section type.
-      - prefix(github.com/caddyserver/caddy/v2/cmd) # ensure that this is always at the top and always has a line break.
-      - prefix(github.com/caddyserver/caddy) # Custom section: groups all imports with the specified Prefix.
-    # Skip generated files.
-    # Default: true
-    skip-generated: true
-    # Enable custom order of sections.
-    # If `true`, make the section order the same as the order of `sections`.
-    # Default: false
-    custom-order: true
-  exhaustive:
-    ignore-enum-types: reflect.Kind|svc.Cmd
-
-linters:
-  disable-all: true
-  enable:
-    - asasalint
-    - asciicheck
-    - bidichk
-    - bodyclose
-    - decorder
-    - dogsled
-    - dupl
-    - dupword
-    - durationcheck
-    - errcheck
-    - errname
-    - exhaustive
-    - gci
-    - gofmt
-    - goimports
-    - gofumpt
-    - gosec
-    - gosimple
-    - govet
-    - ineffassign
-    - importas
-    - misspell
-    - prealloc
-    - promlinter
-    - sloglint
-    - sqlclosecheck
-    - staticcheck
-    - tenv
-    - testableexamples
-    - testifylint
-    - tparallel
-    - typecheck
-    - unconvert
-    - unused
-    - wastedassign
-    - whitespace
-    - zerologlint
-  # these are implicitly disabled:
-  # - containedctx
-  # - contextcheck
-  # - cyclop
-  # - depguard
-  # - errchkjson
-  # - errorlint
-  # - exhaustruct
-  # - execinquery
-  # - exhaustruct
-  # - forbidigo
-  # - forcetypeassert
-  # - funlen
-  # - ginkgolinter
-  # - gocheckcompilerdirectives
-  # - gochecknoglobals
-  # - gochecknoinits
-  # - gochecksumtype
-  # - gocognit
-  # - goconst
-  # - gocritic
-  # - gocyclo
-  # - godot
-  # - godox
-  # - goerr113
-  # - goheader
-  # - gomnd
-  # - gomoddirectives
-  # - gomodguard
-  # - goprintffuncname
-  # - gosmopolitan
-  # - grouper
-  # - inamedparam
-  # - interfacebloat
-  # - ireturn
-  # - lll
-  # - loggercheck
-  # - maintidx
-  # - makezero
-  # - mirror
-  # - musttag
-  # - nakedret
-  # - nestif
-  # - nilerr
-  # - nilnil
-  # - nlreturn
-  # - noctx
-  # - nolintlint
-  # - nonamedreturns
-  # - nosprintfhostport
-  # - paralleltest
-  # - perfsprint
-  # - predeclared
-  # - protogetter
-  # - reassign
-  # - revive
-  # - rowserrcheck
-  # - stylecheck
-  # - tagalign
-  # - tagliatelle
-  # - testpackage
-  # - thelper
-  # - unparam
-  # - usestdlibvars
-  # - varnamelen
-  # - wrapcheck
-  # - wsl
-
-run:
-  # default concurrency is a available CPU number.
-  # concurrency: 4 # explicitly omit this value to fully utilize available resources.
-  timeout: 5m
-  issues-exit-code: 1
-  tests: false
-
-# output configuration options
-output:
-  formats:
-    - format: 'colored-line-number'
-  print-issued-lines: true
-  print-linter-name: true
-
-issues:
-  exclude-rules:
-    - text: 'G115' # TODO: Either we should fix the issues or nuke the linter if it's bad
-      linters:
-        - gosec
-    # we aren't calling unknown URL
-    - text: 'G107' # G107: Url provided to HTTP request as taint input
-      linters:
-        - gosec
-    # as a web server that's expected to handle any template, this is totally in the hands of the user.
-    - text: 'G203' # G203: Use of unescaped data in HTML templates
-      linters:
-        - gosec
-    # we're shelling out to known commands, not relying on user-defined input.
-    - text: 'G204' # G204: Audit use of command execution
-      linters:
-        - gosec
-    # the choice of weakrand is deliberate, hence the named import "weakrand"
-    - path: modules/caddyhttp/reverseproxy/selectionpolicies.go
-      text: 'G404' # G404: Insecure random number source (rand)
-      linters:
-        - gosec
-    - path: modules/caddyhttp/reverseproxy/streaming.go
-      text: 'G404' # G404: Insecure random number source (rand)
-      linters:
-        - gosec
-    - path: modules/logging/filters.go
-      linters:
-        - dupl
-    - path: modules/caddyhttp/matchers.go
-      linters:
-        - dupl
-    - path: modules/caddyhttp/vars.go
-      linters:
-        - dupl
-    - path: _test\.go
-      linters:
-        - errcheck

.goreleaser.yml

@@ -1,214 +0,0 @@
-version: 2
-
-before:
-  hooks:
-    # The build is done in this particular way to build Caddy in a designated directory named in .gitignore.
-    # This is so we can run goreleaser on tag without Git complaining of being dirty. The main.go in cmd/caddy directory 
-    # cannot be built within that directory due to changes necessary for the build causing Git to be dirty, which
-    # subsequently causes gorleaser to refuse running.
-    - rm -rf caddy-build caddy-dist vendor
-    # vendor Caddy deps
-    - go mod vendor
-    - mkdir -p caddy-build
-    - cp cmd/caddy/main.go caddy-build/main.go
-    - /bin/sh -c 'cd ./caddy-build && go mod init caddy'
-    # prepare syso files for windows embedding
-    - /bin/sh -c 'for a in amd64 arm arm64; do XCADDY_SKIP_BUILD=1 GOOS=windows GOARCH=$a xcaddy build {{.Env.TAG}}; done'
-    - /bin/sh -c 'mv /tmp/buildenv_*/*.syso caddy-build'
-    # GoReleaser doesn't seem to offer {{.Tag}} at this stage, so we have to embed it into the env
-    # so we run: TAG=$(git describe --abbrev=0) goreleaser release --rm-dist --skip-publish --skip-validate
-    - go mod edit -require=github.com/caddyserver/caddy/v2@{{.Env.TAG}} ./caddy-build/go.mod
-    # as of Go 1.16, `go` commands no longer automatically change go.{mod,sum}. We now have to explicitly
-    # run `go mod tidy`. The `/bin/sh -c '...'` is because goreleaser can't find cd in PATH without shell invocation.
-    - /bin/sh -c 'cd ./caddy-build && go mod tidy'
-    # vendor the deps of the prepared to-build module
-    - /bin/sh -c 'cd ./caddy-build && go mod vendor'
-    - git clone --depth 1 https://github.com/caddyserver/dist caddy-dist
-    - mkdir -p caddy-dist/man
-    - go mod download
-    - go run cmd/caddy/main.go manpage --directory ./caddy-dist/man
-    - gzip -r ./caddy-dist/man/
-    - /bin/sh -c 'go run cmd/caddy/main.go completion bash > ./caddy-dist/scripts/bash-completion'
-
-builds:
-- env:
-  - CGO_ENABLED=0
-  - GO111MODULE=on
-  dir: ./caddy-build
-  binary: caddy
-  goos:
-  - darwin
-  - linux
-  - windows
-  - freebsd
-  goarch:
-  - amd64
-  - arm
-  - arm64
-  - s390x
-  - ppc64le
-  - riscv64
-  goarm:
-  - "5"
-  - "6"
-  - "7"
-  ignore:
-    - goos: darwin
-      goarch: arm
-    - goos: darwin
-      goarch: ppc64le
-    - goos: darwin
-      goarch: s390x
-    - goos: darwin
-      goarch: riscv64
-    - goos: windows
-      goarch: ppc64le
-    - goos: windows
-      goarch: s390x
-    - goos: windows
-      goarch: riscv64
-    - goos: freebsd
-      goarch: ppc64le
-    - goos: freebsd
-      goarch: s390x
-    - goos: freebsd
-      goarch: riscv64
-    - goos: freebsd
-      goarch: arm
-      goarm: "5"
-  flags:
-  - -trimpath
-  - -mod=readonly
-  ldflags:
-  - -s -w
-  tags:
-  - nobadger
-  - nomysql
-  - nopgx
-
-signs:
-  - cmd: cosign
-    signature: "${artifact}.sig"
-    certificate: '{{ trimsuffix (trimsuffix .Env.artifact ".zip") ".tar.gz" }}.pem'
-    args: ["sign-blob", "--yes", "--output-signature=${signature}", "--output-certificate", "${certificate}", "${artifact}"]
-    artifacts: all
-
-sboms:
-  - artifacts: binary
-    documents:
-      - >-
-        {{ .ProjectName }}_
-        {{- .Version }}_
-        {{- if eq .Os "darwin" }}mac{{ else }}{{ .Os }}{{ end }}_
-        {{- .Arch }}
-        {{- with .Arm }}v{{ . }}{{ end }}
-        {{- with .Mips }}_{{ . }}{{ end }}
-        {{- if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}.sbom
-    cmd: syft
-    args: ["$artifact", "--file", "${document}", "--output", "cyclonedx-json"]
-
-archives:
-  - id: default
-    format_overrides:
-      - goos: windows
-        formats: zip
-    name_template: >-
-      {{ .ProjectName }}_
-      {{- .Version }}_
-      {{- if eq .Os "darwin" }}mac{{ else }}{{ .Os }}{{ end }}_
-      {{- .Arch }}
-      {{- with .Arm }}v{{ . }}{{ end }}
-      {{- with .Mips }}_{{ . }}{{ end }}
-      {{- if not (eq .Amd64 "v1") }}{{ .Amd64 }}{{ end }}
-  
-  # package the 'caddy-build' directory into a tarball,
-  # allowing users to build the exact same set of files as ours.
-  - id: source
-    meta: true
-    name_template: "{{ .ProjectName }}_{{ .Version }}_buildable-artifact"
-    files:
-      - src: LICENSE
-        dst: ./LICENSE
-      - src: README.md
-        dst: ./README.md
-      - src: AUTHORS
-        dst: ./AUTHORS
-      - src: ./caddy-build
-        dst: ./
-
-source:
-  enabled: true
-  name_template: '{{ .ProjectName }}_{{ .Version }}_src'
-  format: 'tar.gz'
-
-  # Additional files/template/globs you want to add to the source archive.
-  #
-  # Default: empty.
-  files:
-    - vendor
-
-
-checksum:
-  algorithm: sha512
-
-nfpms:
-  - id: default
-    package_name: caddy
-
-    vendor: Dyanim
-    homepage: https://caddyserver.com
-    maintainer: Matthew Holt <mholt@users.noreply.github.com>
-    description: |
-      Caddy - Powerful, enterprise-ready, open source web server with automatic HTTPS written in Go
-    license: Apache 2.0
-
-    formats:
-      - deb
-      # - rpm
-
-    bindir: /usr/bin
-    contents:
-      - src: ./caddy-dist/init/caddy.service
-        dst: /lib/systemd/system/caddy.service
-        
-      - src: ./caddy-dist/init/caddy-api.service
-        dst: /lib/systemd/system/caddy-api.service
-      
-      - src: ./caddy-dist/welcome/index.html
-        dst: /usr/share/caddy/index.html
-      
-      - src: ./caddy-dist/scripts/bash-completion
-        dst: /etc/bash_completion.d/caddy
-    
-      - src: ./caddy-dist/config/Caddyfile
-        dst: /etc/caddy/Caddyfile
-        type: config
-
-      - src: ./caddy-dist/man/*
-        dst: /usr/share/man/man8/
-
-    scripts:
-      postinstall: ./caddy-dist/scripts/postinstall.sh
-      preremove: ./caddy-dist/scripts/preremove.sh
-      postremove: ./caddy-dist/scripts/postremove.sh
-
-    provides:
-      - httpd
-
-release:
-  github:
-    owner: caddyserver
-    name: caddy
-  draft: true
-  prerelease: auto
-
-changelog:
-  sort: asc
-  filters:
-    exclude:
-    - '^chore:'
-    - '^ci:'
-    - '^docs?:'
-    - '^readme:'
-    - '^tests?:'
-    - '^\w+\s+' # a hack to remove commit messages without colons thus don't correspond to a package

.travis.yml

@@ -0,0 +1,14 @@
+language: go
+
+go:
+  - 1.4.3
+  - 1.5.1
+  - tip
+
+install:
+  - go get -d ./...
+  - go get golang.org/x/tools/cmd/vet
+
+script:
+  - go vet ./...
+  - go test ./...

AUTHORS

@@ -1,10 +0,0 @@
-# This is the official list of Caddy Authors for copyright purposes.
-# Authors may be either individual people or legal entities.
-#
-# Not all individual contributors are authors. For the full list of
-# contributors, refer to the project's page on GitHub or the repo's
-# commit history.
-
-Matthew Holt <Matthew.Holt@gmail.com>
-Light Code Labs <sales@lightcodelabs.com>
-Ardan Labs <info@ardanlabs.com>

CONTRIBUTING.md

@@ -0,0 +1,32 @@
+## Contributing to Caddy
+
+**[Join us on Slack](https://gophers.slack.com/messages/caddy/)** to chat with other Caddy developers! ([Request an invite](http://bit.ly/go-slack-signup), then join the #caddy channel.)
+
+This project gladly accepts contributions and we encourage interested users to get involved!
+
+
+#### For small tweaks, bug fixes, and tests
+
+Submit [pull requests](https://github.com/mholt/caddy/pulls) at any time. Thank you for helping out in simple ways! Bug fixes should be under test to assert correct behavior.
+
+
+#### Ideas, questions, bug reports
+
+You should totally [open an issue](https://github.com/mholt/caddy/issues) with your ideas, questions, and bug reports, if one does not already exist for it. Bug reports should state expected behavior and contain clear instructions for reproducing the problem.
+
+
+#### New features
+
+Before submitting a pull request, please open an issue first to discuss it and claim it. This prevents overlapping efforts and keeps the project in-line with its goals. If you prefer to discuss the feature privately, you can reach other developers on Slack or you may email me directly. (My email address is below.)
+
+And don't forget to write tests for new features!
+
+
+#### Vulnerabilities
+
+If you've found a vulnerability that is serious, please email me: Matthew dot Holt at Gmail. If it's not a big deal, a pull request will probably be faster.
+
+
+## Thank you
+
+Thanks for your help! Caddy would not be what it is today without your contributions.

LICENSE.txt

@@ -1,4 +1,3 @@
-
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -179,7 +178,7 @@
    APPENDIX: How to apply the Apache License to your work.
 
       To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
+      boilerplate notice, with the fields enclosed by brackets "{}"
       replaced with your own identifying information. (Don't include
       the brackets!)  The text should be enclosed in the appropriate
       comment syntax for the file format. We also recommend that a
@@ -187,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright {yyyy} {name of copyright owner}
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

README.md

@@ -1,201 +1,132 @@
-<p align="center">
-	<a href="https://caddyserver.com">
-		<picture>
-			<source media="(prefers-color-scheme: dark)" srcset="https://user-images.githubusercontent.com/1128849/210187358-e2c39003-9a5e-4dd5-a783-6deb6483ee72.svg">
-			<source media="(prefers-color-scheme: light)" srcset="https://user-images.githubusercontent.com/1128849/210187356-dfb7f1c5-ac2e-43aa-bb23-fc014280ae1f.svg">
-			<img src="https://user-images.githubusercontent.com/1128849/210187356-dfb7f1c5-ac2e-43aa-bb23-fc014280ae1f.svg" alt="Caddy" width="550">
-		</picture>
-	</a>
-	<br>
-	<h3 align="center">a <a href="https://zerossl.com"><img src="https://user-images.githubusercontent.com/55066419/208327323-2770dc16-ec09-43a0-9035-c5b872c2ad7f.svg" height="28" style="vertical-align: -7.7px" valign="middle"></a> project</h3>
-</p>
-<hr>
-<h3 align="center">Every site on HTTPS</h3>
-<p align="center">Caddy is an extensible server platform that uses TLS by default.</p>
-<p align="center">
-	<a href="https://github.com/caddyserver/caddy/actions/workflows/ci.yml"><img src="https://github.com/caddyserver/caddy/actions/workflows/ci.yml/badge.svg"></a>
-	<a href="https://pkg.go.dev/github.com/caddyserver/caddy/v2"><img src="https://img.shields.io/badge/godoc-reference-%23007d9c.svg"></a>
-	<br>
-	<a href="https://x.com/caddyserver" title="@caddyserver on Twitter"><img src="https://img.shields.io/twitter/follow/caddyserver" alt="@caddyserver on Twitter"></a>
-	<a href="https://caddy.community" title="Caddy Forum"><img src="https://img.shields.io/badge/community-forum-ff69b4.svg" alt="Caddy Forum"></a>
-	<br>
-	<a href="https://sourcegraph.com/github.com/caddyserver/caddy?badge" title="Caddy on Sourcegraph"><img src="https://sourcegraph.com/github.com/caddyserver/caddy/-/badge.svg" alt="Caddy on Sourcegraph"></a>
-	<a href="https://cloudsmith.io/~caddy/repos/"><img src="https://img.shields.io/badge/OSS%20hosting%20by-cloudsmith-blue?logo=cloudsmith" alt="Cloudsmith"></a>
-</p>
-<p align="center">
-	<a href="https://github.com/caddyserver/caddy/releases">Releases</a> ·
-	<a href="https://caddyserver.com/docs/">Documentation</a> ·
-	<a href="https://caddy.community">Get Help</a>
-</p>
+[![Caddy](https://caddyserver.com/resources/images/caddy-boxed.png)](https://caddyserver.com)
+
+[![Documentation](https://img.shields.io/badge/godoc-reference-blue.svg?style=flat-square)](https://godoc.org/github.com/mholt/caddy) [![Linux Build Status](https://img.shields.io/travis/mholt/caddy.svg?style=flat-square&label=linux+build)](https://travis-ci.org/mholt/caddy) [![Windows Build Status](https://img.shields.io/appveyor/ci/mholt/caddy.svg?style=flat-square&label=windows+build)](https://ci.appveyor.com/project/mholt/caddy)
+
+Caddy is a lightweight, general-purpose web server for Windows, Mac, Linux, BSD, and [Android](https://github.com/mholt/caddy/wiki/Running-Caddy-on-Android). It is a capable alternative to other popular and easy to use web servers.
+
+The most notable features are HTTP/2, [Let's Encrypt](https://letsencrypt.org) support, Virtual Hosts, TLS + SNI, and easy configuration with a [Caddyfile](https://caddyserver.com/docs/caddyfile). In development, you usually put one Caddyfile with each site. In production, Caddy serves HTTPS by default and manages all cryptographic assets for you.
+
+[Download](https://github.com/mholt/caddy/releases) · [User Guide](https://caddyserver.com/docs)
 
 
 
 ### Menu
 
-- [Features](#features)
-- [Install](#install)
-- [Build from source](#build-from-source)
-	- [For development](#for-development)
-	- [With version information and/or plugins](#with-version-information-andor-plugins)
-- [Quick start](#quick-start)
-- [Overview](#overview)
-- [Full documentation](#full-documentation)
-- [Getting help](#getting-help)
-- [About](#about)
-
-<p align="center">
-	<b>Powered by</b>
-	<br>
-	<a href="https://github.com/caddyserver/certmagic">
-		<picture>
-			<source media="(prefers-color-scheme: dark)" srcset="https://user-images.githubusercontent.com/55066419/206946718-740b6371-3df3-4d72-a822-47e4c48af999.png">
-			<source media="(prefers-color-scheme: light)" srcset="https://user-images.githubusercontent.com/1128849/49704830-49d37200-fbd5-11e8-8385-767e0cd033c3.png">
-			<img src="https://user-images.githubusercontent.com/1128849/49704830-49d37200-fbd5-11e8-8385-767e0cd033c3.png" alt="CertMagic" width="250">
-		</picture>
-	</a>
-</p>
+- [Getting Caddy](#getting-caddy)
+- [Quick Start](#quick-start)
+- [Running from Source](#running-from-source)
+- [Contributing](#contributing)
+- [About the Project](#about-the-project)
 
 
-## [Features](https://caddyserver.com/features)
 
-- **Easy configuration** with the [Caddyfile](https://caddyserver.com/docs/caddyfile)
-- **Powerful configuration** with its [native JSON config](https://caddyserver.com/docs/json/)
-- **Dynamic configuration** with the [JSON API](https://caddyserver.com/docs/api)
-- [**Config adapters**](https://caddyserver.com/docs/config-adapters) if you don't like JSON
-- **Automatic HTTPS** by default
-	- [ZeroSSL](https://zerossl.com) and [Let's Encrypt](https://letsencrypt.org) for public names
-	- Fully-managed local CA for internal names & IPs
-	- Can coordinate with other Caddy instances in a cluster
-	- Multi-issuer fallback
-	- Encrypted ClientHello (ECH) support
-- **Stays up when other servers go down** due to TLS/OCSP/certificate-related issues
-- **Production-ready** after serving trillions of requests and managing millions of TLS certificates
-- **Scales to hundreds of thousands of sites** as proven in production
-- **HTTP/1.1, HTTP/2, and HTTP/3** all supported by default
-- **Highly extensible** [modular architecture](https://caddyserver.com/docs/architecture) lets Caddy do anything without bloat
-- **Runs anywhere** with **no external dependencies** (not even libc)
-- Written in Go, a language with higher **memory safety guarantees** than other servers
-- Actually **fun to use**
-- So much more to [discover](https://caddyserver.com/features)
 
-## Install
+## Getting Caddy
 
-The simplest, cross-platform way to get started is to download Caddy from [GitHub Releases](https://github.com/caddyserver/caddy/releases) and place the executable file in your PATH.
+Caddy binaries have no dependencies and are available for nearly every platform.
 
-See [our online documentation](https://caddyserver.com/docs/install) for other install instructions.
+[Latest release](https://github.com/mholt/caddy/releases/latest)
 
-## Build from source
 
-Requirements:
 
-- [Go 1.24.0 or newer](https://golang.org/dl/)
+## Quick Start
 
-### For development
+The website has [full documentation](https://caddyserver.com/docs) but this will get you started in about 30 seconds:
 
-_**Note:** These steps [will not embed proper version information](https://github.com/golang/go/issues/29228). For that, please follow the instructions in the next section._
-
-```bash
-$ git clone "https://github.com/caddyserver/caddy.git"
-$ cd caddy/cmd/caddy/
-$ go build
-```
-
-When you run Caddy, it may try to bind to low ports unless otherwise specified in your config. If your OS requires elevated privileges for this, you will need to give your new binary permission to do so. On Linux, this can be done easily with: `sudo setcap cap_net_bind_service=+ep ./caddy`
-
-If you prefer to use `go run` which only creates temporary binaries, you can still do this with the included `setcap.sh` like so:
-
-```bash
-$ go run -exec ./setcap.sh main.go
-```
-
-If you don't want to type your password for `setcap`, use `sudo visudo` to edit your sudoers file and allow your user account to run that command without a password, for example:
+Place a file named "Caddyfile" with your site. Paste this into it and save:
 
 ```
-username ALL=(ALL:ALL) NOPASSWD: /usr/sbin/setcap
+localhost
+
+gzip
+browse
+ext .html
+websocket /echo cat
+log ../access.log
+header /api Access-Control-Allow-Origin *
 ```
 
-replacing `username` with your actual username. Please be careful and only do this if you know what you are doing! We are only qualified to document how to use Caddy, not Go tooling or your computer, and we are providing these instructions for convenience only; please learn how to use your own computer at your own risk and make any needful adjustments.
+Run `caddy` from that directory, and it will automatically use that Caddyfile to configure itself.
 
-### With version information and/or plugins
+That simple file enables compression, allows directory browsing (for folders without an index file), serves clean URLs, hosts a WebSocket echo server at /echo, logs requests to access.log, and adds the coveted `Access-Control-Allow-Origin: *` header for all responses from some API.
 
-Using [our builder tool, `xcaddy`](https://github.com/caddyserver/xcaddy)...
+Wow! Caddy can do a lot with just a few lines.
+
+
+#### Defining multiple sites
+
+You can run multiple sites from the same Caddyfile, too:
 
 ```
-$ xcaddy build
+site1.com {
+	# ...
+}
+
+site2.com, sub.site2.com {
+	# ...
+}
 ```
 
-...the following steps are automated:
+Note that all these sites will automatically be served over HTTPS using Let's Encrypt as the CA. Caddy will manage the certificates (including renewals) for you. You don't even have to think about it.
 
-1. Create a new folder: `mkdir caddy`
-2. Change into it: `cd caddy`
-3. Copy [Caddy's main.go](https://github.com/caddyserver/caddy/blob/master/cmd/caddy/main.go) into the empty folder. Add imports for any custom plugins you want to add.
-4. Initialize a Go module: `go mod init caddy`
-5. (Optional) Pin Caddy version: `go get github.com/caddyserver/caddy/v2@version` replacing `version` with a git tag, commit, or branch name.
-6. (Optional) Add plugins by adding their import: `_ "import/path/here"`
-7. Compile: `go build -tags=nobadger,nomysql,nopgx`
+For more documentation, please view [the website](https://caddyserver.com/docs). You may also be interested in the [developer guide](https://github.com/mholt/caddy/wiki) on this project's GitHub wiki.
 
 
 
 
-## Quick start
+## Running from Source
 
-The [Caddy website](https://caddyserver.com/docs/) has documentation that includes tutorials, quick-start guides, reference, and more.
+Note: You will need **[Go 1.4](https://golang.org/dl)** or newer
 
-**We recommend that all users -- regardless of experience level -- do our [Getting Started](https://caddyserver.com/docs/getting-started) guide to become familiar with using Caddy.**
+1. `$ go get github.com/mholt/caddy`
+2. `cd` into your website's directory
+3. Run `caddy` (assumes `$GOPATH/bin` is in your `$PATH`)
 
-If you've only got a minute, [the website has several quick-start tutorials](https://caddyserver.com/docs/quick-starts) to choose from! However, after finishing a quick-start tutorial, please read more documentation to understand how the software works. 🙂
+If you're tinkering, you can also use `go run main.go`.
+
+By default, Caddy serves the current directory at [localhost:2015](http://localhost:2015). You can place a Caddyfile to configure Caddy for serving your site.
+
+Caddy accepts some flags from the command line. Run `caddy -h` to view the help for flags. You can also pipe a Caddyfile into the caddy command.
+
+**Running as root:** We advise against this; use setcap instead, like so: `setcap cap_net_bind_service=+ep ./caddy` This will allow you to listen on ports < 1024 like 80 and 443.
+
+
+
+#### Docker Container
+
+Caddy is available as a Docker container from any of these sources:
+
+- [abiosoft/caddy](https://registry.hub.docker.com/u/abiosoft/caddy/)
+- [darron/caddy](https://registry.hub.docker.com/u/darron/caddy/)
+- [joshix/caddy](https://registry.hub.docker.com/u/joshix/caddy/)
+- [jumanjiman/caddy](https://registry.hub.docker.com/u/jumanjiman/caddy/)
+- [zenithar/nano-caddy](https://registry.hub.docker.com/u/zenithar/nano-caddy/)
+
+
+
+#### 3rd-party dependencies
+
+Although Caddy's binaries are completely static, Caddy relies on some excellent libraries. [Godoc.org](https://godoc.org/github.com/mholt/caddy) shows the packages that each Caddy package imports.
 
 
 
 
-## Overview
+## Contributing
 
-Caddy is most often used as an HTTPS server, but it is suitable for any long-running Go program. First and foremost, it is a platform to run Go applications. Caddy "apps" are just Go programs that are implemented as Caddy modules. Two apps -- `tls` and `http` -- ship standard with Caddy.
+**[Join us on Slack](https://gophers.slack.com/messages/caddy/)** to chat with other Caddy developers! ([Request an invite](http://bit.ly/go-slack-signup), then join the #caddy channel.)
 
-Caddy apps instantly benefit from [automated documentation](https://caddyserver.com/docs/json/), graceful on-line [config changes via API](https://caddyserver.com/docs/api), and unification with other Caddy apps.
+This project would not be what it is without your help. Please see the [contributing guidelines](https://github.com/mholt/caddy/blob/master/CONTRIBUTING.md) if you haven't already.
 
-Although [JSON](https://caddyserver.com/docs/json/) is Caddy's native config language, Caddy can accept input from [config adapters](https://caddyserver.com/docs/config-adapters) which can essentially convert any config format of your choice into JSON: Caddyfile, JSON 5, YAML, TOML, NGINX config, and more.
+Thanks for making Caddy -- and the Web -- better!
 
-The primary way to configure Caddy is through [its API](https://caddyserver.com/docs/api), but if you prefer config files, the [command-line interface](https://caddyserver.com/docs/command-line) supports those too.
-
-Caddy exposes an unprecedented level of control compared to any web server in existence. In Caddy, you are usually setting the actual values of the initialized types in memory that power everything from your HTTP handlers and TLS handshakes to your storage medium. Caddy is also ridiculously extensible, with a powerful plugin system that makes vast improvements over other web servers.
-
-To wield the power of this design, you need to know how the config document is structured. Please see [our documentation site](https://caddyserver.com/docs/) for details about [Caddy's config structure](https://caddyserver.com/docs/json/).
-
-Nearly all of Caddy's configuration is contained in a single config document, rather than being scattered across CLI flags and env variables and a configuration file as with other web servers. This makes managing your server config more straightforward and reduces hidden variables/factors.
-
-
-## Full documentation
-
-Our website has complete documentation:
-
-**https://caddyserver.com/docs/**
-
-The docs are also open source. You can contribute to them here: https://github.com/caddyserver/website
+Special thanks to [![DigitalOcean](http://i.imgur.com/sfGr0eY.png)](https://www.digitalocean.com) for hosting the Caddy project.
 
 
 
-## Getting help
 
-- We advise companies using Caddy to secure a support contract through [Ardan Labs](https://www.ardanlabs.com) before help is needed.
+## About the project
 
-- A [sponsorship](https://github.com/sponsors/mholt) goes a long way! We can offer private help to sponsors. If Caddy is benefitting your company, please consider a sponsorship. This not only helps fund full-time work to ensure the longevity of the project, it provides your company the resources, support, and discounts you need; along with being a great look for your company to your customers and potential customers!
-
-- Individuals can exchange help for free on our community forum at https://caddy.community. Remember that people give help out of their spare time and good will. The best way to get help is to give it first!
-
-Please use our [issue tracker](https://github.com/caddyserver/caddy/issues) only for bug reports and feature requests, i.e. actionable development items (support questions will usually be referred to the forums).
+Caddy was born out of the need for a "batteries-included" web server that runs anywhere and doesn't have to take its configuration with it. Caddy took inspiration from [spark](https://github.com/rif/spark), nginx, lighttpd, Websocketd, and Vagrant, and provides a pleasant mixture of features from each of them.
 
 
-
-## About
-
-Matthew Holt began developing Caddy in 2014 while studying computer science at Brigham Young University. (The name "Caddy" was chosen because this software helps with the tedious, mundane tasks of serving the Web, and is also a single place for multiple things to be organized together.) It soon became the first web server to use HTTPS automatically and by default, and now has hundreds of contributors and has served trillions of HTTPS requests.
-
-**The name "Caddy" is trademarked.** The name of the software is "Caddy", not "Caddy Server" or "CaddyServer". Please call it "Caddy" or, if you wish to clarify, "the Caddy web server". Caddy is a registered trademark of Stack Holdings GmbH.
-
-- _Project on X: [@caddyserver](https://x.com/caddyserver)_
-- _Author on X: [@mholt6](https://x.com/mholt6)_
-
-Caddy is a project of [ZeroSSL](https://zerossl.com), a Stack Holdings company.
-
-Debian package repository hosting is graciously provided by [Cloudsmith](https://cloudsmith.com). Cloudsmith is the only fully hosted, cloud-native, universal package management solution, that enables your organization to create, store and share packages in any format, to any place, with total confidence.
+*Twitter: [@mholt6](https://twitter.com/mholt6)*

admin_test.go

@@ -1,936 +0,0 @@
-// Copyright 2015 Matthew Holt and The Caddy Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddy
-
-import (
-	"context"
-	"crypto/x509"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"reflect"
-	"sync"
-	"testing"
-
-	"github.com/caddyserver/certmagic"
-	"github.com/prometheus/client_golang/prometheus"
-	dto "github.com/prometheus/client_model/go"
-)
-
-var testCfg = []byte(`{
-			"apps": {
-				"http": {
-					"servers": {
-						"myserver": {
-							"listen": ["tcp/localhost:8080-8084"],
-							"read_timeout": "30s"
-						},
-						"yourserver": {
-							"listen": ["127.0.0.1:5000"],
-							"read_header_timeout": "15s"
-						}
-					}
-				}
-			}
-		}
-		`)
-
-func TestUnsyncedConfigAccess(t *testing.T) {
-	// each test is performed in sequence, so
-	// each change builds on the previous ones;
-	// the config is not reset between tests
-	for i, tc := range []struct {
-		method    string
-		path      string // rawConfigKey will be prepended
-		payload   string
-		expect    string // JSON representation of what the whole config is expected to be after the request
-		shouldErr bool
-	}{
-		{
-			method:  "POST",
-			path:    "",
-			payload: `{"foo": "bar", "list": ["a", "b", "c"]}`, // starting value
-			expect:  `{"foo": "bar", "list": ["a", "b", "c"]}`,
-		},
-		{
-			method:  "POST",
-			path:    "/foo",
-			payload: `"jet"`,
-			expect:  `{"foo": "jet", "list": ["a", "b", "c"]}`,
-		},
-		{
-			method:  "POST",
-			path:    "/bar",
-			payload: `{"aa": "bb", "qq": "zz"}`,
-			expect:  `{"foo": "jet", "bar": {"aa": "bb", "qq": "zz"}, "list": ["a", "b", "c"]}`,
-		},
-		{
-			method: "DELETE",
-			path:   "/bar/qq",
-			expect: `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c"]}`,
-		},
-		{
-			method:    "DELETE",
-			path:      "/bar/qq",
-			expect:    `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c"]}`,
-			shouldErr: true,
-		},
-		{
-			method:  "POST",
-			path:    "/list",
-			payload: `"e"`,
-			expect:  `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "e"]}`,
-		},
-		{
-			method:  "PUT",
-			path:    "/list/3",
-			payload: `"d"`,
-			expect:  `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "d", "e"]}`,
-		},
-		{
-			method: "DELETE",
-			path:   "/list/3",
-			expect: `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "e"]}`,
-		},
-		{
-			method:  "PATCH",
-			path:    "/list/3",
-			payload: `"d"`,
-			expect:  `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "d"]}`,
-		},
-		{
-			method:  "POST",
-			path:    "/list/...",
-			payload: `["e", "f", "g"]`,
-			expect:  `{"foo": "jet", "bar": {"aa": "bb"}, "list": ["a", "b", "c", "d", "e", "f", "g"]}`,
-		},
-	} {
-		err := unsyncedConfigAccess(tc.method, rawConfigKey+tc.path, []byte(tc.payload), nil)
-
-		if tc.shouldErr && err == nil {
-			t.Fatalf("Test %d: Expected error return value, but got: %v", i, err)
-		}
-		if !tc.shouldErr && err != nil {
-			t.Fatalf("Test %d: Should not have had error return value, but got: %v", i, err)
-		}
-
-		// decode the expected config so we can do a convenient DeepEqual
-		var expectedDecoded any
-		err = json.Unmarshal([]byte(tc.expect), &expectedDecoded)
-		if err != nil {
-			t.Fatalf("Test %d: Unmarshaling expected config: %v", i, err)
-		}
-
-		// make sure the resulting config is as we expect it
-		if !reflect.DeepEqual(rawCfg[rawConfigKey], expectedDecoded) {
-			t.Fatalf("Test %d:\nExpected:\n\t%#v\nActual:\n\t%#v",
-				i, expectedDecoded, rawCfg[rawConfigKey])
-		}
-	}
-}
-
-// TestLoadConcurrent exercises Load under concurrent conditions
-// and is most useful under test with `-race` enabled.
-func TestLoadConcurrent(t *testing.T) {
-	var wg sync.WaitGroup
-
-	for i := 0; i < 100; i++ {
-		wg.Add(1)
-		go func() {
-			_ = Load(testCfg, true)
-			wg.Done()
-		}()
-	}
-	wg.Wait()
-}
-
-type fooModule struct {
-	IntField int
-	StrField string
-}
-
-func (fooModule) CaddyModule() ModuleInfo {
-	return ModuleInfo{
-		ID:  "foo",
-		New: func() Module { return new(fooModule) },
-	}
-}
-func (fooModule) Start() error { return nil }
-func (fooModule) Stop() error  { return nil }
-
-func TestETags(t *testing.T) {
-	RegisterModule(fooModule{})
-
-	if err := Load([]byte(`{"admin": {"listen": "localhost:2999"}, "apps": {"foo": {"strField": "abc", "intField": 0}}}`), true); err != nil {
-		t.Fatalf("loading: %s", err)
-	}
-
-	const key = "/" + rawConfigKey + "/apps/foo"
-
-	// try update the config with the wrong etag
-	err := changeConfig(http.MethodPost, key, []byte(`{"strField": "abc", "intField": 1}}`), fmt.Sprintf(`"/%s not_an_etag"`, rawConfigKey), false)
-	if apiErr, ok := err.(APIError); !ok || apiErr.HTTPStatus != http.StatusPreconditionFailed {
-		t.Fatalf("expected precondition failed; got %v", err)
-	}
-
-	// get the etag
-	hash := etagHasher()
-	if err := readConfig(key, hash); err != nil {
-		t.Fatalf("reading: %s", err)
-	}
-
-	// do the same update with the correct key
-	err = changeConfig(http.MethodPost, key, []byte(`{"strField": "abc", "intField": 1}`), makeEtag(key, hash), false)
-	if err != nil {
-		t.Fatalf("expected update to work; got %v", err)
-	}
-
-	// now try another update. The hash should no longer match and we should get precondition failed
-	err = changeConfig(http.MethodPost, key, []byte(`{"strField": "abc", "intField": 2}`), makeEtag(key, hash), false)
-	if apiErr, ok := err.(APIError); !ok || apiErr.HTTPStatus != http.StatusPreconditionFailed {
-		t.Fatalf("expected precondition failed; got %v", err)
-	}
-}
-
-func BenchmarkLoad(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		Load(testCfg, true)
-	}
-}
-
-func TestAdminHandlerErrorHandling(t *testing.T) {
-	initAdminMetrics()
-
-	handler := adminHandler{
-		mux: http.NewServeMux(),
-	}
-
-	handler.mux.Handle("/error", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		err := fmt.Errorf("test error")
-		handler.handleError(w, r, err)
-	}))
-
-	req := httptest.NewRequest(http.MethodGet, "/error", nil)
-	rr := httptest.NewRecorder()
-
-	handler.ServeHTTP(rr, req)
-
-	if rr.Code == http.StatusOK {
-		t.Error("expected error response, got success")
-	}
-
-	var apiErr APIError
-	if err := json.NewDecoder(rr.Body).Decode(&apiErr); err != nil {
-		t.Fatalf("decoding response: %v", err)
-	}
-	if apiErr.Message != "test error" {
-		t.Errorf("expected error message 'test error', got '%s'", apiErr.Message)
-	}
-}
-
-func initAdminMetrics() {
-	if adminMetrics.requestErrors != nil {
-		prometheus.Unregister(adminMetrics.requestErrors)
-	}
-	if adminMetrics.requestCount != nil {
-		prometheus.Unregister(adminMetrics.requestCount)
-	}
-
-	adminMetrics.requestErrors = prometheus.NewCounterVec(prometheus.CounterOpts{
-		Namespace: "caddy",
-		Subsystem: "admin_http",
-		Name:      "request_errors_total",
-		Help:      "Number of errors that occurred handling admin endpoint requests",
-	}, []string{"handler", "path", "method"})
-
-	adminMetrics.requestCount = prometheus.NewCounterVec(prometheus.CounterOpts{
-		Namespace: "caddy",
-		Subsystem: "admin_http",
-		Name:      "requests_total",
-		Help:      "Count of requests to the admin endpoint",
-	}, []string{"handler", "path", "code", "method"}) // Added code and method labels
-
-	prometheus.MustRegister(adminMetrics.requestErrors)
-	prometheus.MustRegister(adminMetrics.requestCount)
-}
-
-func TestAdminHandlerBuiltinRouteErrors(t *testing.T) {
-	initAdminMetrics()
-
-	cfg := &Config{
-		Admin: &AdminConfig{
-			Listen: "localhost:2019",
-		},
-	}
-
-	err := replaceLocalAdminServer(cfg, Context{})
-	if err != nil {
-		t.Fatalf("setting up admin server: %v", err)
-	}
-	defer func() {
-		stopAdminServer(localAdminServer)
-	}()
-
-	tests := []struct {
-		name           string
-		path           string
-		method         string
-		expectedStatus int
-	}{
-		{
-			name:           "stop endpoint wrong method",
-			path:           "/stop",
-			method:         http.MethodGet,
-			expectedStatus: http.StatusMethodNotAllowed,
-		},
-		{
-			name:           "config endpoint wrong content-type",
-			path:           "/config/",
-			method:         http.MethodPost,
-			expectedStatus: http.StatusBadRequest,
-		},
-		{
-			name:           "config ID missing ID",
-			path:           "/id/",
-			method:         http.MethodGet,
-			expectedStatus: http.StatusBadRequest,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			req := httptest.NewRequest(test.method, fmt.Sprintf("http://localhost:2019%s", test.path), nil)
-			rr := httptest.NewRecorder()
-
-			localAdminServer.Handler.ServeHTTP(rr, req)
-
-			if rr.Code != test.expectedStatus {
-				t.Errorf("expected status %d but got %d", test.expectedStatus, rr.Code)
-			}
-
-			metricValue := testGetMetricValue(map[string]string{
-				"path":    test.path,
-				"handler": "admin",
-				"method":  test.method,
-			})
-			if metricValue != 1 {
-				t.Errorf("expected error metric to be incremented once, got %v", metricValue)
-			}
-		})
-	}
-}
-
-func testGetMetricValue(labels map[string]string) float64 {
-	promLabels := prometheus.Labels{}
-	for k, v := range labels {
-		promLabels[k] = v
-	}
-
-	metric, err := adminMetrics.requestErrors.GetMetricWith(promLabels)
-	if err != nil {
-		return 0
-	}
-
-	pb := &dto.Metric{}
-	metric.Write(pb)
-	return pb.GetCounter().GetValue()
-}
-
-type mockRouter struct {
-	routes []AdminRoute
-}
-
-func (m mockRouter) Routes() []AdminRoute {
-	return m.routes
-}
-
-type mockModule struct {
-	mockRouter
-}
-
-func (m *mockModule) CaddyModule() ModuleInfo {
-	return ModuleInfo{
-		ID: "admin.api.mock",
-		New: func() Module {
-			mm := &mockModule{
-				mockRouter: mockRouter{
-					routes: m.routes,
-				},
-			}
-			return mm
-		},
-	}
-}
-
-func TestNewAdminHandlerRouterRegistration(t *testing.T) {
-	originalModules := make(map[string]ModuleInfo)
-	for k, v := range modules {
-		originalModules[k] = v
-	}
-	defer func() {
-		modules = originalModules
-	}()
-
-	mockRoute := AdminRoute{
-		Pattern: "/mock",
-		Handler: AdminHandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
-			w.WriteHeader(http.StatusOK)
-			return nil
-		}),
-	}
-
-	mock := &mockModule{
-		mockRouter: mockRouter{
-			routes: []AdminRoute{mockRoute},
-		},
-	}
-	RegisterModule(mock)
-
-	addr, err := ParseNetworkAddress("localhost:2019")
-	if err != nil {
-		t.Fatalf("Failed to parse address: %v", err)
-	}
-
-	admin := &AdminConfig{
-		EnforceOrigin: false,
-	}
-	handler := admin.newAdminHandler(addr, false, Context{})
-
-	req := httptest.NewRequest("GET", "/mock", nil)
-	req.Host = "localhost:2019"
-	rr := httptest.NewRecorder()
-
-	handler.ServeHTTP(rr, req)
-
-	if rr.Code != http.StatusOK {
-		t.Errorf("Expected status code %d but got %d", http.StatusOK, rr.Code)
-		t.Logf("Response body: %s", rr.Body.String())
-	}
-
-	if len(admin.routers) != 1 {
-		t.Errorf("Expected 1 router to be stored, got %d", len(admin.routers))
-	}
-}
-
-type mockProvisionableRouter struct {
-	mockRouter
-	provisionErr error
-	provisioned  bool
-}
-
-func (m *mockProvisionableRouter) Provision(Context) error {
-	m.provisioned = true
-	return m.provisionErr
-}
-
-type mockProvisionableModule struct {
-	*mockProvisionableRouter
-}
-
-func (m *mockProvisionableModule) CaddyModule() ModuleInfo {
-	return ModuleInfo{
-		ID: "admin.api.mock_provision",
-		New: func() Module {
-			mm := &mockProvisionableModule{
-				mockProvisionableRouter: &mockProvisionableRouter{
-					mockRouter:   m.mockRouter,
-					provisionErr: m.provisionErr,
-				},
-			}
-			return mm
-		},
-	}
-}
-
-func TestAdminRouterProvisioning(t *testing.T) {
-	tests := []struct {
-		name         string
-		provisionErr error
-		wantErr      bool
-		routersAfter int // expected number of routers after provisioning
-	}{
-		{
-			name:         "successful provisioning",
-			provisionErr: nil,
-			wantErr:      false,
-			routersAfter: 0,
-		},
-		{
-			name:         "provisioning error",
-			provisionErr: fmt.Errorf("provision failed"),
-			wantErr:      true,
-			routersAfter: 1,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			originalModules := make(map[string]ModuleInfo)
-			for k, v := range modules {
-				originalModules[k] = v
-			}
-			defer func() {
-				modules = originalModules
-			}()
-
-			mockRoute := AdminRoute{
-				Pattern: "/mock",
-				Handler: AdminHandlerFunc(func(w http.ResponseWriter, r *http.Request) error {
-					return nil
-				}),
-			}
-
-			// Create provisionable module
-			mock := &mockProvisionableModule{
-				mockProvisionableRouter: &mockProvisionableRouter{
-					mockRouter: mockRouter{
-						routes: []AdminRoute{mockRoute},
-					},
-					provisionErr: test.provisionErr,
-				},
-			}
-			RegisterModule(mock)
-
-			admin := &AdminConfig{}
-			addr, err := ParseNetworkAddress("localhost:2019")
-			if err != nil {
-				t.Fatalf("Failed to parse address: %v", err)
-			}
-
-			_ = admin.newAdminHandler(addr, false, Context{})
-			err = admin.provisionAdminRouters(Context{})
-
-			if test.wantErr {
-				if err == nil {
-					t.Error("Expected error but got nil")
-				}
-			} else {
-				if err != nil {
-					t.Errorf("Expected no error but got: %v", err)
-				}
-			}
-
-			if len(admin.routers) != test.routersAfter {
-				t.Errorf("Expected %d routers after provisioning, got %d", test.routersAfter, len(admin.routers))
-			}
-		})
-	}
-}
-
-func TestAllowedOriginsUnixSocket(t *testing.T) {
-	// see comment in allowedOrigins() as to why we do not fill out allowed origins for UDS
-	tests := []struct {
-		name          string
-		addr          NetworkAddress
-		origins       []string
-		expectOrigins []string
-	}{
-		{
-			name: "unix socket with default origins",
-			addr: NetworkAddress{
-				Network: "unix",
-				Host:    "/tmp/caddy.sock",
-			},
-			origins:       nil, // default origins
-			expectOrigins: []string{},
-		},
-		{
-			name: "unix socket with custom origins",
-			addr: NetworkAddress{
-				Network: "unix",
-				Host:    "/tmp/caddy.sock",
-			},
-			origins: []string{"example.com"},
-			expectOrigins: []string{
-				"example.com",
-			},
-		},
-		{
-			name: "tcp socket on localhost gets all loopback addresses",
-			addr: NetworkAddress{
-				Network:   "tcp",
-				Host:      "localhost",
-				StartPort: 2019,
-				EndPort:   2019,
-			},
-			origins: nil,
-			expectOrigins: []string{
-				"localhost:2019",
-				"[::1]:2019",
-				"127.0.0.1:2019",
-			},
-		},
-	}
-
-	for i, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			admin := AdminConfig{
-				Origins: test.origins,
-			}
-
-			got := admin.allowedOrigins(test.addr)
-
-			var gotOrigins []string
-			for _, u := range got {
-				gotOrigins = append(gotOrigins, u.Host)
-			}
-
-			if len(gotOrigins) != len(test.expectOrigins) {
-				t.Errorf("%d: Expected %d origins but got %d", i, len(test.expectOrigins), len(gotOrigins))
-				return
-			}
-
-			expectMap := make(map[string]struct{})
-			for _, origin := range test.expectOrigins {
-				expectMap[origin] = struct{}{}
-			}
-
-			gotMap := make(map[string]struct{})
-			for _, origin := range gotOrigins {
-				gotMap[origin] = struct{}{}
-			}
-
-			if !reflect.DeepEqual(expectMap, gotMap) {
-				t.Errorf("%d: Origins mismatch.\nExpected: %v\nGot: %v", i, test.expectOrigins, gotOrigins)
-			}
-		})
-	}
-}
-
-func TestReplaceRemoteAdminServer(t *testing.T) {
-	const testCert = `MIIDCTCCAfGgAwIBAgIUXsqJ1mY8pKlHQtI3HJ23x2eZPqwwDQYJKoZIhvcNAQEL
-BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTIzMDEwMTAwMDAwMFoXDTI0MDEw
-MTAwMDAwMFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEA4O4S6BSoYcoxvRqI+h7yPOjF6KjntjzVVm9M+uHK4lzX
-F1L3pSxJ2nDD4wZEV3FJ5yFOHVFqkG2vXG3BIczOlYG7UeNmKbQnKc5kZj3HGUrS
-VGEktA4OJbeZhhWP15gcXN5eDM2eH3g9BFXVX6AURxLiUXzhNBUEZuj/OEyH9yEF
-/qPCE+EjzVvWxvBXwgz/io4r4yok/Vq/bxJ6FlV6R7DX5oJSXyO0VEHZPi9DIyNU
-kK3F/r4U1sWiJGWOs8i3YQWZ2ejh1C0aLFZpPcCGGgMNpoF31gyYP6ZuPDUyCXsE
-g36UUw1JHNtIXYcLhnXuqj4A8TybTDpgXLqvwA9DBQIDAQABo1MwUTAdBgNVHQ4E
-FgQUc13z30pFC63rr/HGKOE7E82vjXwwHwYDVR0jBBgwFoAUc13z30pFC63rr/HG
-KOE7E82vjXwwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAHO3j
-oeiUXXJ7xD4P8Wj5t9d+E8lE1Xv1Dk3Z+EdG5+dan+RcToE42JJp9zB7FIh5Qz8g
-W77LAjqh5oyqz3A2VJcyVgfE3uJP1R1mJM7JfGHf84QH4TZF2Q1RZY4SZs0VQ6+q
-5wSlIZ4NXDy4Q4XkIJBGS61wT8IzYFXYBpx4PCP1Qj0PIE4sevEGwjsBIgxK307o
-BxF8AWe6N6e4YZmQLGjQ+SeH0iwZb6vpkHyAY8Kj2hvK+cq2P7vU3VGi0t3r1F8L
-IvrXHCvO2BMNJ/1UK1M4YNX8LYJqQhg9hEsIROe1OE/m3VhxIYMJI+qZXk9yHfgJ
-vq+SH04xKhtFudVBAQ==`
-
-	tests := []struct {
-		name    string
-		cfg     *Config
-		wantErr bool
-	}{
-		{
-			name:    "nil config",
-			cfg:     nil,
-			wantErr: false,
-		},
-		{
-			name: "nil admin config",
-			cfg: &Config{
-				Admin: nil,
-			},
-			wantErr: false,
-		},
-		{
-			name: "nil remote config",
-			cfg: &Config{
-				Admin: &AdminConfig{},
-			},
-			wantErr: false,
-		},
-		{
-			name: "invalid listen address",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Remote: &RemoteAdmin{
-						Listen: "invalid:address",
-					},
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name: "valid config",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{},
-					Remote: &RemoteAdmin{
-						Listen: "localhost:2021",
-						AccessControl: []*AdminAccess{
-							{
-								PublicKeys:  []string{testCert},
-								Permissions: []AdminPermissions{{Methods: []string{"GET"}, Paths: []string{"/test"}}},
-							},
-						},
-					},
-				},
-			},
-			wantErr: false,
-		},
-		{
-			name: "invalid certificate",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{},
-					Remote: &RemoteAdmin{
-						Listen: "localhost:2021",
-						AccessControl: []*AdminAccess{
-							{
-								PublicKeys:  []string{"invalid-cert-data"},
-								Permissions: []AdminPermissions{{Methods: []string{"GET"}, Paths: []string{"/test"}}},
-							},
-						},
-					},
-				},
-			},
-			wantErr: true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			ctx := Context{
-				Context: context.Background(),
-				cfg:     test.cfg,
-			}
-
-			if test.cfg != nil {
-				test.cfg.storage = &certmagic.FileStorage{Path: t.TempDir()}
-			}
-
-			if test.cfg != nil && test.cfg.Admin != nil && test.cfg.Admin.Identity != nil {
-				identityCertCache = certmagic.NewCache(certmagic.CacheOptions{
-					GetConfigForCert: func(certmagic.Certificate) (*certmagic.Config, error) {
-						return &certmagic.Config{}, nil
-					},
-				})
-			}
-
-			err := replaceRemoteAdminServer(ctx, test.cfg)
-
-			if test.wantErr {
-				if err == nil {
-					t.Error("Expected error but got nil")
-				}
-			} else {
-				if err != nil {
-					t.Errorf("Expected no error but got: %v", err)
-				}
-			}
-
-			// Clean up
-			if remoteAdminServer != nil {
-				_ = stopAdminServer(remoteAdminServer)
-			}
-		})
-	}
-}
-
-type mockIssuer struct {
-	configSet *certmagic.Config
-}
-
-func (m *mockIssuer) Issue(ctx context.Context, csr *x509.CertificateRequest) (*certmagic.IssuedCertificate, error) {
-	return &certmagic.IssuedCertificate{
-		Certificate: []byte(csr.Raw),
-	}, nil
-}
-
-func (m *mockIssuer) SetConfig(cfg *certmagic.Config) {
-	m.configSet = cfg
-}
-
-func (m *mockIssuer) IssuerKey() string {
-	return "mock"
-}
-
-type mockIssuerModule struct {
-	*mockIssuer
-}
-
-func (m *mockIssuerModule) CaddyModule() ModuleInfo {
-	return ModuleInfo{
-		ID: "tls.issuance.acme",
-		New: func() Module {
-			return &mockIssuerModule{mockIssuer: new(mockIssuer)}
-		},
-	}
-}
-
-func TestManageIdentity(t *testing.T) {
-	originalModules := make(map[string]ModuleInfo)
-	for k, v := range modules {
-		originalModules[k] = v
-	}
-	defer func() {
-		modules = originalModules
-	}()
-
-	RegisterModule(&mockIssuerModule{})
-
-	certPEM := []byte(`-----BEGIN CERTIFICATE-----
-MIIDujCCAqKgAwIBAgIIE31FZVaPXTUwDQYJKoZIhvcNAQEFBQAwSTELMAkGA1UE
-BhMCVVMxEzARBgNVBAoTCkdvb2dsZSBJbmMxJTAjBgNVBAMTHEdvb2dsZSBJbnRl
-cm5ldCBBdXRob3JpdHkgRzIwHhcNMTQwMTI5MTMyNzQzWhcNMTQwNTI5MDAwMDAw
-WjBpMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
-TW91bnRhaW4gVmlldzETMBEGA1UECgwKR29vZ2xlIEluYzEYMBYGA1UEAwwPbWFp
-bC5nb29nbGUuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3lcub2pUwkjC
-5GJQA2ZZfJJi6d1QHhEmkX9VxKYGp6gagZuRqJWy9TXP6++1ZzQQxqZLD0TkuxZ9
-8i9Nz00000CCBjCCAQQwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGgG
-CCsGAQUFBwEBBFwwWjArBggrBgEFBQcwAoYfaHR0cDovL3BraS5nb29nbGUuY29t
-L0dJQUcyLmNydDArBggrBgEFBQcwAYYfaHR0cDovL2NsaWVudHMxLmdvb2dsZS5j
-b20vb2NzcDAdBgNVHQ4EFgQUiJxtimAuTfwb+aUtBn5UYKreKvMwDAYDVR0TAQH/
-BAIwADAfBgNVHSMEGDAWgBRK3QYWG7z2aLV29YG2u2IaulqBLzAXBgNVHREEEDAO
-ggxtYWlsLmdvb2dsZTANBgkqhkiG9w0BAQUFAAOCAQEAMP6IWgNGZE8wP9TjFjSZ
-3mmW3A1eIr0CuPwNZ2LJ5ZD1i70ojzcj4I9IdP5yPg9CAEV4hNASbM1LzfC7GmJE
-tPzW5tRmpKVWZGRgTgZI8Hp/xZXMwLh9ZmXV4kESFAGj5G5FNvJyUV7R5Eh+7OZX
-7G4jJ4ZGJh+5jzN9HdJJHQHGYNIYOzC7+HH9UMwCjX9vhQ4RjwFZJThS2Yb+y7pb
-9yxTJZoXC6J0H5JpnZb7kZEJ+Xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
------END CERTIFICATE-----`)
-
-	keyPEM := []byte(`-----BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRS0LmTwUT0iwP
-...
------END PRIVATE KEY-----`)
-
-	testStorage := certmagic.FileStorage{Path: t.TempDir()}
-	err := testStorage.Store(context.Background(), "localhost/localhost.crt", certPEM)
-	if err != nil {
-		t.Fatal(err)
-	}
-	err = testStorage.Store(context.Background(), "localhost/localhost.key", keyPEM)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	tests := []struct {
-		name       string
-		cfg        *Config
-		wantErr    bool
-		checkState func(*testing.T, *Config)
-	}{
-		{
-			name: "nil config",
-			cfg:  nil,
-		},
-		{
-			name: "nil admin config",
-			cfg: &Config{
-				Admin: nil,
-			},
-		},
-		{
-			name: "nil identity config",
-			cfg: &Config{
-				Admin: &AdminConfig{},
-			},
-		},
-		{
-			name: "default issuer when none specified",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{
-						Identifiers: []string{"localhost"},
-					},
-				},
-				storage: &testStorage,
-			},
-			checkState: func(t *testing.T, cfg *Config) {
-				if len(cfg.Admin.Identity.issuers) == 0 {
-					t.Error("Expected at least 1 issuer to be configured")
-					return
-				}
-				if _, ok := cfg.Admin.Identity.issuers[0].(*mockIssuerModule); !ok {
-					t.Error("Expected mock issuer to be configured")
-				}
-			},
-		},
-		{
-			name: "custom issuer",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{
-						Identifiers: []string{"localhost"},
-						IssuersRaw: []json.RawMessage{
-							json.RawMessage(`{"module": "acme"}`),
-						},
-					},
-				},
-				storage: &certmagic.FileStorage{Path: "testdata"},
-			},
-			checkState: func(t *testing.T, cfg *Config) {
-				if len(cfg.Admin.Identity.issuers) != 1 {
-					t.Fatalf("Expected 1 issuer, got %d", len(cfg.Admin.Identity.issuers))
-				}
-				mockIss, ok := cfg.Admin.Identity.issuers[0].(*mockIssuerModule)
-				if !ok {
-					t.Fatal("Expected mock issuer")
-				}
-				if mockIss.configSet == nil {
-					t.Error("Issuer config was not set")
-				}
-			},
-		},
-		{
-			name: "invalid issuer module",
-			cfg: &Config{
-				Admin: &AdminConfig{
-					Identity: &IdentityConfig{
-						Identifiers: []string{"localhost"},
-						IssuersRaw: []json.RawMessage{
-							json.RawMessage(`{"module": "doesnt_exist"}`),
-						},
-					},
-				},
-			},
-			wantErr: true,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			if identityCertCache != nil {
-				// Reset the cert cache before each test
-				identityCertCache.Stop()
-				identityCertCache = nil
-			}
-
-			ctx := Context{
-				Context:         context.Background(),
-				cfg:             test.cfg,
-				moduleInstances: make(map[string][]Module),
-			}
-
-			err := manageIdentity(ctx, test.cfg)
-
-			if test.wantErr {
-				if err == nil {
-					t.Error("Expected error but got nil")
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("Expected no error but got: %v", err)
-			}
-
-			if test.checkState != nil {
-				test.checkState(t, test.cfg)
-			}
-		})
-	}
-}

appveyor.yml

@@ -0,0 +1,19 @@
+version: "{build}"
+
+os: Windows Server 2012 R2
+
+clone_folder: c:\gopath\src\github.com\mholt\caddy
+
+environment:
+  GOPATH: c:\gopath
+
+install:
+  - go get golang.org/x/tools/cmd/vet
+  - echo %GOPATH%
+  - go version
+  - go env
+  - go get -d ./...
+
+build_script:
+  - go vet ./...
+  - go test ./...

caddy/assets/path.go

@@ -0,0 +1,29 @@
+package assets
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+)
+
+// Path returns the path to the folder
+// where the application may store data. This
+// currently resolves to ~/.caddy
+func Path() string {
+	return filepath.Join(userHomeDir(), ".caddy")
+}
+
+// userHomeDir returns the user's home directory according to
+// environment variables.
+//
+// Credit: http://stackoverflow.com/a/7922977/1048862
+func userHomeDir() string {
+	if runtime.GOOS == "windows" {
+		home := os.Getenv("HOMEDRIVE") + os.Getenv("HOMEPATH")
+		if home == "" {
+			home = os.Getenv("USERPROFILE")
+		}
+		return home
+	}
+	return os.Getenv("HOME")
+}

caddy/assets/path_test.go

@@ -0,0 +1,12 @@
+package assets
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestPath(t *testing.T) {
+	if actual := Path(); !strings.HasSuffix(actual, ".caddy") {
+		t.Errorf("Expected path to be a .caddy folder, got: %v", actual)
+	}
+}

caddy/caddy.go

@@ -0,0 +1,350 @@
+// Package caddy implements the Caddy web server as a service.
+//
+// To use this package, follow a few simple steps:
+//
+//   1. Set the AppName and AppVersion variables.
+//   2. Call LoadCaddyfile() to get the Caddyfile (it
+//      might have been piped in as part of a restart).
+//      You should pass in your own Caddyfile loader.
+//   3. Call caddy.Start() to start Caddy, caddy.Stop()
+//      to stop it, or caddy.Restart() to restart it.
+//
+// You should use caddy.Wait() to wait for all Caddy servers
+// to quit before your process exits.
+//
+// Importing this package has the side-effect of trapping
+// SIGINT on all platforms and SIGUSR1 on not-Windows systems.
+// It has to do this in order to perform shutdowns or reloads.
+package caddy
+
+import (
+	"bytes"
+	"encoding/gob"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net"
+	"os"
+	"path"
+	"strings"
+	"sync"
+
+	"github.com/mholt/caddy/caddy/letsencrypt"
+	"github.com/mholt/caddy/server"
+)
+
+// Configurable application parameters
+var (
+	// The name and version of the application.
+	AppName    string
+	AppVersion string
+
+	// If true, initialization will not show any informative output.
+	Quiet bool
+
+	// HTTP2 indicates whether HTTP2 is enabled or not
+	HTTP2 bool // TODO: temporary flag until http2 is standard
+)
+
+var (
+	// caddyfile is the input configuration text used for this process
+	caddyfile Input
+
+	// caddyfileMu protects caddyfile during changes
+	caddyfileMu sync.Mutex
+
+	// errIncompleteRestart occurs if this process is a fork
+	// of the parent but no Caddyfile was piped in
+	errIncompleteRestart = errors.New("cannot finish restart successfully")
+
+	// servers is a list of all the currently-listening servers
+	servers []*server.Server
+
+	// serversMu protects the servers slice during changes
+	serversMu sync.Mutex
+
+	// wg is used to wait for all servers to shut down
+	wg sync.WaitGroup
+
+	// loadedGob is used if this is a child process as part of
+	// a graceful restart; it is used to map listeners to their
+	// index in the list of inherited file descriptors. This
+	// variable is not safe for concurrent access.
+	loadedGob caddyfileGob
+)
+
+const (
+	// DefaultHost is the default host.
+	DefaultHost = "0.0.0.0"
+	// DefaultPort is the default port.
+	DefaultPort = "2015"
+	// DefaultRoot is the default root folder.
+	DefaultRoot = "."
+)
+
+// Start starts Caddy with the given Caddyfile. If cdyfile
+// is nil or the process is forked from a parent as part of
+// a graceful restart, Caddy will check to see if Caddyfile
+// was piped from stdin and use that. It blocks until all the
+// servers are listening.
+//
+// If this process is a fork and no Caddyfile was piped in,
+// an error will be returned (the Restart() function does this
+// for you automatically). If this process is NOT a fork and
+// cdyfile is nil, a default configuration will be assumed.
+// In any case, an error is returned if Caddy could not be
+// started.
+func Start(cdyfile Input) error {
+	// TODO: What if already started -- is that an error?
+
+	var err error
+
+	// Input must never be nil; try to load something
+	if cdyfile == nil {
+		cdyfile, err = LoadCaddyfile(nil)
+		if err != nil {
+			return err
+		}
+	}
+
+	caddyfileMu.Lock()
+	caddyfile = cdyfile
+	caddyfileMu.Unlock()
+
+	// load the server configs (activates Let's Encrypt)
+	configs, err := loadConfigs(path.Base(cdyfile.Path()), bytes.NewReader(cdyfile.Body()))
+	if err != nil {
+		return err
+	}
+
+	// group virtualhosts by address
+	groupings, err := arrangeBindings(configs)
+	if err != nil {
+		return err
+	}
+
+	// Start each server with its one or more configurations
+	err = startServers(groupings)
+	if err != nil {
+		return err
+	}
+
+	// Close remaining file descriptors we may have inherited that we don't need
+	if IsRestart() {
+		for _, fdIndex := range loadedGob.ListenerFds {
+			file := os.NewFile(fdIndex, "")
+			fln, err := net.FileListener(file)
+			if err == nil {
+				fln.Close()
+			}
+		}
+	}
+
+	// Show initialization output
+	if !Quiet && !IsRestart() {
+		var checkedFdLimit bool
+		for _, group := range groupings {
+			for _, conf := range group.Configs {
+				// Print address of site
+				fmt.Println(conf.Address())
+
+				// Note if non-localhost site resolves to loopback interface
+				if group.BindAddr.IP.IsLoopback() && !isLocalhost(conf.Host) {
+					fmt.Printf("Notice: %s is only accessible on this machine (%s)\n",
+						conf.Host, group.BindAddr.IP.String())
+				}
+				if !checkedFdLimit && !group.BindAddr.IP.IsLoopback() && !isLocalhost(conf.Host) {
+					checkFdlimit()
+					checkedFdLimit = true
+				}
+			}
+		}
+	}
+
+	// Tell parent process that we got this
+	if IsRestart() {
+		ppipe := os.NewFile(3, "") // parent is listening on pipe at index 3
+		ppipe.Write([]byte("success"))
+		ppipe.Close()
+	}
+
+	return nil
+}
+
+// startServers starts all the servers in groupings,
+// taking into account whether or not this process is
+// a child from a graceful restart or not. It blocks
+// until the servers are listening.
+func startServers(groupings Group) error {
+	var startupWg sync.WaitGroup
+	errChan := make(chan error)
+
+	for _, group := range groupings {
+		s, err := server.New(group.BindAddr.String(), group.Configs)
+		if err != nil {
+			return err
+		}
+		s.HTTP2 = HTTP2 // TODO: This setting is temporary
+
+		var ln server.ListenerFile
+		if IsRestart() {
+			// Look up this server's listener in the map of inherited file descriptors;
+			// if we don't have one, we must make a new one (later).
+			if fdIndex, ok := loadedGob.ListenerFds[s.Addr]; ok {
+				file := os.NewFile(fdIndex, "")
+
+				fln, err := net.FileListener(file)
+				if err != nil {
+					return err
+				}
+
+				ln, ok = fln.(server.ListenerFile)
+				if !ok {
+					return errors.New("listener for " + s.Addr + " was not a ListenerFile")
+				}
+
+				delete(loadedGob.ListenerFds, s.Addr) // mark it as used
+			}
+		}
+
+		wg.Add(1)
+		go func(s *server.Server, ln server.ListenerFile) {
+			defer wg.Done()
+			if ln != nil {
+				errChan <- s.Serve(ln)
+			} else {
+				errChan <- s.ListenAndServe()
+			}
+		}(s, ln)
+
+		startupWg.Add(1)
+		go func(s *server.Server) {
+			defer startupWg.Done()
+			s.WaitUntilStarted()
+		}(s)
+
+		serversMu.Lock()
+		servers = append(servers, s)
+		serversMu.Unlock()
+	}
+
+	// Wait for all servers to finish starting
+	startupWg.Wait()
+
+	// Return the first error, if any
+	select {
+	case err := <-errChan:
+		// "use of closed network connection" is normal if it was a graceful shutdown
+		if err != nil && !strings.Contains(err.Error(), "use of closed network connection") {
+			return err
+		}
+	default:
+	}
+
+	return nil
+}
+
+// Stop stops all servers. It blocks until they are all stopped.
+// It does NOT execute shutdown callbacks that may have been
+// configured by middleware (they are executed on SIGINT).
+func Stop() error {
+	letsencrypt.Deactivate()
+
+	serversMu.Lock()
+	for _, s := range servers {
+		s.Stop() // TODO: error checking/reporting?
+	}
+	servers = []*server.Server{} // don't reuse servers
+	serversMu.Unlock()
+
+	return nil
+}
+
+// Wait blocks until all servers are stopped.
+func Wait() {
+	wg.Wait()
+}
+
+// LoadCaddyfile loads a Caddyfile in a way that prioritizes
+// reading from stdin pipe; otherwise it calls loader to load
+// the Caddyfile. If loader does not return a Caddyfile, the
+// default one will be returned. Thus, if there are no other
+// errors, this function always returns at least the default
+// Caddyfile (not the previously-used Caddyfile).
+func LoadCaddyfile(loader func() (Input, error)) (cdyfile Input, err error) {
+	// If we are a fork, finishing the restart is highest priority;
+	// piped input is required in this case.
+	if IsRestart() {
+		err := gob.NewDecoder(os.Stdin).Decode(&loadedGob)
+		if err != nil {
+			return nil, err
+		}
+		cdyfile = loadedGob.Caddyfile
+	}
+
+	// Try user's loader
+	if cdyfile == nil && loader != nil {
+		cdyfile, err = loader()
+	}
+
+	// Otherwise revert to default
+	if cdyfile == nil {
+		cdyfile = DefaultInput()
+	}
+
+	return
+}
+
+// CaddyfileFromPipe loads the Caddyfile input from f if f is
+// not interactive input. f is assumed to be a pipe or stream,
+// such as os.Stdin. If f is not a pipe, no error is returned
+// but the Input value will be nil. An error is only returned
+// if there was an error reading the pipe, even if the length
+// of what was read is 0.
+func CaddyfileFromPipe(f *os.File) (Input, error) {
+	fi, err := f.Stat()
+	if err == nil && fi.Mode()&os.ModeCharDevice == 0 {
+		// Note that a non-nil error is not a problem. Windows
+		// will not create a stdin if there is no pipe, which
+		// produces an error when calling Stat(). But Unix will
+		// make one either way, which is why we also check that
+		// bitmask.
+		// BUG: Reading from stdin after this fails (e.g. for the let's encrypt email address) (OS X)
+		confBody, err := ioutil.ReadAll(f)
+		if err != nil {
+			return nil, err
+		}
+		return CaddyfileInput{
+			Contents: confBody,
+			Filepath: f.Name(),
+		}, nil
+	}
+
+	// not having input from the pipe is not itself an error,
+	// just means no input to return.
+	return nil, nil
+}
+
+// Caddyfile returns the current Caddyfile
+func Caddyfile() Input {
+	caddyfileMu.Lock()
+	defer caddyfileMu.Unlock()
+	return caddyfile
+}
+
+// Input represents a Caddyfile; its contents and file path
+// (which should include the file name at the end of the path).
+// If path does not apply (e.g. piped input) you may use
+// any understandable value. The path is mainly used for logging,
+// error messages, and debugging.
+type Input interface {
+	// Gets the Caddyfile contents
+	Body() []byte
+
+	// Gets the path to the origin file
+	Path() string
+
+	// IsFile returns true if the original input was a file on the file system
+	// that could be loaded again later if requested.
+	IsFile() bool
+}

caddy/caddy_test.go

@@ -0,0 +1,32 @@
+package caddy
+
+import (
+	"net/http"
+	"testing"
+	"time"
+)
+
+func TestCaddyStartStop(t *testing.T) {
+	caddyfile := "localhost:1984\ntls off"
+
+	for i := 0; i < 2; i++ {
+		err := Start(CaddyfileInput{Contents: []byte(caddyfile)})
+		if err != nil {
+			t.Fatalf("Error starting, iteration %d: %v", i, err)
+		}
+
+		client := http.Client{
+			Timeout: time.Duration(2 * time.Second),
+		}
+		resp, err := client.Get("http://localhost:1984")
+		if err != nil {
+			t.Fatalf("Expected GET request to succeed (iteration %d), but it failed: %v", i, err)
+		}
+		resp.Body.Close()
+
+		err = Stop()
+		if err != nil {
+			t.Fatalf("Error stopping, iteration %d: %v", i, err)
+		}
+	}
+}

caddy/caddyfile/json.go

@@ -0,0 +1,165 @@
+package caddyfile
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net"
+	"strconv"
+	"strings"
+
+	"github.com/mholt/caddy/caddy/parse"
+)
+
+const filename = "Caddyfile"
+
+// ToJSON converts caddyfile to its JSON representation.
+func ToJSON(caddyfile []byte) ([]byte, error) {
+	var j Caddyfile
+
+	serverBlocks, err := parse.ServerBlocks(filename, bytes.NewReader(caddyfile), false)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, sb := range serverBlocks {
+		block := ServerBlock{Body: make(map[string]interface{})}
+
+		for _, host := range sb.HostList() {
+			block.Hosts = append(block.Hosts, strings.TrimSuffix(host, ":"))
+		}
+
+		for dir, tokens := range sb.Tokens {
+			disp := parse.NewDispenserTokens(filename, tokens)
+			disp.Next() // the first token is the directive; skip it
+			block.Body[dir] = constructLine(disp)
+		}
+
+		j = append(j, block)
+	}
+
+	result, err := json.Marshal(j)
+	if err != nil {
+		return nil, err
+	}
+
+	return result, nil
+}
+
+// constructLine transforms tokens into a JSON-encodable structure;
+// but only one line at a time, to be used at the top-level of
+// a server block only (where the first token on each line is a
+// directive) - not to be used at any other nesting level.
+func constructLine(d parse.Dispenser) interface{} {
+	var args []interface{}
+
+	all := d.RemainingArgs()
+	for _, arg := range all {
+		args = append(args, arg)
+	}
+
+	d.Next()
+	if d.Val() == "{" {
+		args = append(args, constructBlock(d))
+	}
+
+	return args
+}
+
+// constructBlock recursively processes tokens into a
+// JSON-encodable structure.
+func constructBlock(d parse.Dispenser) interface{} {
+	block := make(map[string]interface{})
+
+	for d.Next() {
+		if d.Val() == "}" {
+			break
+		}
+
+		dir := d.Val()
+		all := d.RemainingArgs()
+
+		var args []interface{}
+		for _, arg := range all {
+			args = append(args, arg)
+		}
+		if d.Val() == "{" {
+			args = append(args, constructBlock(d))
+		}
+
+		block[dir] = args
+	}
+
+	return block
+}
+
+// FromJSON converts JSON-encoded jsonBytes to Caddyfile text
+func FromJSON(jsonBytes []byte) ([]byte, error) {
+	var j Caddyfile
+	var result string
+
+	err := json.Unmarshal(jsonBytes, &j)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, sb := range j {
+		for i, host := range sb.Hosts {
+			if hostname, port, err := net.SplitHostPort(host); err == nil {
+				if port == "http" || port == "https" {
+					host = port + "://" + hostname
+				}
+			}
+			if i > 0 {
+				result += ", "
+			}
+			result += strings.TrimSuffix(host, ":")
+		}
+		result += jsonToText(sb.Body, 1)
+	}
+
+	return []byte(result), nil
+}
+
+// jsonToText recursively transforms a scope of JSON into plain
+// Caddyfile text.
+func jsonToText(scope interface{}, depth int) string {
+	var result string
+
+	switch val := scope.(type) {
+	case string:
+		if strings.ContainsAny(val, "\" \n\t\r") {
+			result += ` "` + strings.Replace(val, "\"", "\\\"", -1) + `"`
+		} else {
+			result += " " + val
+		}
+	case int:
+		result += " " + strconv.Itoa(val)
+	case float64:
+		result += " " + fmt.Sprintf("%v", val)
+	case bool:
+		result += " " + fmt.Sprintf("%t", val)
+	case map[string]interface{}:
+		result += " {\n"
+		for param, args := range val {
+			result += strings.Repeat("\t", depth) + param
+			result += jsonToText(args, depth+1) + "\n"
+		}
+		result += strings.Repeat("\t", depth-1) + "}"
+	case []interface{}:
+		for _, v := range val {
+			result += jsonToText(v, depth)
+		}
+	}
+
+	return result
+}
+
+// Caddyfile encapsulates a slice of ServerBlocks.
+type Caddyfile []ServerBlock
+
+// ServerBlock represents a server block.
+type ServerBlock struct {
+	Hosts []string               `json:"hosts"`
+	Body  map[string]interface{} `json:"body"`
+}

caddy/caddyfile/json_test.go

@@ -0,0 +1,91 @@
+package caddyfile
+
+import "testing"
+
+var tests = []struct {
+	caddyfile, json string
+}{
+	{ // 0
+		caddyfile: `foo {
+	root /bar
+}`,
+		json: `[{"hosts":["foo"],"body":{"root":["/bar"]}}]`,
+	},
+	{ // 1
+		caddyfile: `host1, host2 {
+	dir {
+		def
+	}
+}`,
+		json: `[{"hosts":["host1","host2"],"body":{"dir":[{"def":null}]}}]`,
+	},
+	{ // 2
+		caddyfile: `host1, host2 {
+	dir abc {
+		def ghi
+	}
+}`,
+		json: `[{"hosts":["host1","host2"],"body":{"dir":["abc",{"def":["ghi"]}]}}]`,
+	},
+	{ // 3
+		caddyfile: `host1:1234, host2:5678 {
+	dir abc {
+	}
+}`,
+		json: `[{"hosts":["host1:1234","host2:5678"],"body":{"dir":["abc",{}]}}]`,
+	},
+	{ // 4
+		caddyfile: `host {
+	foo "bar baz"
+}`,
+		json: `[{"hosts":["host"],"body":{"foo":["bar baz"]}}]`,
+	},
+	{ // 5
+		caddyfile: `host, host:80 {
+	foo "bar \"baz\""
+}`,
+		json: `[{"hosts":["host","host:80"],"body":{"foo":["bar \"baz\""]}}]`,
+	},
+	{ // 6
+		caddyfile: `host {
+	foo "bar
+baz"
+}`,
+		json: `[{"hosts":["host"],"body":{"foo":["bar\nbaz"]}}]`,
+	},
+	{ // 7
+		caddyfile: `host {
+	dir 123 4.56 true
+}`,
+		json: `[{"hosts":["host"],"body":{"dir":["123","4.56","true"]}}]`, // NOTE: I guess we assume numbers and booleans should be encoded as strings...?
+	},
+	{ // 8
+		caddyfile: `http://host, https://host {
+}`,
+		json: `[{"hosts":["host:http","host:https"],"body":{}}]`, // hosts in JSON are always host:port format (if port is specified), for consistency
+	},
+}
+
+func TestToJSON(t *testing.T) {
+	for i, test := range tests {
+		output, err := ToJSON([]byte(test.caddyfile))
+		if err != nil {
+			t.Errorf("Test %d: %v", i, err)
+		}
+		if string(output) != test.json {
+			t.Errorf("Test %d\nExpected:\n'%s'\nActual:\n'%s'", i, test.json, string(output))
+		}
+	}
+}
+
+func TestFromJSON(t *testing.T) {
+	for i, test := range tests {
+		output, err := FromJSON([]byte(test.json))
+		if err != nil {
+			t.Errorf("Test %d: %v", i, err)
+		}
+		if string(output) != test.caddyfile {
+			t.Errorf("Test %d\nExpected:\n'%s'\nActual:\n'%s'", i, test.caddyfile, string(output))
+		}
+	}
+}

caddy/config.go

@@ -0,0 +1,376 @@
+package caddy
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"sync"
+
+	"github.com/mholt/caddy/caddy/letsencrypt"
+	"github.com/mholt/caddy/caddy/parse"
+	"github.com/mholt/caddy/caddy/setup"
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/server"
+)
+
+const (
+	// DefaultConfigFile is the name of the configuration file that is loaded
+	// by default if no other file is specified.
+	DefaultConfigFile = "Caddyfile"
+)
+
+// loadConfigs reads input (named filename) and parses it, returning the
+// server configurations in the order they appeared in the input. As part
+// of this, it activates Let's Encrypt for the configs that are produced.
+// Thus, the returned configs are already optimally configured optimally
+// for HTTPS.
+func loadConfigs(filename string, input io.Reader) ([]server.Config, error) {
+	var configs []server.Config
+
+	// Each server block represents similar hosts/addresses, since they
+	// were grouped together in the Caddyfile.
+	serverBlocks, err := parse.ServerBlocks(filename, input, true)
+	if err != nil {
+		return nil, err
+	}
+	if len(serverBlocks) == 0 {
+		newInput := DefaultInput()
+		serverBlocks, err = parse.ServerBlocks(newInput.Path(), bytes.NewReader(newInput.Body()), true)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	var lastDirectiveIndex int // we set up directives in two parts; this stores where we left off
+
+	// Iterate each server block and make a config for each one,
+	// executing the directives that were parsed in order up to the tls
+	// directive; this is because we must activate Let's Encrypt.
+	for i, sb := range serverBlocks {
+		onces := makeOnces()
+		storages := makeStorages()
+
+		for j, addr := range sb.Addresses {
+			config := server.Config{
+				Host:       addr.Host,
+				Port:       addr.Port,
+				Root:       Root,
+				Middleware: make(map[string][]middleware.Middleware),
+				ConfigFile: filename,
+				AppName:    AppName,
+				AppVersion: AppVersion,
+			}
+
+			// It is crucial that directives are executed in the proper order.
+			for k, dir := range directiveOrder {
+				// Execute directive if it is in the server block
+				if tokens, ok := sb.Tokens[dir.name]; ok {
+					// Each setup function gets a controller, from which setup functions
+					// get access to the config, tokens, and other state information useful
+					// to set up its own host only.
+					controller := &setup.Controller{
+						Config:    &config,
+						Dispenser: parse.NewDispenserTokens(filename, tokens),
+						OncePerServerBlock: func(f func() error) error {
+							var err error
+							onces[dir.name].Do(func() {
+								err = f()
+							})
+							return err
+						},
+						ServerBlockIndex:     i,
+						ServerBlockHostIndex: j,
+						ServerBlockHosts:     sb.HostList(),
+						ServerBlockStorage:   storages[dir.name],
+					}
+					// execute setup function and append middleware handler, if any
+					midware, err := dir.setup(controller)
+					if err != nil {
+						return nil, err
+					}
+					if midware != nil {
+						// TODO: For now, we only support the default path scope /
+						config.Middleware["/"] = append(config.Middleware["/"], midware)
+					}
+					storages[dir.name] = controller.ServerBlockStorage // persist for this server block
+				}
+
+				// Stop after TLS setup, since we need to activate Let's Encrypt before continuing;
+				// it makes some changes to the configs that middlewares might want to know about.
+				if dir.name == "tls" {
+					lastDirectiveIndex = k
+					break
+				}
+			}
+
+			configs = append(configs, config)
+		}
+	}
+
+	// Now we have all the configs, but they have only been set up to the
+	// point of tls. We need to activate Let's Encrypt before setting up
+	// the rest of the middlewares so they have correct information regarding
+	// TLS configuration, if necessary. (this call is append-only, so our
+	// iterations below shouldn't be affected)
+	if !IsRestart() && !Quiet {
+		fmt.Print("Activating privacy features...")
+	}
+	configs, err = letsencrypt.Activate(configs)
+	if err != nil {
+		if !Quiet {
+			fmt.Println()
+		}
+		return nil, err
+	}
+	if !IsRestart() && !Quiet {
+		fmt.Println(" done.")
+	}
+
+	// Finish setting up the rest of the directives, now that TLS is
+	// optimally configured. These loops are similar to above except
+	// we don't iterate all the directives from the beginning and we
+	// don't create new configs.
+	configIndex := -1
+	for i, sb := range serverBlocks {
+		onces := makeOnces()
+		storages := makeStorages()
+
+		for j := range sb.Addresses {
+			configIndex++
+
+			for k := lastDirectiveIndex + 1; k < len(directiveOrder); k++ {
+				dir := directiveOrder[k]
+
+				if tokens, ok := sb.Tokens[dir.name]; ok {
+					controller := &setup.Controller{
+						Config:    &configs[configIndex],
+						Dispenser: parse.NewDispenserTokens(filename, tokens),
+						OncePerServerBlock: func(f func() error) error {
+							var err error
+							onces[dir.name].Do(func() {
+								err = f()
+							})
+							return err
+						},
+						ServerBlockIndex:     i,
+						ServerBlockHostIndex: j,
+						ServerBlockHosts:     sb.HostList(),
+						ServerBlockStorage:   storages[dir.name],
+					}
+					midware, err := dir.setup(controller)
+					if err != nil {
+						return nil, err
+					}
+					if midware != nil {
+						// TODO: For now, we only support the default path scope /
+						configs[configIndex].Middleware["/"] = append(configs[configIndex].Middleware["/"], midware)
+					}
+					storages[dir.name] = controller.ServerBlockStorage // persist for this server block
+				}
+			}
+		}
+	}
+
+	return configs, nil
+}
+
+// makeOnces makes a map of directive name to sync.Once
+// instance. This is intended to be called once per server
+// block when setting up configs so that Setup functions
+// for each directive can perform a task just once per
+// server block, even if there are multiple hosts on the block.
+//
+// We need one Once per directive, otherwise the first
+// directive to use it would exclude other directives from
+// using it at all, which would be a bug.
+func makeOnces() map[string]*sync.Once {
+	onces := make(map[string]*sync.Once)
+	for _, dir := range directiveOrder {
+		onces[dir.name] = new(sync.Once)
+	}
+	return onces
+}
+
+// makeStorages makes a map of directive name to interface{}
+// so that directives' setup functions can persist state
+// between different hosts on the same server block during the
+// setup phase.
+func makeStorages() map[string]interface{} {
+	storages := make(map[string]interface{})
+	for _, dir := range directiveOrder {
+		storages[dir.name] = nil
+	}
+	return storages
+}
+
+// arrangeBindings groups configurations by their bind address. For example,
+// a server that should listen on localhost and another on 127.0.0.1 will
+// be grouped into the same address: 127.0.0.1. It will return an error
+// if an address is malformed or a TLS listener is configured on the
+// same address as a plaintext HTTP listener. The return value is a map of
+// bind address to list of configs that would become VirtualHosts on that
+// server. Use the keys of the returned map to create listeners, and use
+// the associated values to set up the virtualhosts.
+func arrangeBindings(allConfigs []server.Config) (Group, error) {
+	var groupings Group
+
+	// Group configs by bind address
+	for _, conf := range allConfigs {
+		// use default port if none is specified
+		if conf.Port == "" {
+			conf.Port = Port
+		}
+
+		bindAddr, warnErr, fatalErr := resolveAddr(conf)
+		if fatalErr != nil {
+			return groupings, fatalErr
+		}
+		if warnErr != nil {
+			log.Printf("[WARNING] Resolving bind address for %s: %v", conf.Address(), warnErr)
+		}
+
+		// Make sure to compare the string representation of the address,
+		// not the pointer, since a new *TCPAddr is created each time.
+		var existing bool
+		for i := 0; i < len(groupings); i++ {
+			if groupings[i].BindAddr.String() == bindAddr.String() {
+				groupings[i].Configs = append(groupings[i].Configs, conf)
+				existing = true
+				break
+			}
+		}
+		if !existing {
+			groupings = append(groupings, BindingMapping{
+				BindAddr: bindAddr,
+				Configs:  []server.Config{conf},
+			})
+		}
+	}
+
+	// Don't allow HTTP and HTTPS to be served on the same address
+	for _, group := range groupings {
+		isTLS := group.Configs[0].TLS.Enabled
+		for _, config := range group.Configs {
+			if config.TLS.Enabled != isTLS {
+				thisConfigProto, otherConfigProto := "HTTP", "HTTP"
+				if config.TLS.Enabled {
+					thisConfigProto = "HTTPS"
+				}
+				if group.Configs[0].TLS.Enabled {
+					otherConfigProto = "HTTPS"
+				}
+				return groupings, fmt.Errorf("configuration error: Cannot multiplex %s (%s) and %s (%s) on same address",
+					group.Configs[0].Address(), otherConfigProto, config.Address(), thisConfigProto)
+			}
+		}
+	}
+
+	return groupings, nil
+}
+
+// resolveAddr determines the address (host and port) that a config will
+// bind to. The returned address, resolvAddr, should be used to bind the
+// listener or group the config with other configs using the same address.
+// The first error, if not nil, is just a warning and should be reported
+// but execution may continue. The second error, if not nil, is a real
+// problem and the server should not be started.
+//
+// This function handles edge cases gracefully. If a port name like
+// "http" or "https" is unknown to the system, this function will
+// change them to 80 or 443 respectively. If a hostname fails to
+// resolve, that host can still be served but will be listening on
+// the wildcard host instead. This function takes care of this for you.
+func resolveAddr(conf server.Config) (resolvAddr *net.TCPAddr, warnErr, fatalErr error) {
+	bindHost := conf.BindHost
+
+	// TODO: Do we even need the port? Maybe we just need to look up the host.
+	resolvAddr, warnErr = net.ResolveTCPAddr("tcp", net.JoinHostPort(bindHost, conf.Port))
+	if warnErr != nil {
+		// Most likely the host lookup failed or the port is unknown
+		tryPort := conf.Port
+
+		switch errVal := warnErr.(type) {
+		case *net.AddrError:
+			if errVal.Err == "unknown port" {
+				// some odd Linux machines don't support these port names; see issue #136
+				switch conf.Port {
+				case "http":
+					tryPort = "80"
+				case "https":
+					tryPort = "443"
+				}
+			}
+			resolvAddr, fatalErr = net.ResolveTCPAddr("tcp", net.JoinHostPort(bindHost, tryPort))
+			if fatalErr != nil {
+				return
+			}
+		default:
+			// the hostname probably couldn't be resolved, just bind to wildcard then
+			resolvAddr, fatalErr = net.ResolveTCPAddr("tcp", net.JoinHostPort("0.0.0.0", tryPort))
+			if fatalErr != nil {
+				return
+			}
+		}
+
+		return
+	}
+
+	return
+}
+
+// validDirective returns true if d is a valid
+// directive; false otherwise.
+func validDirective(d string) bool {
+	for _, dir := range directiveOrder {
+		if dir.name == d {
+			return true
+		}
+	}
+	return false
+}
+
+// NewDefault makes a default configuration, which
+// is empty except for root, host, and port,
+// which are essentials for serving the cwd.
+func NewDefault() server.Config {
+	return server.Config{
+		Root: Root,
+		Host: Host,
+		Port: Port,
+	}
+}
+
+// DefaultInput returns the default Caddyfile input
+// to use when it is otherwise empty or missing.
+func DefaultInput() CaddyfileInput {
+	return CaddyfileInput{
+		Contents: []byte(fmt.Sprintf("%s:%s\nroot %s", Host, Port, Root)),
+	}
+}
+
+// These defaults are configurable through the command line
+var (
+	// Site root
+	Root = DefaultRoot
+
+	// Site host
+	Host = DefaultHost
+
+	// Site port
+	Port = DefaultPort
+)
+
+// BindingMapping maps a network address to configurations
+// that will bind to it. The order of the configs is important.
+type BindingMapping struct {
+	BindAddr *net.TCPAddr
+	Configs  []server.Config
+}
+
+// Group maps network addresses to their configurations.
+// Preserving the order of the groupings is important
+// (related to graceful shutdown and restart)
+// so this is a slice, not a literal map.
+type Group []BindingMapping

caddy/config_test.go

@@ -0,0 +1,138 @@
+package caddy
+
+import (
+	"reflect"
+	"sync"
+	"testing"
+
+	"github.com/mholt/caddy/server"
+)
+
+func TestNewDefault(t *testing.T) {
+	config := NewDefault()
+
+	if actual, expected := config.Root, DefaultRoot; actual != expected {
+		t.Errorf("Root was %s but expected %s", actual, expected)
+	}
+	if actual, expected := config.Host, DefaultHost; actual != expected {
+		t.Errorf("Host was %s but expected %s", actual, expected)
+	}
+	if actual, expected := config.Port, DefaultPort; actual != expected {
+		t.Errorf("Port was %s but expected %s", actual, expected)
+	}
+}
+
+func TestResolveAddr(t *testing.T) {
+	// NOTE: If tests fail due to comparing to string "127.0.0.1",
+	// it's possible that system env resolves with IPv6, or ::1.
+	// If that happens, maybe we should use actualAddr.IP.IsLoopback()
+	// for the assertion, rather than a direct string comparison.
+
+	// NOTE: Tests with {Host: "", Port: ""} and {Host: "localhost", Port: ""}
+	// will not behave the same cross-platform, so they have been omitted.
+
+	for i, test := range []struct {
+		config         server.Config
+		shouldWarnErr  bool
+		shouldFatalErr bool
+		expectedIP     string
+		expectedPort   int
+	}{
+		{server.Config{Host: "127.0.0.1", Port: "1234"}, false, false, "<nil>", 1234},
+		{server.Config{Host: "localhost", Port: "80"}, false, false, "<nil>", 80},
+		{server.Config{BindHost: "localhost", Port: "1234"}, false, false, "127.0.0.1", 1234},
+		{server.Config{BindHost: "127.0.0.1", Port: "1234"}, false, false, "127.0.0.1", 1234},
+		{server.Config{BindHost: "should-not-resolve", Port: "1234"}, true, false, "0.0.0.0", 1234},
+		{server.Config{BindHost: "localhost", Port: "http"}, false, false, "127.0.0.1", 80},
+		{server.Config{BindHost: "localhost", Port: "https"}, false, false, "127.0.0.1", 443},
+		{server.Config{BindHost: "", Port: "1234"}, false, false, "<nil>", 1234},
+		{server.Config{BindHost: "localhost", Port: "abcd"}, false, true, "", 0},
+		{server.Config{BindHost: "127.0.0.1", Host: "should-not-be-used", Port: "1234"}, false, false, "127.0.0.1", 1234},
+		{server.Config{BindHost: "localhost", Host: "should-not-be-used", Port: "1234"}, false, false, "127.0.0.1", 1234},
+		{server.Config{BindHost: "should-not-resolve", Host: "localhost", Port: "1234"}, true, false, "0.0.0.0", 1234},
+	} {
+		actualAddr, warnErr, fatalErr := resolveAddr(test.config)
+
+		if test.shouldFatalErr && fatalErr == nil {
+			t.Errorf("Test %d: Expected error, but there wasn't any", i)
+		}
+		if !test.shouldFatalErr && fatalErr != nil {
+			t.Errorf("Test %d: Expected no error, but there was one: %v", i, fatalErr)
+		}
+		if fatalErr != nil {
+			continue
+		}
+
+		if test.shouldWarnErr && warnErr == nil {
+			t.Errorf("Test %d: Expected warning, but there wasn't any", i)
+		}
+		if !test.shouldWarnErr && warnErr != nil {
+			t.Errorf("Test %d: Expected no warning, but there was one: %v", i, warnErr)
+		}
+
+		if actual, expected := actualAddr.IP.String(), test.expectedIP; actual != expected {
+			t.Errorf("Test %d: IP was %s but expected %s", i, actual, expected)
+		}
+		if actual, expected := actualAddr.Port, test.expectedPort; actual != expected {
+			t.Errorf("Test %d: Port was %d but expected %d", i, actual, expected)
+		}
+	}
+}
+
+func TestMakeOnces(t *testing.T) {
+	directives := []directive{
+		{"dummy", nil},
+		{"dummy2", nil},
+	}
+	directiveOrder = directives
+	onces := makeOnces()
+	if len(onces) != len(directives) {
+		t.Errorf("onces had len %d , expected %d", len(onces), len(directives))
+	}
+	expected := map[string]*sync.Once{
+		"dummy":  new(sync.Once),
+		"dummy2": new(sync.Once),
+	}
+	if !reflect.DeepEqual(onces, expected) {
+		t.Errorf("onces was %v, expected %v", onces, expected)
+	}
+}
+
+func TestMakeStorages(t *testing.T) {
+	directives := []directive{
+		{"dummy", nil},
+		{"dummy2", nil},
+	}
+	directiveOrder = directives
+	storages := makeStorages()
+	if len(storages) != len(directives) {
+		t.Errorf("storages had len %d , expected %d", len(storages), len(directives))
+	}
+	expected := map[string]interface{}{
+		"dummy":  nil,
+		"dummy2": nil,
+	}
+	if !reflect.DeepEqual(storages, expected) {
+		t.Errorf("storages was %v, expected %v", storages, expected)
+	}
+}
+
+func TestValidDirective(t *testing.T) {
+	directives := []directive{
+		{"dummy", nil},
+		{"dummy2", nil},
+	}
+	directiveOrder = directives
+	for i, test := range []struct {
+		directive string
+		valid     bool
+	}{
+		{"dummy", true},
+		{"dummy2", true},
+		{"dummy3", false},
+	} {
+		if actual, expected := validDirective(test.directive), test.valid; actual != expected {
+			t.Errorf("Test %d: valid was %t, expected %t", i, actual, expected)
+		}
+	}
+}

caddy/directives.go

@@ -0,0 +1,80 @@
+package caddy
+
+import (
+	"github.com/mholt/caddy/caddy/parse"
+	"github.com/mholt/caddy/caddy/setup"
+	"github.com/mholt/caddy/middleware"
+)
+
+func init() {
+	// The parse package must know which directives
+	// are valid, but it must not import the setup
+	// or config package. To solve this problem, we
+	// fill up this map in our init function here.
+	// The parse package does not need to know the
+	// ordering of the directives.
+	for _, dir := range directiveOrder {
+		parse.ValidDirectives[dir.name] = struct{}{}
+	}
+}
+
+// Directives are registered in the order they should be
+// executed. Middleware (directives that inject a handler)
+// are executed in the order A-B-C-*-C-B-A, assuming
+// they all call the Next handler in the chain.
+//
+// Ordering is VERY important. Every middleware will
+// feel the effects of all other middleware below
+// (after) them during a request, but they must not
+// care what middleware above them are doing.
+//
+// For example, log needs to know the status code and
+// exactly how many bytes were written to the client,
+// which every other middleware can affect, so it gets
+// registered first. The errors middleware does not
+// care if gzip or log modifies its response, so it
+// gets registered below them. Gzip, on the other hand,
+// DOES care what errors does to the response since it
+// must compress every output to the client, even error
+// pages, so it must be registered before the errors
+// middleware and any others that would write to the
+// response.
+var directiveOrder = []directive{
+	// Essential directives that initialize vital configuration settings
+	{"root", setup.Root},
+	{"tls", setup.TLS}, // letsencrypt is set up just after tls
+	{"bind", setup.BindHost},
+
+	// Other directives that don't create HTTP handlers
+	{"startup", setup.Startup},
+	{"shutdown", setup.Shutdown},
+
+	// Directives that inject handlers (middleware)
+	{"log", setup.Log},
+	{"gzip", setup.Gzip},
+	{"errors", setup.Errors},
+	{"header", setup.Headers},
+	{"rewrite", setup.Rewrite},
+	{"redir", setup.Redir},
+	{"ext", setup.Ext},
+	{"mime", setup.Mime},
+	{"basicauth", setup.BasicAuth},
+	{"internal", setup.Internal},
+	{"proxy", setup.Proxy},
+	{"fastcgi", setup.FastCGI},
+	{"websocket", setup.WebSocket},
+	{"markdown", setup.Markdown},
+	{"templates", setup.Templates},
+	{"browse", setup.Browse},
+}
+
+// directive ties together a directive name with its setup function.
+type directive struct {
+	name  string
+	setup SetupFunc
+}
+
+// SetupFunc takes a controller and may optionally return a middleware.
+// If the resulting middleware is not nil, it will be chained into
+// the HTTP handlers in the order specified in this package.
+type SetupFunc func(c *setup.Controller) (middleware.Middleware, error)

caddy/helpers.go

@@ -0,0 +1,71 @@
+package caddy
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"strconv"
+	"strings"
+
+	"github.com/mholt/caddy/caddy/letsencrypt"
+)
+
+func init() {
+	letsencrypt.OnChange = func() error { return Restart(nil) }
+}
+
+// isLocalhost returns true if host looks explicitly like a localhost address.
+func isLocalhost(host string) bool {
+	return host == "localhost" || host == "::1" || strings.HasPrefix(host, "127.")
+}
+
+// checkFdlimit issues a warning if the OS max file descriptors is below a recommended minimum.
+func checkFdlimit() {
+	const min = 4096
+
+	// Warn if ulimit is too low for production sites
+	if runtime.GOOS == "linux" || runtime.GOOS == "darwin" {
+		out, err := exec.Command("sh", "-c", "ulimit -n").Output() // use sh because ulimit isn't in Linux $PATH
+		if err == nil {
+			// Note that an error here need not be reported
+			lim, err := strconv.Atoi(string(bytes.TrimSpace(out)))
+			if err == nil && lim < min {
+				fmt.Printf("Warning: File descriptor limit %d is too low for production sites. At least %d is recommended. Set with \"ulimit -n %d\".\n", lim, min, min)
+			}
+		}
+	}
+}
+
+// caddyfileGob maps bind address to index of the file descriptor
+// in the Files array passed to the child process. It also contains
+// the caddyfile contents. Used only during graceful restarts.
+type caddyfileGob struct {
+	ListenerFds map[string]uintptr
+	Caddyfile   Input
+}
+
+// IsRestart returns whether this process is, according
+// to env variables, a fork as part of a graceful restart.
+func IsRestart() bool {
+	return os.Getenv("CADDY_RESTART") == "true"
+}
+
+// CaddyfileInput represents a Caddyfile as input
+// and is simply a convenient way to implement
+// the Input interface.
+type CaddyfileInput struct {
+	Filepath string
+	Contents []byte
+	RealFile bool
+}
+
+// Body returns c.Contents.
+func (c CaddyfileInput) Body() []byte { return c.Contents }
+
+// Path returns c.Filepath.
+func (c CaddyfileInput) Path() string { return c.Filepath }
+
+// IsFile returns true if the original input was a real file on the file system.
+func (c CaddyfileInput) IsFile() bool { return c.RealFile }

caddy/letsencrypt/crypto.go

@@ -0,0 +1,30 @@
+package letsencrypt
+
+import (
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"io/ioutil"
+	"os"
+)
+
+// loadRSAPrivateKey loads a PEM-encoded RSA private key from file.
+func loadRSAPrivateKey(file string) (*rsa.PrivateKey, error) {
+	keyBytes, err := ioutil.ReadFile(file)
+	if err != nil {
+		return nil, err
+	}
+	keyBlock, _ := pem.Decode(keyBytes)
+	return x509.ParsePKCS1PrivateKey(keyBlock.Bytes)
+}
+
+// saveRSAPrivateKey saves a PEM-encoded RSA private key to file.
+func saveRSAPrivateKey(key *rsa.PrivateKey, file string) error {
+	pemKey := pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}
+	keyOut, err := os.Create(file)
+	if err != nil {
+		return err
+	}
+	defer keyOut.Close()
+	return pem.Encode(keyOut, &pemKey)
+}

caddy/letsencrypt/crypto_test.go

@@ -0,0 +1,51 @@
+package letsencrypt
+
+import (
+	"bytes"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"os"
+	"testing"
+)
+
+func init() {
+	rsaKeySizeToUse = 128 // make tests faster; small key size OK for testing
+}
+
+func TestSaveAndLoadRSAPrivateKey(t *testing.T) {
+	keyFile := "test.key"
+	defer os.Remove(keyFile)
+
+	privateKey, err := rsa.GenerateKey(rand.Reader, rsaKeySizeToUse)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// test save
+	err = saveRSAPrivateKey(privateKey, keyFile)
+	if err != nil {
+		t.Fatal("error saving private key:", err)
+	}
+
+	// test load
+	loadedKey, err := loadRSAPrivateKey(keyFile)
+	if err != nil {
+		t.Error("error loading private key:", err)
+	}
+
+	// very loaded key is correct
+	if !rsaPrivateKeysSame(privateKey, loadedKey) {
+		t.Error("Expected key bytes to be the same, but they weren't")
+	}
+}
+
+// rsaPrivateKeyBytes returns the bytes of DER-encoded key.
+func rsaPrivateKeyBytes(key *rsa.PrivateKey) []byte {
+	return x509.MarshalPKCS1PrivateKey(key)
+}
+
+// rsaPrivateKeysSame compares the bytes of a and b and returns true if they are the same.
+func rsaPrivateKeysSame(a, b *rsa.PrivateKey) bool {
+	return bytes.Equal(rsaPrivateKeyBytes(a), rsaPrivateKeyBytes(b))
+}

caddy/letsencrypt/handler.go

@@ -0,0 +1,67 @@
+package letsencrypt
+
+import (
+	"crypto/tls"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"sync"
+	"sync/atomic"
+
+	"github.com/mholt/caddy/middleware"
+)
+
+// Handler is a Caddy middleware that can proxy ACME requests
+// to the real ACME endpoint. This is necessary to renew certificates
+// while the server is running. Obviously, a site served on port
+// 443 (HTTPS) binds to that port, so another listener created by
+// our acme client can't bind successfully and solve the challenge.
+// Thus, we chain this handler in so that it can, when activated,
+// proxy ACME requests to an ACME client listening on an alternate
+// port.
+type Handler struct {
+	sync.Mutex      // protects the ChallengePath property
+	Next            middleware.Handler
+	ChallengeActive int32  // use sync/atomic for speed to set/get this flag
+	ChallengePath   string // the exact request path to match before proxying
+}
+
+// ServeHTTP is basically a no-op unless an ACME challenge is active on this host
+// and the request path matches the expected path exactly.
+func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error) {
+	// Only if challenge is active
+	if atomic.LoadInt32(&h.ChallengeActive) == 1 {
+		h.Lock()
+		path := h.ChallengePath
+		h.Unlock()
+
+		// Request path must be correct; if so, proxy to ACME client
+		if r.URL.Path == path {
+			upstream, err := url.Parse("https://" + r.Host + ":" + alternatePort)
+			if err != nil {
+				return http.StatusInternalServerError, err
+			}
+			proxy := httputil.NewSingleHostReverseProxy(upstream)
+			proxy.Transport = &http.Transport{
+				TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, // client uses self-signed cert
+			}
+			proxy.ServeHTTP(w, r)
+			return 0, nil
+		}
+	}
+
+	return h.Next.ServeHTTP(w, r)
+}
+
+// ChallengeOn enables h to proxy ACME requests.
+func (h *Handler) ChallengeOn(challengePath string) {
+	h.Lock()
+	h.ChallengePath = challengePath
+	h.Unlock()
+	atomic.StoreInt32(&h.ChallengeActive, 1)
+}
+
+// ChallengeOff disables ACME proxying from this h.
+func (h *Handler) ChallengeOff(success bool) {
+	atomic.StoreInt32(&h.ChallengeActive, 0)
+}

caddy/letsencrypt/letsencrypt.go

@@ -0,0 +1,509 @@
+// Package letsencrypt integrates Let's Encrypt functionality into Caddy
+// with first-class support for creating and renewing certificates
+// automatically. It is designed to configure sites for HTTPS by default.
+package letsencrypt
+
+import (
+	"encoding/json"
+	"errors"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/mholt/caddy/caddy/setup"
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/redirect"
+	"github.com/mholt/caddy/server"
+	"github.com/xenolf/lego/acme"
+)
+
+// Activate sets up TLS for each server config in configs
+// as needed. It only skips the config if the cert and key
+// are already provided, if plaintext http is explicitly
+// specified as the port, TLS is explicitly disabled, or
+// the host looks like a loopback or wildcard address.
+//
+// This function may prompt the user to provide an email
+// address if none is available through other means. It
+// prefers the email address specified in the config, but
+// if that is not available it will check the command line
+// argument. If absent, it will use the most recent email
+// address from last time. If there isn't one, the user
+// will be prompted and shown SA link.
+//
+// Also note that calling this function activates asset
+// management automatically, which keeps certificates
+// renewed and OCSP stapling updated. This has the effect
+// of causing restarts when assets are updated.
+//
+// Activate returns the updated list of configs, since
+// some may have been appended, for example, to redirect
+// plaintext HTTP requests to their HTTPS counterpart.
+// This function only appends; it does not prepend or splice.
+func Activate(configs []server.Config) ([]server.Config, error) {
+	// just in case previous caller forgot...
+	Deactivate()
+
+	// reset cached ocsp statuses from any previous activations
+	ocspStatus = make(map[*[]byte]int)
+
+	// Identify and configure any eligible hosts for which
+	// we already have certs and keys in storage from last time.
+	configLen := len(configs) // avoid infinite loop since this loop appends plaintext to the slice
+	for i := 0; i < configLen; i++ {
+		if existingCertAndKey(configs[i].Host) && configQualifies(configs, i) {
+			configs = autoConfigure(configs, i)
+		}
+	}
+
+	// Group configs by email address; only configs that are eligible
+	// for TLS management are included. We group by email so that we
+	// can request certificates in batches with the same client.
+	// Note: The return value is a map, and iteration over a map is
+	// not ordered. I don't think it will be a problem, but if an
+	// ordering problem arises, look at this carefully.
+	groupedConfigs, err := groupConfigsByEmail(configs)
+	if err != nil {
+		return configs, err
+	}
+
+	// obtain certificates for configs that need one, and reconfigure each
+	// config to use the certificates
+	for leEmail, cfgIndexes := range groupedConfigs {
+		// make client to service this email address with CA server
+		client, err := newClient(leEmail)
+		if err != nil {
+			return configs, errors.New("error creating client: " + err.Error())
+		}
+
+		// little bit of housekeeping; gather the hostnames into a slice
+		hosts := make([]string, len(cfgIndexes))
+		for i, idx := range cfgIndexes {
+			hosts[i] = configs[idx].Host
+		}
+
+		// client is ready, so let's get free, trusted SSL certificates!
+	Obtain:
+		certificates, failures := client.ObtainCertificates(hosts, true)
+		if len(failures) > 0 {
+			// Build an error string to return, using all the failures in the list.
+			var errMsg string
+
+			// If an error is because of updated SA, only prompt user for agreement once
+			var promptedForAgreement bool
+
+			for domain, obtainErr := range failures {
+				// If the failure was simply because the terms have changed, re-prompt and re-try
+				if tosErr, ok := obtainErr.(acme.TOSError); ok {
+					if !Agreed && !promptedForAgreement {
+						Agreed = promptUserAgreement(tosErr.Detail, true) // TODO: Use latest URL
+						promptedForAgreement = true
+					}
+					if Agreed {
+						err := client.AgreeToTOS()
+						if err != nil {
+							return configs, errors.New("error agreeing to updated terms: " + err.Error())
+						}
+						goto Obtain
+					}
+				}
+
+				// If user did not agree or it was any other kind of error, just append to the list of errors
+				errMsg += "[" + domain + "] failed to get certificate: " + obtainErr.Error() + "\n"
+			}
+
+			return configs, errors.New(errMsg)
+		}
+
+		// ... that's it. save the certs, keys, and metadata files to disk
+		err = saveCertsAndKeys(certificates)
+		if err != nil {
+			return configs, errors.New("error saving assets: " + err.Error())
+		}
+
+		// it all comes down to this: turning on TLS with all the new certs
+		for _, idx := range cfgIndexes {
+			configs = autoConfigure(configs, idx)
+		}
+	}
+
+	// renew all certificates that need renewal
+	renewCertificates(configs, false)
+
+	// keep certificates renewed and OCSP stapling updated
+	go maintainAssets(configs, stopChan)
+
+	return configs, nil
+}
+
+// Deactivate cleans up long-term, in-memory resources
+// allocated by calling Activate(). Essentially, it stops
+// the asset maintainer from running, meaning that certificates
+// will not be renewed, OCSP staples will not be updated, etc.
+func Deactivate() (err error) {
+	defer func() {
+		if rec := recover(); rec != nil {
+			err = errors.New("already deactivated")
+		}
+	}()
+	close(stopChan)
+	stopChan = make(chan struct{})
+	return
+}
+
+// configQualifies returns true if the config at cfgIndex (within allConfigs)
+// qualifes for automatic LE activation. It does NOT check to see if a cert
+// and key already exist for the config.
+func configQualifies(allConfigs []server.Config, cfgIndex int) bool {
+	cfg := allConfigs[cfgIndex]
+	return cfg.TLS.Certificate == "" && // user could provide their own cert and key
+		cfg.TLS.Key == "" &&
+
+		// user can force-disable automatic HTTPS for this host
+		cfg.Port != "http" &&
+		cfg.TLS.LetsEncryptEmail != "off" &&
+
+		// obviously we get can't certs for loopback or internal hosts
+		cfg.Host != "localhost" &&
+		cfg.Host != "" &&
+		cfg.Host != "0.0.0.0" &&
+		cfg.Host != "::1" &&
+		!strings.HasPrefix(cfg.Host, "127.") && // to use boulder on your own machine, add fake domain to hosts file
+		// not excluding 10.* and 192.168.* hosts for possibility of running internal Boulder instance
+
+		// make sure another HTTPS version of this config doesn't exist in the list already
+		!otherHostHasScheme(allConfigs, cfgIndex, "https")
+}
+
+// groupConfigsByEmail groups configs by user email address. The returned map is
+// a map of email address to the configs that are serviced under that account.
+// If an email address is not available for an eligible config, the user will be
+// prompted to provide one. The returned map contains pointers to the original
+// server config values.
+func groupConfigsByEmail(configs []server.Config) (map[string][]int, error) {
+	initMap := make(map[string][]int)
+	for i := 0; i < len(configs); i++ {
+		// filter out configs that we already have certs for and
+		// that we won't be obtaining certs for - this way we won't
+		// bother the user for an email address unnecessarily and
+		// we don't obtain new certs for a host we already have certs for.
+		if existingCertAndKey(configs[i].Host) || !configQualifies(configs, i) {
+			continue
+		}
+		leEmail := getEmail(configs[i])
+		initMap[leEmail] = append(initMap[leEmail], i)
+	}
+	return initMap, nil
+}
+
+// existingCertAndKey returns true if the host has a certificate
+// and private key in storage already, false otherwise.
+func existingCertAndKey(host string) bool {
+	_, err := os.Stat(storage.SiteCertFile(host))
+	if err != nil {
+		return false
+	}
+	_, err = os.Stat(storage.SiteKeyFile(host))
+	if err != nil {
+		return false
+	}
+	return true
+}
+
+// newClient creates a new ACME client to facilitate communication
+// with the Let's Encrypt CA server on behalf of the user specified
+// by leEmail. As part of this process, a user will be loaded from
+// disk (if already exists) or created new and registered via ACME
+// and saved to the file system for next time.
+func newClient(leEmail string) (*acme.Client, error) {
+	return newClientPort(leEmail, exposePort)
+}
+
+// newClientPort does the same thing as newClient, except it creates a
+// new client with a custom port used for ACME transactions instead of
+// the default port. This is important if the default port is already in
+// use or is not exposed to the public, etc.
+func newClientPort(leEmail, port string) (*acme.Client, error) {
+	// Look up or create the LE user account
+	leUser, err := getUser(leEmail)
+	if err != nil {
+		return nil, err
+	}
+
+	// The client facilitates our communication with the CA server.
+	client, err := acme.NewClient(CAUrl, &leUser, rsaKeySizeToUse, port)
+	if err != nil {
+		return nil, err
+	}
+
+	// If not registered, the user must register an account with the CA
+	// and agree to terms
+	if leUser.Registration == nil {
+		reg, err := client.Register()
+		if err != nil {
+			return nil, errors.New("registration error: " + err.Error())
+		}
+		leUser.Registration = reg
+
+		if !Agreed && reg.TosURL == "" {
+			Agreed = promptUserAgreement(saURL, false) // TODO - latest URL
+		}
+		if !Agreed && reg.TosURL == "" {
+			return nil, errors.New("user must agree to terms")
+		}
+
+		err = client.AgreeToTOS()
+		if err != nil {
+			saveUser(leUser) // TODO: Might as well try, right? Error check?
+			return nil, errors.New("error agreeing to terms: " + err.Error())
+		}
+
+		// save user to the file system
+		err = saveUser(leUser)
+		if err != nil {
+			return nil, errors.New("could not save user: " + err.Error())
+		}
+	}
+
+	return client, nil
+}
+
+// obtainCertificates obtains certificates from the CA server for
+// the configurations in serverConfigs using client.
+func obtainCertificates(client *acme.Client, serverConfigs []server.Config) ([]acme.CertificateResource, map[string]error) {
+	// collect all the hostnames into one slice
+	var hosts []string
+	for _, cfg := range serverConfigs {
+		hosts = append(hosts, cfg.Host)
+	}
+
+	return client.ObtainCertificates(hosts, true)
+}
+
+// saveCertificates saves each certificate resource to disk. This
+// includes the certificate file itself, the private key, and the
+// metadata file.
+func saveCertsAndKeys(certificates []acme.CertificateResource) error {
+	for _, cert := range certificates {
+		os.MkdirAll(storage.Site(cert.Domain), 0700)
+
+		// Save cert
+		err := ioutil.WriteFile(storage.SiteCertFile(cert.Domain), cert.Certificate, 0600)
+		if err != nil {
+			return err
+		}
+
+		// Save private key
+		err = ioutil.WriteFile(storage.SiteKeyFile(cert.Domain), cert.PrivateKey, 0600)
+		if err != nil {
+			return err
+		}
+
+		// Save cert metadata
+		jsonBytes, err := json.MarshalIndent(&cert, "", "\t")
+		if err != nil {
+			return err
+		}
+		err = ioutil.WriteFile(storage.SiteMetaFile(cert.Domain), jsonBytes, 0600)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// autoConfigure enables TLS on allConfigs[cfgIndex] and appends, if necessary,
+// a new config to allConfigs that redirects plaintext HTTP to its new HTTPS
+// counterpart. It expects the certificate and key to already be in storage. It
+// returns the new list of allConfigs, since it may append a new config. This
+// function assumes that allConfigs[cfgIndex] is already set up for HTTPS.
+func autoConfigure(allConfigs []server.Config, cfgIndex int) []server.Config {
+	cfg := &allConfigs[cfgIndex]
+
+	bundleBytes, err := ioutil.ReadFile(storage.SiteCertFile(cfg.Host))
+	// TODO: Handle these errors better
+	if err == nil {
+		ocsp, status, err := acme.GetOCSPForCert(bundleBytes)
+		ocspStatus[&bundleBytes] = status
+		if err == nil && status == acme.OCSPGood {
+			cfg.TLS.OCSPStaple = ocsp
+		}
+	}
+	cfg.TLS.Certificate = storage.SiteCertFile(cfg.Host)
+	cfg.TLS.Key = storage.SiteKeyFile(cfg.Host)
+	cfg.TLS.Enabled = true
+	// Ensure all defaults are set for the TLS config
+	setup.SetDefaultTLSParams(cfg)
+
+	if cfg.Port == "" {
+		cfg.Port = "https"
+	}
+
+	// Chain in ACME middleware proxy if we use up the SSL port
+	if cfg.Port == "https" || cfg.Port == "443" {
+		handler := new(Handler)
+		mid := func(next middleware.Handler) middleware.Handler {
+			handler.Next = next
+			return handler
+		}
+		cfg.Middleware["/"] = append(cfg.Middleware["/"], mid)
+		acmeHandlers[cfg.Host] = handler
+	}
+
+	// Set up http->https redirect as long as there isn't already a http counterpart
+	// in the configs and this isn't, for some reason, already on port 80
+	if !otherHostHasScheme(allConfigs, cfgIndex, "http") &&
+		cfg.Port != "80" && cfg.Port != "http" { // (would not be http port with current program flow, but just in case)
+		allConfigs = append(allConfigs, redirPlaintextHost(*cfg))
+	}
+
+	return allConfigs
+}
+
+// otherHostHasScheme tells you whether there is ANOTHER config in allConfigs
+// for the same host but with the port equal to scheme as allConfigs[cfgIndex].
+// This function considers "443" and "https" to be the same scheme, as well as
+// "http" and "80". It does not tell you whether there is ANY config with scheme,
+// only if there's a different one with it.
+func otherHostHasScheme(allConfigs []server.Config, cfgIndex int, scheme string) bool {
+	if scheme == "80" {
+		scheme = "http"
+	} else if scheme == "443" {
+		scheme = "https"
+	}
+	for i, otherCfg := range allConfigs {
+		if i == cfgIndex {
+			continue // has to be a config OTHER than the one we're comparing against
+		}
+		if otherCfg.Host == allConfigs[cfgIndex].Host {
+			if (otherCfg.Port == scheme) ||
+				(scheme == "https" && otherCfg.Port == "443") ||
+				(scheme == "http" && otherCfg.Port == "80") {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// redirPlaintextHost returns a new plaintext HTTP configuration for
+// a virtualHost that simply redirects to cfg, which is assumed to
+// be the HTTPS configuration. The returned configuration is set
+// to listen on the "http" port (port 80).
+func redirPlaintextHost(cfg server.Config) server.Config {
+	toURL := "https://" + cfg.Host
+	if cfg.Port != "https" && cfg.Port != "http" {
+		toURL += ":" + cfg.Port
+	}
+
+	redirMidware := func(next middleware.Handler) middleware.Handler {
+		return redirect.Redirect{Next: next, Rules: []redirect.Rule{
+			{
+				FromScheme: "http",
+				FromPath:   "/",
+				To:         toURL + "{uri}",
+				Code:       http.StatusMovedPermanently,
+			},
+		}}
+	}
+
+	return server.Config{
+		Host: cfg.Host,
+		Port: "http",
+		Middleware: map[string][]middleware.Middleware{
+			"/": []middleware.Middleware{redirMidware},
+		},
+	}
+}
+
+// Revoke revokes the certificate for host via ACME protocol.
+func Revoke(host string) error {
+	if !existingCertAndKey(host) {
+		return errors.New("no certificate and key for " + host)
+	}
+
+	email := getEmail(server.Config{Host: host})
+	if email == "" {
+		return errors.New("email is required to revoke")
+	}
+
+	client, err := newClient(email)
+	if err != nil {
+		return err
+	}
+
+	certFile := storage.SiteCertFile(host)
+	certBytes, err := ioutil.ReadFile(certFile)
+	if err != nil {
+		return err
+	}
+
+	err = client.RevokeCertificate(certBytes)
+	if err != nil {
+		return err
+	}
+
+	err = os.Remove(certFile)
+	if err != nil {
+		return errors.New("certificate revoked, but unable to delete certificate file: " + err.Error())
+	}
+
+	return nil
+}
+
+var (
+	// DefaultEmail represents the Let's Encrypt account email to use if none provided
+	DefaultEmail string
+
+	// Agreed indicates whether user has agreed to the Let's Encrypt SA
+	Agreed bool
+
+	// CAUrl represents the base URL to the CA's ACME endpoint
+	CAUrl string
+)
+
+// Some essential values related to the Let's Encrypt process
+const (
+	// The port to expose to the CA server for Simple HTTP Challenge.
+	// NOTE: Let's Encrypt requires port 443. If exposePort is not 443,
+	// then port 443 must be forwarded to exposePort.
+	exposePort = "443"
+
+	// If port 443 is in use by a Caddy server instance, then this is
+	// port on which the acme client will solve challenges. (Whatever is
+	// listening on port 443 must proxy ACME requests to this port.)
+	alternatePort = "5033"
+
+	// How often to check certificates for renewal.
+	renewInterval = 24 * time.Hour
+
+	// How often to update OCSP stapling.
+	ocspInterval = 1 * time.Hour
+)
+
+// KeySize represents the length of a key in bits.
+type KeySize int
+
+// Key sizes are used to determine the strength of a key.
+const (
+	ECC_224  KeySize = 224
+	ECC_256          = 256
+	RSA_2048         = 2048
+	RSA_4096         = 4096
+)
+
+// rsaKeySizeToUse is the size to use for new RSA keys.
+// This shouldn't need to change except for in tests;
+// the size can be drastically reduced for speed.
+var rsaKeySizeToUse = RSA_2048
+
+// stopChan is used to signal the maintenance goroutine
+// to terminate.
+var stopChan chan struct{}
+
+// ocspStatus maps certificate bundle to OCSP status at start.
+// It is used during regular OCSP checks to see if the OCSP
+// status has changed.
+var ocspStatus = make(map[*[]byte]int)

caddy/letsencrypt/letsencrypt_test.go

@@ -0,0 +1,51 @@
+package letsencrypt
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/mholt/caddy/middleware/redirect"
+	"github.com/mholt/caddy/server"
+)
+
+func TestRedirPlaintextHost(t *testing.T) {
+	cfg := redirPlaintextHost(server.Config{
+		Host: "example.com",
+		Port: "http",
+	})
+
+	// Check host and port
+	if actual, expected := cfg.Host, "example.com"; actual != expected {
+		t.Errorf("Expected redir config to have host %s but got %s", expected, actual)
+	}
+	if actual, expected := cfg.Port, "http"; actual != expected {
+		t.Errorf("Expected redir config to have port '%s' but got '%s'", expected, actual)
+	}
+
+	// Make sure redirect handler is set up properly
+	if cfg.Middleware == nil || len(cfg.Middleware["/"]) != 1 {
+		t.Fatalf("Redir config middleware not set up properly; got: %#v", cfg.Middleware)
+	}
+
+	handler, ok := cfg.Middleware["/"][0](nil).(redirect.Redirect)
+	if !ok {
+		t.Fatalf("Expected a redirect.Redirect middleware, but got: %#v", handler)
+	}
+	if len(handler.Rules) != 1 {
+		t.Fatalf("Expected one redirect rule, got: %#v", handler.Rules)
+	}
+
+	// Check redirect rule for correctness
+	if actual, expected := handler.Rules[0].FromScheme, "http"; actual != expected {
+		t.Errorf("Expected redirect rule to be from scheme '%s' but is actually from '%s'", expected, actual)
+	}
+	if actual, expected := handler.Rules[0].FromPath, "/"; actual != expected {
+		t.Errorf("Expected redirect rule to be for path '%s' but is actually for '%s'", expected, actual)
+	}
+	if actual, expected := handler.Rules[0].To, "https://example.com{uri}"; actual != expected {
+		t.Errorf("Expected redirect rule to be to URL '%s' but is actually to '%s'", expected, actual)
+	}
+	if actual, expected := handler.Rules[0].Code, http.StatusMovedPermanently; actual != expected {
+		t.Errorf("Expected redirect rule to have code %d but was %d", expected, actual)
+	}
+}

caddy/letsencrypt/maintain.go

@@ -0,0 +1,183 @@
+package letsencrypt
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"log"
+	"time"
+
+	"github.com/mholt/caddy/server"
+	"github.com/xenolf/lego/acme"
+)
+
+// OnChange is a callback function that will be used to restart
+// the application or the part of the application that uses
+// the certificates maintained by this package. When at least
+// one certificate is renewed or an OCSP status changes, this
+// function will be called.
+var OnChange func() error
+
+// maintainAssets is a permanently-blocking function
+// that loops indefinitely and, on a regular schedule, checks
+// certificates for expiration and initiates a renewal of certs
+// that are expiring soon. It also updates OCSP stapling and
+// performs other maintenance of assets.
+//
+// You must pass in the server configs to maintain and the channel
+// which you'll close when maintenance should stop, to allow this
+// goroutine to clean up after itself and unblock.
+func maintainAssets(configs []server.Config, stopChan chan struct{}) {
+	renewalTicker := time.NewTicker(renewInterval)
+	ocspTicker := time.NewTicker(ocspInterval)
+
+	for {
+		select {
+		case <-renewalTicker.C:
+			n, errs := renewCertificates(configs, true)
+			if len(errs) > 0 {
+				for _, err := range errs {
+					log.Printf("[ERROR] Certificate renewal: %v", err)
+				}
+			}
+			// even if there was an error, some renewals may have succeeded
+			if n > 0 && OnChange != nil {
+				err := OnChange()
+				if err != nil {
+					log.Printf("[ERROR] OnChange after cert renewal: %v", err)
+				}
+			}
+		case <-ocspTicker.C:
+			for bundle, oldStatus := range ocspStatus {
+				_, newStatus, err := acme.GetOCSPForCert(*bundle)
+				if err == nil && newStatus != oldStatus && OnChange != nil {
+					log.Printf("[INFO] OCSP status changed from %v to %v", oldStatus, newStatus)
+					err := OnChange()
+					if err != nil {
+						log.Printf("[ERROR] OnChange after OCSP update: %v", err)
+					}
+					break
+				}
+			}
+		case <-stopChan:
+			renewalTicker.Stop()
+			ocspTicker.Stop()
+			return
+		}
+	}
+}
+
+// renewCertificates loops through all configured site and
+// looks for certificates to renew. Nothing is mutated
+// through this function; all changes happen directly on disk.
+// It returns the number of certificates renewed and any errors
+// that occurred. It only performs a renewal if necessary.
+// If useCustomPort is true, a custom port will be used, and
+// whatever is listening at 443 better proxy ACME requests to it.
+// Otherwise, the acme package will create its own listener on 443.
+func renewCertificates(configs []server.Config, useCustomPort bool) (int, []error) {
+	log.Printf("[INFO] Checking certificates for %d hosts", len(configs))
+	var errs []error
+	var n int
+
+	defer func() {
+		// reset these so as to not interfere with other challenges
+		acme.OnSimpleHTTPStart = nil
+		acme.OnSimpleHTTPEnd = nil
+	}()
+
+	for _, cfg := range configs {
+		// Host must be TLS-enabled and have existing assets managed by LE
+		if !cfg.TLS.Enabled || !existingCertAndKey(cfg.Host) {
+			continue
+		}
+
+		// Read the certificate and get the NotAfter time.
+		certBytes, err := ioutil.ReadFile(storage.SiteCertFile(cfg.Host))
+		if err != nil {
+			errs = append(errs, err)
+			continue // still have to check other certificates
+		}
+		expTime, err := acme.GetPEMCertExpiration(certBytes)
+		if err != nil {
+			errs = append(errs, err)
+			continue
+		}
+
+		// The time returned from the certificate is always in UTC.
+		// So calculate the time left with local time as UTC.
+		// Directly convert it to days for the following checks.
+		daysLeft := int(expTime.Sub(time.Now().UTC()).Hours() / 24)
+
+		// Renew with two weeks or less remaining.
+		if daysLeft <= 14 {
+			log.Printf("[INFO] Certificate for %s has %d days remaining; attempting renewal", cfg.Host, daysLeft)
+			var client *acme.Client
+			if useCustomPort {
+				client, err = newClientPort("", alternatePort) // email not used for renewal
+			} else {
+				client, err = newClient("")
+			}
+			if err != nil {
+				errs = append(errs, err)
+				continue
+			}
+
+			// Read metadata
+			metaBytes, err := ioutil.ReadFile(storage.SiteMetaFile(cfg.Host))
+			if err != nil {
+				errs = append(errs, err)
+				continue
+			}
+
+			privBytes, err := ioutil.ReadFile(storage.SiteKeyFile(cfg.Host))
+			if err != nil {
+				errs = append(errs, err)
+				continue
+			}
+
+			var certMeta acme.CertificateResource
+			err = json.Unmarshal(metaBytes, &certMeta)
+			certMeta.Certificate = certBytes
+			certMeta.PrivateKey = privBytes
+
+			// Tell the handler to accept and proxy acme request in order to solve challenge
+			acme.OnSimpleHTTPStart = acmeHandlers[cfg.Host].ChallengeOn
+			acme.OnSimpleHTTPEnd = acmeHandlers[cfg.Host].ChallengeOff
+
+			// Renew certificate.
+			// TODO: revokeOld should be an option in the caddyfile
+			// TODO: bundle should be an option in the caddyfile as well :)
+		Renew:
+			newCertMeta, err := client.RenewCertificate(certMeta, true, true)
+			if err != nil {
+				if _, ok := err.(acme.TOSError); ok {
+					err := client.AgreeToTOS()
+					if err != nil {
+						errs = append(errs, err)
+					}
+					goto Renew
+				}
+
+				time.Sleep(10 * time.Second)
+				newCertMeta, err = client.RenewCertificate(certMeta, true, true)
+				if err != nil {
+					errs = append(errs, err)
+					continue
+				}
+			}
+
+			saveCertsAndKeys([]acme.CertificateResource{newCertMeta})
+			n++
+		} else if daysLeft <= 30 {
+			// Warn on 30 days remaining. TODO: Just do this once...
+			log.Printf("[WARNING] Certificate for %s has %d days remaining; will automatically renew when 14 days remain\n", cfg.Host, daysLeft)
+		}
+	}
+
+	return n, errs
+}
+
+// acmeHandlers is a map of host to ACME handler. These
+// are used to proxy ACME requests to the ACME client
+// when port 443 is in use.
+var acmeHandlers = make(map[string]*Handler)

caddy/letsencrypt/storage.go

@@ -0,0 +1,94 @@
+package letsencrypt
+
+import (
+	"path/filepath"
+	"strings"
+
+	"github.com/mholt/caddy/caddy/assets"
+)
+
+// storage is used to get file paths in a consistent,
+// cross-platform way for persisting Let's Encrypt assets
+// on the file system.
+var storage = Storage(filepath.Join(assets.Path(), "letsencrypt"))
+
+// Storage is a root directory and facilitates
+// forming file paths derived from it.
+type Storage string
+
+// Sites gets the directory that stores site certificate and keys.
+func (s Storage) Sites() string {
+	return filepath.Join(string(s), "sites")
+}
+
+// Site returns the path to the folder containing assets for domain.
+func (s Storage) Site(domain string) string {
+	return filepath.Join(s.Sites(), domain)
+}
+
+// SiteCertFile returns the path to the certificate file for domain.
+func (s Storage) SiteCertFile(domain string) string {
+	return filepath.Join(s.Site(domain), domain+".crt")
+}
+
+// SiteKeyFile returns the path to domain's private key file.
+func (s Storage) SiteKeyFile(domain string) string {
+	return filepath.Join(s.Site(domain), domain+".key")
+}
+
+// SiteMetaFile returns the path to the domain's asset metadata file.
+func (s Storage) SiteMetaFile(domain string) string {
+	return filepath.Join(s.Site(domain), domain+".json")
+}
+
+// Users gets the directory that stores account folders.
+func (s Storage) Users() string {
+	return filepath.Join(string(s), "users")
+}
+
+// User gets the account folder for the user with email.
+func (s Storage) User(email string) string {
+	if email == "" {
+		email = emptyEmail
+	}
+	return filepath.Join(s.Users(), email)
+}
+
+// UserRegFile gets the path to the registration file for
+// the user with the given email address.
+func (s Storage) UserRegFile(email string) string {
+	if email == "" {
+		email = emptyEmail
+	}
+	fileName := emailUsername(email)
+	if fileName == "" {
+		fileName = "registration"
+	}
+	return filepath.Join(s.User(email), fileName+".json")
+}
+
+// UserKeyFile gets the path to the private key file for
+// the user with the given email address.
+func (s Storage) UserKeyFile(email string) string {
+	if email == "" {
+		email = emptyEmail
+	}
+	fileName := emailUsername(email)
+	if fileName == "" {
+		fileName = "private"
+	}
+	return filepath.Join(s.User(email), fileName+".key")
+}
+
+// emailUsername returns the username portion of an
+// email address (part before '@') or the original
+// input if it can't find the "@" symbol.
+func emailUsername(email string) string {
+	at := strings.Index(email, "@")
+	if at == -1 {
+		return email
+	} else if at == 0 {
+		return email[1:]
+	}
+	return email[:at]
+}

caddy/letsencrypt/storage_test.go

@@ -0,0 +1,84 @@
+package letsencrypt
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+func TestStorage(t *testing.T) {
+	storage = Storage("./letsencrypt")
+
+	if expected, actual := filepath.Join("letsencrypt", "sites"), storage.Sites(); actual != expected {
+		t.Errorf("Expected Sites() to return '%s' but got '%s'", expected, actual)
+	}
+	if expected, actual := filepath.Join("letsencrypt", "sites", "test.com"), storage.Site("test.com"); actual != expected {
+		t.Errorf("Expected Site() to return '%s' but got '%s'", expected, actual)
+	}
+	if expected, actual := filepath.Join("letsencrypt", "sites", "test.com", "test.com.crt"), storage.SiteCertFile("test.com"); actual != expected {
+		t.Errorf("Expected SiteCertFile() to return '%s' but got '%s'", expected, actual)
+	}
+	if expected, actual := filepath.Join("letsencrypt", "sites", "test.com", "test.com.key"), storage.SiteKeyFile("test.com"); actual != expected {
+		t.Errorf("Expected SiteKeyFile() to return '%s' but got '%s'", expected, actual)
+	}
+	if expected, actual := filepath.Join("letsencrypt", "sites", "test.com", "test.com.json"), storage.SiteMetaFile("test.com"); actual != expected {
+		t.Errorf("Expected SiteMetaFile() to return '%s' but got '%s'", expected, actual)
+	}
+	if expected, actual := filepath.Join("letsencrypt", "users"), storage.Users(); actual != expected {
+		t.Errorf("Expected Users() to return '%s' but got '%s'", expected, actual)
+	}
+	if expected, actual := filepath.Join("letsencrypt", "users", "me@example.com"), storage.User("me@example.com"); actual != expected {
+		t.Errorf("Expected User() to return '%s' but got '%s'", expected, actual)
+	}
+	if expected, actual := filepath.Join("letsencrypt", "users", "me@example.com", "me.json"), storage.UserRegFile("me@example.com"); actual != expected {
+		t.Errorf("Expected UserRegFile() to return '%s' but got '%s'", expected, actual)
+	}
+	if expected, actual := filepath.Join("letsencrypt", "users", "me@example.com", "me.key"), storage.UserKeyFile("me@example.com"); actual != expected {
+		t.Errorf("Expected UserKeyFile() to return '%s' but got '%s'", expected, actual)
+	}
+
+	// Test with empty emails
+	if expected, actual := filepath.Join("letsencrypt", "users", emptyEmail), storage.User(emptyEmail); actual != expected {
+		t.Errorf("Expected User(\"\") to return '%s' but got '%s'", expected, actual)
+	}
+	if expected, actual := filepath.Join("letsencrypt", "users", emptyEmail, emptyEmail+".json"), storage.UserRegFile(""); actual != expected {
+		t.Errorf("Expected UserRegFile(\"\") to return '%s' but got '%s'", expected, actual)
+	}
+	if expected, actual := filepath.Join("letsencrypt", "users", emptyEmail, emptyEmail+".key"), storage.UserKeyFile(""); actual != expected {
+		t.Errorf("Expected UserKeyFile(\"\") to return '%s' but got '%s'", expected, actual)
+	}
+}
+
+func TestEmailUsername(t *testing.T) {
+	for i, test := range []struct {
+		input, expect string
+	}{
+		{
+			input:  "username@example.com",
+			expect: "username",
+		},
+		{
+			input:  "plus+addressing@example.com",
+			expect: "plus+addressing",
+		},
+		{
+			input:  "me+plus-addressing@example.com",
+			expect: "me+plus-addressing",
+		},
+		{
+			input:  "not-an-email",
+			expect: "not-an-email",
+		},
+		{
+			input:  "@foobar.com",
+			expect: "foobar.com",
+		},
+		{
+			input:  emptyEmail,
+			expect: emptyEmail,
+		},
+	} {
+		if actual := emailUsername(test.input); actual != test.expect {
+			t.Errorf("Test %d: Expected username to be '%s' but was '%s'", i, test.expect, actual)
+		}
+	}
+}

caddy/letsencrypt/user.go

@@ -0,0 +1,196 @@
+package letsencrypt
+
+import (
+	"bufio"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"strings"
+
+	"github.com/mholt/caddy/server"
+	"github.com/xenolf/lego/acme"
+)
+
+// User represents a Let's Encrypt user account.
+type User struct {
+	Email        string
+	Registration *acme.RegistrationResource
+	key          *rsa.PrivateKey
+}
+
+// GetEmail gets u's email.
+func (u User) GetEmail() string {
+	return u.Email
+}
+
+// GetRegistration gets u's registration resource.
+func (u User) GetRegistration() *acme.RegistrationResource {
+	return u.Registration
+}
+
+// GetPrivateKey gets u's private key.
+func (u User) GetPrivateKey() *rsa.PrivateKey {
+	return u.key
+}
+
+// getUser loads the user with the given email from disk.
+// If the user does not exist, it will create a new one,
+// but it does NOT save new users to the disk or register
+// them via ACME.
+func getUser(email string) (User, error) {
+	var user User
+
+	// open user file
+	regFile, err := os.Open(storage.UserRegFile(email))
+	if err != nil {
+		if os.IsNotExist(err) {
+			// create a new user
+			return newUser(email)
+		}
+		return user, err
+	}
+	defer regFile.Close()
+
+	// load user information
+	err = json.NewDecoder(regFile).Decode(&user)
+	if err != nil {
+		return user, err
+	}
+
+	// load their private key
+	user.key, err = loadRSAPrivateKey(storage.UserKeyFile(email))
+	if err != nil {
+		return user, err
+	}
+
+	return user, nil
+}
+
+// saveUser persists a user's key and account registration
+// to the file system. It does NOT register the user via ACME.
+func saveUser(user User) error {
+	// make user account folder
+	err := os.MkdirAll(storage.User(user.Email), 0700)
+	if err != nil {
+		return err
+	}
+
+	// save private key file
+	err = saveRSAPrivateKey(user.key, storage.UserKeyFile(user.Email))
+	if err != nil {
+		return err
+	}
+
+	// save registration file
+	jsonBytes, err := json.MarshalIndent(&user, "", "\t")
+	if err != nil {
+		return err
+	}
+
+	return ioutil.WriteFile(storage.UserRegFile(user.Email), jsonBytes, 0600)
+}
+
+// newUser creates a new User for the given email address
+// with a new private key. This function does NOT save the
+// user to disk or register it via ACME. If you want to use
+// a user account that might already exist, call getUser
+// instead.
+func newUser(email string) (User, error) {
+	user := User{Email: email}
+	privateKey, err := rsa.GenerateKey(rand.Reader, rsaKeySizeToUse)
+	if err != nil {
+		return user, errors.New("error generating private key: " + err.Error())
+	}
+	user.key = privateKey
+	return user, nil
+}
+
+// getEmail does everything it can to obtain an email
+// address from the user to use for TLS for cfg. If it
+// cannot get an email address, it returns empty string.
+// (It will warn the user of the consequences of an
+// empty email.)
+func getEmail(cfg server.Config) string {
+	// First try the tls directive from the Caddyfile
+	leEmail := cfg.TLS.LetsEncryptEmail
+	if leEmail == "" {
+		// Then try memory (command line flag or typed by user previously)
+		leEmail = DefaultEmail
+	}
+	if leEmail == "" {
+		// Then try to get most recent user email ~/.caddy/users file
+		userDirs, err := ioutil.ReadDir(storage.Users())
+		if err == nil {
+			var mostRecent os.FileInfo
+			for _, dir := range userDirs {
+				if !dir.IsDir() {
+					continue
+				}
+				if mostRecent == nil || dir.ModTime().After(mostRecent.ModTime()) {
+					mostRecent = dir
+				}
+			}
+			if mostRecent != nil {
+				leEmail = mostRecent.Name()
+			}
+		}
+	}
+	if leEmail == "" {
+		// Alas, we must bother the user and ask for an email address;
+		// if they proceed they also agree to the SA.
+		reader := bufio.NewReader(stdin)
+		fmt.Println("Your sites will be served over HTTPS automatically using Let's Encrypt.")
+		fmt.Println("By continuing, you agree to the Let's Encrypt Subscriber Agreement at:")
+		fmt.Println("  " + saURL) // TODO: Show current SA link
+		fmt.Println("Please enter your email address so you can recover your account if needed.")
+		fmt.Println("You can leave it blank, but you'll lose the ability to recover your account.")
+		fmt.Print("Email address: ")
+		var err error
+		leEmail, err = reader.ReadString('\n')
+		if err != nil {
+			return ""
+		}
+		DefaultEmail = leEmail
+		Agreed = true
+	}
+	return strings.TrimSpace(leEmail)
+}
+
+// promptUserAgreement prompts the user to agree to the agreement
+// at agreementURL via stdin. If the agreement has changed, then pass
+// true as the second argument. If this is the user's first time
+// agreeing, pass false. It returns whether the user agreed or not.
+func promptUserAgreement(agreementURL string, changed bool) bool {
+	if changed {
+		fmt.Printf("The Let's Encrypt Subscriber Agreement has changed:\n  %s\n", agreementURL)
+		fmt.Print("Do you agree to the new terms? (y/n): ")
+	} else {
+		fmt.Printf("To continue, you must agree to the Let's Encrypt Subscriber Agreement:\n  %s\n", agreementURL)
+		fmt.Print("Do you agree to the terms? (y/n): ")
+	}
+
+	reader := bufio.NewReader(stdin)
+	answer, err := reader.ReadString('\n')
+	if err != nil {
+		return false
+	}
+	answer = strings.ToLower(strings.TrimSpace(answer))
+
+	return answer == "y" || answer == "yes"
+}
+
+// stdin is used to read the user's input if prompted;
+// this is changed by tests during tests.
+var stdin = io.ReadWriter(os.Stdin)
+
+// The name of the folder for accounts where the email
+// address was not provided; default 'username' if you will.
+const emptyEmail = "default"
+
+// TODO: Use latest
+const saURL = "https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf"

caddy/letsencrypt/user_test.go

@@ -0,0 +1,192 @@
+package letsencrypt
+
+import (
+	"bytes"
+	"crypto/rand"
+	"crypto/rsa"
+	"io"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/mholt/caddy/server"
+	"github.com/xenolf/lego/acme"
+)
+
+func TestUser(t *testing.T) {
+	privateKey, err := rsa.GenerateKey(rand.Reader, 128)
+	if err != nil {
+		t.Fatalf("Could not generate test private key: %v", err)
+	}
+	u := User{
+		Email:        "me@mine.com",
+		Registration: new(acme.RegistrationResource),
+		key:          privateKey,
+	}
+
+	if expected, actual := "me@mine.com", u.GetEmail(); actual != expected {
+		t.Errorf("Expected email '%s' but got '%s'", expected, actual)
+	}
+	if u.GetRegistration() == nil {
+		t.Error("Expected a registration resource, but got nil")
+	}
+	if expected, actual := privateKey, u.GetPrivateKey(); actual != expected {
+		t.Errorf("Expected the private key at address %p but got one at %p instead ", expected, actual)
+	}
+}
+
+func TestNewUser(t *testing.T) {
+	email := "me@foobar.com"
+	user, err := newUser(email)
+	if err != nil {
+		t.Fatalf("Error creating user: %v", err)
+	}
+	if user.key == nil {
+		t.Error("Private key is nil")
+	}
+	if user.Email != email {
+		t.Errorf("Expected email to be %s, but was %s", email, user.Email)
+	}
+	if user.Registration != nil {
+		t.Error("New user already has a registration resource; it shouldn't")
+	}
+}
+
+func TestSaveUser(t *testing.T) {
+	storage = Storage("./testdata")
+	defer os.RemoveAll(string(storage))
+
+	email := "me@foobar.com"
+	user, err := newUser(email)
+	if err != nil {
+		t.Fatalf("Error creating user: %v", err)
+	}
+
+	err = saveUser(user)
+	if err != nil {
+		t.Fatalf("Error saving user: %v", err)
+	}
+	_, err = os.Stat(storage.UserRegFile(email))
+	if err != nil {
+		t.Errorf("Cannot access user registration file, error: %v", err)
+	}
+	_, err = os.Stat(storage.UserKeyFile(email))
+	if err != nil {
+		t.Errorf("Cannot access user private key file, error: %v", err)
+	}
+}
+
+func TestGetUserDoesNotAlreadyExist(t *testing.T) {
+	storage = Storage("./testdata")
+	defer os.RemoveAll(string(storage))
+
+	user, err := getUser("user_does_not_exist@foobar.com")
+	if err != nil {
+		t.Fatalf("Error getting user: %v", err)
+	}
+
+	if user.key == nil {
+		t.Error("Expected user to have a private key, but it was nil")
+	}
+}
+
+func TestGetUserAlreadyExists(t *testing.T) {
+	storage = Storage("./testdata")
+	defer os.RemoveAll(string(storage))
+
+	email := "me@foobar.com"
+
+	// Set up test
+	user, err := newUser(email)
+	if err != nil {
+		t.Fatalf("Error creating user: %v", err)
+	}
+	err = saveUser(user)
+	if err != nil {
+		t.Fatalf("Error saving user: %v", err)
+	}
+
+	// Expect to load user from disk
+	user2, err := getUser(email)
+	if err != nil {
+		t.Fatalf("Error getting user: %v", err)
+	}
+
+	// Assert keys are the same
+	if !rsaPrivateKeysSame(user.key, user2.key) {
+		t.Error("Expected private key to be the same after loading, but it wasn't")
+	}
+
+	// Assert emails are the same
+	if user.Email != user2.Email {
+		t.Errorf("Expected emails to be equal, but was '%s' before and '%s' after loading", user.Email, user2.Email)
+	}
+}
+
+func TestGetEmail(t *testing.T) {
+	storage = Storage("./testdata")
+	defer os.RemoveAll(string(storage))
+	DefaultEmail = "test2@foo.com"
+
+	// Test1: Use email in config
+	config := server.Config{
+		TLS: server.TLSConfig{
+			LetsEncryptEmail: "test1@foo.com",
+		},
+	}
+	actual := getEmail(config)
+	if actual != "test1@foo.com" {
+		t.Errorf("Did not get correct email from config; expected '%s' but got '%s'", "test1@foo.com", actual)
+	}
+
+	// Test2: Use default email from flag (or user previously typing it)
+	actual = getEmail(server.Config{})
+	if actual != DefaultEmail {
+		t.Errorf("Did not get correct email from config; expected '%s' but got '%s'", DefaultEmail, actual)
+	}
+
+	// Test3: Get input from user
+	DefaultEmail = ""
+	stdin = new(bytes.Buffer)
+	_, err := io.Copy(stdin, strings.NewReader("test3@foo.com\n"))
+	if err != nil {
+		t.Fatalf("Could not simulate user input, error: %v", err)
+	}
+	actual = getEmail(server.Config{})
+	if actual != "test3@foo.com" {
+		t.Errorf("Did not get correct email from user input prompt; expected '%s' but got '%s'", "test3@foo.com", actual)
+	}
+
+	// Test4: Get most recent email from before
+	DefaultEmail = ""
+	for i, eml := range []string{
+		"test4-3@foo.com",
+		"test4-2@foo.com",
+		"test4-1@foo.com",
+	} {
+		u, err := newUser(eml)
+		if err != nil {
+			t.Fatalf("Error creating user %d: %v", i, err)
+		}
+		err = saveUser(u)
+		if err != nil {
+			t.Fatalf("Error saving user %d: %v", i, err)
+		}
+
+		// Change modified time so they're all different, so the test becomes deterministic
+		f, err := os.Stat(storage.User(eml))
+		if err != nil {
+			t.Fatalf("Could not access user folder for '%s': %v", eml, err)
+		}
+		chTime := f.ModTime().Add(-(time.Duration(i) * time.Second))
+		if err := os.Chtimes(storage.User(eml), chTime, chTime); err != nil {
+			t.Fatalf("Could not change user folder mod time for '%s': %v", eml, err)
+		}
+	}
+
+	actual = getEmail(server.Config{})
+	if actual != "test4-3@foo.com" {
+		t.Errorf("Did not get correct email from storage; expected '%s' but got '%s'", "test4-3@foo.com", actual)
+	}
+}

caddy/parse/dispenser.go

@@ -0,0 +1,251 @@
+package parse
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+)
+
+// Dispenser is a type that dispenses tokens, similarly to a lexer,
+// except that it can do so with some notion of structure and has
+// some really convenient methods.
+type Dispenser struct {
+	filename string
+	tokens   []token
+	cursor   int
+	nesting  int
+}
+
+// NewDispenser returns a Dispenser, ready to use for parsing the given input.
+func NewDispenser(filename string, input io.Reader) Dispenser {
+	return Dispenser{
+		filename: filename,
+		tokens:   allTokens(input),
+		cursor:   -1,
+	}
+}
+
+// NewDispenserTokens returns a Dispenser filled with the given tokens.
+func NewDispenserTokens(filename string, tokens []token) Dispenser {
+	return Dispenser{
+		filename: filename,
+		tokens:   tokens,
+		cursor:   -1,
+	}
+}
+
+// Next loads the next token. Returns true if a token
+// was loaded; false otherwise. If false, all tokens
+// have been consumed.
+func (d *Dispenser) Next() bool {
+	if d.cursor < len(d.tokens)-1 {
+		d.cursor++
+		return true
+	}
+	return false
+}
+
+// NextArg loads the next token if it is on the same
+// line. Returns true if a token was loaded; false
+// otherwise. If false, all tokens on the line have
+// been consumed. It handles imported tokens correctly.
+func (d *Dispenser) NextArg() bool {
+	if d.cursor < 0 {
+		d.cursor++
+		return true
+	}
+	if d.cursor >= len(d.tokens) {
+		return false
+	}
+	if d.cursor < len(d.tokens)-1 &&
+		d.tokens[d.cursor].file == d.tokens[d.cursor+1].file &&
+		d.tokens[d.cursor].line+d.numLineBreaks(d.cursor) == d.tokens[d.cursor+1].line {
+		d.cursor++
+		return true
+	}
+	return false
+}
+
+// NextLine loads the next token only if it is not on the same
+// line as the current token, and returns true if a token was
+// loaded; false otherwise. If false, there is not another token
+// or it is on the same line. It handles imported tokens correctly.
+func (d *Dispenser) NextLine() bool {
+	if d.cursor < 0 {
+		d.cursor++
+		return true
+	}
+	if d.cursor >= len(d.tokens) {
+		return false
+	}
+	if d.cursor < len(d.tokens)-1 &&
+		(d.tokens[d.cursor].file != d.tokens[d.cursor+1].file ||
+			d.tokens[d.cursor].line+d.numLineBreaks(d.cursor) < d.tokens[d.cursor+1].line) {
+		d.cursor++
+		return true
+	}
+	return false
+}
+
+// NextBlock can be used as the condition of a for loop
+// to load the next token as long as it opens a block or
+// is already in a block. It returns true if a token was
+// loaded, or false when the block's closing curly brace
+// was loaded and thus the block ended. Nested blocks are
+// not supported.
+func (d *Dispenser) NextBlock() bool {
+	if d.nesting > 0 {
+		d.Next()
+		if d.Val() == "}" {
+			d.nesting--
+			return false
+		}
+		return true
+	}
+	if !d.NextArg() { // block must open on same line
+		return false
+	}
+	if d.Val() != "{" {
+		d.cursor-- // roll back if not opening brace
+		return false
+	}
+	d.Next()
+	if d.Val() == "}" {
+		// Open and then closed right away
+		return false
+	}
+	d.nesting++
+	return true
+}
+
+// IncrNest adds a level of nesting to the dispenser.
+func (d *Dispenser) IncrNest() {
+	d.nesting++
+	return
+}
+
+// Val gets the text of the current token. If there is no token
+// loaded, it returns empty string.
+func (d *Dispenser) Val() string {
+	if d.cursor < 0 || d.cursor >= len(d.tokens) {
+		return ""
+	}
+	return d.tokens[d.cursor].text
+}
+
+// Line gets the line number of the current token. If there is no token
+// loaded, it returns 0.
+func (d *Dispenser) Line() int {
+	if d.cursor < 0 || d.cursor >= len(d.tokens) {
+		return 0
+	}
+	return d.tokens[d.cursor].line
+}
+
+// File gets the filename of the current token. If there is no token loaded,
+// it returns the filename originally given when parsing started.
+func (d *Dispenser) File() string {
+	if d.cursor < 0 || d.cursor >= len(d.tokens) {
+		return d.filename
+	}
+	if tokenFilename := d.tokens[d.cursor].file; tokenFilename != "" {
+		return tokenFilename
+	}
+	return d.filename
+}
+
+// Args is a convenience function that loads the next arguments
+// (tokens on the same line) into an arbitrary number of strings
+// pointed to in targets. If there are fewer tokens available
+// than string pointers, the remaining strings will not be changed
+// and false will be returned. If there were enough tokens available
+// to fill the arguments, then true will be returned.
+func (d *Dispenser) Args(targets ...*string) bool {
+	enough := true
+	for i := 0; i < len(targets); i++ {
+		if !d.NextArg() {
+			enough = false
+			break
+		}
+		*targets[i] = d.Val()
+	}
+	return enough
+}
+
+// RemainingArgs loads any more arguments (tokens on the same line)
+// into a slice and returns them. Open curly brace tokens also indicate
+// the end of arguments, and the curly brace is not included in
+// the return value nor is it loaded.
+func (d *Dispenser) RemainingArgs() []string {
+	var args []string
+
+	for d.NextArg() {
+		if d.Val() == "{" {
+			d.cursor--
+			break
+		}
+		args = append(args, d.Val())
+	}
+
+	return args
+}
+
+// ArgErr returns an argument error, meaning that another
+// argument was expected but not found. In other words,
+// a line break or open curly brace was encountered instead of
+// an argument.
+func (d *Dispenser) ArgErr() error {
+	if d.Val() == "{" {
+		return d.Err("Unexpected token '{', expecting argument")
+	}
+	return d.Errf("Wrong argument count or unexpected line ending after '%s'", d.Val())
+}
+
+// SyntaxErr creates a generic syntax error which explains what was
+// found and what was expected.
+func (d *Dispenser) SyntaxErr(expected string) error {
+	msg := fmt.Sprintf("%s:%d - Syntax error: Unexpected token '%s', expecting '%s'", d.File(), d.Line(), d.Val(), expected)
+	return errors.New(msg)
+}
+
+// EOFErr returns an error indicating that the dispenser reached
+// the end of the input when searching for the next token.
+func (d *Dispenser) EOFErr() error {
+	return d.Errf("Unexpected EOF")
+}
+
+// Err generates a custom parse error with a message of msg.
+func (d *Dispenser) Err(msg string) error {
+	msg = fmt.Sprintf("%s:%d - Parse error: %s", d.File(), d.Line(), msg)
+	return errors.New(msg)
+}
+
+// Errf is like Err, but for formatted error messages
+func (d *Dispenser) Errf(format string, args ...interface{}) error {
+	return d.Err(fmt.Sprintf(format, args...))
+}
+
+// numLineBreaks counts how many line breaks are in the token
+// value given by the token index tknIdx. It returns 0 if the
+// token does not exist or there are no line breaks.
+func (d *Dispenser) numLineBreaks(tknIdx int) int {
+	if tknIdx < 0 || tknIdx >= len(d.tokens) {
+		return 0
+	}
+	return strings.Count(d.tokens[tknIdx].text, "\n")
+}
+
+// isNewLine determines whether the current token is on a different
+// line (higher line number) than the previous token. It handles imported
+// tokens correctly. If there isn't a previous token, it returns true.
+func (d *Dispenser) isNewLine() bool {
+	if d.cursor < 1 {
+		return true
+	}
+	if d.cursor > len(d.tokens)-1 {
+		return false
+	}
+	return d.tokens[d.cursor-1].file != d.tokens[d.cursor].file ||
+		d.tokens[d.cursor-1].line+d.numLineBreaks(d.cursor-1) < d.tokens[d.cursor].line
+}

caddy/parse/dispenser_test.go

@@ -1,21 +1,6 @@
-// Copyright 2015 Matthew Holt and The Caddy Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddyfile
+package parse
 
 import (
-	"errors"
 	"reflect"
 	"strings"
 	"testing"
@@ -26,7 +11,7 @@ func TestDispenser_Val_Next(t *testing.T) {
 			  dir1 arg1
 			  dir2 arg2 arg3
 			  dir3`
-	d := NewTestDispenser(input)
+	d := NewDispenser("Testfile", strings.NewReader(input))
 
 	if val := d.Val(); val != "" {
 		t.Fatalf("Val(): Should return empty string when no token loaded; got '%s'", val)
@@ -64,7 +49,7 @@ func TestDispenser_NextArg(t *testing.T) {
 	input := `dir1 arg1
 			  dir2 arg2 arg3
 			  dir3`
-	d := NewTestDispenser(input)
+	d := NewDispenser("Testfile", strings.NewReader(input))
 
 	assertNext := func(shouldLoad bool, expectedVal string, expectedCursor int) {
 		if d.Next() != shouldLoad {
@@ -79,7 +64,7 @@ func TestDispenser_NextArg(t *testing.T) {
 	}
 
 	assertNextArg := func(expectedVal string, loadAnother bool, expectedCursor int) {
-		if !d.NextArg() {
+		if d.NextArg() != true {
 			t.Error("NextArg(): Should load next argument but got false instead")
 		}
 		if d.cursor != expectedCursor {
@@ -89,7 +74,7 @@ func TestDispenser_NextArg(t *testing.T) {
 			t.Errorf("Val(): Expected '%s' but got '%s'", expectedVal, val)
 		}
 		if !loadAnother {
-			if d.NextArg() {
+			if d.NextArg() != false {
 				t.Fatalf("NextArg(): Should NOT load another argument, but got true instead (val: '%s')", d.Val())
 			}
 			if d.cursor != expectedCursor {
@@ -111,7 +96,7 @@ func TestDispenser_NextLine(t *testing.T) {
 	input := `host:port
 			  dir1 arg1
 			  dir2 arg2 arg3`
-	d := NewTestDispenser(input)
+	d := NewDispenser("Testfile", strings.NewReader(input))
 
 	assertNextLine := func(shouldLoad bool, expectedVal string, expectedCursor int) {
 		if d.NextLine() != shouldLoad {
@@ -144,10 +129,10 @@ func TestDispenser_NextBlock(t *testing.T) {
 			  }
 			  foobar2 {
 			  }`
-	d := NewTestDispenser(input)
+	d := NewDispenser("Testfile", strings.NewReader(input))
 
 	assertNextBlock := func(shouldLoad bool, expectedCursor, expectedNesting int) {
-		if loaded := d.NextBlock(0); loaded != shouldLoad {
+		if loaded := d.NextBlock(); loaded != shouldLoad {
 			t.Errorf("NextBlock(): Should return %v but got %v", shouldLoad, loaded)
 		}
 		if d.cursor != expectedCursor {
@@ -174,7 +159,7 @@ func TestDispenser_Args(t *testing.T) {
 			  dir2 arg4 arg5
 			  dir3 arg6 arg7
 			  dir4`
-	d := NewTestDispenser(input)
+	d := NewDispenser("Testfile", strings.NewReader(input))
 
 	d.Next() // dir1
 
@@ -241,7 +226,7 @@ func TestDispenser_RemainingArgs(t *testing.T) {
 			  dir2 arg4 arg5
 			  dir3 arg6 { arg7
 			  dir4`
-	d := NewTestDispenser(input)
+	d := NewDispenser("Testfile", strings.NewReader(input))
 
 	d.Next() // dir1
 
@@ -278,7 +263,7 @@ func TestDispenser_ArgErr_Err(t *testing.T) {
 	input := `dir1 {
 			  }
 			  dir2 arg1 arg2`
-	d := NewTestDispenser(input)
+	d := NewDispenser("Testfile", strings.NewReader(input))
 
 	d.cursor = 1 // {
 
@@ -304,10 +289,4 @@ func TestDispenser_ArgErr_Err(t *testing.T) {
 	if !strings.Contains(err.Error(), "foobar") {
 		t.Errorf("Expected error message with custom message in it ('foobar'); got '%v'", err)
 	}
-
-	ErrBarIsFull := errors.New("bar is full")
-	bookingError := d.Errf("unable to reserve: %w", ErrBarIsFull)
-	if !errors.Is(bookingError, ErrBarIsFull) {
-		t.Errorf("Errf(): should be able to unwrap the error chain")
-	}
 }

caddy/parse/lexer.go

@@ -0,0 +1,122 @@
+package parse
+
+import (
+	"bufio"
+	"io"
+	"unicode"
+)
+
+type (
+	// lexer is a utility which can get values, token by
+	// token, from a Reader. A token is a word, and tokens
+	// are separated by whitespace. A word can be enclosed
+	// in quotes if it contains whitespace.
+	lexer struct {
+		reader *bufio.Reader
+		token  token
+		line   int
+	}
+
+	// token represents a single parsable unit.
+	token struct {
+		file string
+		line int
+		text string
+	}
+)
+
+// load prepares the lexer to scan an input for tokens.
+func (l *lexer) load(input io.Reader) error {
+	l.reader = bufio.NewReader(input)
+	l.line = 1
+	return nil
+}
+
+// next loads the next token into the lexer.
+// A token is delimited by whitespace, unless
+// the token starts with a quotes character (")
+// in which case the token goes until the closing
+// quotes (the enclosing quotes are not included).
+// Inside quoted strings, quotes may be escaped
+// with a preceding \ character. No other chars
+// may be escaped. The rest of the line is skipped
+// if a "#" character is read in. Returns true if
+// a token was loaded; false otherwise.
+func (l *lexer) next() bool {
+	var val []rune
+	var comment, quoted, escaped bool
+
+	makeToken := func() bool {
+		l.token.text = string(val)
+		return true
+	}
+
+	for {
+		ch, _, err := l.reader.ReadRune()
+		if err != nil {
+			if len(val) > 0 {
+				return makeToken()
+			}
+			if err == io.EOF {
+				return false
+			}
+			panic(err)
+		}
+
+		if quoted {
+			if !escaped {
+				if ch == '\\' {
+					escaped = true
+					continue
+				} else if ch == '"' {
+					quoted = false
+					return makeToken()
+				}
+			}
+			if ch == '\n' {
+				l.line++
+			}
+			if escaped {
+				// only escape quotes
+				if ch != '"' {
+					val = append(val, '\\')
+				}
+			}
+			val = append(val, ch)
+			escaped = false
+			continue
+		}
+
+		if unicode.IsSpace(ch) {
+			if ch == '\r' {
+				continue
+			}
+			if ch == '\n' {
+				l.line++
+				comment = false
+			}
+			if len(val) > 0 {
+				return makeToken()
+			}
+			continue
+		}
+
+		if ch == '#' {
+			comment = true
+		}
+
+		if comment {
+			continue
+		}
+
+		if len(val) == 0 {
+			l.token = token{line: l.line}
+			if ch == '"' {
+				quoted = true
+				continue
+			}
+		}
+
+		val = append(val, ch)
+	}
+}

caddy/parse/lexer_test.go

@@ -0,0 +1,165 @@
+package parse
+
+import (
+	"strings"
+	"testing"
+)
+
+type lexerTestCase struct {
+	input    string
+	expected []token
+}
+
+func TestLexer(t *testing.T) {
+	testCases := []lexerTestCase{
+		{
+			input: `host:123`,
+			expected: []token{
+				{line: 1, text: "host:123"},
+			},
+		},
+		{
+			input: `host:123
+
+					directive`,
+			expected: []token{
+				{line: 1, text: "host:123"},
+				{line: 3, text: "directive"},
+			},
+		},
+		{
+			input: `host:123 {
+						directive
+					}`,
+			expected: []token{
+				{line: 1, text: "host:123"},
+				{line: 1, text: "{"},
+				{line: 2, text: "directive"},
+				{line: 3, text: "}"},
+			},
+		},
+		{
+			input: `host:123 { directive }`,
+			expected: []token{
+				{line: 1, text: "host:123"},
+				{line: 1, text: "{"},
+				{line: 1, text: "directive"},
+				{line: 1, text: "}"},
+			},
+		},
+		{
+			input: `host:123 {
+						#comment
+						directive
+						# comment
+						foobar # another comment
+					}`,
+			expected: []token{
+				{line: 1, text: "host:123"},
+				{line: 1, text: "{"},
+				{line: 3, text: "directive"},
+				{line: 5, text: "foobar"},
+				{line: 6, text: "}"},
+			},
+		},
+		{
+			input: `a "quoted value" b
+					foobar`,
+			expected: []token{
+				{line: 1, text: "a"},
+				{line: 1, text: "quoted value"},
+				{line: 1, text: "b"},
+				{line: 2, text: "foobar"},
+			},
+		},
+		{
+			input: `A "quoted \"value\" inside" B`,
+			expected: []token{
+				{line: 1, text: "A"},
+				{line: 1, text: `quoted "value" inside`},
+				{line: 1, text: "B"},
+			},
+		},
+		{
+			input: `"don't\escape"`,
+			expected: []token{
+				{line: 1, text: `don't\escape`},
+			},
+		},
+		{
+			input: `"don't\\escape"`,
+			expected: []token{
+				{line: 1, text: `don't\\escape`},
+			},
+		},
+		{
+			input: `A "quoted value with line
+					break inside" {
+						foobar
+					}`,
+			expected: []token{
+				{line: 1, text: "A"},
+				{line: 1, text: "quoted value with line\n\t\t\t\t\tbreak inside"},
+				{line: 2, text: "{"},
+				{line: 3, text: "foobar"},
+				{line: 4, text: "}"},
+			},
+		},
+		{
+			input: `"C:\php\php-cgi.exe"`,
+			expected: []token{
+				{line: 1, text: `C:\php\php-cgi.exe`},
+			},
+		},
+		{
+			input: `empty "" string`,
+			expected: []token{
+				{line: 1, text: `empty`},
+				{line: 1, text: ``},
+				{line: 1, text: `string`},
+			},
+		},
+		{
+			input: "skip those\r\nCR characters",
+			expected: []token{
+				{line: 1, text: "skip"},
+				{line: 1, text: "those"},
+				{line: 2, text: "CR"},
+				{line: 2, text: "characters"},
+			},
+		},
+	}
+
+	for i, testCase := range testCases {
+		actual := tokenize(testCase.input)
+		lexerCompare(t, i, testCase.expected, actual)
+	}
+}
+
+func tokenize(input string) (tokens []token) {
+	l := lexer{}
+	l.load(strings.NewReader(input))
+	for l.next() {
+		tokens = append(tokens, l.token)
+	}
+	return
+}
+
+func lexerCompare(t *testing.T, n int, expected, actual []token) {
+	if len(expected) != len(actual) {
+		t.Errorf("Test case %d: expected %d token(s) but got %d", n, len(expected), len(actual))
+	}
+
+	for i := 0; i < len(actual) && i < len(expected); i++ {
+		if actual[i].line != expected[i].line {
+			t.Errorf("Test case %d token %d ('%s'): expected line %d but was line %d",
+				n, i, expected[i].text, expected[i].line, actual[i].line)
+			break
+		}
+		if actual[i].text != expected[i].text {
+			t.Errorf("Test case %d token %d: expected text '%s' but was '%s'",
+				n, i, expected[i].text, actual[i].text)
+			break
+		}
+	}
+}

caddy/parse/parse.go

@@ -0,0 +1,32 @@
+// Package parse provides facilities for parsing configuration files.
+package parse
+
+import "io"
+
+// ServerBlocks parses the input just enough to organize tokens,
+// in order, by server block. No further parsing is performed.
+// If checkDirectives is true, only valid directives will be allowed
+// otherwise we consider it a parse error. Server blocks are returned
+// in the order in which they appear.
+func ServerBlocks(filename string, input io.Reader, checkDirectives bool) ([]serverBlock, error) {
+	p := parser{Dispenser: NewDispenser(filename, input)}
+	p.checkDirectives = checkDirectives
+	blocks, err := p.parseAll()
+	return blocks, err
+}
+
+// allTokens lexes the entire input, but does not parse it.
+// It returns all the tokens from the input, unstructured
+// and in order.
+func allTokens(input io.Reader) (tokens []token) {
+	l := new(lexer)
+	l.load(input)
+	for l.next() {
+		tokens = append(tokens, l.token)
+	}
+	return
+}
+
+// ValidDirectives is a set of directives that are valid (unordered). Populated
+// by config package's init function.
+var ValidDirectives = make(map[string]struct{})

caddy/parse/parse_test.go

@@ -0,0 +1,22 @@
+package parse
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestAllTokens(t *testing.T) {
+	input := strings.NewReader("a b c\nd e")
+	expected := []string{"a", "b", "c", "d", "e"}
+	tokens := allTokens(input)
+
+	if len(tokens) != len(expected) {
+		t.Fatalf("Expected %d tokens, got %d", len(expected), len(tokens))
+	}
+
+	for i, val := range expected {
+		if tokens[i].text != val {
+			t.Errorf("Token %d should be '%s' but was '%s'", i, val, tokens[i].text)
+		}
+	}
+}

caddy/parse/parsing.go

@@ -0,0 +1,329 @@
+package parse
+
+import (
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+type parser struct {
+	Dispenser
+	block           serverBlock // current server block being parsed
+	eof             bool        // if we encounter a valid EOF in a hard place
+	checkDirectives bool        // if true, directives must be known
+}
+
+func (p *parser) parseAll() ([]serverBlock, error) {
+	var blocks []serverBlock
+
+	for p.Next() {
+		err := p.parseOne()
+		if err != nil {
+			return blocks, err
+		}
+		if len(p.block.Addresses) > 0 {
+			blocks = append(blocks, p.block)
+		}
+	}
+
+	return blocks, nil
+}
+
+func (p *parser) parseOne() error {
+	p.block = serverBlock{Tokens: make(map[string][]token)}
+
+	err := p.begin()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (p *parser) begin() error {
+	if len(p.tokens) == 0 {
+		return nil
+	}
+
+	err := p.addresses()
+	if err != nil {
+		return err
+	}
+
+	if p.eof {
+		// this happens if the Caddyfile consists of only
+		// a line of addresses and nothing else
+		return nil
+	}
+
+	err = p.blockContents()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (p *parser) addresses() error {
+	var expectingAnother bool
+
+	for {
+		tkn := p.Val()
+
+		// special case: import directive replaces tokens during parse-time
+		if tkn == "import" && p.isNewLine() {
+			err := p.doImport()
+			if err != nil {
+				return err
+			}
+			continue
+		}
+
+		// Open brace definitely indicates end of addresses
+		if tkn == "{" {
+			if expectingAnother {
+				return p.Errf("Expected another address but had '%s' - check for extra comma", tkn)
+			}
+			break
+		}
+
+		if tkn != "" { // empty token possible if user typed "" in Caddyfile
+			// Trailing comma indicates another address will follow, which
+			// may possibly be on the next line
+			if tkn[len(tkn)-1] == ',' {
+				tkn = tkn[:len(tkn)-1]
+				expectingAnother = true
+			} else {
+				expectingAnother = false // but we may still see another one on this line
+			}
+
+			// Parse and save this address
+			host, port, err := standardAddress(tkn)
+			if err != nil {
+				return err
+			}
+			p.block.Addresses = append(p.block.Addresses, address{host, port})
+		}
+
+		// Advance token and possibly break out of loop or return error
+		hasNext := p.Next()
+		if expectingAnother && !hasNext {
+			return p.EOFErr()
+		}
+		if !hasNext {
+			p.eof = true
+			break // EOF
+		}
+		if !expectingAnother && p.isNewLine() {
+			break
+		}
+	}
+
+	return nil
+}
+
+func (p *parser) blockContents() error {
+	errOpenCurlyBrace := p.openCurlyBrace()
+	if errOpenCurlyBrace != nil {
+		// single-server configs don't need curly braces
+		p.cursor--
+	}
+
+	err := p.directives()
+	if err != nil {
+		return err
+	}
+
+	// Only look for close curly brace if there was an opening
+	if errOpenCurlyBrace == nil {
+		err = p.closeCurlyBrace()
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// directives parses through all the lines for directives
+// and it expects the next token to be the first
+// directive. It goes until EOF or closing curly brace
+// which ends the server block.
+func (p *parser) directives() error {
+	for p.Next() {
+		// end of server block
+		if p.Val() == "}" {
+			break
+		}
+
+		// special case: import directive replaces tokens during parse-time
+		if p.Val() == "import" {
+			err := p.doImport()
+			if err != nil {
+				return err
+			}
+			p.cursor-- // cursor is advanced when we continue, so roll back one more
+			continue
+		}
+
+		// normal case: parse a directive on this line
+		if err := p.directive(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// doImport swaps out the import directive and its argument
+// (a total of 2 tokens) with the tokens in the file specified.
+// When the function returns, the cursor is on the token before
+// where the import directive was. In other words, call Next()
+// to access the first token that was imported.
+func (p *parser) doImport() error {
+	if !p.NextArg() {
+		return p.ArgErr()
+	}
+	importFile := p.Val()
+	if p.NextArg() {
+		return p.Err("Import allows only one file to import")
+	}
+
+	file, err := os.Open(importFile)
+	if err != nil {
+		return p.Errf("Could not import %s - %v", importFile, err)
+	}
+	defer file.Close()
+	importedTokens := allTokens(file)
+
+	// Tack the filename onto these tokens so any errors show the imported file's name
+	for i := 0; i < len(importedTokens); i++ {
+		importedTokens[i].file = filepath.Base(importFile)
+	}
+
+	// Splice out the import directive and its argument (2 tokens total)
+	// and insert the imported tokens in their place.
+	tokensBefore := p.tokens[:p.cursor-1]
+	tokensAfter := p.tokens[p.cursor+1:]
+	p.tokens = append(tokensBefore, append(importedTokens, tokensAfter...)...)
+	p.cursor-- // cursor was advanced one position to read the filename; rewind it
+
+	return nil
+}
+
+// directive collects tokens until the directive's scope
+// closes (either end of line or end of curly brace block).
+// It expects the currently-loaded token to be a directive
+// (or } that ends a server block). The collected tokens
+// are loaded into the current server block for later use
+// by directive setup functions.
+func (p *parser) directive() error {
+	dir := p.Val()
+	nesting := 0
+
+	if p.checkDirectives {
+		if _, ok := ValidDirectives[dir]; !ok {
+			return p.Errf("Unknown directive '%s'", dir)
+		}
+	}
+
+	// The directive itself is appended as a relevant token
+	p.block.Tokens[dir] = append(p.block.Tokens[dir], p.tokens[p.cursor])
+
+	for p.Next() {
+		if p.Val() == "{" {
+			nesting++
+		} else if p.isNewLine() && nesting == 0 {
+			p.cursor-- // read too far
+			break
+		} else if p.Val() == "}" && nesting > 0 {
+			nesting--
+		} else if p.Val() == "}" && nesting == 0 {
+			return p.Err("Unexpected '}' because no matching opening brace")
+		}
+		p.block.Tokens[dir] = append(p.block.Tokens[dir], p.tokens[p.cursor])
+	}
+
+	if nesting > 0 {
+		return p.EOFErr()
+	}
+	return nil
+}
+
+// openCurlyBrace expects the current token to be an
+// opening curly brace. This acts like an assertion
+// because it returns an error if the token is not
+// a opening curly brace. It does NOT advance the token.
+func (p *parser) openCurlyBrace() error {
+	if p.Val() != "{" {
+		return p.SyntaxErr("{")
+	}
+	return nil
+}
+
+// closeCurlyBrace expects the current token to be
+// a closing curly brace. This acts like an assertion
+// because it returns an error if the token is not
+// a closing curly brace. It does NOT advance the token.
+func (p *parser) closeCurlyBrace() error {
+	if p.Val() != "}" {
+		return p.SyntaxErr("}")
+	}
+	return nil
+}
+
+// standardAddress turns the accepted host and port patterns
+// into a format accepted by net.Dial.
+func standardAddress(str string) (host, port string, err error) {
+	var schemePort, splitPort string
+
+	if strings.HasPrefix(str, "https://") {
+		schemePort = "https"
+		str = str[8:]
+	} else if strings.HasPrefix(str, "http://") {
+		schemePort = "http"
+		str = str[7:]
+	}
+
+	host, splitPort, err = net.SplitHostPort(str)
+	if err != nil {
+		host, splitPort, err = net.SplitHostPort(str + ":") // tack on empty port
+	}
+	if err != nil {
+		// ¯\_(ツ)_/¯
+		host = str
+	}
+
+	if splitPort != "" {
+		port = splitPort
+	} else {
+		port = schemePort
+	}
+
+	return
+}
+
+type (
+	// serverBlock associates tokens with a list of addresses
+	// and groups tokens by directive name.
+	serverBlock struct {
+		Addresses []address
+		Tokens    map[string][]token
+	}
+
+	address struct {
+		Host, Port string
+	}
+)
+
+// HostList converts the list of addresses (hosts)
+// that are associated with this server block into
+// a slice of strings. Each string is a host:port
+// combination.
+func (sb serverBlock) HostList() []string {
+	sbHosts := make([]string, len(sb.Addresses))
+	for j, addr := range sb.Addresses {
+		sbHosts[j] = net.JoinHostPort(addr.Host, addr.Port)
+	}
+	return sbHosts
+}

caddy/parse/parsing_test.go

@@ -0,0 +1,380 @@
+package parse
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestStandardAddress(t *testing.T) {
+	for i, test := range []struct {
+		input      string
+		host, port string
+		shouldErr  bool
+	}{
+		{`localhost`, "localhost", "", false},
+		{`localhost:1234`, "localhost", "1234", false},
+		{`localhost:`, "localhost", "", false},
+		{`0.0.0.0`, "0.0.0.0", "", false},
+		{`127.0.0.1:1234`, "127.0.0.1", "1234", false},
+		{`:1234`, "", "1234", false},
+		{`[::1]`, "::1", "", false},
+		{`[::1]:1234`, "::1", "1234", false},
+		{`:`, "", "", false},
+		{`localhost:http`, "localhost", "http", false},
+		{`localhost:https`, "localhost", "https", false},
+		{`:http`, "", "http", false},
+		{`:https`, "", "https", false},
+		{`http://localhost`, "localhost", "http", false},
+		{`https://localhost`, "localhost", "https", false},
+		{`http://127.0.0.1`, "127.0.0.1", "http", false},
+		{`https://127.0.0.1`, "127.0.0.1", "https", false},
+		{`http://[::1]`, "::1", "http", false},
+		{`http://localhost:1234`, "localhost", "1234", false},
+		{`https://127.0.0.1:1234`, "127.0.0.1", "1234", false},
+		{`http://[::1]:1234`, "::1", "1234", false},
+		{``, "", "", false},
+		{`::1`, "::1", "", true},
+		{`localhost::`, "localhost::", "", true},
+		{`#$%@`, "#$%@", "", true},
+	} {
+		host, port, err := standardAddress(test.input)
+
+		if err != nil && !test.shouldErr {
+			t.Errorf("Test %d: Expected no error, but had error: %v", i, err)
+		}
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d: Expected error, but had none", i)
+		}
+
+		if host != test.host {
+			t.Errorf("Test %d: Expected host '%s', got '%s'", i, test.host, host)
+		}
+
+		if port != test.port {
+			t.Errorf("Test %d: Expected port '%s', got '%s'", i, test.port, port)
+		}
+	}
+}
+
+func TestParseOneAndImport(t *testing.T) {
+	setupParseTests()
+
+	testParseOne := func(input string) (serverBlock, error) {
+		p := testParser(input)
+		p.Next() // parseOne doesn't call Next() to start, so we must
+		err := p.parseOne()
+		return p.block, err
+	}
+
+	for i, test := range []struct {
+		input     string
+		shouldErr bool
+		addresses []address
+		tokens    map[string]int // map of directive name to number of tokens expected
+	}{
+		{`localhost`, false, []address{
+			{"localhost", ""},
+		}, map[string]int{}},
+
+		{`localhost
+		  dir1`, false, []address{
+			{"localhost", ""},
+		}, map[string]int{
+			"dir1": 1,
+		}},
+
+		{`localhost:1234
+		  dir1 foo bar`, false, []address{
+			{"localhost", "1234"},
+		}, map[string]int{
+			"dir1": 3,
+		}},
+
+		{`localhost {
+		    dir1
+		  }`, false, []address{
+			{"localhost", ""},
+		}, map[string]int{
+			"dir1": 1,
+		}},
+
+		{`localhost:1234 {
+		    dir1 foo bar
+		    dir2
+		  }`, false, []address{
+			{"localhost", "1234"},
+		}, map[string]int{
+			"dir1": 3,
+			"dir2": 1,
+		}},
+
+		{`http://localhost https://localhost
+		  dir1 foo bar`, false, []address{
+			{"localhost", "http"},
+			{"localhost", "https"},
+		}, map[string]int{
+			"dir1": 3,
+		}},
+
+		{`http://localhost https://localhost {
+		    dir1 foo bar
+		  }`, false, []address{
+			{"localhost", "http"},
+			{"localhost", "https"},
+		}, map[string]int{
+			"dir1": 3,
+		}},
+
+		{`http://localhost, https://localhost {
+		    dir1 foo bar
+		  }`, false, []address{
+			{"localhost", "http"},
+			{"localhost", "https"},
+		}, map[string]int{
+			"dir1": 3,
+		}},
+
+		{`http://localhost, {
+		  }`, true, []address{
+			{"localhost", "http"},
+		}, map[string]int{}},
+
+		{`host1:80, http://host2.com
+		  dir1 foo bar
+		  dir2 baz`, false, []address{
+			{"host1", "80"},
+			{"host2.com", "http"},
+		}, map[string]int{
+			"dir1": 3,
+			"dir2": 2,
+		}},
+
+		{`http://host1.com,
+		  http://host2.com,
+		  https://host3.com`, false, []address{
+			{"host1.com", "http"},
+			{"host2.com", "http"},
+			{"host3.com", "https"},
+		}, map[string]int{}},
+
+		{`http://host1.com:1234, https://host2.com
+		  dir1 foo {
+		    bar baz
+		  }
+		  dir2`, false, []address{
+			{"host1.com", "1234"},
+			{"host2.com", "https"},
+		}, map[string]int{
+			"dir1": 6,
+			"dir2": 1,
+		}},
+
+		{`127.0.0.1
+		  dir1 {
+		    bar baz
+		  }
+		  dir2 {
+		    foo bar
+		  }`, false, []address{
+			{"127.0.0.1", ""},
+		}, map[string]int{
+			"dir1": 5,
+			"dir2": 5,
+		}},
+
+		{`127.0.0.1
+		  unknown_directive`, true, []address{
+			{"127.0.0.1", ""},
+		}, map[string]int{}},
+
+		{`localhost
+		  dir1 {
+		    foo`, true, []address{
+			{"localhost", ""},
+		}, map[string]int{
+			"dir1": 3,
+		}},
+
+		{`localhost
+		  dir1 {
+		  }`, false, []address{
+			{"localhost", ""},
+		}, map[string]int{
+			"dir1": 3,
+		}},
+
+		{`localhost
+		  dir1 {
+		  } }`, true, []address{
+			{"localhost", ""},
+		}, map[string]int{
+			"dir1": 3,
+		}},
+
+		{`localhost
+		  dir1 {
+		    nested {
+		      foo
+		    }
+		  }
+		  dir2 foo bar`, false, []address{
+			{"localhost", ""},
+		}, map[string]int{
+			"dir1": 7,
+			"dir2": 3,
+		}},
+
+		{``, false, []address{}, map[string]int{}},
+
+		{`localhost
+		  dir1 arg1
+		  import import_test1.txt`, false, []address{
+			{"localhost", ""},
+		}, map[string]int{
+			"dir1": 2,
+			"dir2": 3,
+			"dir3": 1,
+		}},
+
+		{`import import_test2.txt`, false, []address{
+			{"host1", ""},
+		}, map[string]int{
+			"dir1": 1,
+			"dir2": 2,
+		}},
+
+		{`import import_test1.txt import_test2.txt`, true, []address{}, map[string]int{}},
+
+		{`import not_found.txt`, true, []address{}, map[string]int{}},
+
+		{`""`, false, []address{}, map[string]int{}},
+
+		{``, false, []address{}, map[string]int{}},
+	} {
+		result, err := testParseOne(test.input)
+
+		if test.shouldErr && err == nil {
+			t.Errorf("Test %d: Expected an error, but didn't get one", i)
+		}
+		if !test.shouldErr && err != nil {
+			t.Errorf("Test %d: Expected no error, but got: %v", i, err)
+		}
+
+		if len(result.Addresses) != len(test.addresses) {
+			t.Errorf("Test %d: Expected %d addresses, got %d",
+				i, len(test.addresses), len(result.Addresses))
+			continue
+		}
+		for j, addr := range result.Addresses {
+			if addr.Host != test.addresses[j].Host {
+				t.Errorf("Test %d, address %d: Expected host to be '%s', but was '%s'",
+					i, j, test.addresses[j].Host, addr.Host)
+			}
+			if addr.Port != test.addresses[j].Port {
+				t.Errorf("Test %d, address %d: Expected port to be '%s', but was '%s'",
+					i, j, test.addresses[j].Port, addr.Port)
+			}
+		}
+
+		if len(result.Tokens) != len(test.tokens) {
+			t.Errorf("Test %d: Expected %d directives, had %d",
+				i, len(test.tokens), len(result.Tokens))
+			continue
+		}
+		for directive, tokens := range result.Tokens {
+			if len(tokens) != test.tokens[directive] {
+				t.Errorf("Test %d, directive '%s': Expected %d tokens, counted %d",
+					i, directive, test.tokens[directive], len(tokens))
+				continue
+			}
+		}
+	}
+}
+
+func TestParseAll(t *testing.T) {
+	setupParseTests()
+
+	for i, test := range []struct {
+		input     string
+		shouldErr bool
+		addresses [][]address // addresses per server block, in order
+	}{
+		{`localhost`, false, [][]address{
+			{{"localhost", ""}},
+		}},
+
+		{`localhost:1234`, false, [][]address{
+			[]address{{"localhost", "1234"}},
+		}},
+
+		{`localhost:1234 {
+		  }
+		  localhost:2015 {
+		  }`, false, [][]address{
+			[]address{{"localhost", "1234"}},
+			[]address{{"localhost", "2015"}},
+		}},
+
+		{`localhost:1234, http://host2`, false, [][]address{
+			[]address{{"localhost", "1234"}, {"host2", "http"}},
+		}},
+
+		{`localhost:1234, http://host2,`, true, [][]address{}},
+
+		{`http://host1.com, http://host2.com {
+		  }
+		  https://host3.com, https://host4.com {
+		  }`, false, [][]address{
+			[]address{{"host1.com", "http"}, {"host2.com", "http"}},
+			[]address{{"host3.com", "https"}, {"host4.com", "https"}},
+		}},
+	} {
+		p := testParser(test.input)
+		blocks, err := p.parseAll()
+
+		if test.shouldErr && err == nil {
+			t.Errorf("Test %d: Expected an error, but didn't get one", i)
+		}
+		if !test.shouldErr && err != nil {
+			t.Errorf("Test %d: Expected no error, but got: %v", i, err)
+		}
+
+		if len(blocks) != len(test.addresses) {
+			t.Errorf("Test %d: Expected %d server blocks, got %d",
+				i, len(test.addresses), len(blocks))
+			continue
+		}
+		for j, block := range blocks {
+			if len(block.Addresses) != len(test.addresses[j]) {
+				t.Errorf("Test %d: Expected %d addresses in block %d, got %d",
+					i, len(test.addresses[j]), j, len(block.Addresses))
+				continue
+			}
+			for k, addr := range block.Addresses {
+				if addr.Host != test.addresses[j][k].Host {
+					t.Errorf("Test %d, block %d, address %d: Expected host to be '%s', but was '%s'",
+						i, j, k, test.addresses[j][k].Host, addr.Host)
+				}
+				if addr.Port != test.addresses[j][k].Port {
+					t.Errorf("Test %d, block %d, address %d: Expected port to be '%s', but was '%s'",
+						i, j, k, test.addresses[j][k].Port, addr.Port)
+				}
+			}
+		}
+	}
+}
+
+func setupParseTests() {
+	// Set up some bogus directives for testing
+	ValidDirectives = map[string]struct{}{
+		"dir1": {},
+		"dir2": {},
+		"dir3": {},
+	}
+}
+
+func testParser(input string) parser {
+	buf := strings.NewReader(input)
+	p := parser{Dispenser: NewDispenser("Test", buf), checkDirectives: true}
+	return p
+}

caddy/restart.go

@@ -0,0 +1,102 @@
+// +build !windows
+
+package caddy
+
+import (
+	"encoding/gob"
+	"io/ioutil"
+	"log"
+	"os"
+	"syscall"
+)
+
+func init() {
+	gob.Register(CaddyfileInput{})
+}
+
+// Restart restarts the entire application; gracefully with zero
+// downtime if on a POSIX-compatible system, or forcefully if on
+// Windows but with imperceptibly-short downtime.
+//
+// The restarted application will use newCaddyfile as its input
+// configuration. If newCaddyfile is nil, the current (existing)
+// Caddyfile configuration will be used.
+//
+// Note: The process must exist in the same place on the disk in
+// order for this to work. Thus, multiple graceful restarts don't
+// work if executing with `go run`, since the binary is cleaned up
+// when `go run` sees the initial parent process exit.
+func Restart(newCaddyfile Input) error {
+	if newCaddyfile == nil {
+		caddyfileMu.Lock()
+		newCaddyfile = caddyfile
+		caddyfileMu.Unlock()
+	}
+
+	if len(os.Args) == 0 { // this should never happen...
+		os.Args = []string{""}
+	}
+
+	// Tell the child that it's a restart
+	os.Setenv("CADDY_RESTART", "true")
+
+	// Prepare our payload to the child process
+	cdyfileGob := caddyfileGob{
+		ListenerFds: make(map[string]uintptr),
+		Caddyfile:   newCaddyfile,
+	}
+
+	// Prepare a pipe to the fork's stdin so it can get the Caddyfile
+	rpipe, wpipe, err := os.Pipe()
+	if err != nil {
+		return err
+	}
+
+	// Prepare a pipe that the child process will use to communicate
+	// its success or failure with us, the parent
+	sigrpipe, sigwpipe, err := os.Pipe()
+	if err != nil {
+		return err
+	}
+
+	// Pass along current environment and file descriptors to child.
+	// Ordering here is very important: stdin, stdout, stderr, sigpipe,
+	// and then the listener file descriptors (in order).
+	fds := []uintptr{rpipe.Fd(), os.Stdout.Fd(), os.Stderr.Fd(), sigwpipe.Fd()}
+
+	// Now add file descriptors of the sockets
+	serversMu.Lock()
+	for i, s := range servers {
+		fds = append(fds, s.ListenerFd())
+		cdyfileGob.ListenerFds[s.Addr] = uintptr(4 + i) // 4 fds come before any of the listeners
+	}
+	serversMu.Unlock()
+
+	// Fork the process with the current environment and file descriptors
+	execSpec := &syscall.ProcAttr{
+		Env:   os.Environ(),
+		Files: fds,
+	}
+	_, err = syscall.ForkExec(os.Args[0], os.Args, execSpec)
+	if err != nil {
+		return err
+	}
+
+	// Feed it the Caddyfile
+	err = gob.NewEncoder(wpipe).Encode(cdyfileGob)
+	if err != nil {
+		return err
+	}
+	wpipe.Close()
+
+	// Wait for child process to signal success or fail
+	sigwpipe.Close() // close our copy of the write end of the pipe or we might be stuck
+	answer, err := ioutil.ReadAll(sigrpipe)
+	if err != nil || len(answer) == 0 {
+		log.Println("[ERROR] Restart: child failed to initialize; changes not applied")
+		return errIncompleteRestart
+	}
+
+	// Child process is listening now; we can stop all our servers here.
+	return Stop()
+}

caddy/restart_windows.go

@@ -0,0 +1,25 @@
+package caddy
+
+func Restart(newCaddyfile Input) error {
+	if newCaddyfile == nil {
+		caddyfileMu.Lock()
+		newCaddyfile = caddyfile
+		caddyfileMu.Unlock()
+	}
+
+	wg.Add(1) // barrier so Wait() doesn't unblock
+
+	err := Stop()
+	if err != nil {
+		return err
+	}
+
+	err = Start(newCaddyfile)
+	if err != nil {
+		return err
+	}
+
+	wg.Done() // take down our barrier
+
+	return nil
+}

caddy/setup/basicauth.go

@@ -0,0 +1,72 @@
+package setup
+
+import (
+	"strings"
+
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/basicauth"
+)
+
+// BasicAuth configures a new BasicAuth middleware instance.
+func BasicAuth(c *Controller) (middleware.Middleware, error) {
+	root := c.Root
+
+	rules, err := basicAuthParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	basic := basicauth.BasicAuth{Rules: rules}
+
+	return func(next middleware.Handler) middleware.Handler {
+		basic.Next = next
+		basic.SiteRoot = root
+		return basic
+	}, nil
+}
+
+func basicAuthParse(c *Controller) ([]basicauth.Rule, error) {
+	var rules []basicauth.Rule
+
+	var err error
+	for c.Next() {
+		var rule basicauth.Rule
+
+		args := c.RemainingArgs()
+
+		switch len(args) {
+		case 2:
+			rule.Username = args[0]
+			if rule.Password, err = passwordMatcher(rule.Username, args[1], c.Root); err != nil {
+				return rules, c.Errf("Get password matcher from %s: %v", c.Val(), err)
+			}
+
+			for c.NextBlock() {
+				rule.Resources = append(rule.Resources, c.Val())
+				if c.NextArg() {
+					return rules, c.Errf("Expecting only one resource per line (extra '%s')", c.Val())
+				}
+			}
+		case 3:
+			rule.Resources = append(rule.Resources, args[0])
+			rule.Username = args[1]
+			if rule.Password, err = passwordMatcher(rule.Username, args[2], c.Root); err != nil {
+				return rules, c.Errf("Get password matcher from %s: %v", c.Val(), err)
+			}
+		default:
+			return rules, c.ArgErr()
+		}
+
+		rules = append(rules, rule)
+	}
+
+	return rules, nil
+}
+
+func passwordMatcher(username, passw, siteRoot string) (basicauth.PasswordMatcher, error) {
+	if !strings.HasPrefix(passw, "htpasswd=") {
+		return basicauth.PlainMatcher(passw), nil
+	}
+
+	return basicauth.GetHtpasswdMatcher(passw[9:], username, siteRoot)
+}

caddy/setup/basicauth_test.go

@@ -0,0 +1,132 @@
+package setup
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/mholt/caddy/middleware/basicauth"
+)
+
+func TestBasicAuth(t *testing.T) {
+	c := NewTestController(`basicauth user pwd`)
+
+	mid, err := BasicAuth(c)
+	if err != nil {
+		t.Errorf("Expected no errors, but got: %v", err)
+	}
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(basicauth.BasicAuth)
+	if !ok {
+		t.Fatalf("Expected handler to be type BasicAuth, got: %#v", handler)
+	}
+
+	if !SameNext(myHandler.Next, EmptyNext) {
+		t.Error("'Next' field of handler was not set properly")
+	}
+}
+
+func TestBasicAuthParse(t *testing.T) {
+	htpasswdPasswd := "IedFOuGmTpT8"
+	htpasswdFile := `sha1:{SHA}dcAUljwz99qFjYR0YLTXx0RqLww=
+md5:$apr1$l42y8rex$pOA2VJ0x/0TwaFeAF9nX61`
+
+	var skipHtpassword bool
+	htfh, err := ioutil.TempFile(".", "basicauth-")
+	if err != nil {
+		t.Logf("Error creating temp file (%v), will skip htpassword test", err)
+		skipHtpassword = true
+	} else {
+		if _, err = htfh.Write([]byte(htpasswdFile)); err != nil {
+			t.Fatalf("write htpasswd file %q: %v", htfh.Name(), err)
+		}
+		htfh.Close()
+		defer os.Remove(htfh.Name())
+	}
+
+	tests := []struct {
+		input     string
+		shouldErr bool
+		password  string
+		expected  []basicauth.Rule
+	}{
+		{`basicauth user pwd`, false, "pwd", []basicauth.Rule{
+			{Username: "user"},
+		}},
+		{`basicauth user pwd {
+		}`, false, "pwd", []basicauth.Rule{
+			{Username: "user"},
+		}},
+		{`basicauth user pwd {
+			/resource1
+			/resource2
+		}`, false, "pwd", []basicauth.Rule{
+			{Username: "user", Resources: []string{"/resource1", "/resource2"}},
+		}},
+		{`basicauth /resource user pwd`, false, "pwd", []basicauth.Rule{
+			{Username: "user", Resources: []string{"/resource"}},
+		}},
+		{`basicauth /res1 user1 pwd1
+		  basicauth /res2 user2 pwd2`, false, "pwd", []basicauth.Rule{
+			{Username: "user1", Resources: []string{"/res1"}},
+			{Username: "user2", Resources: []string{"/res2"}},
+		}},
+		{`basicauth user`, true, "", []basicauth.Rule{}},
+		{`basicauth`, true, "", []basicauth.Rule{}},
+		{`basicauth /resource user pwd asdf`, true, "", []basicauth.Rule{}},
+
+		{`basicauth sha1 htpasswd=` + htfh.Name(), false, htpasswdPasswd, []basicauth.Rule{
+			{Username: "sha1"},
+		}},
+	}
+
+	for i, test := range tests {
+		c := NewTestController(test.input)
+		actual, err := basicAuthParse(c)
+
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d didn't error, but it should have", i)
+		} else if err != nil && !test.shouldErr {
+			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
+		}
+
+		if len(actual) != len(test.expected) {
+			t.Fatalf("Test %d expected %d rules, but got %d",
+				i, len(test.expected), len(actual))
+		}
+
+		for j, expectedRule := range test.expected {
+			actualRule := actual[j]
+
+			if actualRule.Username != expectedRule.Username {
+				t.Errorf("Test %d, rule %d: Expected username '%s', got '%s'",
+					i, j, expectedRule.Username, actualRule.Username)
+			}
+
+			if strings.Contains(test.input, "htpasswd=") && skipHtpassword {
+				continue
+			}
+			pwd := test.password
+			if len(actual) > 1 {
+				pwd = fmt.Sprintf("%s%d", pwd, j+1)
+			}
+			if !actualRule.Password(pwd) || actualRule.Password(test.password+"!") {
+				t.Errorf("Test %d, rule %d: Expected password '%v', got '%v'",
+					i, j, test.password, actualRule.Password)
+			}
+
+			expectedRes := fmt.Sprintf("%v", expectedRule.Resources)
+			actualRes := fmt.Sprintf("%v", actualRule.Resources)
+			if actualRes != expectedRes {
+				t.Errorf("Test %d, rule %d: Expected resource list %s, but got %s",
+					i, j, expectedRes, actualRes)
+			}
+		}
+	}
+}

caddy/setup/bindhost.go

@@ -0,0 +1,13 @@
+package setup
+
+import "github.com/mholt/caddy/middleware"
+
+// BindHost sets the host to bind the listener to.
+func BindHost(c *Controller) (middleware.Middleware, error) {
+	for c.Next() {
+		if !c.Args(&c.BindHost) {
+			return nil, c.ArgErr()
+		}
+	}
+	return nil, nil
+}

caddy/setup/browse.go

@@ -0,0 +1,256 @@
+package setup
+
+import (
+	"fmt"
+	"io/ioutil"
+	"text/template"
+
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/browse"
+)
+
+// Browse configures a new Browse middleware instance.
+func Browse(c *Controller) (middleware.Middleware, error) {
+	configs, err := browseParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	browse := browse.Browse{
+		Root:          c.Root,
+		Configs:       configs,
+		IgnoreIndexes: false,
+	}
+
+	return func(next middleware.Handler) middleware.Handler {
+		browse.Next = next
+		return browse
+	}, nil
+}
+
+func browseParse(c *Controller) ([]browse.Config, error) {
+	var configs []browse.Config
+
+	appendCfg := func(bc browse.Config) error {
+		for _, c := range configs {
+			if c.PathScope == bc.PathScope {
+				return fmt.Errorf("duplicate browsing config for %s", c.PathScope)
+			}
+		}
+		configs = append(configs, bc)
+		return nil
+	}
+
+	for c.Next() {
+		var bc browse.Config
+
+		// First argument is directory to allow browsing; default is site root
+		if c.NextArg() {
+			bc.PathScope = c.Val()
+		} else {
+			bc.PathScope = "/"
+		}
+
+		// Second argument would be the template file to use
+		var tplText string
+		if c.NextArg() {
+			tplBytes, err := ioutil.ReadFile(c.Val())
+			if err != nil {
+				return configs, err
+			}
+			tplText = string(tplBytes)
+		} else {
+			tplText = defaultTemplate
+		}
+
+		// Build the template
+		tpl, err := template.New("listing").Parse(tplText)
+		if err != nil {
+			return configs, err
+		}
+		bc.Template = tpl
+
+		// Save configuration
+		err = appendCfg(bc)
+		if err != nil {
+			return configs, err
+		}
+	}
+
+	return configs, nil
+}
+
+// The default template to use when serving up directory listings
+const defaultTemplate = `<!DOCTYPE html>
+<html>
+	<head>
+		<title>{{.Name}}</title>
+		<meta charset="utf-8">
+<style>
+* { padding: 0; margin: 0; }
+
+body {
+	padding: 1% 2%;
+	font: 16px Arial;
+}
+
+header {
+	font-size: 45px;
+	padding: 25px;
+}
+
+header a {
+	text-decoration: none;
+	color: inherit;
+}
+
+header .up {
+	display: inline-block;
+	height: 50px;
+	width: 50px;
+	text-align: center;
+	margin-right: 20px;
+}
+
+header a.up:hover {
+	background: #000;
+	color: #FFF;
+}
+
+h1 {
+	font-size: 30px;
+	display: inline;
+}
+
+table {
+	border: 0;
+	border-collapse: collapse;
+	max-width: 750px;
+	margin: 0 auto;
+}
+
+th,
+td {
+	padding: 4px 20px;
+	vertical-align: middle;
+	line-height: 1.5em; /* emoji are kind of odd heights */
+}
+
+th {
+	text-align: left;
+}
+
+th a {
+	color: #000;
+	text-decoration: none;
+}
+
+@media (max-width: 700px) {
+	.hideable {
+		display: none;
+	}
+
+	body {
+		padding: 0;
+	}
+
+	header,
+	header h1 {
+		font-size: 16px;
+	}
+
+	header {
+		position: fixed;
+		top: 0;
+		width: 100%;
+		background: #333;
+		color: #FFF;
+		padding: 15px;
+		text-align: center;
+	}
+
+	header .up {
+		height: auto;
+		width: auto;
+		display: none;
+	}
+
+	header a.up {
+		display: inline-block;
+		position: absolute;
+		left: 0;
+		top: 0;
+		width: 40px;
+		height: 48px;
+		font-size: 35px;
+	}
+
+	header h1 {
+		font-weight: normal;
+	}
+
+	main {
+		margin-top: 70px;
+	}
+}
+
+.name {
+	white-space: pre;
+}
+</style>
+	</head>
+	<body>
+		<header>
+			{{if .CanGoUp}}
+			<a href=".." class="up" title="Up one level">&#11025;</a>
+			{{else}}
+			<div class="up">&nbsp;</div>
+			{{end}}
+
+			<h1>{{.Path}}</h1>
+		</header>
+		<main>
+			<table>
+				<tr>
+					<th>
+						{{if and (eq .Sort "name") (ne .Order "desc")}}
+						<a href="?sort=name&order=desc">Name &#9650;</a>
+						{{else if and (eq .Sort "name") (ne .Order "asc")}}
+						<a href="?sort=name&order=asc">Name &#9660;</a>
+						{{else}}
+						<a href="?sort=name&order=asc">Name</a>
+						{{end}}
+					</th>
+					<th>
+						{{if and (eq .Sort "size") (ne .Order "desc")}}
+						<a href="?sort=size&order=desc">Size &#9650;</a>
+						{{else if and (eq .Sort "size") (ne .Order "asc")}}
+						<a href="?sort=size&order=asc">Size &#9660;</a>
+						{{else}}
+						<a href="?sort=size&order=asc">Size</a>
+						{{end}}
+					</th>
+					<th class="hideable">
+						{{if and (eq .Sort "time") (ne .Order "desc")}}
+						<a href="?sort=time&order=desc">Modified &#9650;</a>
+						{{else if and (eq .Sort "time") (ne .Order "asc")}}
+						<a href="?sort=time&order=asc">Modified &#9660;</a>
+						{{else}}
+						<a href="?sort=time&order=asc">Modified</a>
+						{{end}}
+					</th>
+				</tr>
+				{{range .Items}}
+				<tr>
+					<td>
+						{{if .IsDir}}&#128194;{{else}}&#128196;{{end}}
+						<a href="{{.URL}}" class="name">{{.Name}}</a>
+					</td>
+					<td>{{.HumanSize}}</td>
+					<td class="hideable">{{.HumanModTime "01/02/2006 3:04:05 PM -0700"}}</td>
+				</tr>
+				{{end}}
+			</table>
+		</main>
+	</body>
+</html>`

caddy/setup/controller.go

@@ -0,0 +1,83 @@
+package setup
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/mholt/caddy/caddy/parse"
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/server"
+)
+
+// Controller is given to the setup function of middlewares which
+// gives them access to be able to read tokens and set config. Each
+// virtualhost gets their own server config and dispenser.
+type Controller struct {
+	*server.Config
+	parse.Dispenser
+
+	// OncePerServerBlock is a function that executes f
+	// exactly once per server block, no matter how many
+	// hosts are associated with it. If it is the first
+	// time, the function f is executed immediately
+	// (not deferred) and may return an error which is
+	// returned by OncePerServerBlock.
+	OncePerServerBlock func(f func() error) error
+
+	// ServerBlockIndex is the 0-based index of the
+	// server block as it appeared in the input.
+	ServerBlockIndex int
+
+	// ServerBlockHostIndex is the 0-based index of this
+	// host as it appeared in the input at the head of the
+	// server block.
+	ServerBlockHostIndex int
+
+	// ServerBlockHosts is a list of hosts that are
+	// associated with this server block. All these
+	// hosts, consequently, share the same tokens.
+	ServerBlockHosts []string
+
+	// ServerBlockStorage is used by a directive's
+	// setup function to persist state between all
+	// the hosts on a server block.
+	ServerBlockStorage interface{}
+}
+
+// NewTestController creates a new *Controller for
+// the input specified, with a filename of "Testfile".
+// The Config is bare, consisting only of a Root of cwd.
+//
+// Used primarily for testing but needs to be exported so
+// add-ons can use this as a convenience. Does not initialize
+// the server-block-related fields.
+func NewTestController(input string) *Controller {
+	return &Controller{
+		Config: &server.Config{
+			Root: ".",
+		},
+		Dispenser: parse.NewDispenser("Testfile", strings.NewReader(input)),
+		OncePerServerBlock: func(f func() error) error {
+			return f()
+		},
+	}
+}
+
+// EmptyNext is a no-op function that can be passed into
+// middleware.Middleware functions so that the assignment
+// to the Next field of the Handler can be tested.
+//
+// Used primarily for testing but needs to be exported so
+// add-ons can use this as a convenience.
+var EmptyNext = middleware.HandlerFunc(func(w http.ResponseWriter, r *http.Request) (int, error) {
+	return 0, nil
+})
+
+// SameNext does a pointer comparison between next1 and next2.
+//
+// Used primarily for testing but needs to be exported so
+// add-ons can use this as a convenience.
+func SameNext(next1, next2 middleware.Handler) bool {
+	return fmt.Sprintf("%v", next1) == fmt.Sprintf("%v", next2)
+}

caddy/setup/errors.go

@@ -0,0 +1,148 @@
+package setup
+
+import (
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"strconv"
+
+	"github.com/hashicorp/go-syslog"
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/errors"
+)
+
+// Errors configures a new gzip middleware instance.
+func Errors(c *Controller) (middleware.Middleware, error) {
+	handler, err := errorsParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	// Open the log file for writing when the server starts
+	c.Startup = append(c.Startup, func() error {
+		var err error
+		var writer io.Writer
+
+		switch handler.LogFile {
+		case "visible":
+			handler.Debug = true
+		case "stdout":
+			writer = os.Stdout
+		case "stderr":
+			writer = os.Stderr
+		case "syslog":
+			writer, err = gsyslog.NewLogger(gsyslog.LOG_ERR, "LOCAL0", "caddy")
+			if err != nil {
+				return err
+			}
+		default:
+			if handler.LogFile == "" {
+				writer = os.Stderr // default
+				break
+			}
+
+			var file *os.File
+			file, err = os.OpenFile(handler.LogFile, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0644)
+			if err != nil {
+				return err
+			}
+			if handler.LogRoller != nil {
+				file.Close()
+
+				handler.LogRoller.Filename = handler.LogFile
+
+				writer = handler.LogRoller.GetLogWriter()
+			} else {
+				writer = file
+			}
+		}
+
+		handler.Log = log.New(writer, "", 0)
+		return nil
+	})
+
+	return func(next middleware.Handler) middleware.Handler {
+		handler.Next = next
+		return handler
+	}, nil
+}
+
+func errorsParse(c *Controller) (*errors.ErrorHandler, error) {
+	// Very important that we make a pointer because the Startup
+	// function that opens the log file must have access to the
+	// same instance of the handler, not a copy.
+	handler := &errors.ErrorHandler{ErrorPages: make(map[int]string)}
+
+	optionalBlock := func() (bool, error) {
+		var hadBlock bool
+
+		for c.NextBlock() {
+			hadBlock = true
+
+			what := c.Val()
+			if !c.NextArg() {
+				return hadBlock, c.ArgErr()
+			}
+			where := c.Val()
+
+			if what == "log" {
+				if where == "visible" {
+					handler.Debug = true
+				} else {
+					handler.LogFile = where
+					if c.NextArg() {
+						if c.Val() == "{" {
+							c.IncrNest()
+							logRoller, err := parseRoller(c)
+							if err != nil {
+								return hadBlock, err
+							}
+							handler.LogRoller = logRoller
+						}
+					}
+				}
+			} else {
+				// Error page; ensure it exists
+				where = filepath.Join(c.Root, where)
+				f, err := os.Open(where)
+				if err != nil {
+					log.Printf("[WARNING] Unable to open error page '%s': %v", where, err)
+				}
+				f.Close()
+
+				whatInt, err := strconv.Atoi(what)
+				if err != nil {
+					return hadBlock, c.Err("Expecting a numeric status code, got '" + what + "'")
+				}
+				handler.ErrorPages[whatInt] = where
+			}
+		}
+		return hadBlock, nil
+	}
+
+	for c.Next() {
+		// weird hack to avoid having the handler values overwritten.
+		if c.Val() == "}" {
+			continue
+		}
+		// Configuration may be in a block
+		hadBlock, err := optionalBlock()
+		if err != nil {
+			return handler, err
+		}
+
+		// Otherwise, the only argument would be an error log file name or 'visible'
+		if !hadBlock {
+			if c.NextArg() {
+				if c.Val() == "visible" {
+					handler.Debug = true
+				} else {
+					handler.LogFile = c.Val()
+				}
+			}
+		}
+	}
+
+	return handler, nil
+}

caddy/setup/errors_test.go

@@ -0,0 +1,158 @@
+package setup
+
+import (
+	"testing"
+
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/errors"
+)
+
+func TestErrors(t *testing.T) {
+	c := NewTestController(`errors`)
+	mid, err := Errors(c)
+
+	if err != nil {
+		t.Errorf("Expected no errors, got: %v", err)
+	}
+
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(*errors.ErrorHandler)
+
+	if !ok {
+		t.Fatalf("Expected handler to be type ErrorHandler, got: %#v", handler)
+	}
+
+	if myHandler.LogFile != "" {
+		t.Errorf("Expected '%s' as the default LogFile", "")
+	}
+	if myHandler.LogRoller != nil {
+		t.Errorf("Expected LogRoller to be nil, got: %v", *myHandler.LogRoller)
+	}
+	if !SameNext(myHandler.Next, EmptyNext) {
+		t.Error("'Next' field of handler was not set properly")
+	}
+
+	// Test Startup function
+	if len(c.Startup) == 0 {
+		t.Fatal("Expected 1 startup function, had 0")
+	}
+	err = c.Startup[0]()
+	if myHandler.Log == nil {
+		t.Error("Expected Log to be non-nil after startup because Debug is not enabled")
+	}
+}
+
+func TestErrorsParse(t *testing.T) {
+	tests := []struct {
+		inputErrorsRules     string
+		shouldErr            bool
+		expectedErrorHandler errors.ErrorHandler
+	}{
+		{`errors`, false, errors.ErrorHandler{
+			LogFile: "",
+		}},
+		{`errors errors.txt`, false, errors.ErrorHandler{
+			LogFile: "errors.txt",
+		}},
+		{`errors visible`, false, errors.ErrorHandler{
+			LogFile: "",
+			Debug:   true,
+		}},
+		{`errors { log visible }`, false, errors.ErrorHandler{
+			LogFile: "",
+			Debug:   true,
+		}},
+		{`errors { log errors.txt
+        404 404.html
+        500 500.html
+}`, false, errors.ErrorHandler{
+			LogFile: "errors.txt",
+			ErrorPages: map[int]string{
+				404: "404.html",
+				500: "500.html",
+			},
+		}},
+		{`errors { log errors.txt { size 2 age 10 keep 3 } }`, false, errors.ErrorHandler{
+			LogFile: "errors.txt",
+			LogRoller: &middleware.LogRoller{
+				MaxSize:    2,
+				MaxAge:     10,
+				MaxBackups: 3,
+				LocalTime:  true,
+			},
+		}},
+		{`errors { log errors.txt {
+            size 3
+            age 11
+            keep 5
+        }
+        404 404.html
+        503 503.html
+}`, false, errors.ErrorHandler{
+			LogFile: "errors.txt",
+			ErrorPages: map[int]string{
+				404: "404.html",
+				503: "503.html",
+			},
+			LogRoller: &middleware.LogRoller{
+				MaxSize:    3,
+				MaxAge:     11,
+				MaxBackups: 5,
+				LocalTime:  true,
+			},
+		}},
+	}
+	for i, test := range tests {
+		c := NewTestController(test.inputErrorsRules)
+		actualErrorsRule, err := errorsParse(c)
+
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d didn't error, but it should have", i)
+		} else if err != nil && !test.shouldErr {
+			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
+		}
+		if actualErrorsRule.LogFile != test.expectedErrorHandler.LogFile {
+			t.Errorf("Test %d expected LogFile to be %s, but got %s",
+				i, test.expectedErrorHandler.LogFile, actualErrorsRule.LogFile)
+		}
+		if actualErrorsRule.Debug != test.expectedErrorHandler.Debug {
+			t.Errorf("Test %d expected Debug to be %v, but got %v",
+				i, test.expectedErrorHandler.Debug, actualErrorsRule.Debug)
+		}
+		if actualErrorsRule.LogRoller != nil && test.expectedErrorHandler.LogRoller == nil || actualErrorsRule.LogRoller == nil && test.expectedErrorHandler.LogRoller != nil {
+			t.Fatalf("Test %d expected LogRoller to be %v, but got %v",
+				i, test.expectedErrorHandler.LogRoller, actualErrorsRule.LogRoller)
+		}
+		if len(actualErrorsRule.ErrorPages) != len(test.expectedErrorHandler.ErrorPages) {
+			t.Fatalf("Test %d expected %d no of Error pages, but got %d ",
+				i, len(test.expectedErrorHandler.ErrorPages), len(actualErrorsRule.ErrorPages))
+		}
+		if actualErrorsRule.LogRoller != nil && test.expectedErrorHandler.LogRoller != nil {
+			if actualErrorsRule.LogRoller.Filename != test.expectedErrorHandler.LogRoller.Filename {
+				t.Fatalf("Test %d expected LogRoller Filename to be %s, but got %s",
+					i, test.expectedErrorHandler.LogRoller.Filename, actualErrorsRule.LogRoller.Filename)
+			}
+			if actualErrorsRule.LogRoller.MaxAge != test.expectedErrorHandler.LogRoller.MaxAge {
+				t.Fatalf("Test %d expected LogRoller MaxAge to be %d, but got %d",
+					i, test.expectedErrorHandler.LogRoller.MaxAge, actualErrorsRule.LogRoller.MaxAge)
+			}
+			if actualErrorsRule.LogRoller.MaxBackups != test.expectedErrorHandler.LogRoller.MaxBackups {
+				t.Fatalf("Test %d expected LogRoller MaxBackups to be %d, but got %d",
+					i, test.expectedErrorHandler.LogRoller.MaxBackups, actualErrorsRule.LogRoller.MaxBackups)
+			}
+			if actualErrorsRule.LogRoller.MaxSize != test.expectedErrorHandler.LogRoller.MaxSize {
+				t.Fatalf("Test %d expected LogRoller MaxSize to be %d, but got %d",
+					i, test.expectedErrorHandler.LogRoller.MaxSize, actualErrorsRule.LogRoller.MaxSize)
+			}
+			if actualErrorsRule.LogRoller.LocalTime != test.expectedErrorHandler.LogRoller.LocalTime {
+				t.Fatalf("Test %d expected LogRoller LocalTime to be %t, but got %t",
+					i, test.expectedErrorHandler.LogRoller.LocalTime, actualErrorsRule.LogRoller.LocalTime)
+			}
+		}
+	}
+
+}

caddy/setup/ext.go

@@ -0,0 +1,54 @@
+package setup
+
+import (
+	"os"
+
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/extensions"
+)
+
+// Ext configures a new instance of 'extensions' middleware for clean URLs.
+func Ext(c *Controller) (middleware.Middleware, error) {
+	root := c.Root
+
+	exts, err := extParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	return func(next middleware.Handler) middleware.Handler {
+		return extensions.Ext{
+			Next:       next,
+			Extensions: exts,
+			Root:       root,
+		}
+	}, nil
+}
+
+// extParse sets up an instance of extension middleware
+// from a middleware controller and returns a list of extensions.
+func extParse(c *Controller) ([]string, error) {
+	var exts []string
+
+	for c.Next() {
+		// At least one extension is required
+		if !c.NextArg() {
+			return exts, c.ArgErr()
+		}
+		exts = append(exts, c.Val())
+
+		// Tack on any other extensions that may have been listed
+		exts = append(exts, c.RemainingArgs()...)
+	}
+
+	return exts, nil
+}
+
+// resourceExists returns true if the file specified at
+// root + path exists; false otherwise.
+func resourceExists(root, path string) bool {
+	_, err := os.Stat(root + path)
+	// technically we should use os.IsNotExist(err)
+	// but we don't handle any other kinds of errors anyway
+	return err == nil
+}

caddy/setup/ext_test.go

@@ -0,0 +1,76 @@
+package setup
+
+import (
+	"testing"
+
+	"github.com/mholt/caddy/middleware/extensions"
+)
+
+func TestExt(t *testing.T) {
+	c := NewTestController(`ext .html .htm .php`)
+
+	mid, err := Ext(c)
+
+	if err != nil {
+		t.Errorf("Expected no errors, got: %v", err)
+	}
+
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(extensions.Ext)
+
+	if !ok {
+		t.Fatalf("Expected handler to be type Ext, got: %#v", handler)
+	}
+
+	if myHandler.Extensions[0] != ".html" {
+		t.Errorf("Expected .html in the list of Extensions")
+	}
+	if myHandler.Extensions[1] != ".htm" {
+		t.Errorf("Expected .htm in the list of Extensions")
+	}
+	if myHandler.Extensions[2] != ".php" {
+		t.Errorf("Expected .php in the list of Extensions")
+	}
+	if !SameNext(myHandler.Next, EmptyNext) {
+		t.Error("'Next' field of handler was not set properly")
+	}
+
+}
+
+func TestExtParse(t *testing.T) {
+	tests := []struct {
+		inputExts    string
+		shouldErr    bool
+		expectedExts []string
+	}{
+		{`ext .html .htm .php`, false, []string{".html", ".htm", ".php"}},
+		{`ext .php .html .xml`, false, []string{".php", ".html", ".xml"}},
+		{`ext .txt .php .xml`, false, []string{".txt", ".php", ".xml"}},
+	}
+	for i, test := range tests {
+		c := NewTestController(test.inputExts)
+		actualExts, err := extParse(c)
+
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d didn't error, but it should have", i)
+		} else if err != nil && !test.shouldErr {
+			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
+		}
+
+		if len(actualExts) != len(test.expectedExts) {
+			t.Fatalf("Test %d expected %d rules, but got %d",
+				i, len(test.expectedExts), len(actualExts))
+		}
+		for j, actualExt := range actualExts {
+			if actualExt != test.expectedExts[j] {
+				t.Fatalf("Test %d expected %dth extension to be  %s  , but got %s",
+					i, j, test.expectedExts[j], actualExt)
+			}
+		}
+	}
+
+}

caddy/setup/fastcgi.go

@@ -0,0 +1,110 @@
+package setup
+
+import (
+	"errors"
+	"net/http"
+	"path/filepath"
+
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/fastcgi"
+)
+
+// FastCGI configures a new FastCGI middleware instance.
+func FastCGI(c *Controller) (middleware.Middleware, error) {
+	absRoot, err := filepath.Abs(c.Root)
+	if err != nil {
+		return nil, err
+	}
+
+	rules, err := fastcgiParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	return func(next middleware.Handler) middleware.Handler {
+		return fastcgi.Handler{
+			Next:            next,
+			Rules:           rules,
+			Root:            c.Root,
+			AbsRoot:         absRoot,
+			FileSys:         http.Dir(c.Root),
+			SoftwareName:    c.AppName,
+			SoftwareVersion: c.AppVersion,
+			ServerName:      c.Host,
+			ServerPort:      c.Port,
+		}
+	}, nil
+}
+
+func fastcgiParse(c *Controller) ([]fastcgi.Rule, error) {
+	var rules []fastcgi.Rule
+
+	for c.Next() {
+		var rule fastcgi.Rule
+
+		args := c.RemainingArgs()
+
+		switch len(args) {
+		case 0:
+			return rules, c.ArgErr()
+		case 1:
+			rule.Path = "/"
+			rule.Address = args[0]
+		case 2:
+			rule.Path = args[0]
+			rule.Address = args[1]
+		case 3:
+			rule.Path = args[0]
+			rule.Address = args[1]
+			err := fastcgiPreset(args[2], &rule)
+			if err != nil {
+				return rules, c.Err("Invalid fastcgi rule preset '" + args[2] + "'")
+			}
+		}
+
+		for c.NextBlock() {
+			switch c.Val() {
+			case "ext":
+				if !c.NextArg() {
+					return rules, c.ArgErr()
+				}
+				rule.Ext = c.Val()
+			case "split":
+				if !c.NextArg() {
+					return rules, c.ArgErr()
+				}
+				rule.SplitPath = c.Val()
+			case "index":
+				args := c.RemainingArgs()
+				if len(args) == 0 {
+					return rules, c.ArgErr()
+				}
+				rule.IndexFiles = args
+			case "env":
+				envArgs := c.RemainingArgs()
+				if len(envArgs) < 2 {
+					return rules, c.ArgErr()
+				}
+				rule.EnvVars = append(rule.EnvVars, [2]string{envArgs[0], envArgs[1]})
+			}
+		}
+
+		rules = append(rules, rule)
+	}
+
+	return rules, nil
+}
+
+// fastcgiPreset configures rule according to name. It returns an error if
+// name is not a recognized preset name.
+func fastcgiPreset(name string, rule *fastcgi.Rule) error {
+	switch name {
+	case "php":
+		rule.Ext = ".php"
+		rule.SplitPath = ".php"
+		rule.IndexFiles = []string{"index.php"}
+	default:
+		return errors.New(name + " is not a valid preset name")
+	}
+	return nil
+}

caddy/setup/fastcgi_test.go

@@ -0,0 +1,107 @@
+package setup
+
+import (
+	"fmt"
+	"github.com/mholt/caddy/middleware/fastcgi"
+	"testing"
+)
+
+func TestFastCGI(t *testing.T) {
+
+	c := NewTestController(`fastcgi / 127.0.0.1:9000`)
+
+	mid, err := FastCGI(c)
+
+	if err != nil {
+		t.Errorf("Expected no errors, got: %v", err)
+	}
+
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(fastcgi.Handler)
+
+	if !ok {
+		t.Fatalf("Expected handler to be type , got: %#v", handler)
+	}
+
+	if myHandler.Rules[0].Path != "/" {
+		t.Errorf("Expected / as the Path")
+	}
+	if myHandler.Rules[0].Address != "127.0.0.1:9000" {
+		t.Errorf("Expected 127.0.0.1:9000 as the Address")
+	}
+
+}
+
+func TestFastcgiParse(t *testing.T) {
+	tests := []struct {
+		inputFastcgiConfig    string
+		shouldErr             bool
+		expectedFastcgiConfig []fastcgi.Rule
+	}{
+
+		{`fastcgi /blog 127.0.0.1:9000 php`,
+			false, []fastcgi.Rule{{
+				Path:       "/blog",
+				Address:    "127.0.0.1:9000",
+				Ext:        ".php",
+				SplitPath:  ".php",
+				IndexFiles: []string{"index.php"},
+			}}},
+		{`fastcgi / 127.0.0.1:9001 {
+	              split .html
+	              }`,
+			false, []fastcgi.Rule{{
+				Path:       "/",
+				Address:    "127.0.0.1:9001",
+				Ext:        "",
+				SplitPath:  ".html",
+				IndexFiles: []string{},
+			}}},
+	}
+	for i, test := range tests {
+		c := NewTestController(test.inputFastcgiConfig)
+		actualFastcgiConfigs, err := fastcgiParse(c)
+
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d didn't error, but it should have", i)
+		} else if err != nil && !test.shouldErr {
+			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
+		}
+		if len(actualFastcgiConfigs) != len(test.expectedFastcgiConfig) {
+			t.Fatalf("Test %d expected %d no of FastCGI configs, but got %d ",
+				i, len(test.expectedFastcgiConfig), len(actualFastcgiConfigs))
+		}
+		for j, actualFastcgiConfig := range actualFastcgiConfigs {
+
+			if actualFastcgiConfig.Path != test.expectedFastcgiConfig[j].Path {
+				t.Errorf("Test %d expected %dth FastCGI Path to be  %s  , but got %s",
+					i, j, test.expectedFastcgiConfig[j].Path, actualFastcgiConfig.Path)
+			}
+
+			if actualFastcgiConfig.Address != test.expectedFastcgiConfig[j].Address {
+				t.Errorf("Test %d expected %dth FastCGI Address to be  %s  , but got %s",
+					i, j, test.expectedFastcgiConfig[j].Address, actualFastcgiConfig.Address)
+			}
+
+			if actualFastcgiConfig.Ext != test.expectedFastcgiConfig[j].Ext {
+				t.Errorf("Test %d expected %dth FastCGI Ext to be  %s  , but got %s",
+					i, j, test.expectedFastcgiConfig[j].Ext, actualFastcgiConfig.Ext)
+			}
+
+			if actualFastcgiConfig.SplitPath != test.expectedFastcgiConfig[j].SplitPath {
+				t.Errorf("Test %d expected %dth FastCGI SplitPath to be  %s  , but got %s",
+					i, j, test.expectedFastcgiConfig[j].SplitPath, actualFastcgiConfig.SplitPath)
+			}
+
+			if fmt.Sprint(actualFastcgiConfig.IndexFiles) != fmt.Sprint(test.expectedFastcgiConfig[j].IndexFiles) {
+				t.Errorf("Test %d expected %dth FastCGI IndexFiles to be  %s  , but got %s",
+					i, j, test.expectedFastcgiConfig[j].IndexFiles, actualFastcgiConfig.IndexFiles)
+			}
+		}
+	}
+
+}

caddy/setup/gzip.go

@@ -0,0 +1,95 @@
+package setup
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/gzip"
+)
+
+// Gzip configures a new gzip middleware instance.
+func Gzip(c *Controller) (middleware.Middleware, error) {
+	configs, err := gzipParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	return func(next middleware.Handler) middleware.Handler {
+		return gzip.Gzip{Next: next, Configs: configs}
+	}, nil
+}
+
+func gzipParse(c *Controller) ([]gzip.Config, error) {
+	var configs []gzip.Config
+
+	for c.Next() {
+		config := gzip.Config{}
+
+		pathFilter := gzip.PathFilter{IgnoredPaths: make(gzip.Set)}
+		extFilter := gzip.ExtFilter{Exts: make(gzip.Set)}
+
+		// No extra args expected
+		if len(c.RemainingArgs()) > 0 {
+			return configs, c.ArgErr()
+		}
+
+		for c.NextBlock() {
+			switch c.Val() {
+			case "ext":
+				exts := c.RemainingArgs()
+				if len(exts) == 0 {
+					return configs, c.ArgErr()
+				}
+				for _, e := range exts {
+					if !strings.HasPrefix(e, ".") && e != gzip.ExtWildCard {
+						return configs, fmt.Errorf(`gzip: invalid extension "%v" (must start with dot)`, e)
+					}
+					extFilter.Exts.Add(e)
+				}
+			case "not":
+				paths := c.RemainingArgs()
+				if len(paths) == 0 {
+					return configs, c.ArgErr()
+				}
+				for _, p := range paths {
+					if p == "/" {
+						return configs, fmt.Errorf(`gzip: cannot exclude path "/" - remove directive entirely instead`)
+					}
+					if !strings.HasPrefix(p, "/") {
+						return configs, fmt.Errorf(`gzip: invalid path "%v" (must start with /)`, p)
+					}
+					pathFilter.IgnoredPaths.Add(p)
+				}
+			case "level":
+				if !c.NextArg() {
+					return configs, c.ArgErr()
+				}
+				level, _ := strconv.Atoi(c.Val())
+				config.Level = level
+			default:
+				return configs, c.ArgErr()
+			}
+		}
+
+		config.Filters = []gzip.Filter{}
+
+		// If ignored paths are specified, put in front to filter with path first
+		if len(pathFilter.IgnoredPaths) > 0 {
+			config.Filters = []gzip.Filter{pathFilter}
+		}
+
+		// Then, if extensions are specified, use those to filter.
+		// Otherwise, use default extensions filter.
+		if len(extFilter.Exts) > 0 {
+			config.Filters = append(config.Filters, extFilter)
+		} else {
+			config.Filters = append(config.Filters, gzip.DefaultExtFilter())
+		}
+
+		configs = append(configs, config)
+	}
+
+	return configs, nil
+}

caddy/setup/gzip_test.go

@@ -0,0 +1,86 @@
+package setup
+
+import (
+	"testing"
+
+	"github.com/mholt/caddy/middleware/gzip"
+)
+
+func TestGzip(t *testing.T) {
+	c := NewTestController(`gzip`)
+
+	mid, err := Gzip(c)
+	if err != nil {
+		t.Errorf("Expected no errors, but got: %v", err)
+	}
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(gzip.Gzip)
+	if !ok {
+		t.Fatalf("Expected handler to be type Gzip, got: %#v", handler)
+	}
+
+	if !SameNext(myHandler.Next, EmptyNext) {
+		t.Error("'Next' field of handler was not set properly")
+	}
+
+	tests := []struct {
+		input     string
+		shouldErr bool
+	}{
+		{`gzip {`, true},
+		{`gzip {}`, true},
+		{`gzip a b`, true},
+		{`gzip a {`, true},
+		{`gzip { not f } `, true},
+		{`gzip { not } `, true},
+		{`gzip { not /file
+		 ext .html
+		 level 1
+		} `, false},
+		{`gzip { level 9 } `, false},
+		{`gzip { ext } `, true},
+		{`gzip { ext /f
+		} `, true},
+		{`gzip { not /file
+		 ext .html
+		 level 1
+		}
+		gzip`, false},
+		{`gzip { not /file
+		 ext .html
+		 level 1
+		}
+		gzip { not /file1
+		 ext .htm
+		 level 3
+		}
+		`, false},
+		{`gzip { not /file
+		 ext .html
+		 level 1
+		}
+		gzip { not /file1
+		 ext .htm
+		 level 3
+		}
+		`, false},
+		{`gzip { not /file
+		 ext *
+		 level 1
+		}
+		`, false},
+	}
+	for i, test := range tests {
+		c := NewTestController(test.input)
+		_, err := gzipParse(c)
+		if test.shouldErr && err == nil {
+			t.Errorf("Test %v: Expected error but found nil", i)
+		} else if !test.shouldErr && err != nil {
+			t.Errorf("Test %v: Expected no error but found error: %v", i, err)
+		}
+	}
+}

caddy/setup/headers.go

@@ -0,0 +1,84 @@
+package setup
+
+import (
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/headers"
+)
+
+// Headers configures a new Headers middleware instance.
+func Headers(c *Controller) (middleware.Middleware, error) {
+	rules, err := headersParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	return func(next middleware.Handler) middleware.Handler {
+		return headers.Headers{Next: next, Rules: rules}
+	}, nil
+}
+
+func headersParse(c *Controller) ([]headers.Rule, error) {
+	var rules []headers.Rule
+
+	for c.NextLine() {
+		var head headers.Rule
+		var isNewPattern bool
+
+		if !c.NextArg() {
+			return rules, c.ArgErr()
+		}
+		pattern := c.Val()
+
+		// See if we already have a definition for this Path pattern...
+		for _, h := range rules {
+			if h.Path == pattern {
+				head = h
+				break
+			}
+		}
+
+		// ...otherwise, this is a new pattern
+		if head.Path == "" {
+			head.Path = pattern
+			isNewPattern = true
+		}
+
+		for c.NextBlock() {
+			// A block of headers was opened...
+
+			h := headers.Header{Name: c.Val()}
+
+			if c.NextArg() {
+				h.Value = c.Val()
+			}
+
+			head.Headers = append(head.Headers, h)
+		}
+		if c.NextArg() {
+			// ... or single header was defined as an argument instead.
+
+			h := headers.Header{Name: c.Val()}
+
+			h.Value = c.Val()
+
+			if c.NextArg() {
+				h.Value = c.Val()
+			}
+
+			head.Headers = append(head.Headers, h)
+		}
+
+		if isNewPattern {
+			rules = append(rules, head)
+		} else {
+			for i := 0; i < len(rules); i++ {
+				if rules[i].Path == pattern {
+					rules[i] = head
+					break
+				}
+			}
+		}
+	}
+
+	return rules, nil
+}

caddy/setup/headers_test.go

@@ -0,0 +1,85 @@
+package setup
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/mholt/caddy/middleware/headers"
+)
+
+func TestHeaders(t *testing.T) {
+	c := NewTestController(`header / Foo Bar`)
+
+	mid, err := Headers(c)
+	if err != nil {
+		t.Errorf("Expected no errors, but got: %v", err)
+	}
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(headers.Headers)
+	if !ok {
+		t.Fatalf("Expected handler to be type Headers, got: %#v", handler)
+	}
+
+	if !SameNext(myHandler.Next, EmptyNext) {
+		t.Error("'Next' field of handler was not set properly")
+	}
+}
+
+func TestHeadersParse(t *testing.T) {
+	tests := []struct {
+		input     string
+		shouldErr bool
+		expected  []headers.Rule
+	}{
+		{`header /foo Foo "Bar Baz"`,
+			false, []headers.Rule{
+				{Path: "/foo", Headers: []headers.Header{
+					{"Foo", "Bar Baz"},
+				}},
+			}},
+		{`header /bar { Foo "Bar Baz" Baz Qux }`,
+			false, []headers.Rule{
+				{Path: "/bar", Headers: []headers.Header{
+					{"Foo", "Bar Baz"},
+					{"Baz", "Qux"},
+				}},
+			}},
+	}
+
+	for i, test := range tests {
+		c := NewTestController(test.input)
+		actual, err := headersParse(c)
+
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d didn't error, but it should have", i)
+		} else if err != nil && !test.shouldErr {
+			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
+		}
+
+		if len(actual) != len(test.expected) {
+			t.Fatalf("Test %d expected %d rules, but got %d",
+				i, len(test.expected), len(actual))
+		}
+
+		for j, expectedRule := range test.expected {
+			actualRule := actual[j]
+
+			if actualRule.Path != expectedRule.Path {
+				t.Errorf("Test %d, rule %d: Expected path %s, but got %s",
+					i, j, expectedRule.Path, actualRule.Path)
+			}
+
+			expectedHeaders := fmt.Sprintf("%v", expectedRule.Headers)
+			actualHeaders := fmt.Sprintf("%v", actualRule.Headers)
+
+			if actualHeaders != expectedHeaders {
+				t.Errorf("Test %d, rule %d: Expected headers %s, but got %s",
+					i, j, expectedHeaders, actualHeaders)
+			}
+		}
+	}
+}

caddy/setup/internal.go

@@ -0,0 +1,31 @@
+package setup
+
+import (
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/inner"
+)
+
+// Internal configures a new Internal middleware instance.
+func Internal(c *Controller) (middleware.Middleware, error) {
+	paths, err := internalParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	return func(next middleware.Handler) middleware.Handler {
+		return inner.Internal{Next: next, Paths: paths}
+	}, nil
+}
+
+func internalParse(c *Controller) ([]string, error) {
+	var paths []string
+
+	for c.Next() {
+		if !c.NextArg() {
+			return paths, c.ArgErr()
+		}
+		paths = append(paths, c.Val())
+	}
+
+	return paths, nil
+}

caddy/setup/internal_test.go

@@ -0,0 +1,72 @@
+package setup
+
+import (
+	"testing"
+
+	"github.com/mholt/caddy/middleware/inner"
+)
+
+func TestInternal(t *testing.T) {
+	c := NewTestController(`internal /internal`)
+
+	mid, err := Internal(c)
+
+	if err != nil {
+		t.Errorf("Expected no errors, got: %v", err)
+	}
+
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(inner.Internal)
+
+	if !ok {
+		t.Fatalf("Expected handler to be type Internal, got: %#v", handler)
+	}
+
+	if myHandler.Paths[0] != "/internal" {
+		t.Errorf("Expected internal in the list of internal Paths")
+	}
+
+	if !SameNext(myHandler.Next, EmptyNext) {
+		t.Error("'Next' field of handler was not set properly")
+	}
+
+}
+
+func TestInternalParse(t *testing.T) {
+	tests := []struct {
+		inputInternalPaths    string
+		shouldErr             bool
+		expectedInternalPaths []string
+	}{
+		{`internal /internal`, false, []string{"/internal"}},
+
+		{`internal /internal1
+		  internal /internal2`, false, []string{"/internal1", "/internal2"}},
+	}
+	for i, test := range tests {
+		c := NewTestController(test.inputInternalPaths)
+		actualInternalPaths, err := internalParse(c)
+
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d didn't error, but it should have", i)
+		} else if err != nil && !test.shouldErr {
+			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
+		}
+
+		if len(actualInternalPaths) != len(test.expectedInternalPaths) {
+			t.Fatalf("Test %d expected %d InternalPaths, but got %d",
+				i, len(test.expectedInternalPaths), len(actualInternalPaths))
+		}
+		for j, actualInternalPath := range actualInternalPaths {
+			if actualInternalPath != test.expectedInternalPaths[j] {
+				t.Fatalf("Test %d expected %dth Internal Path to be  %s  , but got %s",
+					i, j, test.expectedInternalPaths[j], actualInternalPath)
+			}
+		}
+	}
+
+}

caddy/setup/log.go

@@ -0,0 +1,130 @@
+package setup
+
+import (
+	"io"
+	"log"
+	"os"
+
+	"github.com/hashicorp/go-syslog"
+	"github.com/mholt/caddy/middleware"
+	caddylog "github.com/mholt/caddy/middleware/log"
+	"github.com/mholt/caddy/server"
+)
+
+// Log sets up the logging middleware.
+func Log(c *Controller) (middleware.Middleware, error) {
+	rules, err := logParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	// Open the log files for writing when the server starts
+	c.Startup = append(c.Startup, func() error {
+		for i := 0; i < len(rules); i++ {
+			var err error
+			var writer io.Writer
+
+			if rules[i].OutputFile == "stdout" {
+				writer = os.Stdout
+			} else if rules[i].OutputFile == "stderr" {
+				writer = os.Stderr
+			} else if rules[i].OutputFile == "syslog" {
+				writer, err = gsyslog.NewLogger(gsyslog.LOG_INFO, "LOCAL0", "caddy")
+				if err != nil {
+					return err
+				}
+			} else {
+				var file *os.File
+				file, err = os.OpenFile(rules[i].OutputFile, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0644)
+				if err != nil {
+					return err
+				}
+				if rules[i].Roller != nil {
+					file.Close()
+					rules[i].Roller.Filename = rules[i].OutputFile
+					writer = rules[i].Roller.GetLogWriter()
+				} else {
+					writer = file
+				}
+			}
+
+			rules[i].Log = log.New(writer, "", 0)
+		}
+
+		return nil
+	})
+
+	return func(next middleware.Handler) middleware.Handler {
+		return caddylog.Logger{Next: next, Rules: rules, ErrorFunc: server.DefaultErrorFunc}
+	}, nil
+}
+
+func logParse(c *Controller) ([]caddylog.Rule, error) {
+	var rules []caddylog.Rule
+
+	for c.Next() {
+		args := c.RemainingArgs()
+
+		var logRoller *middleware.LogRoller
+		if c.NextBlock() {
+			if c.Val() == "rotate" {
+				if c.NextArg() {
+					if c.Val() == "{" {
+						var err error
+						logRoller, err = parseRoller(c)
+						if err != nil {
+							return nil, err
+						}
+						// This part doesn't allow having something after the rotate block
+						if c.Next() {
+							if c.Val() != "}" {
+								return nil, c.ArgErr()
+							}
+						}
+					}
+				}
+			}
+		}
+		if len(args) == 0 {
+			// Nothing specified; use defaults
+			rules = append(rules, caddylog.Rule{
+				PathScope:  "/",
+				OutputFile: caddylog.DefaultLogFilename,
+				Format:     caddylog.DefaultLogFormat,
+				Roller:     logRoller,
+			})
+		} else if len(args) == 1 {
+			// Only an output file specified
+			rules = append(rules, caddylog.Rule{
+				PathScope:  "/",
+				OutputFile: args[0],
+				Format:     caddylog.DefaultLogFormat,
+				Roller:     logRoller,
+			})
+		} else {
+			// Path scope, output file, and maybe a format specified
+
+			format := caddylog.DefaultLogFormat
+
+			if len(args) > 2 {
+				switch args[2] {
+				case "{common}":
+					format = caddylog.CommonLogFormat
+				case "{combined}":
+					format = caddylog.CombinedLogFormat
+				default:
+					format = args[2]
+				}
+			}
+
+			rules = append(rules, caddylog.Rule{
+				PathScope:  args[0],
+				OutputFile: args[1],
+				Format:     format,
+				Roller:     logRoller,
+			})
+		}
+	}
+
+	return rules, nil
+}

caddy/setup/log_test.go

@@ -0,0 +1,175 @@
+package setup
+
+import (
+	"testing"
+
+	"github.com/mholt/caddy/middleware"
+	caddylog "github.com/mholt/caddy/middleware/log"
+)
+
+func TestLog(t *testing.T) {
+
+	c := NewTestController(`log`)
+
+	mid, err := Log(c)
+
+	if err != nil {
+		t.Errorf("Expected no errors, got: %v", err)
+	}
+
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(caddylog.Logger)
+
+	if !ok {
+		t.Fatalf("Expected handler to be type Logger, got: %#v", handler)
+	}
+
+	if myHandler.Rules[0].PathScope != "/" {
+		t.Errorf("Expected / as the default PathScope")
+	}
+	if myHandler.Rules[0].OutputFile != caddylog.DefaultLogFilename {
+		t.Errorf("Expected %s as the default OutputFile", caddylog.DefaultLogFilename)
+	}
+	if myHandler.Rules[0].Format != caddylog.DefaultLogFormat {
+		t.Errorf("Expected %s as the default Log Format", caddylog.DefaultLogFormat)
+	}
+	if myHandler.Rules[0].Roller != nil {
+		t.Errorf("Expected Roller to be nil, got: %v", *myHandler.Rules[0].Roller)
+	}
+	if !SameNext(myHandler.Next, EmptyNext) {
+		t.Error("'Next' field of handler was not set properly")
+	}
+
+}
+
+func TestLogParse(t *testing.T) {
+	tests := []struct {
+		inputLogRules    string
+		shouldErr        bool
+		expectedLogRules []caddylog.Rule
+	}{
+		{`log`, false, []caddylog.Rule{{
+			PathScope:  "/",
+			OutputFile: caddylog.DefaultLogFilename,
+			Format:     caddylog.DefaultLogFormat,
+		}}},
+		{`log log.txt`, false, []caddylog.Rule{{
+			PathScope:  "/",
+			OutputFile: "log.txt",
+			Format:     caddylog.DefaultLogFormat,
+		}}},
+		{`log /api log.txt`, false, []caddylog.Rule{{
+			PathScope:  "/api",
+			OutputFile: "log.txt",
+			Format:     caddylog.DefaultLogFormat,
+		}}},
+		{`log /serve stdout`, false, []caddylog.Rule{{
+			PathScope:  "/serve",
+			OutputFile: "stdout",
+			Format:     caddylog.DefaultLogFormat,
+		}}},
+		{`log /myapi log.txt {common}`, false, []caddylog.Rule{{
+			PathScope:  "/myapi",
+			OutputFile: "log.txt",
+			Format:     caddylog.CommonLogFormat,
+		}}},
+		{`log /test accesslog.txt {combined}`, false, []caddylog.Rule{{
+			PathScope:  "/test",
+			OutputFile: "accesslog.txt",
+			Format:     caddylog.CombinedLogFormat,
+		}}},
+		{`log /api1 log.txt
+		  log /api2 accesslog.txt {combined}`, false, []caddylog.Rule{{
+			PathScope:  "/api1",
+			OutputFile: "log.txt",
+			Format:     caddylog.DefaultLogFormat,
+		}, {
+			PathScope:  "/api2",
+			OutputFile: "accesslog.txt",
+			Format:     caddylog.CombinedLogFormat,
+		}}},
+		{`log /api3 stdout {host}
+		  log /api4 log.txt {when}`, false, []caddylog.Rule{{
+			PathScope:  "/api3",
+			OutputFile: "stdout",
+			Format:     "{host}",
+		}, {
+			PathScope:  "/api4",
+			OutputFile: "log.txt",
+			Format:     "{when}",
+		}}},
+		{`log access.log { rotate { size 2 age 10 keep 3 } }`, false, []caddylog.Rule{{
+			PathScope:  "/",
+			OutputFile: "access.log",
+			Format:     caddylog.DefaultLogFormat,
+			Roller: &middleware.LogRoller{
+				MaxSize:    2,
+				MaxAge:     10,
+				MaxBackups: 3,
+				LocalTime:  true,
+			},
+		}}},
+	}
+	for i, test := range tests {
+		c := NewTestController(test.inputLogRules)
+		actualLogRules, err := logParse(c)
+
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d didn't error, but it should have", i)
+		} else if err != nil && !test.shouldErr {
+			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
+		}
+		if len(actualLogRules) != len(test.expectedLogRules) {
+			t.Fatalf("Test %d expected %d no of Log rules, but got %d ",
+				i, len(test.expectedLogRules), len(actualLogRules))
+		}
+		for j, actualLogRule := range actualLogRules {
+
+			if actualLogRule.PathScope != test.expectedLogRules[j].PathScope {
+				t.Errorf("Test %d expected %dth LogRule PathScope to be  %s  , but got %s",
+					i, j, test.expectedLogRules[j].PathScope, actualLogRule.PathScope)
+			}
+
+			if actualLogRule.OutputFile != test.expectedLogRules[j].OutputFile {
+				t.Errorf("Test %d expected %dth LogRule OutputFile to be  %s  , but got %s",
+					i, j, test.expectedLogRules[j].OutputFile, actualLogRule.OutputFile)
+			}
+
+			if actualLogRule.Format != test.expectedLogRules[j].Format {
+				t.Errorf("Test %d expected %dth LogRule Format to be  %s  , but got %s",
+					i, j, test.expectedLogRules[j].Format, actualLogRule.Format)
+			}
+			if actualLogRule.Roller != nil && test.expectedLogRules[j].Roller == nil || actualLogRule.Roller == nil && test.expectedLogRules[j].Roller != nil {
+				t.Fatalf("Test %d expected %dth LogRule Roller to be %v, but got %v",
+					i, j, test.expectedLogRules[j].Roller, actualLogRule.Roller)
+			}
+			if actualLogRule.Roller != nil && test.expectedLogRules[j].Roller != nil {
+				if actualLogRule.Roller.Filename != test.expectedLogRules[j].Roller.Filename {
+					t.Fatalf("Test %d expected %dth LogRule Roller Filename to be %s, but got %s",
+						i, j, test.expectedLogRules[j].Roller.Filename, actualLogRule.Roller.Filename)
+				}
+				if actualLogRule.Roller.MaxAge != test.expectedLogRules[j].Roller.MaxAge {
+					t.Fatalf("Test %d expected %dth LogRule Roller MaxAge to be %d, but got %d",
+						i, j, test.expectedLogRules[j].Roller.MaxAge, actualLogRule.Roller.MaxAge)
+				}
+				if actualLogRule.Roller.MaxBackups != test.expectedLogRules[j].Roller.MaxBackups {
+					t.Fatalf("Test %d expected %dth LogRule Roller MaxBackups to be %d, but got %d",
+						i, j, test.expectedLogRules[j].Roller.MaxBackups, actualLogRule.Roller.MaxBackups)
+				}
+				if actualLogRule.Roller.MaxSize != test.expectedLogRules[j].Roller.MaxSize {
+					t.Fatalf("Test %d expected %dth LogRule Roller MaxSize to be %d, but got %d",
+						i, j, test.expectedLogRules[j].Roller.MaxSize, actualLogRule.Roller.MaxSize)
+				}
+				if actualLogRule.Roller.LocalTime != test.expectedLogRules[j].Roller.LocalTime {
+					t.Fatalf("Test %d expected %dth LogRule Roller LocalTime to be %t, but got %t",
+						i, j, test.expectedLogRules[j].Roller.LocalTime, actualLogRule.Roller.LocalTime)
+				}
+			}
+		}
+	}
+
+}

caddy/setup/markdown.go

@@ -0,0 +1,152 @@
+package setup
+
+import (
+	"net/http"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/markdown"
+	"github.com/russross/blackfriday"
+)
+
+// Markdown configures a new Markdown middleware instance.
+func Markdown(c *Controller) (middleware.Middleware, error) {
+	mdconfigs, err := markdownParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	md := markdown.Markdown{
+		Root:       c.Root,
+		FileSys:    http.Dir(c.Root),
+		Configs:    mdconfigs,
+		IndexFiles: []string{"index.md"},
+	}
+
+	// Sweep the whole path at startup to at least generate link index, maybe generate static site
+	c.Startup = append(c.Startup, func() error {
+		for i := range mdconfigs {
+			cfg := mdconfigs[i]
+
+			// Generate link index and static files (if enabled)
+			if err := markdown.GenerateStatic(md, cfg); err != nil {
+				return err
+			}
+
+			// Watch file changes for static site generation if not in development mode.
+			if !cfg.Development {
+				markdown.Watch(md, cfg, markdown.DefaultInterval)
+			}
+		}
+
+		return nil
+	})
+
+	return func(next middleware.Handler) middleware.Handler {
+		md.Next = next
+		return md
+	}, nil
+}
+
+func markdownParse(c *Controller) ([]*markdown.Config, error) {
+	var mdconfigs []*markdown.Config
+
+	for c.Next() {
+		md := &markdown.Config{
+			Renderer:    blackfriday.HtmlRenderer(0, "", ""),
+			Templates:   make(map[string]string),
+			StaticFiles: make(map[string]string),
+		}
+
+		// Get the path scope
+		if !c.NextArg() || c.Val() == "{" {
+			return mdconfigs, c.ArgErr()
+		}
+		md.PathScope = c.Val()
+
+		// Load any other configuration parameters
+		for c.NextBlock() {
+			if err := loadParams(c, md); err != nil {
+				return mdconfigs, err
+			}
+		}
+
+		// If no extensions were specified, assume .md
+		if len(md.Extensions) == 0 {
+			md.Extensions = []string{".md"}
+		}
+
+		mdconfigs = append(mdconfigs, md)
+	}
+
+	return mdconfigs, nil
+}
+
+func loadParams(c *Controller, mdc *markdown.Config) error {
+	switch c.Val() {
+	case "ext":
+		exts := c.RemainingArgs()
+		if len(exts) == 0 {
+			return c.ArgErr()
+		}
+		mdc.Extensions = append(mdc.Extensions, exts...)
+		return nil
+	case "css":
+		if !c.NextArg() {
+			return c.ArgErr()
+		}
+		mdc.Styles = append(mdc.Styles, c.Val())
+		return nil
+	case "js":
+		if !c.NextArg() {
+			return c.ArgErr()
+		}
+		mdc.Scripts = append(mdc.Scripts, c.Val())
+		return nil
+	case "template":
+		tArgs := c.RemainingArgs()
+		switch len(tArgs) {
+		case 0:
+			return c.ArgErr()
+		case 1:
+			if _, ok := mdc.Templates[markdown.DefaultTemplate]; ok {
+				return c.Err("only one default template is allowed, use alias.")
+			}
+			fpath := filepath.ToSlash(filepath.Clean(c.Root + string(filepath.Separator) + tArgs[0]))
+			mdc.Templates[markdown.DefaultTemplate] = fpath
+			return nil
+		case 2:
+			fpath := filepath.ToSlash(filepath.Clean(c.Root + string(filepath.Separator) + tArgs[1]))
+			mdc.Templates[tArgs[0]] = fpath
+			return nil
+		default:
+			return c.ArgErr()
+		}
+	case "sitegen":
+		if c.NextArg() {
+			mdc.StaticDir = path.Join(c.Root, c.Val())
+		} else {
+			mdc.StaticDir = path.Join(c.Root, markdown.DefaultStaticDir)
+		}
+		if c.NextArg() {
+			// only 1 argument allowed
+			return c.ArgErr()
+		}
+		return nil
+	case "dev":
+		if c.NextArg() {
+			mdc.Development = strings.ToLower(c.Val()) == "true"
+		} else {
+			mdc.Development = true
+		}
+		if c.NextArg() {
+			// only 1 argument allowed
+			return c.ArgErr()
+		}
+		return nil
+	default:
+		return c.Err("Expected valid markdown configuration property")
+	}
+}

caddy/setup/markdown_test.go

@@ -0,0 +1,184 @@
+package setup
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/markdown"
+)
+
+func TestMarkdown(t *testing.T) {
+
+	c := NewTestController(`markdown /blog`)
+
+	mid, err := Markdown(c)
+
+	if err != nil {
+		t.Errorf("Expected no errors, got: %v", err)
+	}
+
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(markdown.Markdown)
+
+	if !ok {
+		t.Fatalf("Expected handler to be type Markdown, got: %#v", handler)
+	}
+
+	if myHandler.Configs[0].PathScope != "/blog" {
+		t.Errorf("Expected /blog as the Path Scope")
+	}
+	if fmt.Sprint(myHandler.Configs[0].Extensions) != fmt.Sprint([]string{".md"}) {
+		t.Errorf("Expected .md  as the Default Extension")
+	}
+}
+
+func TestMarkdownStaticGen(t *testing.T) {
+	c := NewTestController(`markdown /blog {
+	ext .md
+	template tpl_with_include.html
+	sitegen
+}`)
+
+	c.Root = "./testdata"
+	mid, err := Markdown(c)
+
+	if err != nil {
+		t.Errorf("Expected no errors, got: %v", err)
+	}
+
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	for _, start := range c.Startup {
+		err := start()
+		if err != nil {
+			t.Errorf("Startup error: %v", err)
+		}
+	}
+
+	next := middleware.HandlerFunc(func(w http.ResponseWriter, r *http.Request) (int, error) {
+		t.Fatalf("Next shouldn't be called")
+		return 0, nil
+	})
+	hndlr := mid(next)
+	mkdwn, ok := hndlr.(markdown.Markdown)
+	if !ok {
+		t.Fatalf("Was expecting a markdown.Markdown but got %T", hndlr)
+	}
+
+	expectedStaticFiles := map[string]string{"/blog/first_post.md": "testdata/generated_site/blog/first_post.md/index.html"}
+	if fmt.Sprint(expectedStaticFiles) != fmt.Sprint(mkdwn.Configs[0].StaticFiles) {
+		t.Fatalf("Test expected StaticFiles to be  %s, but got %s",
+			fmt.Sprint(expectedStaticFiles), fmt.Sprint(mkdwn.Configs[0].StaticFiles))
+	}
+
+	filePath := "testdata/generated_site/blog/first_post.md/index.html"
+	if _, err := os.Stat(filePath); err != nil {
+		t.Fatalf("An error occured when getting the file information: %v", err)
+	}
+
+	html, err := ioutil.ReadFile(filePath)
+	if err != nil {
+		t.Fatalf("An error occured when getting the file content: %v", err)
+	}
+
+	expectedBody := []byte(`<!DOCTYPE html>
+<html>
+<head>
+<title>first_post</title>
+</head>
+<body>
+<h1>Header title</h1>
+
+<h1>Test h1</h1>
+
+</body>
+</html>
+`)
+
+	if !bytes.Equal(html, expectedBody) {
+		t.Fatalf("Expected file content: %s got: %s", string(expectedBody), string(html))
+	}
+
+	fp := filepath.Join(c.Root, markdown.DefaultStaticDir)
+	if err = os.RemoveAll(fp); err != nil {
+		t.Errorf("Error while removing the generated static files: %v", err)
+	}
+}
+
+func TestMarkdownParse(t *testing.T) {
+	tests := []struct {
+		inputMarkdownConfig    string
+		shouldErr              bool
+		expectedMarkdownConfig []markdown.Config
+	}{
+
+		{`markdown /blog {
+	ext .md .txt
+	css /resources/css/blog.css
+	js  /resources/js/blog.js
+}`, false, []markdown.Config{{
+			PathScope:  "/blog",
+			Extensions: []string{".md", ".txt"},
+			Styles:     []string{"/resources/css/blog.css"},
+			Scripts:    []string{"/resources/js/blog.js"},
+		}}},
+		{`markdown /blog {
+	ext .md
+	template tpl_with_include.html
+	sitegen
+}`, false, []markdown.Config{{
+			PathScope:  "/blog",
+			Extensions: []string{".md"},
+			Templates:  map[string]string{markdown.DefaultTemplate: "testdata/tpl_with_include.html"},
+			StaticDir:  markdown.DefaultStaticDir,
+		}}},
+	}
+	for i, test := range tests {
+		c := NewTestController(test.inputMarkdownConfig)
+		c.Root = "./testdata"
+		actualMarkdownConfigs, err := markdownParse(c)
+
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d didn't error, but it should have", i)
+		} else if err != nil && !test.shouldErr {
+			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
+		}
+		if len(actualMarkdownConfigs) != len(test.expectedMarkdownConfig) {
+			t.Fatalf("Test %d expected %d no of WebSocket configs, but got %d ",
+				i, len(test.expectedMarkdownConfig), len(actualMarkdownConfigs))
+		}
+		for j, actualMarkdownConfig := range actualMarkdownConfigs {
+
+			if actualMarkdownConfig.PathScope != test.expectedMarkdownConfig[j].PathScope {
+				t.Errorf("Test %d expected %dth Markdown PathScope to be  %s  , but got %s",
+					i, j, test.expectedMarkdownConfig[j].PathScope, actualMarkdownConfig.PathScope)
+			}
+
+			if fmt.Sprint(actualMarkdownConfig.Styles) != fmt.Sprint(test.expectedMarkdownConfig[j].Styles) {
+				t.Errorf("Test %d expected %dth Markdown Config Styles to be  %s  , but got %s",
+					i, j, fmt.Sprint(test.expectedMarkdownConfig[j].Styles), fmt.Sprint(actualMarkdownConfig.Styles))
+			}
+			if fmt.Sprint(actualMarkdownConfig.Scripts) != fmt.Sprint(test.expectedMarkdownConfig[j].Scripts) {
+				t.Errorf("Test %d expected %dth Markdown Config Scripts to be  %s  , but got %s",
+					i, j, fmt.Sprint(test.expectedMarkdownConfig[j].Scripts), fmt.Sprint(actualMarkdownConfig.Scripts))
+			}
+			if fmt.Sprint(actualMarkdownConfig.Templates) != fmt.Sprint(test.expectedMarkdownConfig[j].Templates) {
+				t.Errorf("Test %d expected %dth Markdown Config Templates to be  %s  , but got %s",
+					i, j, fmt.Sprint(test.expectedMarkdownConfig[j].Templates), fmt.Sprint(actualMarkdownConfig.Templates))
+			}
+		}
+	}
+
+}

caddy/setup/mime.go

@@ -0,0 +1,62 @@
+package setup
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/mime"
+)
+
+// Mime configures a new mime middleware instance.
+func Mime(c *Controller) (middleware.Middleware, error) {
+	configs, err := mimeParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	return func(next middleware.Handler) middleware.Handler {
+		return mime.Mime{Next: next, Configs: configs}
+	}, nil
+}
+
+func mimeParse(c *Controller) ([]mime.Config, error) {
+	var configs []mime.Config
+
+	for c.Next() {
+		// At least one extension is required
+
+		args := c.RemainingArgs()
+		switch len(args) {
+		case 2:
+			if err := validateExt(args[0]); err != nil {
+				return configs, err
+			}
+			configs = append(configs, mime.Config{Ext: args[0], ContentType: args[1]})
+		case 1:
+			return configs, c.ArgErr()
+		case 0:
+			for c.NextBlock() {
+				ext := c.Val()
+				if err := validateExt(ext); err != nil {
+					return configs, err
+				}
+				if !c.NextArg() {
+					return configs, c.ArgErr()
+				}
+				configs = append(configs, mime.Config{Ext: ext, ContentType: c.Val()})
+			}
+		}
+
+	}
+
+	return configs, nil
+}
+
+// validateExt checks for valid file name extension.
+func validateExt(ext string) error {
+	if !strings.HasPrefix(ext, ".") {
+		return fmt.Errorf(`mime: invalid extension "%v" (must start with dot)`, ext)
+	}
+	return nil
+}

caddy/setup/mime_test.go

@@ -0,0 +1,59 @@
+package setup
+
+import (
+	"testing"
+
+	"github.com/mholt/caddy/middleware/mime"
+)
+
+func TestMime(t *testing.T) {
+
+	c := NewTestController(`mime .txt text/plain`)
+
+	mid, err := Mime(c)
+	if err != nil {
+		t.Errorf("Expected no errors, but got: %v", err)
+	}
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(mime.Mime)
+	if !ok {
+		t.Fatalf("Expected handler to be type Mime, got: %#v", handler)
+	}
+
+	if !SameNext(myHandler.Next, EmptyNext) {
+		t.Error("'Next' field of handler was not set properly")
+	}
+
+	tests := []struct {
+		input     string
+		shouldErr bool
+	}{
+		{`mime {`, true},
+		{`mime {}`, true},
+		{`mime a b`, true},
+		{`mime a {`, true},
+		{`mime { txt f } `, true},
+		{`mime { html } `, true},
+		{`mime {
+		 .html text/html
+		 .txt text/plain
+		} `, false},
+		{`mime { .html text/html } `, false},
+		{`mime { .html
+		} `, true},
+		{`mime .txt text/plain`, false},
+	}
+	for i, test := range tests {
+		c := NewTestController(test.input)
+		m, err := mimeParse(c)
+		if test.shouldErr && err == nil {
+			t.Errorf("Test %v: Expected error but found nil %v", i, m)
+		} else if !test.shouldErr && err != nil {
+			t.Errorf("Test %v: Expected no error but found error: %v", i, err)
+		}
+	}
+}

caddy/setup/proxy.go

@@ -0,0 +1,17 @@
+package setup
+
+import (
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/proxy"
+)
+
+// Proxy configures a new Proxy middleware instance.
+func Proxy(c *Controller) (middleware.Middleware, error) {
+	upstreams, err := proxy.NewStaticUpstreams(c.Dispenser)
+	if err != nil {
+		return nil, err
+	}
+	return func(next middleware.Handler) middleware.Handler {
+		return proxy.Proxy{Next: next, Upstreams: upstreams}
+	}, nil
+}

caddy/setup/redir.go

@@ -0,0 +1,173 @@
+package setup
+
+import (
+	"net/http"
+
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/redirect"
+)
+
+// Redir configures a new Redirect middleware instance.
+func Redir(c *Controller) (middleware.Middleware, error) {
+	rules, err := redirParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	return func(next middleware.Handler) middleware.Handler {
+		return redirect.Redirect{Next: next, Rules: rules}
+	}, nil
+}
+
+func redirParse(c *Controller) ([]redirect.Rule, error) {
+	var redirects []redirect.Rule
+
+	// setRedirCode sets the redirect code for rule if it can, or returns an error
+	setRedirCode := func(code string, rule *redirect.Rule) error {
+		if code == "meta" {
+			rule.Meta = true
+		} else if codeNumber, ok := httpRedirs[code]; ok {
+			rule.Code = codeNumber
+		} else {
+			return c.Errf("Invalid redirect code '%v'", code)
+		}
+		return nil
+	}
+
+	// checkAndSaveRule checks the rule for validity (except the redir code)
+	// and saves it if it's valid, or returns an error.
+	checkAndSaveRule := func(rule redirect.Rule) error {
+		if rule.FromPath == rule.To {
+			return c.Err("'from' and 'to' values of redirect rule cannot be the same")
+		}
+
+		for _, otherRule := range redirects {
+			if otherRule.FromPath == rule.FromPath {
+				return c.Errf("rule with duplicate 'from' value: %s -> %s", otherRule.FromPath, otherRule.To)
+			}
+		}
+
+		redirects = append(redirects, rule)
+		return nil
+	}
+
+	for c.Next() {
+		args := c.RemainingArgs()
+
+		var hadOptionalBlock bool
+		for c.NextBlock() {
+			hadOptionalBlock = true
+
+			var rule redirect.Rule
+
+			if c.Config.TLS.Enabled {
+				rule.FromScheme = "https"
+			} else {
+				rule.FromScheme = "http"
+			}
+
+			// Set initial redirect code
+			// BUG: If the code is specified for a whole block and that code is invalid,
+			// the line number will appear on the first line inside the block, even if that
+			// line overwrites the block-level code with a valid redirect code. The program
+			// still functions correctly, but the line number in the error reporting is
+			// misleading to the user.
+			if len(args) == 1 {
+				err := setRedirCode(args[0], &rule)
+				if err != nil {
+					return redirects, err
+				}
+			} else {
+				rule.Code = http.StatusMovedPermanently // default code
+			}
+
+			// RemainingArgs only gets the values after the current token, but in our
+			// case we want to include the current token to get an accurate count.
+			insideArgs := append([]string{c.Val()}, c.RemainingArgs()...)
+
+			switch len(insideArgs) {
+			case 1:
+				// To specified (catch-all redirect)
+				// Not sure why user is doing this in a table, as it causes all other redirects to be ignored.
+				// As such, this feature remains undocumented.
+				rule.FromPath = "/"
+				rule.To = insideArgs[0]
+			case 2:
+				// From and To specified
+				rule.FromPath = insideArgs[0]
+				rule.To = insideArgs[1]
+			case 3:
+				// From, To, and Code specified
+				rule.FromPath = insideArgs[0]
+				rule.To = insideArgs[1]
+				err := setRedirCode(insideArgs[2], &rule)
+				if err != nil {
+					return redirects, err
+				}
+			default:
+				return redirects, c.ArgErr()
+			}
+
+			err := checkAndSaveRule(rule)
+			if err != nil {
+				return redirects, err
+			}
+		}
+
+		if !hadOptionalBlock {
+			var rule redirect.Rule
+
+			if c.Config.TLS.Enabled {
+				rule.FromScheme = "https"
+			} else {
+				rule.FromScheme = "http"
+			}
+
+			rule.Code = http.StatusMovedPermanently // default
+
+			switch len(args) {
+			case 1:
+				// To specified (catch-all redirect)
+				rule.FromPath = "/"
+				rule.To = args[0]
+			case 2:
+				// To and Code specified (catch-all redirect)
+				rule.FromPath = "/"
+				rule.To = args[0]
+				err := setRedirCode(args[1], &rule)
+				if err != nil {
+					return redirects, err
+				}
+			case 3:
+				// From, To, and Code specified
+				rule.FromPath = args[0]
+				rule.To = args[1]
+				err := setRedirCode(args[2], &rule)
+				if err != nil {
+					return redirects, err
+				}
+			default:
+				return redirects, c.ArgErr()
+			}
+
+			err := checkAndSaveRule(rule)
+			if err != nil {
+				return redirects, err
+			}
+		}
+	}
+
+	return redirects, nil
+}
+
+// httpRedirs is a list of supported HTTP redirect codes.
+var httpRedirs = map[string]int{
+	"300": http.StatusMultipleChoices,
+	"301": http.StatusMovedPermanently,
+	"302": http.StatusFound, // (NOT CORRECT for "Temporary Redirect", see 307)
+	"303": http.StatusSeeOther,
+	"304": http.StatusNotModified,
+	"305": http.StatusUseProxy,
+	"307": http.StatusTemporaryRedirect,
+	"308": 308, // Permanent Redirect
+}

caddy/setup/rewrite.go

@@ -0,0 +1,79 @@
+package setup
+
+import (
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/rewrite"
+)
+
+// Rewrite configures a new Rewrite middleware instance.
+func Rewrite(c *Controller) (middleware.Middleware, error) {
+	rewrites, err := rewriteParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	return func(next middleware.Handler) middleware.Handler {
+		return rewrite.Rewrite{Next: next, Rules: rewrites}
+	}, nil
+}
+
+func rewriteParse(c *Controller) ([]rewrite.Rule, error) {
+	var simpleRules []rewrite.Rule
+	var regexpRules []rewrite.Rule
+
+	for c.Next() {
+		var rule rewrite.Rule
+		var err error
+		var base = "/"
+		var pattern, to string
+		var ext []string
+
+		args := c.RemainingArgs()
+
+		switch len(args) {
+		case 2:
+			rule = rewrite.NewSimpleRule(args[0], args[1])
+			simpleRules = append(simpleRules, rule)
+		case 1:
+			base = args[0]
+			fallthrough
+		case 0:
+			for c.NextBlock() {
+				switch c.Val() {
+				case "r", "regexp":
+					if !c.NextArg() {
+						return nil, c.ArgErr()
+					}
+					pattern = c.Val()
+				case "to":
+					if !c.NextArg() {
+						return nil, c.ArgErr()
+					}
+					to = c.Val()
+				case "ext":
+					args1 := c.RemainingArgs()
+					if len(args1) == 0 {
+						return nil, c.ArgErr()
+					}
+					ext = args1
+				default:
+					return nil, c.ArgErr()
+				}
+			}
+			// ensure pattern and to are specified
+			if pattern == "" || to == "" {
+				return nil, c.ArgErr()
+			}
+			if rule, err = rewrite.NewRegexpRule(base, pattern, to, ext); err != nil {
+				return nil, err
+			}
+			regexpRules = append(regexpRules, rule)
+		default:
+			return nil, c.ArgErr()
+		}
+
+	}
+
+	// put simple rules in front to avoid regexp computation for them
+	return append(simpleRules, regexpRules...), nil
+}

caddy/setup/rewrite_test.go

@@ -0,0 +1,185 @@
+package setup
+
+import (
+	"testing"
+
+	"fmt"
+	"regexp"
+
+	"github.com/mholt/caddy/middleware/rewrite"
+)
+
+func TestRewrite(t *testing.T) {
+	c := NewTestController(`rewrite /from /to`)
+
+	mid, err := Rewrite(c)
+	if err != nil {
+		t.Errorf("Expected no errors, but got: %v", err)
+	}
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(rewrite.Rewrite)
+	if !ok {
+		t.Fatalf("Expected handler to be type Rewrite, got: %#v", handler)
+	}
+
+	if !SameNext(myHandler.Next, EmptyNext) {
+		t.Error("'Next' field of handler was not set properly")
+	}
+
+	if len(myHandler.Rules) != 1 {
+		t.Errorf("Expected handler to have %d rule, has %d instead", 1, len(myHandler.Rules))
+	}
+}
+
+func TestRewriteParse(t *testing.T) {
+	simpleTests := []struct {
+		input     string
+		shouldErr bool
+		expected  []rewrite.Rule
+	}{
+		{`rewrite /from /to`, false, []rewrite.Rule{
+			rewrite.SimpleRule{From: "/from", To: "/to"},
+		}},
+		{`rewrite /from /to
+		  rewrite a b`, false, []rewrite.Rule{
+			rewrite.SimpleRule{From: "/from", To: "/to"},
+			rewrite.SimpleRule{From: "a", To: "b"},
+		}},
+		{`rewrite a`, true, []rewrite.Rule{}},
+		{`rewrite`, true, []rewrite.Rule{}},
+		{`rewrite a b c`, true, []rewrite.Rule{
+			rewrite.SimpleRule{From: "a", To: "b"},
+		}},
+	}
+
+	for i, test := range simpleTests {
+		c := NewTestController(test.input)
+		actual, err := rewriteParse(c)
+
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d didn't error, but it should have", i)
+		} else if err != nil && !test.shouldErr {
+			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
+		} else if err != nil && test.shouldErr {
+			continue
+		}
+
+		if len(actual) != len(test.expected) {
+			t.Fatalf("Test %d expected %d rules, but got %d",
+				i, len(test.expected), len(actual))
+		}
+
+		for j, e := range test.expected {
+			actualRule := actual[j].(rewrite.SimpleRule)
+			expectedRule := e.(rewrite.SimpleRule)
+
+			if actualRule.From != expectedRule.From {
+				t.Errorf("Test %d, rule %d: Expected From=%s, got %s",
+					i, j, expectedRule.From, actualRule.From)
+			}
+
+			if actualRule.To != expectedRule.To {
+				t.Errorf("Test %d, rule %d: Expected To=%s, got %s",
+					i, j, expectedRule.To, actualRule.To)
+			}
+		}
+	}
+
+	regexpTests := []struct {
+		input     string
+		shouldErr bool
+		expected  []rewrite.Rule
+	}{
+		{`rewrite {
+			r	.*
+			to	/to
+		 }`, false, []rewrite.Rule{
+			&rewrite.RegexpRule{Base: "/", To: "/to", Regexp: regexp.MustCompile(".*")},
+		}},
+		{`rewrite {
+			regexp	.*
+			to		/to
+			ext		/ html txt
+		 }`, false, []rewrite.Rule{
+			&rewrite.RegexpRule{Base: "/", To: "/to", Exts: []string{"/", "html", "txt"}, Regexp: regexp.MustCompile(".*")},
+		}},
+		{`rewrite /path {
+			r	rr
+			to	/dest
+		 }
+		 rewrite / {
+		 	regexp	[a-z]+
+		 	to 		/to
+		 }
+		 `, false, []rewrite.Rule{
+			&rewrite.RegexpRule{Base: "/path", To: "/dest", Regexp: regexp.MustCompile("rr")},
+			&rewrite.RegexpRule{Base: "/", To: "/to", Regexp: regexp.MustCompile("[a-z]+")},
+		}},
+		{`rewrite {
+			to	/to
+		 }`, true, []rewrite.Rule{
+			&rewrite.RegexpRule{},
+		}},
+		{`rewrite {
+			r	.*
+		 }`, true, []rewrite.Rule{
+			&rewrite.RegexpRule{},
+		}},
+		{`rewrite {
+
+		 }`, true, []rewrite.Rule{
+			&rewrite.RegexpRule{},
+		}},
+		{`rewrite /`, true, []rewrite.Rule{
+			&rewrite.RegexpRule{},
+		}},
+	}
+
+	for i, test := range regexpTests {
+		c := NewTestController(test.input)
+		actual, err := rewriteParse(c)
+
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d didn't error, but it should have", i)
+		} else if err != nil && !test.shouldErr {
+			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
+		} else if err != nil && test.shouldErr {
+			continue
+		}
+
+		if len(actual) != len(test.expected) {
+			t.Fatalf("Test %d expected %d rules, but got %d",
+				i, len(test.expected), len(actual))
+		}
+
+		for j, e := range test.expected {
+			actualRule := actual[j].(*rewrite.RegexpRule)
+			expectedRule := e.(*rewrite.RegexpRule)
+
+			if actualRule.Base != expectedRule.Base {
+				t.Errorf("Test %d, rule %d: Expected Base=%s, got %s",
+					i, j, expectedRule.Base, actualRule.Base)
+			}
+
+			if actualRule.To != expectedRule.To {
+				t.Errorf("Test %d, rule %d: Expected To=%s, got %s",
+					i, j, expectedRule.To, actualRule.To)
+			}
+
+			if fmt.Sprint(actualRule.Exts) != fmt.Sprint(expectedRule.Exts) {
+				t.Errorf("Test %d, rule %d: Expected Ext=%v, got %v",
+					i, j, expectedRule.To, actualRule.To)
+			}
+
+			if actualRule.String() != expectedRule.String() {
+				t.Errorf("Test %d, rule %d: Expected Pattern=%s, got %s",
+					i, j, expectedRule.String(), actualRule.String())
+			}
+		}
+	}
+
+}

caddy/setup/roller.go

@@ -0,0 +1,40 @@
+package setup
+
+import (
+	"strconv"
+
+	"github.com/mholt/caddy/middleware"
+)
+
+func parseRoller(c *Controller) (*middleware.LogRoller, error) {
+	var size, age, keep int
+	// This is kind of a hack to support nested blocks:
+	// As we are already in a block: either log or errors,
+	// c.nesting > 0 but, as soon as c meets a }, it thinks
+	// the block is over and return false for c.NextBlock.
+	for c.NextBlock() {
+		what := c.Val()
+		if !c.NextArg() {
+			return nil, c.ArgErr()
+		}
+		value := c.Val()
+		var err error
+		switch what {
+		case "size":
+			size, err = strconv.Atoi(value)
+		case "age":
+			age, err = strconv.Atoi(value)
+		case "keep":
+			keep, err = strconv.Atoi(value)
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
+	return &middleware.LogRoller{
+		MaxSize:    size,
+		MaxAge:     age,
+		MaxBackups: keep,
+		LocalTime:  true,
+	}, nil
+}

caddy/setup/root.go

@@ -0,0 +1,32 @@
+package setup
+
+import (
+	"log"
+	"os"
+
+	"github.com/mholt/caddy/middleware"
+)
+
+// Root sets up the root file path of the server.
+func Root(c *Controller) (middleware.Middleware, error) {
+	for c.Next() {
+		if !c.NextArg() {
+			return nil, c.ArgErr()
+		}
+		c.Root = c.Val()
+	}
+
+	// Check if root path exists
+	_, err := os.Stat(c.Root)
+	if err != nil {
+		if os.IsNotExist(err) {
+			// Allow this, because the folder might appear later.
+			// But make sure the user knows!
+			log.Printf("[WARNING] Root path does not exist: %s", c.Root)
+		} else {
+			return nil, c.Errf("Unable to access root path '%s': %v", c.Root, err)
+		}
+	}
+
+	return nil, nil
+}

caddy/setup/root_test.go

@@ -0,0 +1,108 @@
+package setup
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestRoot(t *testing.T) {
+
+	// Predefined error substrings
+	parseErrContent := "Parse error:"
+	unableToAccessErrContent := "Unable to access root path"
+
+	existingDirPath, err := getTempDirPath()
+	if err != nil {
+		t.Fatalf("BeforeTest: Failed to find an existing directory for testing! Error was: %v", err)
+	}
+
+	nonExistingDir := filepath.Join(existingDirPath, "highly_unlikely_to_exist_dir")
+
+	existingFile, err := ioutil.TempFile("", "root_test")
+	if err != nil {
+		t.Fatalf("BeforeTest: Failed to create temp file for testing! Error was: %v", err)
+	}
+	defer func() {
+		existingFile.Close()
+		os.Remove(existingFile.Name())
+	}()
+
+	inaccessiblePath := getInaccessiblePath(existingFile.Name())
+
+	tests := []struct {
+		input              string
+		shouldErr          bool
+		expectedRoot       string // expected root, set to the controller. Empty for negative cases.
+		expectedErrContent string // substring from the expected error. Empty for positive cases.
+	}{
+		// positive
+		{
+			fmt.Sprintf(`root %s`, nonExistingDir), false, nonExistingDir, "",
+		},
+		{
+			fmt.Sprintf(`root %s`, existingDirPath), false, existingDirPath, "",
+		},
+		// negative
+		{
+			`root `, true, "", parseErrContent,
+		},
+		{
+			fmt.Sprintf(`root %s`, inaccessiblePath), true, "", unableToAccessErrContent,
+		},
+		{
+			fmt.Sprintf(`root {
+				%s
+			}`, existingDirPath), true, "", parseErrContent,
+		},
+	}
+
+	for i, test := range tests {
+		c := NewTestController(test.input)
+		mid, err := Root(c)
+
+		if test.shouldErr && err == nil {
+			t.Errorf("Test %d: Expected error but found %s for input %s", i, err, test.input)
+		}
+
+		if err != nil {
+			if !test.shouldErr {
+				t.Errorf("Test %d: Expected no error but found one for input %s. Error was: %v", i, test.input, err)
+			}
+
+			if !strings.Contains(err.Error(), test.expectedErrContent) {
+				t.Errorf("Test %d: Expected error to contain: %v, found error: %v, input: %s", i, test.expectedErrContent, err, test.input)
+			}
+		}
+
+		// the Root method always returns a nil middleware
+		if mid != nil {
+			t.Errorf("Middware, returned from Root() was not nil: %v", mid)
+		}
+
+		// check c.Root only if we are in a positive test.
+		if !test.shouldErr && test.expectedRoot != c.Root {
+			t.Errorf("Root not correctly set for input %s. Expected: %s, actual: %s", test.input, test.expectedRoot, c.Root)
+		}
+	}
+}
+
+// getTempDirPath returnes the path to the system temp directory. If it does not exists - an error is returned.
+func getTempDirPath() (string, error) {
+	tempDir := os.TempDir()
+
+	_, err := os.Stat(tempDir)
+	if err != nil {
+		return "", err
+	}
+
+	return tempDir, nil
+}
+
+func getInaccessiblePath(file string) string {
+	// null byte in filename is not allowed on Windows AND unix
+	return filepath.Join("C:", "file\x00name")
+}

caddy/setup/startupshutdown.go

@@ -0,0 +1,64 @@
+package setup
+
+import (
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/mholt/caddy/middleware"
+)
+
+// Startup registers a startup callback to execute during server start.
+func Startup(c *Controller) (middleware.Middleware, error) {
+	return nil, registerCallback(c, &c.Startup)
+}
+
+// Shutdown registers a shutdown callback to execute during process exit.
+func Shutdown(c *Controller) (middleware.Middleware, error) {
+	return nil, registerCallback(c, &c.Shutdown)
+}
+
+// registerCallback registers a callback function to execute by
+// using c to parse the line. It appends the callback function
+// to the list of callback functions passed in by reference.
+func registerCallback(c *Controller, list *[]func() error) error {
+	var funcs []func() error
+
+	for c.Next() {
+		args := c.RemainingArgs()
+		if len(args) == 0 {
+			return c.ArgErr()
+		}
+
+		nonblock := false
+		if len(args) > 1 && args[len(args)-1] == "&" {
+			// Run command in background; non-blocking
+			nonblock = true
+			args = args[:len(args)-1]
+		}
+
+		command, args, err := middleware.SplitCommandAndArgs(strings.Join(args, " "))
+		if err != nil {
+			return c.Err(err.Error())
+		}
+
+		fn := func() error {
+			cmd := exec.Command(command, args...)
+			cmd.Stdin = os.Stdin
+			cmd.Stdout = os.Stdout
+			cmd.Stderr = os.Stderr
+
+			if nonblock {
+				return cmd.Start()
+			}
+			return cmd.Run()
+		}
+
+		funcs = append(funcs, fn)
+	}
+
+	return c.OncePerServerBlock(func() error {
+		*list = append(*list, funcs...)
+		return nil
+	})
+}

caddy/setup/startupshutdown_test.go

@@ -0,0 +1,58 @@
+package setup
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"testing"
+	"time"
+)
+
+// The Startup function's tests are symmetrical to Shutdown tests,
+// because the Startup and Shutdown functions share virtually the
+// same functionality
+func TestStartup(t *testing.T) {
+
+	tempDirPath, err := getTempDirPath()
+	if err != nil {
+		t.Fatalf("BeforeTest: Failed to find an existing directory for testing! Error was: %v", err)
+	}
+
+	testDir := filepath.Join(tempDirPath, "temp_dir_for_testing_startupshutdown.go")
+	osSenitiveTestDir := filepath.FromSlash(testDir)
+
+	exec.Command("rm", "-r", osSenitiveTestDir).Run() // removes osSenitiveTestDir from the OS's temp directory, if the osSenitiveTestDir already exists
+
+	tests := []struct {
+		input              string
+		shouldExecutionErr bool
+		shouldRemoveErr    bool
+	}{
+		// test case #0 tests proper functionality blocking commands
+		{"startup mkdir " + osSenitiveTestDir, false, false},
+
+		// test case #1 tests proper functionality of non-blocking commands
+		{"startup mkdir " + osSenitiveTestDir + " &", false, true},
+
+		// test case #2 tests handling of non-existant commands
+		{"startup " + strconv.Itoa(int(time.Now().UnixNano())), true, true},
+	}
+
+	for i, test := range tests {
+		c := NewTestController(test.input)
+		_, err = Startup(c)
+		if err != nil {
+			t.Errorf("Expected no errors, got: %v", err)
+		}
+		err = c.Startup[0]()
+		if err != nil && !test.shouldExecutionErr {
+			t.Errorf("Test %d recieved an error of:\n%v", i, err)
+		}
+		err = os.Remove(osSenitiveTestDir)
+		if err != nil && !test.shouldRemoveErr {
+			t.Errorf("Test %d recieved an error of:\n%v", i, err)
+		}
+
+	}
+}

caddy/setup/templates.go

@@ -0,0 +1,90 @@
+package setup
+
+import (
+	"net/http"
+
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/templates"
+)
+
+// Templates configures a new Templates middleware instance.
+func Templates(c *Controller) (middleware.Middleware, error) {
+	rules, err := templatesParse(c)
+	if err != nil {
+		return nil, err
+	}
+
+	tmpls := templates.Templates{
+		Rules:   rules,
+		Root:    c.Root,
+		FileSys: http.Dir(c.Root),
+	}
+
+	return func(next middleware.Handler) middleware.Handler {
+		tmpls.Next = next
+		return tmpls
+	}, nil
+}
+
+func templatesParse(c *Controller) ([]templates.Rule, error) {
+	var rules []templates.Rule
+
+	for c.Next() {
+		var rule templates.Rule
+
+		rule.Path = defaultTemplatePath
+		rule.Extensions = defaultTemplateExtensions
+
+		args := c.RemainingArgs()
+
+		switch len(args) {
+		case 0:
+			// Optional block
+			for c.NextBlock() {
+				switch c.Val() {
+				case "path":
+					args := c.RemainingArgs()
+					if len(args) != 1 {
+						return nil, c.ArgErr()
+					}
+					rule.Path = args[0]
+
+				case "ext":
+					args := c.RemainingArgs()
+					if len(args) == 0 {
+						return nil, c.ArgErr()
+					}
+					rule.Extensions = args
+
+				case "between":
+					args := c.RemainingArgs()
+					if len(args) != 2 {
+						return nil, c.ArgErr()
+					}
+					rule.Delims[0] = args[0]
+					rule.Delims[1] = args[1]
+				}
+			}
+		default:
+			// First argument would be the path
+			rule.Path = args[0]
+
+			// Any remaining arguments are extensions
+			rule.Extensions = args[1:]
+			if len(rule.Extensions) == 0 {
+				rule.Extensions = defaultTemplateExtensions
+			}
+		}
+
+		for _, ext := range rule.Extensions {
+			rule.IndexFiles = append(rule.IndexFiles, "index"+ext)
+		}
+
+		rules = append(rules, rule)
+	}
+	return rules, nil
+}
+
+const defaultTemplatePath = "/"
+
+var defaultTemplateExtensions = []string{".html", ".htm", ".tmpl", ".tpl", ".txt"}

caddy/setup/templates_test.go

@@ -0,0 +1,112 @@
+package setup
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/mholt/caddy/middleware/templates"
+)
+
+func TestTemplates(t *testing.T) {
+
+	c := NewTestController(`templates`)
+
+	mid, err := Templates(c)
+
+	if err != nil {
+		t.Errorf("Expected no errors, got: %v", err)
+	}
+
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(templates.Templates)
+
+	if !ok {
+		t.Fatalf("Expected handler to be type Templates, got: %#v", handler)
+	}
+
+	if myHandler.Rules[0].Path != defaultTemplatePath {
+		t.Errorf("Expected / as the default Path")
+	}
+	if fmt.Sprint(myHandler.Rules[0].Extensions) != fmt.Sprint(defaultTemplateExtensions) {
+		t.Errorf("Expected %v to be the Default Extensions", defaultTemplateExtensions)
+	}
+	var indexFiles []string
+	for _, extension := range defaultTemplateExtensions {
+		indexFiles = append(indexFiles, "index"+extension)
+	}
+	if fmt.Sprint(myHandler.Rules[0].IndexFiles) != fmt.Sprint(indexFiles) {
+		t.Errorf("Expected %v to be the Default Index files", indexFiles)
+	}
+	if myHandler.Rules[0].Delims != [2]string{} {
+		t.Errorf("Expected %v to be the Default Delims", [2]string{})
+	}
+}
+
+func TestTemplatesParse(t *testing.T) {
+	tests := []struct {
+		inputTemplateConfig    string
+		shouldErr              bool
+		expectedTemplateConfig []templates.Rule
+	}{
+		{`templates /api1`, false, []templates.Rule{{
+			Path:       "/api1",
+			Extensions: defaultTemplateExtensions,
+			Delims:     [2]string{},
+		}}},
+		{`templates /api2 .txt .htm`, false, []templates.Rule{{
+			Path:       "/api2",
+			Extensions: []string{".txt", ".htm"},
+			Delims:     [2]string{},
+		}}},
+
+		{`templates /api3 .htm .html
+		  templates /api4 .txt .tpl `, false, []templates.Rule{{
+			Path:       "/api3",
+			Extensions: []string{".htm", ".html"},
+			Delims:     [2]string{},
+		}, {
+			Path:       "/api4",
+			Extensions: []string{".txt", ".tpl"},
+			Delims:     [2]string{},
+		}}},
+		{`templates {
+				path /api5
+				ext .html
+				between {% %}
+			}`, false, []templates.Rule{{
+			Path:       "/api5",
+			Extensions: []string{".html"},
+			Delims:     [2]string{"{%", "%}"},
+		}}},
+	}
+	for i, test := range tests {
+		c := NewTestController(test.inputTemplateConfig)
+		actualTemplateConfigs, err := templatesParse(c)
+
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d didn't error, but it should have", i)
+		} else if err != nil && !test.shouldErr {
+			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
+		}
+		if len(actualTemplateConfigs) != len(test.expectedTemplateConfig) {
+			t.Fatalf("Test %d expected %d no of Template configs, but got %d ",
+				i, len(test.expectedTemplateConfig), len(actualTemplateConfigs))
+		}
+		for j, actualTemplateConfig := range actualTemplateConfigs {
+
+			if actualTemplateConfig.Path != test.expectedTemplateConfig[j].Path {
+				t.Errorf("Test %d expected %dth Template Config Path to be  %s  , but got %s",
+					i, j, test.expectedTemplateConfig[j].Path, actualTemplateConfig.Path)
+			}
+
+			if fmt.Sprint(actualTemplateConfig.Extensions) != fmt.Sprint(test.expectedTemplateConfig[j].Extensions) {
+				t.Errorf("Expected %v to be the  Extensions , but got %v instead", test.expectedTemplateConfig[j].Extensions, actualTemplateConfig.Extensions)
+			}
+		}
+	}
+
+}

caddy/setup/testdata/blog/first_post.md

@@ -0,0 +1 @@
+# Test h1

caddy/setup/testdata/header.html

@@ -0,0 +1 @@
+<h1>Header title</h1>

caddy/setup/testdata/tpl_with_include.html

@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>{{.Doc.title}}</title>
+</head>
+<body>
+{{.Include "header.html"}}
+{{.Doc.body}}
+</body>
+</html>

caddy/setup/tls.go

@@ -0,0 +1,161 @@
+package setup
+
+import (
+	"crypto/tls"
+	"log"
+	"strings"
+
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/server"
+)
+
+// TLS sets up the TLS configuration (but does not activate Let's Encrypt; that is handled elsewhere).
+func TLS(c *Controller) (middleware.Middleware, error) {
+	if c.Port == "http" {
+		c.TLS.Enabled = false
+		log.Printf("[WARNING] TLS disabled for %s://%s. To force TLS over the plaintext HTTP port, "+
+			"specify port 80 explicitly (https://%s:80).", c.Port, c.Host, c.Host)
+	} else {
+		c.TLS.Enabled = true // they had a tls directive, so assume it's on unless we confirm otherwise later
+	}
+
+	for c.Next() {
+		args := c.RemainingArgs()
+		switch len(args) {
+		case 1:
+			c.TLS.LetsEncryptEmail = args[0]
+
+			// user can force-disable LE activation this way
+			if c.TLS.LetsEncryptEmail == "off" {
+				c.TLS.Enabled = false
+			}
+		case 2:
+			c.TLS.Certificate = args[0]
+			c.TLS.Key = args[1]
+
+			// manual HTTPS configuration without port specified should be
+			// served on the HTTPS port; that is what user would expect, and
+			// makes it consistent with how the letsencrypt package works.
+			if c.Port == "" {
+				c.Port = "https"
+			}
+		default:
+			return nil, c.ArgErr()
+		}
+
+		// Optional block
+		for c.NextBlock() {
+			switch c.Val() {
+			case "protocols":
+				args := c.RemainingArgs()
+				if len(args) != 2 {
+					return nil, c.ArgErr()
+				}
+				value, ok := supportedProtocols[strings.ToLower(args[0])]
+				if !ok {
+					return nil, c.Errf("Wrong protocol name or protocol not supported '%s'", c.Val())
+				}
+				c.TLS.ProtocolMinVersion = value
+				value, ok = supportedProtocols[strings.ToLower(args[1])]
+				if !ok {
+					return nil, c.Errf("Wrong protocol name or protocol not supported '%s'", c.Val())
+				}
+				c.TLS.ProtocolMaxVersion = value
+			case "ciphers":
+				for c.NextArg() {
+					value, ok := supportedCiphersMap[strings.ToUpper(c.Val())]
+					if !ok {
+						return nil, c.Errf("Wrong cipher name or cipher not supported '%s'", c.Val())
+					}
+					c.TLS.Ciphers = append(c.TLS.Ciphers, value)
+				}
+			case "clients":
+				c.TLS.ClientCerts = c.RemainingArgs()
+				if len(c.TLS.ClientCerts) == 0 {
+					return nil, c.ArgErr()
+				}
+			default:
+				return nil, c.Errf("Unknown keyword '%s'", c.Val())
+			}
+		}
+	}
+
+	SetDefaultTLSParams(c.Config)
+
+	return nil, nil
+}
+
+// SetDefaultTLSParams sets the default TLS cipher suites, protocol versions and server preferences
+// of a server.Config if they were not previously set.
+func SetDefaultTLSParams(c *server.Config) {
+	// If no ciphers provided, use all that Caddy supports for the protocol
+	if len(c.TLS.Ciphers) == 0 {
+		c.TLS.Ciphers = supportedCiphers
+	}
+
+	// Not a cipher suite, but still important for mitigating protocol downgrade attacks
+	c.TLS.Ciphers = append(c.TLS.Ciphers, tls.TLS_FALLBACK_SCSV)
+
+	// Set default protocol min and max versions - must balance compatibility and security
+	if c.TLS.ProtocolMinVersion == 0 {
+		c.TLS.ProtocolMinVersion = tls.VersionTLS10
+	}
+	if c.TLS.ProtocolMaxVersion == 0 {
+		c.TLS.ProtocolMaxVersion = tls.VersionTLS12
+	}
+
+	// Prefer server cipher suites
+	c.TLS.PreferServerCipherSuites = true
+}
+
+// Map of supported protocols
+// SSLv3 will be not supported in future release
+// HTTP/2 only supports TLS 1.2 and higher
+var supportedProtocols = map[string]uint16{
+	"ssl3.0": tls.VersionSSL30,
+	"tls1.0": tls.VersionTLS10,
+	"tls1.1": tls.VersionTLS11,
+	"tls1.2": tls.VersionTLS12,
+}
+
+// Map of supported ciphers, used only for parsing config.
+//
+// Note that, at time of writing, HTTP/2 blacklists 276 cipher suites,
+// including all but two of the suites below (the two GCM suites).
+// See https://http2.github.io/http2-spec/#BadCipherSuites
+//
+// TLS_FALLBACK_SCSV is not in this list because we manually ensure
+// it is always added (even though it is not technically a cipher suite).
+//
+// This map, like any map, is NOT ORDERED. Do not range over this map.
+var supportedCiphersMap = map[string]uint16{
+	"ECDHE-RSA-AES128-GCM-SHA256":   tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+	"ECDHE-ECDSA-AES128-GCM-SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+	"ECDHE-RSA-AES128-CBC-SHA":      tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+	"ECDHE-RSA-AES256-CBC-SHA":      tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+	"ECDHE-ECDSA-AES256-CBC-SHA":    tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+	"ECDHE-ECDSA-AES128-CBC-SHA":    tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+	"RSA-AES128-CBC-SHA":            tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+	"RSA-AES256-CBC-SHA":            tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+	"ECDHE-RSA-3DES-EDE-CBC-SHA":    tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+	"RSA-3DES-EDE-CBC-SHA":          tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
+}
+
+// List of supported cipher suites in descending order of preference.
+// Ordering is very important! Getting the wrong order will break
+// mainstream clients, especially with HTTP/2.
+//
+// Note that TLS_FALLBACK_SCSV is not in this list since it is always
+// added manually.
+var supportedCiphers = []uint16{
+	tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+	tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+	tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+	tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+	tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+	tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+	tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+	tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+	tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+	tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
+}

caddy/setup/tls_test.go

@@ -0,0 +1,153 @@
+package setup
+
+import (
+	"crypto/tls"
+	"testing"
+)
+
+func TestTLSParseBasic(t *testing.T) {
+	c := NewTestController(`tls cert.pem key.pem`)
+
+	_, err := TLS(c)
+	if err != nil {
+		t.Errorf("Expected no errors, got: %v", err)
+	}
+
+	// Basic checks
+	if c.TLS.Certificate != "cert.pem" {
+		t.Errorf("Expected certificate arg to be 'cert.pem', was '%s'", c.TLS.Certificate)
+	}
+	if c.TLS.Key != "key.pem" {
+		t.Errorf("Expected key arg to be 'key.pem', was '%s'", c.TLS.Key)
+	}
+	if !c.TLS.Enabled {
+		t.Error("Expected TLS Enabled=true, but was false")
+	}
+
+	// Security defaults
+	if c.TLS.ProtocolMinVersion != tls.VersionTLS10 {
+		t.Errorf("Expected 'tls1.0 (0x0301)' as ProtocolMinVersion, got %#v", c.TLS.ProtocolMinVersion)
+	}
+	if c.TLS.ProtocolMaxVersion != tls.VersionTLS12 {
+		t.Errorf("Expected 'tls1.2 (0x0303)' as ProtocolMaxVersion, got %v", c.TLS.ProtocolMaxVersion)
+	}
+
+	// Cipher checks
+	expectedCiphers := []uint16{
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+		tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+		tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+		tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+		tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+		tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+		tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+		tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+		tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,
+		tls.TLS_FALLBACK_SCSV,
+	}
+
+	// Ensure count is correct (plus one for TLS_FALLBACK_SCSV)
+	if len(c.TLS.Ciphers) != len(supportedCiphers)+1 {
+		t.Errorf("Expected %v Ciphers (including TLS_FALLBACK_SCSV), got %v",
+			len(supportedCiphers)+1, len(c.TLS.Ciphers))
+	}
+
+	// Ensure ordering is correct
+	for i, actual := range c.TLS.Ciphers {
+		if actual != expectedCiphers[i] {
+			t.Errorf("Expected cipher in position %d to be %0x, got %0x", i, expectedCiphers[i], actual)
+		}
+	}
+
+	if !c.TLS.PreferServerCipherSuites {
+		t.Error("Expected PreferServerCipherSuites = true, but was false")
+	}
+}
+
+func TestTLSParseIncompleteParams(t *testing.T) {
+	c := NewTestController(`tls`)
+
+	_, err := TLS(c)
+	if err == nil {
+		t.Errorf("Expected errors (first check), but no error returned")
+	}
+}
+
+func TestTLSParseWithOptionalParams(t *testing.T) {
+	params := `tls cert.crt cert.key {
+            protocols ssl3.0 tls1.2
+            ciphers RSA-3DES-EDE-CBC-SHA RSA-AES256-CBC-SHA ECDHE-RSA-AES128-GCM-SHA256
+        }`
+	c := NewTestController(params)
+
+	_, err := TLS(c)
+	if err != nil {
+		t.Errorf("Expected no errors, got: %v", err)
+	}
+
+	if c.TLS.ProtocolMinVersion != tls.VersionSSL30 {
+		t.Errorf("Expected 'ssl3.0 (0x0300)' as ProtocolMinVersion, got %#v", c.TLS.ProtocolMinVersion)
+	}
+
+	if c.TLS.ProtocolMaxVersion != tls.VersionTLS12 {
+		t.Errorf("Expected 'tls1.2 (0x0302)' as ProtocolMaxVersion, got %#v", c.TLS.ProtocolMaxVersion)
+	}
+
+	if len(c.TLS.Ciphers)-1 != 3 {
+		t.Errorf("Expected 3 Ciphers (not including TLS_FALLBACK_SCSV), got %v", len(c.TLS.Ciphers))
+	}
+}
+
+func TestTLSParseWithWrongOptionalParams(t *testing.T) {
+	// Test protocols wrong params
+	params := `tls cert.crt cert.key {
+			protocols ssl tls
+		}`
+	c := NewTestController(params)
+	_, err := TLS(c)
+	if err == nil {
+		t.Errorf("Expected errors, but no error returned")
+	}
+
+	// Test ciphers wrong params
+	params = `tls cert.crt cert.key {
+			ciphers not-valid-cipher
+		}`
+	c = NewTestController(params)
+	_, err = TLS(c)
+	if err == nil {
+		t.Errorf("Expected errors, but no error returned")
+	}
+}
+
+func TestTLSParseWithClientAuth(t *testing.T) {
+	params := `tls cert.crt cert.key {
+			clients client_ca.crt client2_ca.crt
+		}`
+	c := NewTestController(params)
+	_, err := TLS(c)
+	if err != nil {
+		t.Errorf("Expected no errors, got: %v", err)
+	}
+
+	if count := len(c.TLS.ClientCerts); count != 2 {
+		t.Fatalf("Expected two client certs, had %d", count)
+	}
+	if actual := c.TLS.ClientCerts[0]; actual != "client_ca.crt" {
+		t.Errorf("Expected first client cert file to be '%s', but was '%s'", "client_ca.crt", actual)
+	}
+	if actual := c.TLS.ClientCerts[1]; actual != "client2_ca.crt" {
+		t.Errorf("Expected second client cert file to be '%s', but was '%s'", "client2_ca.crt", actual)
+	}
+
+	// Test missing client cert file
+	params = `tls cert.crt cert.key {
+			clients
+		}`
+	c = NewTestController(params)
+	_, err = TLS(c)
+	if err == nil {
+		t.Errorf("Expected an error, but no error returned")
+	}
+}

caddy/setup/websocket.go

@@ -0,0 +1,87 @@
+package setup
+
+import (
+	"github.com/mholt/caddy/middleware"
+	"github.com/mholt/caddy/middleware/websocket"
+)
+
+// WebSocket configures a new WebSocket middleware instance.
+func WebSocket(c *Controller) (middleware.Middleware, error) {
+
+	websocks, err := webSocketParse(c)
+	if err != nil {
+		return nil, err
+	}
+	websocket.GatewayInterface = c.AppName + "-CGI/1.1"
+	websocket.ServerSoftware = c.AppName + "/" + c.AppVersion
+
+	return func(next middleware.Handler) middleware.Handler {
+		return websocket.WebSocket{Next: next, Sockets: websocks}
+	}, nil
+}
+
+func webSocketParse(c *Controller) ([]websocket.Config, error) {
+	var websocks []websocket.Config
+	var respawn bool
+
+	optionalBlock := func() (hadBlock bool, err error) {
+		for c.NextBlock() {
+			hadBlock = true
+			if c.Val() == "respawn" {
+				respawn = true
+			} else {
+				return true, c.Err("Expected websocket configuration parameter in block")
+			}
+		}
+		return
+	}
+
+	for c.Next() {
+		var val, path, command string
+
+		// Path or command; not sure which yet
+		if !c.NextArg() {
+			return nil, c.ArgErr()
+		}
+		val = c.Val()
+
+		// Extra configuration may be in a block
+		hadBlock, err := optionalBlock()
+		if err != nil {
+			return nil, err
+		}
+
+		if !hadBlock {
+			// The next argument on this line will be the command or an open curly brace
+			if c.NextArg() {
+				path = val
+				command = c.Val()
+			} else {
+				path = "/"
+				command = val
+			}
+
+			// Okay, check again for optional block
+			hadBlock, err = optionalBlock()
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		// Split command into the actual command and its arguments
+		cmd, args, err := middleware.SplitCommandAndArgs(command)
+		if err != nil {
+			return nil, err
+		}
+
+		websocks = append(websocks, websocket.Config{
+			Path:      path,
+			Command:   cmd,
+			Arguments: args,
+			Respawn:   respawn, // TODO: This isn't used currently
+		})
+	}
+
+	return websocks, nil
+
+}

caddy/setup/websocket_test.go

@@ -0,0 +1,105 @@
+package setup
+
+import (
+	"testing"
+
+	"github.com/mholt/caddy/middleware/websocket"
+)
+
+func TestWebSocket(t *testing.T) {
+
+	c := NewTestController(`websocket cat`)
+
+	mid, err := WebSocket(c)
+
+	if err != nil {
+		t.Errorf("Expected no errors, got: %v", err)
+	}
+
+	if mid == nil {
+		t.Fatal("Expected middleware, was nil instead")
+	}
+
+	handler := mid(EmptyNext)
+	myHandler, ok := handler.(websocket.WebSocket)
+
+	if !ok {
+		t.Fatalf("Expected handler to be type WebSocket, got: %#v", handler)
+	}
+
+	if myHandler.Sockets[0].Path != "/" {
+		t.Errorf("Expected / as the default Path")
+	}
+	if myHandler.Sockets[0].Command != "cat" {
+		t.Errorf("Expected %s as the command", "cat")
+	}
+
+}
+func TestWebSocketParse(t *testing.T) {
+	tests := []struct {
+		inputWebSocketConfig    string
+		shouldErr               bool
+		expectedWebSocketConfig []websocket.Config
+	}{
+		{`websocket /api1 cat`, false, []websocket.Config{{
+			Path:    "/api1",
+			Command: "cat",
+		}}},
+
+		{`websocket /api3 cat  
+		  websocket /api4 cat `, false, []websocket.Config{{
+			Path:    "/api3",
+			Command: "cat",
+		}, {
+			Path:    "/api4",
+			Command: "cat",
+		}}},
+
+		{`websocket /api5 "cmd arg1 arg2 arg3"`, false, []websocket.Config{{
+			Path:      "/api5",
+			Command:   "cmd",
+			Arguments: []string{"arg1", "arg2", "arg3"},
+		}}},
+
+		// accept respawn
+		{`websocket /api6 cat {
+			respawn
+		}`, false, []websocket.Config{{
+			Path:    "/api6",
+			Command: "cat",
+		}}},
+
+		// invalid configuration
+		{`websocket /api7 cat {
+			invalid
+		}`, true, []websocket.Config{}},
+	}
+	for i, test := range tests {
+		c := NewTestController(test.inputWebSocketConfig)
+		actualWebSocketConfigs, err := webSocketParse(c)
+
+		if err == nil && test.shouldErr {
+			t.Errorf("Test %d didn't error, but it should have", i)
+		} else if err != nil && !test.shouldErr {
+			t.Errorf("Test %d errored, but it shouldn't have; got '%v'", i, err)
+		}
+		if len(actualWebSocketConfigs) != len(test.expectedWebSocketConfig) {
+			t.Fatalf("Test %d expected %d no of WebSocket configs, but got %d ",
+				i, len(test.expectedWebSocketConfig), len(actualWebSocketConfigs))
+		}
+		for j, actualWebSocketConfig := range actualWebSocketConfigs {
+
+			if actualWebSocketConfig.Path != test.expectedWebSocketConfig[j].Path {
+				t.Errorf("Test %d expected %dth WebSocket Config Path to be  %s  , but got %s",
+					i, j, test.expectedWebSocketConfig[j].Path, actualWebSocketConfig.Path)
+			}
+
+			if actualWebSocketConfig.Command != test.expectedWebSocketConfig[j].Command {
+				t.Errorf("Test %d expected %dth WebSocket Config Command to be  %s  , but got %s",
+					i, j, test.expectedWebSocketConfig[j].Command, actualWebSocketConfig.Command)
+			}
+
+		}
+	}
+
+}

caddy/sigtrap.go

@@ -0,0 +1,33 @@
+package caddy
+
+import (
+	"log"
+	"os"
+	"os/signal"
+
+	"github.com/mholt/caddy/server"
+)
+
+func init() {
+	// Trap quit signals (cross-platform)
+	go func() {
+		shutdown := make(chan os.Signal, 1)
+		signal.Notify(shutdown, os.Interrupt, os.Kill)
+		<-shutdown
+
+		var exitCode int
+
+		serversMu.Lock()
+		errs := server.ShutdownCallbacks(servers)
+		serversMu.Unlock()
+
+		if len(errs) > 0 {
+			for _, err := range errs {
+				log.Printf("[ERROR] Shutting down: %v", err)
+			}
+			exitCode = 1
+		}
+
+		os.Exit(exitCode)
+	}()
+}

caddy/sigtrap_posix.go

@@ -0,0 +1,49 @@
+// +build !windows
+
+package caddy
+
+import (
+	"io/ioutil"
+	"log"
+	"os"
+	"os/signal"
+	"syscall"
+)
+
+func init() {
+	// Trap POSIX-only signals
+	go func() {
+		reload := make(chan os.Signal, 1)
+		signal.Notify(reload, syscall.SIGUSR1) // reload configuration
+
+		for {
+			<-reload
+
+			var updatedCaddyfile Input
+
+			caddyfileMu.Lock()
+			if caddyfile == nil {
+				// Hmm, did spawing process forget to close stdin? Anyhow, this is unusual.
+				log.Println("[ERROR] SIGUSR1: no caddyfile to reload (was stdin left open?)")
+				caddyfileMu.Unlock()
+				continue
+			}
+			if caddyfile.IsFile() {
+				body, err := ioutil.ReadFile(caddyfile.Path())
+				if err == nil {
+					caddyfile = CaddyfileInput{
+						Filepath: caddyfile.Path(),
+						Contents: body,
+						RealFile: true,
+					}
+				}
+			}
+			caddyfileMu.Unlock()
+
+			err := Restart(updatedCaddyfile)
+			if err != nil {
+				log.Printf("[ERROR] SIGUSR1: Restart returned: %v", err)
+			}
+		}
+	}()
+}

caddy_test.go

@@ -1,74 +0,0 @@
-// Copyright 2015 Matthew Holt and The Caddy Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddy
-
-import (
-	"testing"
-	"time"
-)
-
-func TestParseDuration(t *testing.T) {
-	const day = 24 * time.Hour
-	for i, tc := range []struct {
-		input  string
-		expect time.Duration
-	}{
-		{
-			input:  "3h",
-			expect: 3 * time.Hour,
-		},
-		{
-			input:  "1d",
-			expect: day,
-		},
-		{
-			input:  "1d30m",
-			expect: day + 30*time.Minute,
-		},
-		{
-			input:  "1m2d",
-			expect: time.Minute + day*2,
-		},
-		{
-			input:  "1m2d30s",
-			expect: time.Minute + day*2 + 30*time.Second,
-		},
-		{
-			input:  "1d2d",
-			expect: 3 * day,
-		},
-		{
-			input:  "1.5d",
-			expect: time.Duration(1.5 * float64(day)),
-		},
-		{
-			input:  "4m1.25d",
-			expect: 4*time.Minute + time.Duration(1.25*float64(day)),
-		},
-		{
-			input:  "-1.25d12h",
-			expect: time.Duration(-1.25*float64(day)) - 12*time.Hour,
-		},
-	} {
-		actual, err := ParseDuration(tc.input)
-		if err != nil {
-			t.Errorf("Test %d ('%s'): Got error: %v", i, tc.input, err)
-			continue
-		}
-		if actual != tc.expect {
-			t.Errorf("Test %d ('%s'): Expected=%s Actual=%s", i, tc.input, tc.expect, actual)
-		}
-	}
-}

caddyconfig/caddyfile/adapter.go

@@ -1,145 +0,0 @@
-// Copyright 2015 Matthew Holt and The Caddy Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddyfile
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-
-	"github.com/caddyserver/caddy/v2"
-	"github.com/caddyserver/caddy/v2/caddyconfig"
-)
-
-// Adapter adapts Caddyfile to Caddy JSON.
-type Adapter struct {
-	ServerType ServerType
-}
-
-// Adapt converts the Caddyfile config in body to Caddy JSON.
-func (a Adapter) Adapt(body []byte, options map[string]any) ([]byte, []caddyconfig.Warning, error) {
-	if a.ServerType == nil {
-		return nil, nil, fmt.Errorf("no server type")
-	}
-	if options == nil {
-		options = make(map[string]any)
-	}
-
-	filename, _ := options["filename"].(string)
-	if filename == "" {
-		filename = "Caddyfile"
-	}
-
-	serverBlocks, err := Parse(filename, body)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	cfg, warnings, err := a.ServerType.Setup(serverBlocks, options)
-	if err != nil {
-		return nil, warnings, err
-	}
-
-	// lint check: see if input was properly formatted; sometimes messy files parse
-	// successfully but result in logical errors (the Caddyfile is a bad format, I'm sorry)
-	if warning, different := FormattingDifference(filename, body); different {
-		warnings = append(warnings, warning)
-	}
-
-	result, err := json.Marshal(cfg)
-
-	return result, warnings, err
-}
-
-// FormattingDifference returns a warning and true if the formatted version
-// is any different from the input; empty warning and false otherwise.
-// TODO: also perform this check on imported files
-func FormattingDifference(filename string, body []byte) (caddyconfig.Warning, bool) {
-	// replace windows-style newlines to normalize comparison
-	normalizedBody := bytes.Replace(body, []byte("\r\n"), []byte("\n"), -1)
-
-	formatted := Format(normalizedBody)
-	if bytes.Equal(formatted, normalizedBody) {
-		return caddyconfig.Warning{}, false
-	}
-
-	// find where the difference is
-	line := 1
-	for i, ch := range normalizedBody {
-		if i >= len(formatted) || ch != formatted[i] {
-			break
-		}
-		if ch == '\n' {
-			line++
-		}
-	}
-	return caddyconfig.Warning{
-		File:    filename,
-		Line:    line,
-		Message: "Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies",
-	}, true
-}
-
-// Unmarshaler is a type that can unmarshal Caddyfile tokens to
-// set itself up for a JSON encoding. The goal of an unmarshaler
-// is not to set itself up for actual use, but to set itself up for
-// being marshaled into JSON. Caddyfile-unmarshaled values will not
-// be used directly; they will be encoded as JSON and then used from
-// that. Implementations _may_ be able to support multiple segments
-// (instances of their directive or batch of tokens); typically this
-// means wrapping parsing logic in a loop: `for d.Next() { ... }`.
-// More commonly, only a single segment is supported, so a simple
-// `d.Next()` at the start should be used to consume the module
-// identifier token (directive name, etc).
-type Unmarshaler interface {
-	UnmarshalCaddyfile(d *Dispenser) error
-}
-
-// ServerType is a type that can evaluate a Caddyfile and set up a caddy config.
-type ServerType interface {
-	// Setup takes the server blocks which contain tokens,
-	// as well as options (e.g. CLI flags) and creates a
-	// Caddy config, along with any warnings or an error.
-	Setup([]ServerBlock, map[string]any) (*caddy.Config, []caddyconfig.Warning, error)
-}
-
-// UnmarshalModule instantiates a module with the given ID and invokes
-// UnmarshalCaddyfile on the new value using the immediate next segment
-// of d as input. In other words, d's next token should be the first
-// token of the module's Caddyfile input.
-//
-// This function is used when the next segment of Caddyfile tokens
-// belongs to another Caddy module. The returned value is often
-// type-asserted to the module's associated type for practical use
-// when setting up a config.
-func UnmarshalModule(d *Dispenser, moduleID string) (Unmarshaler, error) {
-	mod, err := caddy.GetModule(moduleID)
-	if err != nil {
-		return nil, d.Errf("getting module named '%s': %v", moduleID, err)
-	}
-	inst := mod.New()
-	unm, ok := inst.(Unmarshaler)
-	if !ok {
-		return nil, d.Errf("module %s is not a Caddyfile unmarshaler; is %T", mod.ID, inst)
-	}
-	err = unm.UnmarshalCaddyfile(d.NewFromNextSegment())
-	if err != nil {
-		return nil, err
-	}
-	return unm, nil
-}
-
-// Interface guard
-var _ caddyconfig.Adapter = (*Adapter)(nil)