Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 21:00 UTC
caddytls: Allow disabling distributed solving (except http-01)
Matthew Holt committed
Sep 4, 2025 at 08:51 UTC
38848f7f2525777edd0241ad3118f070e045d771
4 files changed
+42
-9
go.mod
+3
-3
@@ -8,7 +8,7 @@ require (
8
github.com/Masterminds/sprig/v3 v3.3.0
9
github.com/alecthomas/chroma/v2 v2.20.0
10
github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b
11
- github.com/caddyserver/certmagic v0.24.0
11
+ github.com/caddyserver/certmagic v0.25.0
12
github.com/caddyserver/zerossl v0.1.3
13
github.com/cloudflare/circl v1.6.1
14
github.com/dustin/go-humanize v1.0.1
@@ -17,7 +17,7 @@ require (
17
github.com/google/uuid v1.6.0
18
github.com/klauspost/compress v1.18.0
19
github.com/klauspost/cpuid/v2 v2.3.0
20
- github.com/mholt/acmez/v3 v3.1.2
20
+ github.com/mholt/acmez/v3 v3.1.3
21
github.com/prometheus/client_golang v1.23.0
22
github.com/quic-go/quic-go v0.54.0
23
github.com/smallstep/certificates v0.28.4
@@ -128,7 +128,7 @@ require (
128
github.com/mattn/go-colorable v0.1.13 // indirect
129
github.com/mattn/go-isatty v0.0.20 // indirect
130
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
131
- github.com/miekg/dns v1.1.63 // indirect
131
+ github.com/miekg/dns v1.1.68 // indirect
132
github.com/mitchellh/copystructure v1.2.0 // indirect
133
github.com/mitchellh/go-ps v1.0.0 // indirect
134
github.com/mitchellh/reflectwalk v1.0.2 // indirect
go.sum
+6
-6
@@ -91,8 +91,8 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
91
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
92
github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
93
github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
94
-github.com/caddyserver/certmagic v0.24.0 h1:EfXTWpxHAUKgDfOj6MHImJN8Jm4AMFfMT6ITuKhrDF0=
95
-github.com/caddyserver/certmagic v0.24.0/go.mod h1:xPT7dC1DuHHnS2yuEQCEyks+b89sUkMENh8dJF+InLE=
94
+github.com/caddyserver/certmagic v0.25.0 h1:VMleO/XA48gEWes5l+Fh6tRWo9bHkhwAEhx63i+F5ic=
95
+github.com/caddyserver/certmagic v0.25.0/go.mod h1:m9yB7Mud24OQbPHOiipAoyKPn9pKHhpSJxXR1jydBxA=
96
github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+YTAyA=
97
github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
98
github.com/ccoveille/go-safecast v1.6.1 h1:Nb9WMDR8PqhnKCVs2sCB+OqhohwO5qaXtCviZkIff5Q=
@@ -274,11 +274,11 @@ github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D
274
github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
275
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
276
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
277
-github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
278
-github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
277
+github.com/mholt/acmez/v3 v3.1.3 h1:gUl789rjbJSuM5hYzOFnNaGgWPV1xVfnOs59o0dZEcc=
278
+github.com/mholt/acmez/v3 v3.1.3/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
279
github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4=
280
-github.com/miekg/dns v1.1.63 h1:8M5aAw6OMZfFXTT7K5V0Eu5YiiL8l7nUAkyN6C9YwaY=
281
-github.com/miekg/dns v1.1.63/go.mod h1:6NGHfjhpmr5lt3XPLuyfDJi5AXbNIPM9PY6H6sF1Nfs=
280
+github.com/miekg/dns v1.1.68 h1:jsSRkNozw7G/mnmXULynzMNIsgY2dHC8LO6U6Ij2JEA=
281
+github.com/miekg/dns v1.1.68/go.mod h1:fujopn7TB3Pu3JM69XaawiU0wqjpL9/8xGop5UrTPps=
282
github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
283
github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
284
github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
modules/caddytls/acmeissuer.go
+17
@@ -244,6 +244,9 @@ func (iss *ACMEIssuer) makeIssuerTemplate(ctx caddy.Context) (certmagic.ACMEIssu
244
template.DNS01Solver = iss.Challenges.DNS.solver
245
}
246
template.ListenHost = iss.Challenges.BindHost
247
+ if iss.Challenges.Distributed != nil {
248
+ template.DisableDistributedSolvers = !*iss.Challenges.Distributed
249
+ }
250
}
251
252
if iss.PreferredChains != nil {
@@ -480,6 +483,20 @@ func (iss *ACMEIssuer) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
483
}
484
iss.Challenges.TLSALPN.Disabled = true
485
486
+ case "distributed":
487
+ if !d.NextArg() {
488
+ return d.ArgErr()
489
+ }
490
+ if d.Val() != "false" {
491
+ return d.Errf("only accepted value is 'false'")
492
+ }
493
+ if iss.Challenges == nil {
494
+ iss.Challenges = new(ChallengesConfig)
495
+ }
496
+ if iss.Challenges.Distributed == nil {
497
+ iss.Challenges.Distributed = new(bool)
498
+ }
499
+
500
case "alt_http_port":
501
if !d.NextArg() {
502
return d.ArgErr()
modules/caddytls/automation.go
+16
@@ -456,6 +456,22 @@ type ChallengesConfig struct {
456
// Optionally customize the host to which a listener
457
// is bound if required for solving a challenge.
458
BindHost string `json:"bind_host,omitempty"`
459
+
460
+ // Whether distributed solving is enabled. This is
461
+ // enabled by default, so this is only used to
462
+ // disable it, which should only need to be done if
463
+ // you cannot reliably or affordably use storage
464
+ // backend for writing/distributing challenge info.
465
+ // (Applies to HTTP and TLS-ALPN challenges.)
466
+ // If set to false, challenges can only be solved
467
+ // from the Caddy instance that initiated the
468
+ // challenge, with the exception of HTTP challenges
469
+ // initiated with the same ACME account that this
470
+ // config uses. (Caddy can still solve those challenges
471
+ // without explicitly writing the info to storage.)
472
+ //
473
+ // Default: true
474
+ Distributed *bool `json:"distributed,omitempty"`
475
}
476
477
// HTTPChallengeConfig configures the ACME HTTP challenge.