5 ms·
There are some features in Caddy that are simply outstanding - HTTP/2 and Let's Encrypt integration, to name a few - both pretty much work out-of-the-box with z
by aexaey 10y ago
There are some features in Caddy that are simply outstanding - HTTP/2 and Let's Encrypt integration, to name a few - both pretty much work out-of-the-box with zero-configuration.
On the other hand, there are still some gaping holes - for example, to block (or allow) a 192.168.0.0/17 IPv4 subnet in Caddy, one needs to do all of below:
- Install an addon [1];
- Which used to require recompilation, with 0.9 release you can just click an option during download, yay!;
- Add 128 ranges to cover this single subnet: 192.168.0.0-255, 192.168.1.0-255, ...192.168.127.0-255. Configuration doesn't support subnets, only ranges. And only ranges in last octet, i.e. 192.168.1.0-255 (meaning 192.168.1.0/24), or implied ranges by trailing octet(s) omission, i.e. 192.168 (meaning 192.168.0.0/16) [2].
Oh, and ipv6 filtering doesn't exist at all.
[1] https://caddyserver.com/docs/ipfilter https://caddyserver.com/docs/ipfilter
[2] Which is mildly confusing notation too, since traditional UNIX inet_aton() call would interpret this as 192.0.0.168. Try typing "ping 192.168" on Linux.
- vesak 10y agoWouldn't you normally want to do ip filtering on a lower level?
- aexaey 10y agoSure, if you want to serve TCP reset / ICMP port-unreachable to blocked users, then yes - iptables or external firewall is a more natural way to do it. But what if you want to serve different content to "blocked" users? i.e. login page, "we're sorry" page, redirect to read-only version of the site, reminder to connect to office VPN, anything like that... Another example - more than one site on the same (server) IP, and only part of them are (client) IP-restricted.
- pritambaral 10y agoConsidering that firewalls are the best tools to "filter" by IP ranges, I'd suggest this "hack": Reroute the "blocked" packets (my favourite method is DNAT with iptables) to a different webserver which only serves the special pages.
- justinsaccount 10y agogo stdlib has functions for parsing cidr blocks (both v4 and v6) so adding support for subnets should not be that hard.
- tychuz 10y ago>simply outstanding - HTTP/2 and Let's Encrypt integration Simply simple de facto features basically are called outstanding now?
- spdustin 10y agoWhich other web server software intended to replace nginx or apache has HTTP/2 or Let's Encrypt as built-in functions?
- moosingin3space 10y agoIt's called "outstanding" because all of this functionality is incredibly easy to configure.
- StavrosK 10y agoI love the super-simple configuration, but it comes with some tradeoffs. For example, last I checked, I couldn't forward some requests to a hostname to another machine, while serving certain URLs (e.g. /static) from the local machine.
- mholt 10y agoYou can do that now. There's 'except' in the proxy directive for that. And you can also define sites with paths in the address as another possibility.
- StavrosK 10y agoAh, fantastic. I'll download 0.9 and replace 0.8 with it, hopefully I won't need to change my existing Caddyfile too much.
- SEJeff 10y agoSo in reality, you'd be much better served with an iptables rule or two instead of blocking at the Caddy server level. Sad
- drdaeman 10y agoExcept for iptables doesn't work on per-host or per-URL level (well, technically one could try with a string-matching, but that would be just a crude hack).
- newman314 10y agoOn a related note, I haven't used Caddy but have used lego (which Caddy uses under the hood) and lego makes amazingly easy to get certs via commandline and DNS challenge. Literally, one line (without needing root). Happy user.
- toupeira 10y agoI use letsencrypt.sh which also works well.