mholt

39 ms·

541.
by mholt 4y ago
No, currently we increment it when the HTTP request is parsed. (It counts HTTP requests, not packets/connections.) This was a quick and easy way to count; but I am very open to improving this! Feel free to submit a proposal or a PR. Re
542.
by mholt 4y ago
Good point. Our current metric (number of active requests) is a bit naive, but mostly does the job essentially for free. If your proposed metric doesn't cost too much in memory, it might be a good fit.
543.
by mholt 4y ago
Good question! When I first announced Caddy in 2015 and the server got busy, it started downloading everything as .gz files. (facepalm) (good ol' days) But that's just a fun story, not actually the reason we don't enable it b
544.
by mholt 4y ago
Yes it works with self-signed certificates!
545.
by mholt 4y ago
Oh hey HN. This is in the Caddy 2.6 beta already: https://github.com/caddyserver/caddy/releases/tag/v2.6.0-bet... - please try it out! Thanks to Marten Seemann for maintaining the quic-go library we use.
546.
by mholt 4y ago
If there was "nothing wrong" with the certificate, it shouldn't be revoked. I get that there's red tape, but the policy surely exists for a reason. I'm obviously familiar with LE's prior mass revocations where,
547.
by mholt 4y ago
It's on the order of a few hundred bytes, only happens on the first connection, and is still orders of magnitude faster and more effective than the alternative (no stapling, which requires the client to make separate round-trips to a t
548.
by mholt 4y ago
I am lukewarm about ARI. It's nice that clients can know the most convenient time to renew a certificate to avoid overwhelming the server. However, it is optional, so we will repeat the same mistake we made with optional OCSP stapling.
549.
by mholt 4y ago
It's a good question, if I read you rightly. There is no "handful" of intermediate certificates -- there are precisely 4 (for Let's Encrypt [0]) and they are essentially on-line root certificates. And if those certificat
550.
by mholt 4y ago
"The connection has timed out. An error occurred during a connection to ccadb-public.secure.force.com."
551.
by mholt 4y ago
Yes, I noticed this too and asked the author about it [0]. IMO, OCSP stapling is the best overall solution until certificate lifetimes are shorter (< 7 days). As a server developer I'm worried that the focus on independent CRLs wi
552.
by mholt 4y ago
It's like the programmer who just runs their code again without actually testing it in the hopes that something changed
553.
by mholt 4y ago
Over all time, yes, but look at the last ~year: https://github.com/caddyserver/caddy/graphs/contributors?fro...
554.
by mholt 4y ago
Good questions. I use Caddy often. Even some of the features coming out next month are based on my own needs. So that's a plus: it's not a project that's irrelevant to me. True, I could earn more at a large or VC-backed tech
555.
by mholt 4y ago
I want to submit a PR to remove Caddy from the "open core" category... or at least add it to several other categories which helped make it possible for me to work on Caddy full-time. Open Core did not work for us (hence the link t
556.
by mholt 4y ago
Neat comparison! (And Caddy is an excellent choice for production. Or so says the many companies now powering half a million sites with it!)
557.
by mholt 4y ago
No; if it's not in the core, that means we don't want to bloat the code base. Caddy is extensible for very good reasons!
558.
by mholt 4y ago
Happy to finish it if a company would like to sponsor that work. It works well enough for what it was originally commissioned for. It actually will probably work pretty well for you as-is. Try it!
559.
by mholt 4y ago
For a time we ran a build service that produced binaries that were commercially licensed if used for business purposes (personal use still free). But that was only with the optional use of our build service. The source code has always bee
560.
by mholt 4y ago
Did you know Caddy lets you use an NGINX config? https://caddyserver.com/docs/config-adapters -- no need to "learn" another tool (except for a command or two, perhaps).
561.
by mholt 4y ago
We try to be helpful :D Thank you for the kind remarks and for being part of our community!
562.
by mholt 4y ago
Thanks for the feedback! What's your site/company?
563.
by mholt 4y ago
FYI, I just revamped how Caddy handles encoded slashes: https://github.com/caddyserver/caddy/pull/4948 It's much smarter now. Caddy also doesn't stop if a certificate can't be obtained. When di
564.
by mholt 4y ago
We have the caddy add-package command that may be of interest to you!
565.
by mholt 4y ago
What's keeping you from using Caddy exclusively?
566.
by mholt 4y ago
Ah, that's you! Thanks so much for sponsoring. Hit me up if you ever need something or would like something more/special from your sponsorship.
567.
by mholt 4y ago
Holy cow, 100k? Who are you? (Seriously) That might be the largest deployments I know about in terms of domain names. I keep telling people "tens of thousands" when I probably should be saying "hundreds of thousands"...
568.
by mholt 4y ago
If you can't already do it with the rate limit module I wrote, open an issue with your detailed requirements: https://github.com/mholt/caddy-ratelimit -- should be pretty straightforward for the most part. > Qo
569.
by mholt 4y ago
Yes! So many people apply their conceptions of Caddy v1 to Caddy 2. Thanks for the comment!
570.
by mholt 4y ago
Hm, the templating thing surprises me. I'd be interested to know more about that, since Caddyfile is heavily inspired by nginx config. But for automating and scripting, I typically recommend using the JSON config. Pro tip: Did you know

More ›