Changes
- Trust client certificates by their certificate authority. A proxy host's mTLS card has a new Trust switch: trust individual roles and certificates as before, or trust a certificate authority and accept every client certificate it signs — an imported CA such as Cloudflare's origin pull CA, for example. The two modes are exclusive per host.
- PowerDNS DNS-01 provider. PowerDNS joins the DNS providers for the ACME DNS-01 challenge, used for certificates on internal names.
config:importandbackups:restoreare administrator-only. Each can replace or restore the whole configuration, so they are now administrator-level and are removed from every custom role that held them, once, on the first start after upgrading. An administrator can grant either one again on the Users page.- Changes Caddy rejects are undone, not left behind. When Caddy refuses a saved change — a certificate it cannot read, a WAF rule that will not compile, an address it cannot bind — it is rolled back instead of blocking every later apply, and the message says the change was saved but is not live and where Caddy stopped. Certificates and other values are checked the way Caddy reads them before they are stored.
- Security hardening for non-administrators. A non-administrator with host write permissions can no longer reach Caddy's admin API, add an upstream or custom WAF directives through raw Caddy JSON without the matching permission, store a value that blocks every later apply, or make Caddy send files of its container to a server they choose. See advisories GHSA-6mfm-phqp-5q57, GHSA-fqgg-6xq4-6xpx and GHSA-hq6v-h837-3536.
- Dependency updates: Caddy 2.11.9, the Caddy image's base images, and the production and development dependency groups.
Donations
Ingressi is free. If it saves you time or money, please consider supporting it: GitHub Sponsors or Ko-fi.