diff --git a/www/caddy/Makefile b/www/caddy/Makefile
index bd346b669..26bed4d6a 100644
--- a/www/caddy/Makefile
+++ b/www/caddy/Makefile
@@ -1,5 +1,5 @@
PLUGIN_NAME= caddy
-PLUGIN_VERSION= 1.7.4
+PLUGIN_VERSION= 1.7.5
PLUGIN_DEPENDS= caddy-custom
PLUGIN_COMMENT= Modern Reverse Proxy with Automatic HTTPS, Dynamic DNS and Layer4 Routing
PLUGIN_MAINTAINER= cedrik@pischem.com
diff --git a/www/caddy/pkg-descr b/www/caddy/pkg-descr
index 42a8d507d..4f4a41636 100644
--- a/www/caddy/pkg-descr
+++ b/www/caddy/pkg-descr
@@ -13,6 +13,12 @@ DOC: https://docs.opnsense.org/manual/how-tos/caddy.html
Plugin Changelog
================
+1.7.5
+
+* Add: Layer4 TLS Termination
+* Add: h2c protocol to HTTP Handler
+* Cleanup: Refactor caddy_certs.php to Trust model
+
1.7.4
* Add: Layer4 OpenVPN matcher with mode, digest and static key support
diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4.xml
index 1679b056f..a3ebb43f9 100644
--- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4.xml
+++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4.xml
@@ -19,34 +19,27 @@
header
-
- true
+
layer4.Type
dropdown
- true
-
-
- header
-
- true
layer4.Protocol
dropdown
+
- true
layer4.FromPort
text
+
- true
header
@@ -89,6 +82,13 @@
true
+
+ layer4.TerminateTls
+
+ checkbox
+
+
+
header
diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php
index 066574cbf..2be38c8bb 100644
--- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php
+++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php
@@ -180,7 +180,10 @@ class Caddy extends BaseModel
foreach ($this->reverseproxy->layer4->iterateItems() as $item) {
if ($item->isFieldChanged()) {
$key = $item->__reference;
- if (in_array((string)$item->Matchers, ['httphost', 'tlssni', 'quicsni']) && empty((string)$item->FromDomain)) {
+ if (
+ in_array((string)$item->Matchers, ['httphost', 'tlssni', 'quicsni']) &&
+ empty((string)$item->FromDomain)
+ ) {
$messages->appendMessage(new Message(
sprintf(
gettext(
@@ -208,6 +211,18 @@ class Caddy extends BaseModel
));
}
+ if (!in_array((string)$item->Matchers, ['tlssni', 'quicsni']) && !empty((string)$item->TerminateTls)) {
+ $messages->appendMessage(new Message(
+ sprintf(
+ gettext(
+ 'When "%s" matcher is selected, TLS can not be terminated.'
+ ),
+ $item->Matchers
+ ),
+ $key . ".TerminateTls"
+ ));
+ }
+
if ((string)$item->Matchers !== 'openvpn' && !empty((string)$item->FromOpenvpnModes)) {
$messages->appendMessage(new Message(
sprintf(
diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
index 04897e2f8..dc0f8de5e 100644
--- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
+++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
@@ -544,6 +544,7 @@
Y
Please enter one or multiple valid IP addresses, hostnames or FQDNs.
+
Y
diff --git a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/layer4.volt b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/layer4.volt
index b76211292..7e41ee417 100644
--- a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/layer4.volt
+++ b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/layer4.volt
@@ -95,9 +95,6 @@
}
});
- // Hide all elements with style_matchers initially
- $(".style_matchers").closest('tr').hide();
-
$("#layer4\\.Matchers").change(function() {
$(".style_matchers").closest('tr').hide();
const selectedVal = $(this).val();
@@ -109,6 +106,14 @@
}
});
+ $("#layer4\\.Type").change(function() {
+ if ($(this).val() === "global") {
+ $(".style_type").closest('tr').show();
+ } else {
+ $(".style_type").closest('tr').hide();
+ }
+ });
+
updateServiceControlUI('caddy');
});
diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeLayer4 b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeLayer4
index c6058ccd7..0029c1ba6 100644
--- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeLayer4
+++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeLayer4
@@ -23,6 +23,9 @@
{% set layer4_configs = unsorted_layer4_configs | sort(attribute='Sequence') %}
{% macro define_proxy(layer4, to_domains, to_port, fail_duration, proxy_protocol) %}
+ {% if layer4.TerminateTls|default("0") == "1" %}
+ tls
+ {% endif %}
proxy {% for domain in to_domains.split(',') %}
{% set is_ipv6 = (':' in domain) %}
{{ layer4.Protocol }}/{{ '[' if is_ipv6 }}{{ domain }}{{ ']' if is_ipv6 }}:{{ to_port }}{% if not loop.last %} {% endif %}