From c590eef1e27d54a3844f34c8476bd7a64a17936c Mon Sep 17 00:00:00 2001
From: Monviech <79600909+Monviech@users.noreply.github.com>
Date: Mon, 30 Jun 2025 10:06:10 +0200
Subject: [PATCH] www/caddy: Add global servers timeouts options (#4778)

* www/caddy: Add global servers timeouts options

* www/caddy: Bump version and changelog

* www/caddy: Add changelog
---
 www/caddy/Makefile                            |  2 +-
 www/caddy/pkg-descr                           |  6 +++
 .../OPNsense/Caddy/forms/general.xml          | 40 +++++++++++++++++++
 .../mvc/app/models/OPNsense/Caddy/Caddy.xml   | 16 ++++++++
 .../templates/OPNsense/Caddy/Caddyfile        | 20 ++++++++++
 5 files changed, 83 insertions(+), 1 deletion(-)

diff --git a/www/caddy/Makefile b/www/caddy/Makefile
index 08f8f247a..5b9504ba7 100644
--- a/www/caddy/Makefile
+++ b/www/caddy/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		caddy
-PLUGIN_VERSION=		2.0.1
+PLUGIN_VERSION=		2.0.2
 PLUGIN_DEPENDS=		caddy-custom
 PLUGIN_COMMENT=		Modern Reverse Proxy with Automatic HTTPS, Dynamic DNS and Layer4 Routing
 PLUGIN_MAINTAINER=	cedrik@pischem.com
diff --git a/www/caddy/pkg-descr b/www/caddy/pkg-descr
index 6eb887b28..9845f3f37 100644
--- a/www/caddy/pkg-descr
+++ b/www/caddy/pkg-descr
@@ -6,6 +6,12 @@ DOC: https://docs.opnsense.org/manual/how-tos/caddy.html
 Plugin Changelog
 ================
 
+2.0.2
+
+Add: Global server timeout options (opnsense/plugins/pull/4778)
+Cleanup: Change all camelCase to snake_case in api notations (opnsense/plugins/pull/4767,4768,4776)
+Cleanup: Use SimpleActionButton in general.volt (opnsense/plugins/pull/4779)
+
 2.0.1
 
 Add: Active health checks to handlers (contributed by zaben903) (opnsense/plugins/pull/4721)
diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml
index 849ea61d7..bb7d29b7b 100644
--- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml
+++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/general.xml
@@ -26,12 +26,20 @@
         </field>
     </tab>
     <tab id="general-advanced" description="Advanced Settings">
+        <field>
+            <type>header</type>
+            <label>Security Settings</label>
+        </field>
         <field>
             <id>caddy.general.DisableSuperuser</id>
             <label>System User</label>
             <type>dropdown</type>
             <help><![CDATA[Run this service as "www" user and group, instead of "root". This setting increases security, but comes with the hard restriction that the well-known port range can not be used anymore. After enabling and saving this setting, the service has to be totally restarted. For this, please disable Caddy and press Apply. Afterwards enable Caddy and press Apply. This setting is reversible by following the same steps.]]></help>
         </field>
+        <field>
+            <type>header</type>
+            <label>HTTP Settings</label>
+        </field>
         <field>
             <id>caddy.general.HttpVersions</id>
             <label>HTTP Versions</label>
@@ -52,6 +60,10 @@
             <hint>443</hint>
             <help><![CDATA[If the default HTTPS port is changed to e.g. 8443, then a port forward from port 443 to 8443 is necessary to issue automatic certificates with the TLS-ALPN-01 challenge and serve clients the reverse proxied resources.]]></help>
         </field>
+        <field>
+            <type>header</type>
+            <label>Server Settings</label>
+        </field>
         <field>
             <id>caddy.general.accesslist</id>
             <label>Trusted Proxies</label>
@@ -75,6 +87,34 @@
             <hint>10</hint>
             <help><![CDATA[Defines the grace period for shutting down Caddy during a reload in seconds. If clients do not finish their requests within the grace period, the server will be forcefully terminated to allow the reload to complete and free up resources. This can influence how long "Apply" of new configurations take, since Caddy waits for all open connections to close. If the grace period is over and Caddy is unresponsive, there will be a forced kill and service restart.]]></help>
         </field>
+        <field>
+            <id>caddy.general.timeout_read_body</id>
+            <label>Read Body Timeout</label>
+            <type>text</type>
+            <hint>no timout</hint>
+            <help><![CDATA[read_body is a duration value in seconds that sets how long to allow a read from a client's upload. Setting this to a short, non-zero value can mitigate slowloris attacks, but may also affect legitimately slow clients.]]></help>
+        </field>
+        <field>
+            <id>caddy.general.timeout_read_header</id>
+            <label>Read Header Timeout</label>
+            <type>text</type>
+            <hint>no timout</hint>
+            <help><![CDATA[read_header is a duration value in seconds that sets how long to allow a read from a client's request headers.]]></help>
+        </field>
+        <field>
+            <id>caddy.general.timeout_write</id>
+            <label>Write Timeout</label>
+            <type>text</type>
+            <hint>no timout</hint>
+            <help><![CDATA[write is a duration value in seconds that sets how long to allow a write to a client. Note that setting this to a small value when serving large files may negatively affect legitimately slow clients.]]></help>
+        </field>
+        <field>
+            <id>caddy.general.timeout_idle</id>
+            <label>Idle Timeout</label>
+            <type>text</type>
+            <hint>300</hint>
+            <help><![CDATA[idle is a duration value in seconds that sets the maximum time to wait for the next request when keep-alives are enabled. Defaults value helps to avoid resource exhaustion.]]></help>
+        </field>
     </tab>
     <tab id="general-logsettings" description="Log Settings">
         <field>
diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
index 3bf5aa4c3..a1b829a4a 100644
--- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
+++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
@@ -89,6 +89,22 @@
                     <h3>HTTP/3</h3>
                 </OptionValues>
             </HttpVersions>
+            <timeout_read_body type="IntegerField">
+                <MinimumValue>0</MinimumValue>
+                <ValidationMessage>Please enter a minimum value of 0 or leave empty for defaults.</ValidationMessage>
+            </timeout_read_body>
+            <timeout_read_header type="IntegerField">
+                <MinimumValue>0</MinimumValue>
+                <ValidationMessage>Please enter a minimum value of 0 or leave empty for defaults.</ValidationMessage>
+            </timeout_read_header>
+            <timeout_write type="IntegerField">
+                <MinimumValue>0</MinimumValue>
+                <ValidationMessage>Please enter a minimum value of 0 or leave empty for defaults.</ValidationMessage>
+            </timeout_write>
+            <timeout_idle type="IntegerField">
+                <MinimumValue>0</MinimumValue>
+                <ValidationMessage>Please enter a minimum value of 0 or leave empty for defaults.</ValidationMessage>
+            </timeout_idle>
             <LogCredentials type="BooleanField"/>
             <LogAccessPlain type="BooleanField"/>
             <LogAccessPlainKeep type="IntegerField">
diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
index 7c30c2f68..997a746f4 100644
--- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
+++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
@@ -93,9 +93,29 @@
                 {% endif %}
             {% endfor %}
         {% endif %}
+
         {% if generalSettings.LogCredentials|default("0") == "1" %}
             log_credentials
         {% endif %}
+        {% if generalSettings.timeout_read_body or
+            generalSettings.timeout_read_header or
+            generalSettings.timeout_write or
+            generalSettings.timeout_idle %}
+        timeouts {
+            {% if generalSettings.timeout_read_body %}
+                read_body {{ generalSettings.timeout_read_body }}s
+            {% endif %}
+            {% if generalSettings.timeout_read_header %}
+                read_header {{ generalSettings.timeout_read_header }}s
+            {% endif %}
+            {% if generalSettings.timeout_write %}
+                write {{ generalSettings.timeout_write }}s
+            {% endif %}
+            {% if generalSettings.timeout_idle %}
+                idle {{ generalSettings.timeout_idle }}s
+            {% endif %}
+        }
+        {% endif %}
         {% if generalSettings.EnableLayer4|default("0") == "1" %}
             listener_wrappers {
                 layer4 {