github.com/mholt/caddy-l4

This minor release adds new capabilities for the proxy handler and expands features of the postgres module, along with reliability fixes and dependency updates.

Thanks to everyone who contributed code, tests, and feedback for this release. Special thanks to @tannevaled for your hard work on already merged and pending changes.

Highlights

• proxy: Rise/fall thresholds for active health checks (#427), weighted load balancing (#428), optional connection closing when an upstream peer goes unhealthy (#425) and support for Prometheus metrics (#431); collaborated by @tannevaled
• postgres: Dedicated intermediate handler (postgres_tls) to terminate TLS on classic PostgreSQL connections (#432), support for matching on user, client, and TLS parameters (#436); collaborated by @metafeather and @tannevaled
• regexp: Hex option to match non-UTF8 byte sequences (#448); collaborated by @vnxme

Fixes

• proxy_protocol: Align the internal buffer size with the app's maximum buffer size to prevent connection drops (#420 -> #450); collaborated by @carterbryden and @vnxme

What's Changed

• build(deps): bump the all-updates group with 2 updates by @dependabot[bot] in #433
• build(deps): bump the actions-deps group with 4 updates by @dependabot[bot] in #434
• build(deps): bump the actions-deps group with 2 updates by @dependabot[bot] in #441
• build(deps): bump the all-updates group with 4 updates by @dependabot[bot] in #442
• deps: Bump Caddy to v2.11.4 by @vnxme in #443
• l4proxy: add rise/fall thresholds to active health checks by @tannevaled in #427
• l4proxy: add weighted load balancing by @tannevaled in #428
• l4proxy: add Prometheus metrics by @tannevaled in #431
• l4proxy: add Caddyfile unmarshaling tests by @tannevaled in #424
• test(l4proxy): add unit tests for Handle (the proxy main loop) by @tannevaled in #435
• l4proxy: optionally close connections when a peer goes unhealthy by @tannevaled in #425
• l4proxy: fix duplicate metrics registration panic (fixes #445) by @tannevaled in #446
• l4postgres: add a Postgres TLS handler (terminate inbound + re-originate outbound) by @tannevaled in #432
• l4postgres: consolidate into one postgres matcher (user/database, client, TLS) — supersedes #188 by @tannevaled in #436
• docs: Adjust the Postgres-over-TLS example by @vnxme in #447
• regexp: Introduce hex option to match non-UTF8 bytes by @vnxme in #448
• proxy_protocol: Adjust go-proxyproto's internal buffer size by @vnxme in #450

New Contributors

• @carterbryden made their first contribution in #420
• @tannevaled made their first contribution in #427

Full Changelog: v0.1.1...v0.1.2

This minor release expands routing capabilities of this app, so that any context variable can be used as a basis for routing decisions. It also brings in a few niche features to the proxy handler, and contains dependency upgrades and several important fixes to the QUIC matcher.

Thank you to everyone who was involved in this release!

Highlights

• vars: Now it's possible to route connections based on placeholders and other context variables and define custom context variables per connection. It enables to use client certificate data to orchestrate mutual TLS connections, filter TLS connections based on the protocol version, and much more. Regular expression matching for context variables is on board as well. See also #396.
• proxy: Placeholders and context variables are valid in port numbers of upstream dial addresses with #289; collaborated by @lelemka0.
• proxy: Source addresses and DNS resolver preferences for upstream dial addresses are respected with #361; collaborated by @JDTX0.
• proxy: Fixed a few bugs related to how tls_server_name is treated for upstream configuration; collaborated by @c00ldchan in #392.
• quic: Several important fixes to the matcher code in #413, #414, #415, #416; collaborated by @kkroo.

What's Changed

• deps: Bump Caddy to v2.11.2 by @vnxme in #397
• proxy: Treat TLS server names carefully by @vnxme in #398
• lint: Modernize atomic operations in the proxy handler by @vnxme in #403
• build(deps): bump the all-updates group across 1 directory with 4 updates by @dependabot[bot] in #404
• build(deps): bump the actions-deps group with 2 updates by @dependabot[bot] in #401
• chore: No space between // and nolint by @vnxme in #406
• feat: Enable routing based on placeholders and custom variables by @vnxme in #396
• remote_ip_list: Fix phantom test failures by @vnxme in #407
• proxy: support dynamic port number by @lelemka0 in #289
• proxy: Quick fix for #408 by @vnxme in #409
• lint: Modernize reverse loops over slices by @vnxme in #417
• build(deps): bump step-security/harden-runner from 2.17.0 to 2.19.1 in the actions-deps group across 1 directory by @dependabot[bot] in #411
• build(deps): bump the all-updates group across 1 directory with 3 updates by @dependabot[bot] in #412
• l4quic: close qListener on every Match() exit path by @kkroo in #416
• l4quic: distinguish Accept() deadline from cancellation in Match() by @kkroo in #413
• l4quic: panic-recover the WaitForMore goroutine by @kkroo in #414
• l4quic: log Accept() errors at WARN/DEBUG split by @kkroo in #415
• Support upstream source addresses and DNS resolver preferences by @JDTX0 in #361
• deps: Bump Caddy to v2.11.3 by @vnxme in #418

New Contributors

• @lelemka0 made their first contribution in #289
• @JDTX0 made their first contribution in #361
• @kkroo made their first contribution in #416

Full Changelog: v0.1.0...v0.1.1

We are excited to announce the first public release of caddy-l4, a Layer 4 (TCP/UDP) app for Caddy.

It enables Caddy to inspect and route raw network connections using composable matchers and handlers, similar in spirit to how the HTTP app processes requests. This allows building flexible Layer 4 routing pipelines for arbitrary protocols.

Capabilities

• TCP/UDP proxying
• Routing based on protocol detection (TLS, HTTP, SSH, etc.)
• TLS termination and SNI-based routing
• Protocol multiplexing on shared ports
• IP-based filtering and connection controls
• Pluggable matchers and handlers

Stability

⚠️ The module is still evolving and breaking changes may occur before a stable release.

Documentation

ℹ️ See the README and the docs directory for configuration examples and usage details.

Thanks

❤️ We are grateful to everyone who has experimented with early versions of this module, contributed new features, and provided feedback.