caddy: add suport for compiling Caddy with plugins by vincentbernat · Pull Request #358586 · NixOS/nixpkgs

vincentbernat · 2024-11-23T23:26:04Z

This adds a withPlugins function to Caddy package.

services.caddy = {
  enable = true;
  package = pkgs.caddy.withPlugins {
    plugins = [ "github.com/caddy-dns/powerdns@v1.0.1" ];
    hash = "sha256-F/jqR4iEsklJFycTjSaW8B/V3iTGqqGOzwYBUXxRKrc=";
  };
};

Fix: #14671

This is an alternative to #317881 and it relies on xcaddy. Looking at #317881 (comment), I am still missing tests. I am unsure if this is a build test (in checkPhase) or a NixOS test. The remaining requirements should be OK (notably use of xcaddy and FOD).

The release notes are missing, I'll add them once this gets a chance to be accepted.

Things done

Add a 👍 reaction to pull requests you find important.

stepbrobd · 2024-11-24T01:23:09Z

pkgs/by-name/ca/caddy/package.nix

Quick question, should we make the build fail if a plugin is provided without the version string?

For example:

pkgs.caddy.withPlugins { plugins = [ "github.com/caddy-dns/powerdns@v1.0.1" "github.com/caddy-dns/cloudflare" ]; hash = "sha256-AoW35l7QkXunjBzZ43IlyU3UkVXw2D4eyc1jx8xpT0U="; }

After testing this on my darwin machine, I have the following:

$ /nix/store/icp2z20hpf2ps7g4n5rzqdkg5qsjp38z-caddy-2.8.4/bin/caddy build-info ... dep github.com/caddy-dns/cloudflare v0.0.0-20240703190432-89f16b99c18e dep github.com/caddy-dns/powerdns v1.0.1 ...

Yes, I think I can add an assertion.

I have added an assertion (using the first non-versioned plugin as an example).

stepbrobd · 2024-11-24T01:27:02Z

pkgs/by-name/ca/caddy/package.nix

Small nit, imo pluginsHash makes the build log a bit too long, maybe caddy-src-with-plugins is good enough here?

It's there to ensure a cached build is not used when adding/removing a plugin. This was one of the request in #317881 (comment).

I have switched to md5 to reduce the length a bit. We could also use a subset of the hash if it's still too long.

I'm not sure if using md5 is a good idea, IIRC it's considered outdated and insecure (citation needed)?

I took a look into the comment you linked, it seems like it'd be a good idea to include a test to make sure specified plugins are properly installed. I came up with the following but don't have time to dig deeper (feel free to take whatever you need):

diff --git a/pkgs/by-name/ca/caddy/package.nix b/pkgs/by-name/ca/caddy/package.nix index eea6894ce328..c052da5ef290 100644 --- a/pkgs/by-name/ca/caddy/package.nix +++ b/pkgs/by-name/ca/caddy/package.nix @@ -116,6 +116,31 @@ buildGoModule { outputHash = hash; outputHashAlgo = "sha256"; }; + + doInstallCheck = true; + installCheckPhase = '' + runHook preInstallCheck + + build_info="$($out/bin/caddy build-info)" + + for plugin in ''${plugins[@]}; do + # this won't work :( + echo $plugin + url=$(echo "$plugin" | cut -d'@' -f1) + version=$(echo "$plugin" | cut -d'@' -f2) + echo $url + echo $version + + if echo "$build_info" | grep -q "$url[[:space:]]*$version"; then + echo "$plugin found in build-info" + else + echo "$plugin not found in build-info" >&2 + exit 1 + fi + done + + runHook postInstallCheck + ''; }); };

For testing:

nom-build --expr 'with import ./. { }; caddy.withPlugins { plugins = [ "github.com/caddy-dns/powerdns@v1.0.1" "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e" ]; hash = "sha256-AoW35l7QkXunjBzZ43IlyU3UkVXw2D4eyc1jx8xpT0U="; }'

I have added a postInstallCheck as you suggest.

As for the MD5, this is not meant to be secure, just a safety to ensure the user does not forget to update the hash when modifying plugins. A mechanism like this was requested in the original PR.

stepbrobd · 2024-11-29T00:22:51Z

LGTM!

Tested with couple more plugins and everything works fine on aarch64-darwin and x86_64-linux

stepbrobd · 2024-11-29T16:00:09Z

cc @NickCao

NickCao

Apart from the nitpick, looks pretty good!

NickCao · 2024-11-29T18:36:16Z

pkgs/by-name/ca/caddy/package.nix

Suggested change

unpackPhase = "true";

dontUnpack = true;

Fixed. Thanks.

BatteredBunny · 2024-11-30T12:10:45Z

fyi theres a typo in the commit message

vincentbernat · 2024-12-01T07:04:17Z

I have also updated the release notes.

vincentbernat · 2024-12-03T18:02:57Z

I have added git as a native build input, as it may be required for modules not present on proxy.golang.org. There was a comment about that. goModule also uses git as a native build input.

kusold · 2024-12-04T06:22:45Z

pkgs/by-name/ca/caddy/package.nix

I ran into an issue with this check when plugin versions are specified as git-shas.

When given the input:

plugins = [ "github.com/caddy-dns/cloudflare@89f16b99c18ef49c8bb470a82f895bce01cbaece" "github.com/dulli/caddy-wol@c0d58507c9037191aa9622d531a001db619dd543" ]; hash = "sha256-pKiL3bGcFVcD7r67mY9RtAEHDJc+gq3vz8DkZYssfb4=";

caddy build-info contains:

... dep github.com/caddy-dns/cloudflare v0.0.0-20240703190432-89f16b99c18e ... dep github.com/dulli/caddy-wol v1.0.1-0.20240903185854-c0d58507c903 ...

This causes this check to fail because the versions were substituted. If I update my input to the versions, it works:

plugins = [ "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e" "github.com/dulli/caddy-wol@v1.0.1-0.20240903185854-c0d58507c903" ]; hash = "sha256-pKiL3bGcFVcD7r67mY9RtAEHDJc+gq3vz8DkZYssfb4=";

Do you need to check for the version, or is matching the module sufficient?

IMO checking module + version is better, and you can get the format it wants beforehand with go get and check the go.mod file

thegatesdev · 2024-12-05T09:26:44Z

Is there intent to support plugins like FrankenPHP?
FrankenPHP requires PHP to be present at compile- and runtime and uses CGO.

thiagokokada · 2024-12-19T23:58:04Z

pkgs/by-name/ca/caddy/package.nix

+      let
+        pluginsSorted = builtins.sort builtins.lessThan plugins;
+        pluginsList = lib.concatMapStrings (plugin: "${plugin}-") pluginsSorted;
+        pluginsHash = builtins.hashString "md5" pluginsList;
+        pluginsWithoutVersion = builtins.filter (p: !lib.hasInfix "@" p) pluginsSorted;
+      in
+      assert lib.assertMsg (builtins.length pluginsWithoutVersion == 0)


Another non-blocking nit, but in general builtins should be avoided because sometimes we have polyfills for older versions of Nix inside lib, so in general we should always prefer using lib.

Done, except for builtins.hashString as there does not seem there is an equivalent.

There is no `lib.hashString`, so keep using `builtins` for this one.

oxalica · 2024-12-27T20:30:07Z

It does not work well with a commit-hash version. I'm using https://github.com/mholt/caddy-webdav which does not have a version tag, and it results in an unhelpful build error.

caddy.withPlugins {
  plugins = [
    "github.com/mholt/caddy-webdav@42168ba04c9dc2cd228ab8c453dbab27654e52e6"
  ];
  hash = "";
}

caddy> Running phase: installCheckPhase
caddy> Plugins not found: github.com/mholt/caddy-webdav@42168ba04c9dc2cd228ab8c453dbab27654e52e6

Thanks to @kusold 's #358586 (comment), I need to fill in the magic v0.0.0-{date}-{shortrev} to make it build. (Sorry if it's in any obvious format but I'm not a Go dev)

If this is intentional, could we improve the documentation to inform how to generate a valid version string for commit-hash-only plugins? Or if it's possible, could we provide these information directly in build error messages?

stepbrobd · 2024-12-27T20:37:05Z

I need to fill in the magic v0.0.0-{date}-{shortrev} to make it build

What I usually do is create an empty project and run go get on the plugin to get the full string:

$ go mod init temp
$ go get github.com/mholt/caddy-webdav
$ grep 'caddy-webdav' go.mod
        github.com/mholt/caddy-webdav v0.0.0-20241008162340-42168ba04c9d // indirect

I'll make a new PR to update the docs and perhaps a script to automatically generate those strings for untagged plugins

oxalica · 2025-01-13T22:20:11Z

Is it possible to override the caddy source when using withPlugin? It seems (caddy.overrideAttrs (old: { patches = [ .. ]; })).withPlugin { .. } will not applying the patch at all. Overriding src or version to use a different version also has no effect.

I tried (caddy.withPlugin { .. }).overrideAttrs (old: { patches = [ .. ]; }). It does try to apply the patch, but fails because the source layout is significantly different than upstream.

stepbrobd · 2025-01-14T00:28:38Z

Oof this is a hard one

withPlugin overrides the caddy source by using the one generated by xcaddy, i.e. if you call withPlugins, the src will be replaced (from the full caddy source) to only one main.go and vendored dependencies (where the full caddy source will be moved to)

If you want to apply the patches, try changing the patch paths to /vendor/github.com/caddyserver/caddy/v2/.... In other words, instead of apply patches directly on (caddy.withPlugins {...}).src, apply them to "${(caddy.withPlugins {...}).src}/vendor/github.com/caddyserver/caddy/v2/"

To illustrate:

$ # im in nixpkgs
$ nix repl -f .
Type :? for help.
Loading installable ''...
Added 23515 variables.
nix-repl> :b (caddy.withPlugins {
          plugins = [
                "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e"
          ];
          hash = "sha256-JoujVXRXjKUam1Ej3/zKVvF0nX97dUizmISjy3M3Kr8=";
          }).src

This derivation produced the following outputs:
  out -> /nix/store/48vdfpdaz04wcdqvymx7cx29vsav5pxj-caddy-src-with-plugins-0bbf432f07a600413ee833233180f51d-2.9.0
nix-repl> :b caddy.src

This derivation produced the following outputs:
  out -> /nix/store/vwmnpjxxfq1ffc5a82c0q24p0c3sdl3h-source
$ # withPlugins caddy src:
$ > ls -l /nix/store/48vdfpdaz04wcdqvymx7cx29vsav5pxj-caddy-src-with-plugins-0bbf432f07a600413ee833233180f51d-2.9.0/vendor/github.com/caddyserver/caddy/v2
total 608
-r--r--r--   1 root  nixbld    399 Dec 31  1969 AUTHORS
-r--r--r--   1 root  nixbld  11358 Dec 31  1969 LICENSE
-r--r--r--   1 root  nixbld  12002 Dec 31  1969 README.md
-r--r--r--   1 root  nixbld  45621 Dec 31  1969 admin.go
-r--r--r--   1 root  nixbld  33278 Dec 31  1969 caddy.go
...
$ # caddy.src:
$ ls -l /nix/store/vwmnpjxxfq1ffc5a82c0q24p0c3sdl3h-source
total 880
-r--r--r--   1 root  nixbld    399 Dec 31  1969 AUTHORS
-r--r--r--   1 root  nixbld  11358 Dec 31  1969 LICENSE
-r--r--r--   1 root  nixbld  12002 Dec 31  1969 README.md
-r--r--r--   1 root  nixbld  45621 Dec 31  1969 admin.go
-r--r--r--   1 root  nixbld   5790 Dec 31  1969 admin_test.go
-r--r--r--   1 root  nixbld  33278 Dec 31  1969 caddy.go
...

Edit:

If you want to use a specific version of caddy, you might have to patch xcaddy as well, since the vendored caddy source is pinned in xcaddy's go.mod 🤣

nixos-discourse · 2025-03-18T00:54:05Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/tailscale-caddy-certificates-not-working/61228/6

nixos-discourse · 2025-03-24T09:10:58Z

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/using-nix-to-replace-xcaddy-to-build-caddy-webserver/11765/3

Jonas-Sander · 2025-04-07T18:24:22Z

Please add this to the docs!
I wasted hours, because I didn't know about this way.

aaravrav · 2025-08-30T21:30:10Z

How can I replace a caddy module with my own? This is implemented in xcaddy's --with flag

stepbrobd · 2025-08-30T21:36:54Z

How can I replace a caddy module with my own? This is implemented in xcaddy's --with flag

use this patch for now, should be merged fairly soon #433072

sokai · 2025-09-03T19:36:55Z

@stepbrobd´: Thanks a lot for your/this implementation + dedication!
May I ask you, if/how it's possible to use the GOPROXY env var during the building process? – I tried a lot, with no luck, to use my Athens proxy, that works with go install $MODULE$ but not with nixos-rebuild).
KR

stepbrobd · 2025-09-03T20:05:24Z

@stepbrobd´: Thanks a lot for your/this implementation + dedication! May I ask you, if/how it's possible to use the GOPROXY env var during the building process? – I tried a lot, with no luck, to use my Athens proxy, that works with go install $MODULE$ but not with nixos-rebuild). KR

My immediate thought is using overrideAttrs to inject GOPROXY into the build env var... Have you tried that yet?

sokai · 2025-09-03T20:23:15Z

@stepbrobd Thanks for your fast reply! :)

using overrideAttrs to inject GOPROXY into the build env var

Yes, think so …

Current/simple setup

caddyWithPlugins = pkgs.caddy.withPlugins {
  plugins = [
    […]
  ];
  hash = "sha256-9TR2vFgrxupy8O4i+a05+/Fj2D4sQCw42q2odX22fD0=";
};

overrideAttrs setup

caddyWithPlugins = (pkgs.caddy.overrideAttrs (
  finalAttrs: prevAttrs: {
    env.GOPROXY = "http://$MYATHENSPROXYHOSTNAME:3000,https://proxy.golang.org,direct";
  }
)).withPlugins {
  plugins = [
    […]
  ];
  hash = "sha256-9TR2vFgrxupy8O4i+a05+/Fj2D4sQCw42q2odX22fD0=";
};

With both setups $GOPROXY isn't used … :/

stepbrobd · 2025-09-09T12:07:15Z

sorry about the late reply, i was at nixcon last week. the problem is with where GOPROXY is used:

the above snippet in your reply overrides the withPlugins' build environment variable, where all the dependencies are already fetched by xcaddy (check the with plugins implementation, we are overriding caddy's source with xcaddy's build env)

the correct place to do the override is at (caddy.withPlugins { ... }).src).overrideAttrs (...). for example:

$ nix build -L --impure --expr '
  ((import ./. {}).caddy.withPlugins {
    plugins = [ "github.com/mholt/caddy-webdav@v0.0.0-20241008162340-42168ba04c9d" ];
    hash = "sha256-ymuWQ6ic2MacS3JiGZ5Nu/wq2Iz53TOhxrylRIz3CQc=";
  }).overrideAttrs (prev: {
    src = prev.src.overrideAttrs (_: { env.GOPROXY = "sup"; });
  })
'
...
/nix/store/rgmygksbfyy75iappxpinv0y8lxfq35x-go-1.24.6/bin/go mod init caddy
       > go: creating new go.mod: module caddy
       > go: to add module requirements and sums:
       >    go mod tidy
       > 2025/09/09 12:00:02 [INFO] Pinning versions
       > 2025/09/09 12:00:02 [INFO] exec (timeout=0s): /nix/store/rgmygksbfyy75iappxpinv0y8lxfq35x-go-1.24.6/bin/go get -v github.com/caddyserver/caddy/v2@v2.10.2
       > go: github.com/caddyserver/caddy/v2@v2.10.2: invalid proxy URL missing scheme: sup
       > 2025/09/09 12:00:02 [FATAL] exit status 1
...

shoud give you what you want

stepbrobd · 2025-09-09T14:32:42Z

for future reference, if you have a question on using caddy withPlugins, or for some reason it doesn't work for your use case, please open a new issue and ping the maintainers there instead of replying to this old PR. thanks!

vincentbernat requested a review from emilylange November 23, 2024 23:37

stepbrobd reviewed Nov 24, 2024

View reviewed changes

vincentbernat force-pushed the feature/caddy-plugins branch from 6068ba7 to 72a4b4b Compare November 24, 2024 08:04

ofborg bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux. labels Nov 24, 2024

vincentbernat force-pushed the feature/caddy-plugins branch from 72a4b4b to 2144da1 Compare November 25, 2024 07:56

Nanotwerp mentioned this pull request Nov 28, 2024

caddy: add support for compiling with Caddy modules (plugins) #317881

Closed

13 tasks

stepbrobd approved these changes Nov 29, 2024

View reviewed changes

stepbrobd added the 12.approvals: 1 This PR was reviewed and approved by one person. label Nov 29, 2024

NickCao reviewed Nov 29, 2024

View reviewed changes

vincentbernat force-pushed the feature/caddy-plugins branch from 2144da1 to 15314ff Compare November 30, 2024 06:33

vincentbernat force-pushed the feature/caddy-plugins branch 2 times, most recently from e1c0a97 to 56bc3a5 Compare December 1, 2024 07:03

github-actions bot added 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: documentation This PR adds or changes documentation 8.has: changelog This PR adds or changes release notes labels Dec 1, 2024

github-actions bot added 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. and removed 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux. labels Dec 1, 2024

wegank removed the 12.approvals: 1 This PR was reviewed and approved by one person. label Dec 1, 2024

stepbrobd approved these changes Dec 3, 2024

View reviewed changes

stepbrobd added the 12.approvals: 1 This PR was reviewed and approved by one person. label Dec 3, 2024

vincentbernat force-pushed the feature/caddy-plugins branch from 56bc3a5 to b8a1497 Compare December 3, 2024 18:02

wegank removed the 12.approvals: 1 This PR was reviewed and approved by one person. label Dec 3, 2024

kusold reviewed Dec 4, 2024

View reviewed changes

thiagokokada reviewed Dec 19, 2024

View reviewed changes

vincentbernat added 2 commits December 24, 2024 18:08

caddy: move withPlugins function into a dedicated file

4642e27

caddy: avoid use of builtins and prefer lib

e57d662

There is no `lib.hashString`, so keep using `builtins` for this one.

vincentbernat force-pushed the feature/caddy-plugins branch from 08407c0 to e57d662 Compare December 24, 2024 17:10

thiagokokada approved these changes Dec 24, 2024

View reviewed changes

griffi-gh approved these changes Dec 24, 2024

View reviewed changes

wegank added the 12.approvals: 2 This PR was reviewed and approved by two persons. label Dec 26, 2024

thiagokokada merged commit 9ceb117 into NixOS:master Dec 26, 2024
4 of 5 checks passed

stepbrobd mentioned this pull request Dec 27, 2024

caddy: withPlugins better error messages for untagged plugins #368657

Merged

13 tasks

jdheyburn mentioned this pull request Jan 1, 2025

Use upstream caddy jdheyburn/nixos-configs#89

Merged

phanirithvij mentioned this pull request Jan 2, 2025

caddy: Allow adding external plugins #259275

Closed

12 tasks

Wint3rmute mentioned this pull request Jan 4, 2025

Waiting for first release mholt/caddy-ratelimit#51

Closed

aqxa1 mentioned this pull request Jan 23, 2025

Add version tag caddy-dns/desec#10

Closed

stepbrobd mentioned this pull request Jul 12, 2025

nixos/caddy: secure admin API #389055

Open

13 tasks

stepbrobd mentioned this pull request Aug 13, 2025

caddy: clean up withPlugins logic and support replacement #433072

Merged

13 tasks

michaelfranzl mentioned this pull request Sep 28, 2025

Caddy with plugins now supported in nixpkgs pinpox/nixos-caddy-patched#3

Closed

Uh oh!

Conversation

vincentbernat commented Nov 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Things done

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stepbrobd commented Nov 29, 2024

Uh oh!

stepbrobd commented Nov 29, 2024

Uh oh!

NickCao left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BatteredBunny commented Nov 30, 2024

Uh oh!

vincentbernat commented Dec 1, 2024

Uh oh!

vincentbernat commented Dec 3, 2024

Uh oh!

kusold Dec 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

thegatesdev commented Dec 5, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

oxalica commented Dec 27, 2024

Uh oh!

stepbrobd commented Dec 27, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oxalica commented Jan 13, 2025

Uh oh!

stepbrobd commented Jan 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nixos-discourse commented Mar 18, 2025

Uh oh!

nixos-discourse commented Mar 24, 2025

Uh oh!

Jonas-Sander commented Apr 7, 2025

Uh oh!

aaravrav commented Aug 30, 2025

Uh oh!

stepbrobd commented Aug 30, 2025

Uh oh!

sokai commented Sep 3, 2025

Uh oh!

stepbrobd commented Sep 3, 2025

Uh oh!

sokai commented Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

stepbrobd commented Sep 9, 2025

vincentbernat commented Nov 23, 2024 •

edited

Loading

kusold Dec 4, 2024 •

edited

Loading

stepbrobd commented Dec 27, 2024 •

edited

Loading

stepbrobd commented Jan 14, 2025 •

edited

Loading

sokai commented Sep 3, 2025 •

edited

Loading