V2.10.0-beta.1 dns vs acme_dns

jum · March 7, 2025, 2:34pm

I am seeing when I use the new beta 2.10.0 if I have acme_dns configured globally, I also have to set the new dns global directive, otherwise caddy will not start. I do not yet have anything configured for ech, is that expected behavior? I find it slightly confusing that I have to set both global options although nothing changed in my config.

matt · March 7, 2025, 5:24pm

Thanks for trying the beta! Fixed here already:

github.com/caddyserver/caddy

v2.10.0-beta.1: provision http: DNS challenge enabled, but no DNS provider configured

opened 10:15PM - 06 Mar 25 UTC

closed 04:46PM - 07 Mar 25 UTC

steffenbusch

bug

With the Caddy v2.10.0-beta.1, ``` $ ./caddy-v2.10 I get this error on startup: class="show-more-container">….0-beta1 run --watch -c Caddyfile-dns-error maxprocs: Leaving GOMAXPROCS=1: CPU quota undefined GOMEMLIMIT is updated {"package": "github.com/KimMachineGun/automemlimit/memlimit", "GOMEMLIMIT": 1582722662, "previous": 9223372036854775807} using config from file {"file": "Caddyfile-dns-error"} adapted config to JSON {"adapter": "caddyfile"} admin admin endpoint started {"address": "localhost:2019", "enforce_origin": false, "origins": ["//localhost:2019", "//[::1]:2019", "//127.0.0.1:2019"]} http.auto_https server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS {"server_name": "srv0", "https_port": 8443} http.auto_https enabling automatic HTTP->HTTPS redirects {"server_name": "srv0"} tls.cache.maintenance started background certificate maintenance {"cache": "0xc000552b80"} tls.cache.maintenance stopped background certificate maintenance {"cache": "0xc000552b80"} config: loading new config: loading http app module: provision http: DNS challenge enabled, but no DNS provider configured {file.cloudflare-api-key.txt} working and Caddy can start: --watch -c Caddyfile-dns-error using config from file {"file": "Caddyfile-dns-error"} adapted config to JSON {"adapter": "caddyfile"} admin admin endpoint started {"address": "localhost:2019", "enforce_origin": false, "origins": ["//[::1]:2019", "//127.0.0.1:2019", "//localhost:2019"]} http.auto_https server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS {"server_name": "srv0", "https_port": 8443} http.auto_https enabling automatic HTTP->HTTPS redirects {"server_name": "srv0"} http.auto_https adjusted config {"tls": {"automation":{"policies":[{"subjects":["todo.stbu.net"]},{}]}}, "http": {"http_port":8080,"https_port":8443,"servers":{"remaining_auto_https_redirects":{"listen":[":8080"],"routes":[{},{}]},"srv0":{"listen":[":8443"],"routes":[{"handle":[{"handler":"subroute","routes":[{"handle":[{"body":"test","handler":"static_response"}]}]}],"terminal":true}],"tls_connection_policies":[{}],"automatic_https":{}}}}} starting server loop {"address": "[::]:8443", "tls": true, "http3": false} http enabling HTTP/3 listener {"addr": ":8443"} failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details. http.log server running {"name": "srv0", "protocols": ["h1", "h2", "h3"]} starting server loop {"address": "[::]:8080", "tls": false, "http3": false} http HTTP/2 skipped because it requires TLS {"network": "tcp", "addr": ":8080"} http HTTP/3 skipped because it requires TLS {"network": "tcp", "addr": ":8080"} http.log server running {"name": "remaining_auto_https_redirects", "protocols": ["h1", "h2", "h3"]} http enabling automatic TLS certificate management {"domains": ["todo.stbu.net"]} tls.cache added certificate to cache {"subjects": ["todo.stbu.net"], "expiration": "2025/05/13 17:02:13.000", "managed": true, "issuer_key": "acme-v02.api.letsencrypt.org-directory", "hash": "951e9c1498a2fd04914f6a6a288684a419d2a47702e4c484605c1659c4dcfcb3", "cache_size": 1, "cache_capacity": 10000} events event {"name": "cached_managed_cert", "id": "4c9a92f4-ffd6-4cfc-87ad-65d8ccc3e62c", "origin": "tls", "data": {"sans":["todo.stbu.net"]}} autosaved config (load with --resume flag) {"file": "/home/stbu/.config/caddy/autosave.json"} serving initial configuration watcher watching config file for changes {"config_file": "Caddyfile-dns-error"} tls.cache.maintenance started background certificate maintenance {"cache": "0xc000afc700"}

jum · March 7, 2025, 7:55pm

Indeed. But if I use the new version, what do I do with tailscale certificates? I am using cloudflare for all my production endpoints, but internally I have web hooks running on my tailnet. I got the impression, that even though a tailnet acquires its cert via the tailscale daemon, it will now complain about not having a dns global default. But this global default is not authoritative there, is is only for the cloudflare domains. Is there a way to decouple this?

jum · March 7, 2025, 8:15pm

I have just noticed that this might also be the stale go proxy problem. Will build again and see what happens.