Merge pull request mozilla#261 from gstrauss/caddy-update

Fix Caddy 2 configs, drop Caddy 1 support

src/js/configs.js

@@ -37,7 +37,7 @@ module.exports = {
   caddy: {
     cipherFormat: 'caddy',
     highlighter: 'nginx', // TODO: find better
-    latestVersion: '2.1.1',
+    latestVersion: '2.8.4',
     name: 'Caddy',
     supportsOcspStapling: false, // actually true; can't be disabled in Caddy
     tls13: '0.11.5',

src/templates/partials/caddy.hbs

@@ -1,43 +1,31 @@
 # {{output.header}}
 # {{{output.link}}}
-{{#unless (includes "old" form.config)}}
+{{#unless (minver "2.0.0" form.serverVersion)}}
+# note that Caddy version 1 reached end-of-life > 4 years ago back in 2020
+{{else}}
+{{#if (includes "old" form.config)}}
+# note that Caddy supports only TLSv1.2 and later
+{{else}}
 # note that Caddy automatically configures safe TLS settings
+{{/if}}
 {{/unless}}
 
 # replace example.com with your domain name
-example.com
-{{! This is a big of a kludge due to Caddy restrictions on TLS versions and cipher suites }}
-{{#if (includes "old" form.config)}}
-
-tls {
-    protocols tls1.0 tls1.3
-    {{#if (minver "2.0.0" form.serverVersion)}}
-    ciphers {{{join output.ciphers " "}}}
-    {{ else }}
-    ciphers ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-WITH-CHACHA20-POLY1305 ECDHE-RSA-WITH-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-CBC-SHA ECDHE-RSA-AES256-CBC-SHA ECDHE-RSA-AES128-CBC-SHA ECDHE-ECDSA-AES256-CBC-SHA RSA-AES128-CBC-SHA RSA-AES256-CBC-SHA RSA-3DES-EDE-CBC-SHA
-    {{/if}}
-}
-{{/if}}
-{{#if (includes "intermediate" form.config)}}
+example.com {
 
-# Due to a lack of DHE support, you -must- use an ECDSA cert to support IE 11 on Windows 7
-tls {
-    protocols tls1.2 tls1.3
-    {{#if (minver "2.0.0" form.serverVersion)}}
+  tls {
+{{#if output.ciphers.length}}
+    # Due to a lack of DHE support, you -must- use an ECDSA cert to support IE 11 on Windows 7
     ciphers {{{join output.ciphers " "}}}
-    {{ else }}
-    ciphers ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-WITH-CHACHA20-POLY1305 ECDHE-RSA-WITH-CHACHA20-POLY1305
-    {{/if}}
-}
 {{/if}}
 {{#if (includes "modern" form.config)}}
-
-tls {
     protocols tls1.3
-}
 {{/if}}
+  }
 {{#if form.hsts}}
 
-# HSTS ({{output.hstsMaxAge}} seconds)
-header Strict-Transport-Security "max-age={{output.hstsMaxAge}}"
+  # HSTS ({{output.hstsMaxAge}} seconds)
+  header Strict-Transport-Security "max-age={{output.hstsMaxAge}}"
 {{/if}}
+
+}