Build Caddy with plugins
Find a file
a 053cb6b8f1
Expose build steps and per-step output to API consumers (#276)
* Expose build steps and per-step output to API consumers

Add an optional OnStep callback to Builder that makes builds
observable and controllable programmatically, e.g. for tools that
embed xcaddy and want to show live, per-stage build progress. The
zero value changes nothing: with OnStep nil, output goes to the
standard log package and os.Stdout/os.Stderr exactly as before, and
the CLI is unaffected.

The build is modeled as a sequence of named steps (create_environment,
initialize_module, pin_versions, windows_resources, tidy_module,
compile, cleanup). For each step, the callback receives a StepEvent
whose Output is an io.Reader over everything the step produces:
xcaddy's own log lines as well as the stdout and stderr of the
underlying go commands. The callback runs in its own goroutine,
concurrently with its step, so a consumer needs no goroutine of its
own -- it simply reads Output (e.g. with a bufio.Scanner) until EOF,
which arrives when the step ends:

	OnStep: func(e *xcaddy.StepEvent) error {
		scanner := bufio.NewScanner(e.Output)
		for scanner.Scan() {
			showProgress(e.Step, scanner.Text())
		}
		return scanner.Err()
	}

Output is backed by a builder-owned buffered pipe whose write side
never blocks, so a slow or absent consumer can never stall or
deadlock the build; output is readable the moment it is produced,
the builder closes the write side at the step boundary, and unread
output is discarded. Callbacks never overlap: the next step does not
begin until the previous step's callback has returned, and Build
does not return until the final callback has.

Returning a non-nil error from the callback aborts the build at the
end of the step, and the error is returned from Build wrapped with
the step name; aborting never leaks the temporary build folder.
Errors from the deferred cleanup path (environment.Close) are now
joined into Build's returned error instead of being discarded.

* Support hermetic environments and secret redaction for publishable logs

Two additions for consumers that publish build logs (world-readable
live progress, CI services, multi-tenant builders):

Builder.Env, if non-nil, is used as the entire environment of the
underlying go commands instead of inheriting the process's. This
enables hermetic, credential-free builds -- the strongest guarantee
for publishable logs: if the build never had access to a credential
(GOPROXY userinfo, git config, .netrc, cloud keys), no error message
or verbose output can leak one.

Builder.Secrets and Builder.RedactCredentials add a masking backstop
between the build's output and StepEvent.Output. Secrets performs
exact-value redaction; RedactCredentials masks common credential
shapes (userinfo in URLs, GitHub/GitLab/Slack tokens, AWS access key
IDs, and PEM private key blocks, including multi-line bodies). The
redactor is line-buffered so a secret can never slip through by
straddling a write boundary, and it flushes any unterminated final
line, masked, when the step ends.
2026-07-09 14:13:47 -06:00
.github build(deps): bump actions/cache from 5 to 6 (#273) 2026-07-02 12:57:08 +03:00
cmd Add PGO support to xcaddy (#259) 2026-03-17 08:59:59 -06:00
internal/utils embed icon and version information to windows builds (#184) 2024-05-29 14:45:07 -06:00
.gitignore bugfix- #221, xcaddy skips minor updates of lexical submodules (#238) 2025-05-05 10:53:03 -06:00
.golangci.yml chore: upgrade to golangci-lint v2 (#242) 2025-06-02 21:26:42 +03:00
.goreleaser.yml chore: fix lint (#229) 2025-03-02 23:02:35 +03:00
builder.go Expose build steps and per-step output to API consumers (#276) 2026-07-09 14:13:47 -06:00
builder_test.go Expose build steps and per-step output to API consumers (#276) 2026-07-09 14:13:47 -06:00
environment.go Expose build steps and per-step output to API consumers (#276) 2026-07-09 14:13:47 -06:00
environment_test.go build: ensure build flags are inserted before arguments (#223) 2025-01-17 02:36:34 +03:00
go.mod build(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 (#265) 2026-06-20 01:47:36 +03:00
go.sum build(deps): bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 (#265) 2026-06-20 01:47:36 +03:00
io.go Expose build steps and per-step output to API consumers (#276) 2026-07-09 14:13:47 -06:00
LICENSE Initial commit 2020-03-21 14:31:29 -06:00
platforms.go Do not use only hardcoded "go" (#97) 2022-04-25 10:13:12 -06:00
README.md Add PGO support to xcaddy (#259) 2026-03-17 08:59:59 -06:00
redact.go Expose build steps and per-step output to API consumers (#276) 2026-07-09 14:13:47 -06:00

xcaddy - Custom Caddy Builder

This command line tool and associated Go package makes it easy to make custom builds of the Caddy Web Server.

It is used heavily by Caddy plugin developers as well as anyone who wishes to make custom caddy binaries (with or without plugins).

Stay updated, be aware of changes, and please submit feedback! Thanks!

Requirements

Install

You can download binaries that are already compiled for your platform from the Release tab.

You may also build xcaddy from source:

go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest

For Debian, Ubuntu, and Raspbian, an xcaddy package is available from our Cloudsmith repo:

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-xcaddy-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/xcaddy/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-xcaddy.list
sudo apt update
sudo apt install xcaddy

⚠️ Pro tip

If you find yourself fighting xcaddy in relation to your custom or proprietary build or development process, it might be easier to just build Caddy manually!

Caddy's main.go file, the main entry point to the application, has instructions in the comments explaining how to build Caddy essentially the same way xcaddy does it. But when you use the go command directly, you have more control over the whole thing and it may save you a lot of trouble.

The manual build procedure is very easy: just copy the main.go into a new folder, initialize a Go module, plug in your plugins (add an import for each one) and then run go build. Of course, you may wish to customize the go.mod file to your liking (specific dependency versions, replacements, etc).

Command usage

The xcaddy command has two primary uses:

  1. Compile custom caddy binaries
  2. A replacement for go run while developing Caddy plugins

The xcaddy command will use the latest version of Caddy by default. You can customize this for all invocations by setting the CADDY_VERSION environment variable.

As usual with go command, the xcaddy command will pass the GOOS, GOARCH, and GOARM environment variables through for cross-compilation.

Note that xcaddy will ignore the vendor/ folder with -mod=readonly.

Custom builds

Syntax:

$ xcaddy build [<caddy_version>]
    [--output <file>]
    [--with <module[@version][=replacement]>...]
    [--replace <module[@version]=replacement>...]
    [--embed <[alias]:path/to/dir>...]
    [--pgo <file>] # EXPERIMENTAL
  • <caddy_version> is the core Caddy version to build; defaults to CADDY_VERSION env variable or latest.
    This can be the keyword latest, which will use the latest stable tag, or any git ref such as:

    • A tag like v2.0.1
    • A branch like master
    • A commit like a58f240d3ecbb59285303746406cab50217f8d24
  • --output changes the output file.

  • --with can be used multiple times to add plugins by specifying the Go module name and optionally its version, similar to go get. Module name is required, but specific version and/or local replacement are optional.

  • --replace is like --with, but does not add a blank import to the code; it only writes a replace directive to go.mod, which is useful when developing on Caddy's dependencies (ones that are not Caddy modules). Try this if you got an error when using --with, like cannot find module providing package.

  • --embed can be used to embed the contents of a directory into the Caddy executable. --embed can be passed multiple times with separate source directories. The source directory can be prefixed with a custom alias and a colon : to write the embedded files into an aliased subdirectory, which is useful when combined with the root directive and sub-directive.

  • --pgo can be used to specify a file containing a profile to use for profile guided optimization. If a file named default.pgo is present in the current directory, it will automatically be used. This feature is new to xcaddy and is considered experimental.

Examples

$ xcaddy build \
    --with github.com/caddyserver/ntlm-transport

$ xcaddy build v2.0.1 \
    --with github.com/caddyserver/ntlm-transport@v0.1.1

$ xcaddy build master \
    --with github.com/caddyserver/ntlm-transport

$ xcaddy build a58f240d3ecbb59285303746406cab50217f8d24 \
    --with github.com/caddyserver/ntlm-transport

$ xcaddy build \
    --with github.com/caddyserver/ntlm-transport=../../my-fork

$ xcaddy build \
    --with github.com/caddyserver/ntlm-transport@v0.1.1=../../my-fork

You can even replace Caddy core using the --with flag:

$ xcaddy build \
    --with github.com/caddyserver/caddy/v2=../../my-caddy-fork
    
$ xcaddy build \
    --with github.com/caddyserver/caddy/v2=github.com/my-user/caddy/v2@some-branch

This allows you to hack on Caddy core (and optionally plug in extra modules at the same time!) with relative ease.


If --embed is used without an alias prefix, the contents of the source directory are written directly into the root directory of the embedded filesystem within the Caddy executable. The contents of multiple unaliased source directories will be merged together:

$ xcaddy build --embed ./my-files --embed ./my-other-files
$ cat Caddyfile
{
	# You must declare a custom filesystem using the `embedded` module.
	# The first argument to `filesystem` is an arbitrary identifier
	# that will also be passed to `fs` directives.
	filesystem my_embeds embedded
}

localhost {
	# This serves the files or directories that were
	# contained inside of ./my-files and ./my-other-files
	file_server {
		fs my_embeds
	}
}

You may also prefix the source directory with a custom alias and colon separator to write the source directory's contents to a separate subdirectory within the embedded filesystem:

$ xcaddy build --embed foo:./sites/foo --embed bar:./sites/bar
$ cat Caddyfile
{
	filesystem my_embeds embedded
}

foo.localhost {
	# This serves the files or directories that were
	# contained inside of ./sites/foo
	root * /foo
	file_server {
		fs my_embeds
	}
}

bar.localhost {
	# This serves the files or directories that were
	# contained inside of ./sites/bar
	root * /bar
	file_server {
		fs my_embeds
	}
}

This allows you to serve 2 sites from 2 different embedded directories, which are referenced by aliases, from a single Caddy executable.


If you need to work on Caddy's dependencies, you can use the --replace flag to replace it with a local copy of that dependency (or your fork on github etc if you need):

$ xcaddy build some-branch-on-caddy \
    --replace golang.org/x/net=../net

For plugin development

If you run xcaddy from within the folder of the Caddy plugin you're working on without the build subcommand, it will build Caddy with your current module and run it, as if you manually plugged it in and invoked go run.

The binary will be built and run from the current directory, then cleaned up.

The current working directory must be inside an initialized Go module.

Syntax:

$ xcaddy <args...>
  • <args...> are passed through to the caddy command.

For example:

$ xcaddy list-modules
$ xcaddy run
$ xcaddy run --config caddy.json

The race detector can be enabled by setting XCADDY_RACE_DETECTOR=1. The DWARF debug info can be enabled by setting XCADDY_DEBUG=1.

Getting xcaddy's version

$ xcaddy version

Library usage

builder := xcaddy.Builder{
	CaddyVersion: "v2.0.0",
	Plugins: []xcaddy.Dependency{
		{
			ModulePath: "github.com/caddyserver/ntlm-transport",
			Version:    "v0.1.1",
		},
	},
}
err := builder.Build(context.Background(), "./caddy")

Versions can be anything compatible with go get.

Environment variables

Because the subcommands and flags are constrained to benefit rapid plugin prototyping, xcaddy does read some environment variables to take cues for its behavior and/or configuration when there is no room for flags.

  • CADDY_VERSION sets the version of Caddy to build.
  • XCADDY_RACE_DETECTOR=1 enables the Go race detector in the build.
  • XCADDY_DEBUG=1 enables the DWARF debug information in the build.
  • XCADDY_SETCAP=1 will run sudo setcap cap_net_bind_service=+ep on the resulting binary. By default, the sudo command will be used if it is found; set XCADDY_SUDO=0 to avoid using sudo if necessary.
  • XCADDY_SKIP_BUILD=1 causes xcaddy to not compile the program, it is used in conjunction with build tools such as GoReleaser. Implies XCADDY_SKIP_CLEANUP=1.
  • XCADDY_SKIP_CLEANUP=1 causes xcaddy to leave build artifacts on disk after exiting.
  • XCADDY_WHICH_GO sets the go command to use when for example more then 1 version of go is installed.
  • XCADDY_GO_BUILD_FLAGS overrides default build arguments. Supports Unix-style shell quoting, for example: XCADDY_GO_BUILD_FLAGS="-ldflags '-w -s'". The provided flags are applied to go commands: build, clean, get, install, list, run, and test
  • XCADDY_GO_MOD_FLAGS overrides default go mod arguments. Supports Unix-style shell quoting.

© 2020 Matthew Holt