caddy-security

Security App with Authentication and Authorization Plugins for Caddy v2.

It includes:

• Authentication Plugin for implementing Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0, SAML Authentication
• Authorization Plugin for HTTP request authorization based on JWT/PASETO tokens
• Credentials Plugin for managing credentials for various integrations

To retain sessions and generated signing keys across restarts, enable persistent runtime state. It supports portals and direct OAuth policies without a portal. Persistent deployments require a complete stop/start; overlapping reload is rejected.

Please show your appreciation for this work and :star: :star: :star:

Please consider sponsoring this project via Github Sponsors!

Please ask questions either here or via LinkedIn. I am happy to help you! @greenpau

Documentation for this project was previously hosted at https://docs.authcrunch.com. As AI agents become part of the development workflow, this repository is moving to skill-based documentation that helps both humans and AI agents work with the codebase.

See Runtime ownership and reload behavior for request draining, failed replacement cleanup, and the restriction on overlapping runtimes that use the same local identity file.

For standalone command-line portal login with named profiles, see caddy-authenticator for release downloads, Go installation and usage. Its release archives support Linux, macOS and Windows on amd64 and arm64.

Run bin/authcrunch security version to display the linked go-authcrunch version. See version diagnostics for module replacement details.

Download Caddy with the plugins enabled:

• windows/amd64
• linux/amd64

Tests and Reports

Run make dep to download module dependencies and resolve the pinned tested tool, then make test for race-enabled Go tests and coverage. Open .coverage/index.html for the report dashboard. make run-reports rebuilds reports from recorded evidence without rerunning tests.

Test and report workflows require Python 3.9+ and macOS or Linux. They stream progress and monitor resource usage, with one guarded run per checkout. See test resource controls for limits, overrides and interruption evidence.

make ci-check runs version checks, automation fixtures, the full Go suite, and the Caddy binary build. GitHub Actions uploads the complete report bundle with a versioned name, including failure evidence, and retains it for 14 days. Release publication requires the same CI gate.

See Testing and CI for focused runs and report files, and Release and Versioning for artifact names and release procedures.