[iloveitaly]

Obviously, this was built with AI. I reviewed + tested all of the code. It's working great for me.

Motivation

Update the embedded proxy and Go dependencies to pick up Caddy's streaming, connection handling, TLS, and security fixes since 2.10.0.

Description

Upgrade Caddy to 2.11.7 and refresh the Go module dependencies, including migrating shellescape and YAML v2 to their maintained import paths. Align CI, lint, and Nix with the resulting Go 1.26.9 minimum; refresh the nixpkgs pin and vendor hash so Nix builds continue to work.

Document the Go requirement, incremental streaming, request limits, and header filtering in the README.

Caddy behavior

• 2.11.7 fixes an HTTP/2 proxy panic and premature stream termination introduced in 2.11.6. Quiet SSE responses survive pauses between writes, and upstreams can send Incremental: ?1 for immediate forwarding.
• Other benefits include partial-response flushing, TCP half-close propagation on upgraded streams, HTTP/3 fixes for low-MTU links such as Tailscale, lower TLS handshake overhead, and security fixes across HTTP/TLS handling.
• Compatibility changes include a 16 KiB request-header limit (previously 1 MiB), one-minute stalled-I/O timeouts, and filtering of request headers containing underscores or dots. Localias does not currently expose Caddy's max_header_size, read_body_idle, write_idle, expected_underscore_headers, or expected_dot_headers settings.
• No additional generated Caddy directives are needed. Internal on-demand certificates continue to use the existing Localias CA and storage, with the admin listener disabled. The new HTTPS-upstream Host rewrite does not affect Localias's plain HTTP localhost:<port> backends. Caddy's file-based CLI SIGUSR1 reload does not apply to configurations loaded through caddy.Load.

Test

• Passed go test ./..., including a new Caddy configuration regression test for internal on-demand certificates, HTTPS aliases, and the disabled admin listener.
• Passed golangci-lint 2.15.0, go mod tidy -diff, and go mod verify.
• Built all four macOS/Linux amd64/arm64 release targets and ran the local macOS binary.
• Passed the Linux ARM64 Nix build and flake checks.

This will be a good update to test with the new SemVer release process in #75. Once that process lands, use this release to confirm ordered tags, matching embedded binary versions, correct asset uploads, and latest-version detection by mise.

Links

• Continues the dependency refresh from feat: update to caddy v2.10.0 #62.
• Relates to fix(release): use ordered SemVer tags so mise detects the latest version #75.
• Caddy 2.11.7 release notes
• Caddy 2.11.6 release notes and breaking changes
• Caddy 2.11.1 release notes
• Follow-up JSON CLI layer: feat(cli): add JSON output for list and status #77 (depends on this Caddy upgrade).