When I enable Coraza on a host, I get these lines repeating in my main caddy log.
{"level":"info","ts":1778924053.9293013,"msg":"http: superfluous response.WriteHeader call"}
{"level":"info","ts":1778924055.384399,"msg":"http: superfluous response.WriteHeader call"}
{"level":"info","ts":1778924056.2240324,"msg":"http: superfluous response.WriteHeader call"}
{"level":"info","ts":1778924058.6971262,"msg":"http: superfluous response.WriteHeader call"}
{"level":"info","ts":1778924059.9666855,"msg":"http: superfluous response.WriteHeader call"}
{"level":"info","ts":1778924061.1894848,"msg":"http: superfluous response.WriteHeader call"}
A typical caddy vhost looks like this:
(main) {
tls /etc/caddy/certs/{args[0]}_fullchain.pem /etc/caddy/certs/{args[0]}_privkey.pem {
curves x25519mlkem768 x25519 secp521r1 secp384r1 secp256r1
}
log {
output file /var/log/caddy/{args[0]}.log {
roll_disabled
}
format json
}
encode zstd br gzip
}
git.tnonline.net:443 {
import main git.tnonline.net
coraza_waf {
load_owasp_crs
directives `
Include @coraza.conf-recommended
Include @crs-setup.conf.example
Include @owasp_crs/*.conf
SecRequestBodyLimitAction ProcessPartial
SecAuditEngine RelevantOnly
SecAuditLog /var/log/caddy/coraza_audit_git.tnonline.net.log
SecAuditLogParts ABFHJKZ
SecRuleEngine On
`
}
root * /var/www/domains/git.tnonline.net/htdocs
file_server
@https not path /.well-known/*
reverse_proxy @https 127.0.0.1:3000 {
header_up X-Real-Ip {remote_host}
header_up X-Http-Version {http.request.proto}
}
}
When I enable Coraza on a host, I get these lines repeating in my main caddy log.
A typical caddy vhost looks like this: