fix(caddyfile): stop blanking every forwarded TLS/request header

[forgetso]

Problem

Every x-tls-* / x-client-ip / x-method / x-remote-* header forwarded to the provider was written as a two-line header_up pair — the value line plus a header_up X "^{placeholder}$" "" guard meant to blank the header when the placeholder didn't expand:

header_up x-tls-resumed "{http.request.tls.resumed}"
header_up x-tls-resumed "^{http.request.tls.resumed}$" ""

The guard is self-defeating: Caddy expands placeholders inside the search argument too, so ^{http.request.tls.resumed}$ becomes the same value line 1 just set, the regex always matches, and the header is replaced with "".

Impact

Every stable TLS/connection field was blanked on 100% of requests — x-tls-resumed, x-tls-version, x-tls-cipher, x-tls-server-name, x-client-ip, x-method, x-remote-host, x-remote-port. Verified against 200k recent production sessions: x-tls-resumed was "" or absent on every single one.

The smoking gun: x-duration-ms uses the same pattern but survives, because its value ticks upward between the two evaluations, so the regex no longer matches. That's what identified the mechanism.

req.TLS is fine (chaddy's handler.go gates on req.TLS.HandshakeComplete and populates x-tls-clienthello), and the placeholders are valid — the values were purely being wiped by the guard.

Fix

Collapse each pair to a single line. Every placeholder is a valid Caddy v2.8.4 shorthand or {http.request.*} field (checked against shorthands.go / replacer.go), which resolves to its value or an empty string — never a literal — so the guard is unnecessary.

Also corrects two genuinely-invalid placeholders: {http.request.tls.public_key} / {http.request.tls.public_key_sha256} don't exist (Caddy only has them under the client-cert namespace). Left with the guard removed they'd forward a literal {...}; repointed to {http.request.tls.client.public_key[_sha256]}, which resolve to "" for the captcha clients (no client certs).

Result

x-tls-resumed now carries the real true/false session-resumption bit, and the other TLS/connection headers populate as intended. Applied to both provider.Caddyfile and local.Caddyfile; both pass caddy fmt.

🤖 Generated with Claude Code