Release 2026.2.0

TUN-9858: Remove proxy-dns feature from cloudflared
Remove the DNS over HTTPS (DoH) proxy feature built on CoreDNS due to security vulnerabilities (GO-2025-3942, GO-2026-4289). This removes: - Standalone proxy-dns command (cloudflared proxy-dns) - Tunnel subcommand (cloudflared tunnel proxy-dns) - Proxy-dns flags for tunnel run (--proxy-dns, --proxy-dns-port, etc.) - Config file resolver section support - tunneldns/ package (CoreDNS-based implementation) - Related component tests BREAKING CHANGE: The proxy-dns feature is no longer available. Users should migrate to alternative DNS over HTTPS solutions.
2026-06-08 13:33:07 +00:00 · 2026-02-06 14:21:32 +00:00 · 2026-02-06 12:43:53 +00:00 · 2026-02-06 10:01:07 +00:00 · 2026-01-23 12:45:53 +00:00 · 2026-01-23 12:45:36 +00:00
306 changed files with 1771 additions and 50453 deletions
@@ -0,0 +1,151 @@
+.register_inputs: &register_inputs
+  stage: release-internal
+  runOnBranches: "^master$"
+  COMPONENT: "common"
+
+.register_inputs_stable_bookworm: &register_inputs_stable_bookworm
+  <<: *register_inputs
+  runOnChangesTo: ['RELEASE_NOTES']
+  FLAVOR: "bookworm"
+  SERIES: "stable"
+
+.register_inputs_stable_trixie: &register_inputs_stable_trixie
+  <<: *register_inputs
+  runOnChangesTo: ['RELEASE_NOTES']
+  FLAVOR: "trixie"
+  SERIES: "stable"
+
+.register_inputs_next_bookworm: &register_inputs_next_bookworm
+  <<: *register_inputs
+  FLAVOR: "bookworm"
+  SERIES: next
+
+.register_inputs_next_trixie: &register_inputs_next_trixie
+  <<: *register_inputs
+  FLAVOR: "trixie"
+  SERIES: next
+
+################################################
+### Generate Debian Package for Internal APT ###
+################################################
+.cloudflared-apt-build: &cloudflared_apt_build
+  stage: package
+  needs:
+    - ci-image-get-image-ref
+    - linux-packaging # For consistency, we only run this job after we knew we could build the packages for external delivery
+  image: $BUILD_IMAGE
+  cache: {}
+  script:
+    - make cloudflared-deb
+  artifacts:
+    paths:
+      - cloudflared*.deb
+
+##############
+### Stable ###
+##############
+cloudflared-amd64-stable:
+  <<: *cloudflared_apt_build
+  rules:
+    - !reference [.default-rules, run-on-release]
+  variables: &amd64-stable-vars
+    GOOS: linux
+    GOARCH: amd64
+    FIPS: true
+    ORIGINAL_NAME: true
+    CGO_ENABLED: 1
+
+cloudflared-arm64-stable:
+  <<: *cloudflared_apt_build
+  rules:
+    - !reference [.default-rules, run-on-release]
+  variables: &arm64-stable-vars
+    GOOS: linux
+    GOARCH: arm64
+    FIPS: false # TUN-7595
+    ORIGINAL_NAME: true
+    CGO_ENABLED: 1
+
+############
+### Next ###
+############
+cloudflared-amd64-next:
+  <<: *cloudflared_apt_build
+  rules:
+    - !reference [.default-rules, run-on-master]
+  variables:
+    <<: *amd64-stable-vars
+    NIGHTLY: true
+
+cloudflared-arm64-next:
+  <<: *cloudflared_apt_build
+  rules:
+    - !reference [.default-rules, run-on-master]
+  variables:
+    <<: *arm64-stable-vars
+    NIGHTLY: true
+
+include:
+  - local: .ci/commons.gitlab-ci.yml
+
+  ##########################################
+  ### Publish Packages to Internal Repos ###
+  ##########################################
+  # Bookworm AMD64
+  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
+    inputs:
+      <<: *register_inputs_stable_bookworm
+      jobPrefix: cloudflared-bookworm-amd64
+      needs: &amd64-stable ["cloudflared-amd64-stable"]
+
+  # Bookworm ARM64
+  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
+    inputs:
+      <<: *register_inputs_stable_bookworm
+      jobPrefix: cloudflared-bookworm-arm64
+      needs: &arm64-stable ["cloudflared-arm64-stable"]
+
+  # Trixie AMD64
+  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
+    inputs:
+      <<: *register_inputs_stable_trixie
+      jobPrefix: cloudflared-trixie-amd64
+      needs: *amd64-stable
+
+  # Trixie ARM64
+  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
+    inputs:
+      <<: *register_inputs_stable_trixie
+      jobPrefix: cloudflared-trixie-arm64
+      needs: *arm64-stable
+
+  ##################################################
+  ### Publish Nightly Packages to Internal Repos ###
+  ##################################################
+  # Bookworm AMD64
+  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
+    inputs:
+      <<: *register_inputs_next_bookworm
+      jobPrefix: cloudflared-nightly-bookworm-amd64
+      needs: &amd64-next ['cloudflared-amd64-next']
+
+  # Bookworm ARM64
+  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
+    inputs:
+      <<: *register_inputs_next_bookworm
+      jobPrefix: cloudflared-nightly-bookworm-arm64
+      needs: &arm64-next ['cloudflared-arm64-next']
+
+  # Trixie AMD64
+  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
+    inputs:
+      <<: *register_inputs_next_trixie
+      jobPrefix: cloudflared-nightly-trixie-amd64
+      needs: *amd64-next
+
+  # Trixie ARM64
+  - component: $CI_SERVER_FQDN/cloudflare/ci/apt-register/register@~latest
+    inputs:
+      <<: *register_inputs_next_trixie
+      jobPrefix: cloudflared-nightly-trixie-arm64
+      needs: *arm64-next
@@ -3,14 +3,14 @@
  # Rules to run the job only on the master branch
  run-on-master:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-      when: always
+      when: on_success
    - when: never
  # Rules to run the job only on merge requests
  run-on-mr:
    - if: $CI_COMMIT_TAG
      when: never
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-      when: always
+      when: on_success
    - when: never
  # Rules to run the job on merge_requests and master branch
  run-always:
@@ -18,23 +18,15 @@
      when: never
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH != null && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-      when: always
+      when: on_success
+    - when: never
+  # Rules to run the job only when a release happens
+  run-on-release:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      changes:
+          - 'RELEASE_NOTES'
+      when: on_success
    - when: never
-
-# This before_script is injected into every job that runs on master meaning that if there is no tag the step
-# will succeed but only write "No tag present - Skipping" to the console.
-.check-tag:
-  before_script:
-    - |
-      # Check if there is a Git tag pointing to HEAD
-      echo "Tag found: $(git tag --points-at HEAD | grep .)"
-      if git tag --points-at HEAD | grep .; then
-        echo "Tag found: $(git tag --points-at HEAD | grep .)"
-        export "VERSION=$(git tag --points-at HEAD | grep .)"
-      else
-        echo "No tag present — skipping."
-        exit 0
-      fi

 .component-tests:
  image: $BUILD_IMAGE
@@ -0,0 +1,17 @@
+include:
+  - local: .ci/commons.gitlab-ci.yml
+
+######################################
+### Sync master branch with Github ###
+######################################
+push-github:
+  stage: sync
+  rules:
+    - !reference [.default-rules, run-on-master]
+  script:
+    - ./.ci/scripts/github-push.sh
+  secrets:
+    CLOUDFLARED_DEPLOY_SSH_KEY:
+      vault: gitlab/cloudflare/tun/cloudflared/_branch/master/cloudflared_github_ssh/data@kv
+      file: false
+  cache: {}
@@ -1,26 +1,39 @@
 ARG CLOUDFLARE_DOCKER_REGISTRY_HOST

-FROM ${CLOUDFLARE_DOCKER_REGISTRY_HOST:-registry.cfdata.org}/stash/cf/debian-images/bookworm/main:2025.7.0@sha256:6350da2f7e728dae2c1420f6dafc38e23cacc0b399d3d5b2f40fe48d9c8ff1ca
-
+FROM ${CLOUDFLARE_DOCKER_REGISTRY_HOST:-registry.cfdata.org}/stash/cf/debian-images/trixie/main:2026.1.0@sha256:e32092fd01520f5ae7de1fa6bb5a721720900ebeaa48e98f36f6f86168833cd7
 RUN apt-get update && \
-    apt-get upgrade -y && \
-    apt-get install --no-install-recommends --allow-downgrades -y \
-        build-essential \
-        git \
-        go-boring=1.24.6-1 \
-        libffi-dev \
-        procps \
-        python3-dev \
-        python3-pip \
-        python3-setuptools \
-        python3-venv \
-        # libmsi and libgcab are libraries the wixl binary depends on.
-        libmsi-dev \
-        libgcab-dev && \
-    rm -rf /var/lib/apt/lists/* && \
-    # Install wixl
-    curl -o /usr/local/bin/wixl -L https://pkg.cloudflare.com/binaries/wixl && \
-    chmod a+x /usr/local/bin/wixl && \
-    mkdir -p opt
+  apt-get upgrade -y && \
+  apt-get install --no-install-recommends --allow-downgrades -y \
+  build-essential \
+  git \
+  go-boring=1.24.13-1 \
+  libffi-dev \
+  procps \
+  python3-dev \
+  python3-pip \
+  python3-setuptools \
+  python3-venv \
+  # tool to create msi packages
+  wixl \
+  # install ruby and rpm which are required to install fpm package builder
+  rpm \
+  ruby \
+  ruby-dev \
+  rubygems \
+  # create deb and rpm repository files
+  reprepro \
+  createrepo-c \
+  # gcc for cross architecture compilation in arm
+  gcc-aarch64-linux-gnu \
+  libc6-dev-arm64-cross && \
+  rm -rf /var/lib/apt/lists/* && \
+  # Install fpm gem
+  gem install fpm --no-document && \
+  # Initialize rpm repository, SQL Lite DB
+  mkdir -p /var/lib/rpm && \
+  rpm --initdb && \
+  chmod -R 777 /var/lib/rpm && \
+  # Create work directory
+  mkdir -p opt

 WORKDIR /opt
@@ -1,12 +1,25 @@
 .golang-inputs: &golang_inputs
  runOnMR: true
-  runOnBranches: '^master$'
+  runOnBranches: "^master$"
  outputDir: artifacts
  runner: linux-x86-8cpu-16gb
  stage: build
  golangVersion: "boring-1.24"
+  imageVersion: "3462-0b23466e0715@sha256:42e8533370666a2463041572293a79e1449001ef803a993e6a860be00858c806"
  CGO_ENABLED: 1

+.default-packaging-job: &packaging-job-defaults
+  stage: package
+  needs:
+    - ci-image-get-image-ref
+  rules:
+    - !reference [.default-rules, run-on-master]
+  image: $BUILD_IMAGE
+  cache: {}
+  artifacts:
+    paths:
+      - artifacts/*
+
 include:
  ###################
  ### Linux Build ###
@@ -52,7 +65,7 @@ include:
  - component: $CI_SERVER_FQDN/cloudflare/ci/golang/boring-make@~latest
    inputs:
      <<: *golang_inputs
-      runOnBranches: '^$'
+      runOnBranches: "^$"
      stage: validate
      jobPrefix: vulncheck
      GOLANG_MAKE_TARGET: vulncheck
@@ -60,7 +73,7 @@ include:
 #################################
 ### Run Linux Component Tests ###
 #################################
-component-tests-linux: &component-tests-linux
+linux-component-tests: &linux-component-tests
  stage: test
  extends: .component-tests
  needs:
@@ -70,7 +83,7 @@ component-tests-linux: &component-tests-linux
    - ./.ci/scripts/component-tests.sh
  variables: &component-tests-variables
    CI: 1
-    COMPONENT_TESTS_CONFIG_CONTENT: Y2xvdWRmbGFyZWRfYmluYXJ5OiBjbG91ZGZsYXJlZApjcmVkZW50aWFsc19maWxlOiBjcmVkLmpzb24Kb3JpZ2luY2VydDogY2VydC5wZW0Kem9uZV9kb21haW46IGFyZ290dW5uZWx0ZXN0LmNvbQp6b25lX3RhZzogNDg3OTZmMWU3MGJiNzY2OWMyOWJiNTFiYTI4MmJmNjU=
+    COMPONENT_TESTS_CONFIG_CONTENT: Y2xvdWRmbGFyZWRfYmluYXJ5OiAuL2Nsb3VkZmxhcmVkCmNyZWRlbnRpYWxzX2ZpbGU6IGNyZWQuanNvbgpvcmlnaW5jZXJ0OiBjZXJ0LnBlbQp6b25lX2RvbWFpbjogYXJnb3R1bm5lbHRlc3QuY29tCnpvbmVfdGFnOiA0ODc5NmYxZTcwYmI3NjY5YzI5YmI1MWJhMjgyYmY2NQ==
  tags:
    - linux-x86-8cpu-16gb
  artifacts:
@@ -80,11 +93,30 @@ component-tests-linux: &component-tests-linux
 ######################################
 ### Run Linux FIPS Component Tests ###
 ######################################
-component-tests-linux-fips:
-  <<: *component-tests-linux
+linux-component-tests-fips:
+  <<: *linux-component-tests
  needs:
    - ci-image-get-image-ref
    - linux-fips-build-boring-make
  variables:
    <<: *component-tests-variables
    COMPONENT_TESTS_FIPS: 1
+
+################################
+####### Linux Packaging ########
+################################
+linux-packaging:
+  <<: *packaging-job-defaults
+  parallel:
+    matrix:
+      - ARCH: ["386", "amd64", "arm", "armhf", "arm64"]
+  script:
+    - ./.ci/scripts/linux/build-packages.sh ${ARCH}
+
+################################
+##### Linux FIPS Packaging #####
+################################
+linux-packaging-fips:
+  <<: *packaging-job-defaults
+  script:
+    - ./.ci/scripts/linux/build-packages-fips.sh
@@ -17,7 +17,7 @@ include:
 ######################################
 ### Build Cloudflared Mac Binaries ###
 ######################################
-build-cloudflared-macos: &build-mac
+macos-build-cloudflared: &mac-build
  <<: *mac-build-defaults
  stage: build
  artifacts:
@@ -28,7 +28,7 @@ build-cloudflared-macos: &build-mac
    - '[ "${RUNNER_ARCH}" = "intel" ] && export TARGET_ARCH=amd64'
    - ARCH=$(uname -m)
    - echo ARCH=$ARCH - TARGET_ARCH=$TARGET_ARCH
-    - ./.ci/scripts/mac/install-go.sh
+    - ./.ci/scripts/mac/install-go.sh "$MAC_GO_VERSION"
    - BUILD_SCRIPT=.ci/scripts/mac/build.sh
    - if [[ ! -x ${BUILD_SCRIPT} ]] ; then exit ; fi
    - set -euo pipefail
@@ -38,8 +38,8 @@ build-cloudflared-macos: &build-mac
 ###############################################
 ### Build and Sign Cloudflared Mac Binaries ###
 ###############################################
-build-and-sign-cloudflared-macos:
-  <<: *build-mac
+macos-build-and-sign-cloudflared:
+  <<: *mac-build
  rules:
    - !reference [.default-rules, run-on-master]
  secrets:
@@ -1,26 +1,48 @@
 include:
  - local: .ci/commons.gitlab-ci.yml

-###########################################
-### Push Cloudflared Binaries to Github ###
-###########################################
-release-cloudflared-to-github:
+  ######################################
+  ### Build and Push DockerHub Image ###
+  ######################################
+  - component: $CI_SERVER_FQDN/cloudflare/ci/docker-image/build-push-image@~latest
+    inputs:
+      stage: release
+      jobPrefix: docker-hub
+      runOnMR: false
+      runOnBranches: '^master$'
+      runOnChangesTo: ['RELEASE_NOTES']
+      needs:
+        - generate-version-file
+        - release-cloudflared-to-r2
+      commentImageRefs: false
+      runner: vm-linux-x86-4cpu-8gb
+      # Based on if the CI reference is protected or not the CI component will
+      # either use _BRANCH or _PROD, therefore, to prevent the pipelines from failing
+      # we simply set both to the same value.
+      DOCKER_USER_BRANCH: &docker-hub-user svcgithubdockerhubcloudflar045
+      DOCKER_PASSWORD_BRANCH: &docker-hub-password gitlab/cloudflare/tun/cloudflared/_dev/dockerhub/svc_password/data
+      DOCKER_USER_PROD: *docker-hub-user
+      DOCKER_PASSWORD_PROD: *docker-hub-password
+      EXTRA_DIB_ARGS: --overwrite
+
+.default-release-job: &release-job-defaults
  stage: release
  image: $BUILD_IMAGE
-  extends: .check-tag
-  needs:
-    - ci-image-get-image-ref
-    - package-windows
-    - build-and-sign-cloudflared-macos
-  rules:
-    - !reference [.default-rules, run-on-master]
  cache:
    paths:
      - .cache/pip
-  variables:
+  variables: &release-job-variables
    PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
+    # KV Vars
    KV_NAMESPACE: 380e19aa04314648949b6ad841417ebe
-    KV_ACCOUNT: 5ab4e9dfbd435d24068829fda0077963
+    KV_ACCOUNT: &cf-account 5ab4e9dfbd435d24068829fda0077963
+    # R2 Vars
+    R2_BUCKET: cloudflared-pkgs
+    R2_ACCOUNT_ID: *cf-account
+    # APT and RPM Repository Vars
+    GPG_PUBLIC_KEY_URL: "https://pkg.cloudflare.com/cloudflare-ascii-pubkey.gpg"
+    PKG_URL: "https://pkg.cloudflare.com/cloudflared"
+    BINARY_NAME: cloudflared
  secrets:
    KV_API_TOKEN:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/cfd_kv_api_token/data@kv
@@ -28,12 +50,84 @@ release-cloudflared-to-github:
    API_KEY:
      vault: gitlab/cloudflare/tun/cloudflared/_dev/cfd_github_api_key/data@kv
      file: false
+    R2_CLIENT_ID:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/_terraform_atlantis/r2_api_token/client_id@kv
+      file: false
+    R2_CLIENT_SECRET:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/_terraform_atlantis/r2_api_token/client_secret@kv
+      file: false
+    LINUX_SIGNING_PUBLIC_KEY:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/gpg_v1/public_key@kv
+      file: false
+    LINUX_SIGNING_PRIVATE_KEY:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/gpg_v1/private_key@kv
+      file: false
+    LINUX_SIGNING_PUBLIC_KEY_2:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/gpg_v2/public_key@kv
+      file: false
+    LINUX_SIGNING_PRIVATE_KEY_2:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/gpg_v2/private_key@kv
+      file: false
+
+###########################################
+### Push Cloudflared Binaries to Github ###
+###########################################
+release-cloudflared-to-github:
+  <<: *release-job-defaults
+  rules:
+    - !reference [.default-rules, run-on-release]
+  needs:
+    - ci-image-get-image-ref
+    - linux-packaging
+    - linux-packaging-fips
+    - macos-build-and-sign-cloudflared
+    - windows-package-sign
  script:
-    - python3 --version ; pip --version  # For debugging
-    - python3 -m venv venv
-    - source venv/bin/activate
-    - pip install pynacl==1.4.0 pygithub==1.55
-    - echo $VERSION
-    - echo $TAG_EXISTS
-    - echo "Running release because tag exists."
-    - make gitlab-release
+    - ./.ci/scripts/release-target.sh github-release
+
+#########################################
+### Upload Cloudflared Binaries to R2 ###
+#########################################
+release-cloudflared-to-r2:
+  <<: *release-job-defaults
+  rules:
+    - !reference [.default-rules, run-on-release]
+  needs:
+    - ci-image-get-image-ref
+    - linux-packaging # We only release non-FIPS binaries to R2
+    - release-cloudflared-to-github
+  script:
+    - ./.ci/scripts/release-target.sh r2-linux-release
+
+#################################################
+### Upload Cloudflared Nightly Binaries to R2 ###
+#################################################
+release-cloudflared-nightly-to-r2:
+  <<: *release-job-defaults
+  rules:
+    - !reference [.default-rules, run-on-master]
+  variables:
+    <<: *release-job-variables
+    R2_BUCKET: cloudflared-pkgs-next
+    GPG_PUBLIC_KEY_URL: "https://next.pkg.cloudflare.com/cloudflare-ascii-pubkey.gpg"
+    PKG_URL: "https://next.pkg.cloudflare.com/cloudflared"
+  needs:
+    - ci-image-get-image-ref
+    - linux-packaging # We only release non-FIPS binaries to R2
+  script:
+    - ./.ci/scripts/release-target.sh r2-linux-release
+
+#############################
+### Generate Version File ###
+#############################
+generate-version-file:
+  <<: *release-job-defaults
+  rules:
+    - !reference [.default-rules, run-on-release]
+  needs:
+    - ci-image-get-image-ref
+  script:
+    - make generate-docker-version
+  artifacts:
+    paths:
+      - versions
@@ -1,5 +1,5 @@
 #!/bin/bash
-set -e -o pipefail
+set -e -u -o pipefail

 # Fetch cloudflared from the artifacts folder
 mv ./artifacts/cloudflared ./cloudflared
@@ -1,5 +1,5 @@
 #!/bin/bash
-set -e -o pipefail
+set -e -u -o pipefail

 OUTPUT=$(go run -mod=readonly golang.org/x/tools/cmd/goimports@v0.30.0 -l -d -local github.com/cloudflare/cloudflared $(go list -mod=vendor -f '{{.Dir}}' -a ./... | fgrep -v tunnelrpc))

@@ -0,0 +1,31 @@
+#!/bin/bash
+set -e -u -o pipefail
+
+BRANCH="master"
+TMP_PATH="$PWD/tmp"
+PRIVATE_KEY_PATH="$TMP_PATH/github-deploy-key"
+PUBLIC_KEY_GITHUB_PATH="$TMP_PATH/github.pub"
+
+mkdir -p $TMP_PATH
+
+# Setup Private Key
+echo "$CLOUDFLARED_DEPLOY_SSH_KEY" > $PRIVATE_KEY_PATH
+chmod 400 $PRIVATE_KEY_PATH
+
+# Download GitHub Public Key for KnownHostsFile
+ssh-keyscan -t ed25519 github.com > $PUBLIC_KEY_GITHUB_PATH
+
+# Setup git ssh command with the right configurations
+export GIT_SSH_COMMAND="ssh -o UserKnownHostsFile=$PUBLIC_KEY_GITHUB_PATH -o IdentitiesOnly=yes -i $PRIVATE_KEY_PATH"
+
+# Add GitHub as a new remote
+git remote add github git@github.com:cloudflare/cloudflared.git || true
+
+# GitLab doesn't pull branch references, instead it creates a new one on each pipeline.
+# Therefore, we need to manually fetch the reference to then push it to GitHub.
+git fetch origin $BRANCH:$BRANCH
+git push -u github $BRANCH
+
+if TAG="$(git describe --tags --exact-match 2>/dev/null)"; then
+  git push -u github "$TAG"
+fi
@@ -1,4 +1,5 @@
 #!/bin/bash
+set -e -u -o pipefail
 VERSION=$(git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
 echo $VERSION

@@ -0,0 +1,60 @@
+#!/bin/bash
+set -e -u -o pipefail
+
+# Check if architecture argument is provided
+if [ $# -eq 0 ]; then
+    echo "Error: Architecture argument is required"
+    echo "Usage: $0 <architecture>"
+    exit 1
+fi
+
+# Parameters
+arch=$1
+
+# Get Version
+VERSION=$(git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
+echo $VERSION
+
+# Disable FIPS module in go-boring
+export GOEXPERIMENT=noboringcrypto
+export CGO_ENABLED=0
+
+# This controls the directory the built artifacts go into
+export ARTIFACT_DIR=artifacts/
+mkdir -p $ARTIFACT_DIR
+
+export TARGET_OS=linux
+
+unset TARGET_ARM
+export TARGET_ARCH=$arch
+
+## Support for arm platforms without hardware FPU enabled
+if [[ $arch == arm ]] ; then
+    export TARGET_ARCH=arm
+    export TARGET_ARM=5
+fi
+
+## Support for armhf builds
+if [[ $arch == armhf ]] ; then
+    export TARGET_ARCH=arm
+    export TARGET_ARM=7
+fi
+
+make cloudflared-deb
+mv cloudflared\_$VERSION\_$arch.deb $ARTIFACT_DIR/cloudflared-linux-$arch.deb
+
+# rpm packages invert the - and _ and use x86_64 instead of amd64.
+RPMVERSION=$(echo $VERSION|sed -r 's/-/_/g')
+RPMARCH=$arch
+if [ $arch == "amd64" ];then
+    RPMARCH="x86_64"
+fi
+if [ $arch == "arm64" ]; then
+    RPMARCH="aarch64"
+fi
+make cloudflared-rpm
+mv cloudflared-$RPMVERSION-1.$RPMARCH.rpm $ARTIFACT_DIR/cloudflared-linux-$RPMARCH.rpm
+
+# finally move the linux binary as well.
+mv ./cloudflared $ARTIFACT_DIR/cloudflared-linux-$arch
+
@@ -2,9 +2,13 @@ rm -rf /tmp/go
 export GOCACHE=/tmp/gocache
 rm -rf $GOCACHE

-brew install go@1.24
+if [ -z "$1" ]
+  then
+    echo "No go version supplied"
+fi
+
+brew install "$1"

 go version
 which go
 go env
-
@@ -1,4 +1,6 @@
 #!/bin/bash
+set -e -u -o pipefail
+
 python3 -m venv env
 . env/bin/activate
 pip install pynacl==1.4.0 pygithub==1.55
@@ -0,0 +1,18 @@
+#!/bin/bash
+set -e -u -o pipefail
+
+# Check if a make target is provided as an argument
+if [ $# -eq 0 ]; then
+    echo "Error: Make target argument is required"
+    echo "Usage: $0 <make-target>"
+    exit 1
+fi
+
+MAKE_TARGET=$1
+
+python3 -m venv venv
+source venv/bin/activate
+
+# Our release scripts are written in python, so we should install their dependecies here.
+pip install pynacl==1.4.0 pygithub==1.55 boto3==1.42.30 python-gnupg==0.4.9
+make $MAKE_TARGET
@@ -0,0 +1,53 @@
+#!/bin/bash
+set -e -u
+
+# Define the file to store the list of vulnerabilities to ignore.
+IGNORE_FILE=".vulnignore"
+
+go version
+# Check if the ignored vulnerabilities file exists. If not, create an empty one.
+if [ ! -f "$IGNORE_FILE" ]; then
+  touch "$IGNORE_FILE"
+  echo "Created an empty file to store ignored vulnerabilities: $IGNORE_FILE"
+  echo "# Add vulnerability IDs (e.g., GO-2022-0450) to ignore, one per line." >>"$IGNORE_FILE"
+  echo "# You can also add comments on the same line after the ID." >>"$IGNORE_FILE"
+  echo "" >>"$IGNORE_FILE"
+fi
+
+# Run govulncheck and capture its output.
+VULN_OUTPUT=$(go run -mod=readonly golang.org/x/vuln/cmd/govulncheck@latest ./... || true)
+
+# Print the govuln output
+echo "====================================="
+echo "Full Output of govulncheck:"
+echo "====================================="
+echo "$VULN_OUTPUT"
+echo "====================================="
+echo "End of govulncheck Output"
+echo "====================================="
+
+# Process the ignore file to remove comments and empty lines.
+# The 'cut' command gets the vulnerability ID and removes anything after the '#'.
+# The 'grep' command filters out empty lines and lines starting with '#'.
+CLEAN_IGNORES=$(grep -v '^\s*#' "$IGNORE_FILE" | cut -d'#' -f1 | sed 's/ //g' | sort -u || true)
+
+# Filter out the ignored vulnerabilities.
+UNIGNORED_VULNS=$(echo "$VULN_OUTPUT" | grep 'Vulnerability' || true)
+
+# If the list of ignored vulnerabilities is not empty, filter them out.
+if [ -n "$CLEAN_IGNORES" ]; then
+  UNIGNORED_VULNS=$(echo "$UNIGNORED_VULNS" | grep -vFf <(echo "$CLEAN_IGNORES") || true)
+fi
+
+# If there are any vulnerabilities that were not in our ignore list, print them and exit with an error.
+if [ -n "$UNIGNORED_VULNS" ]; then
+  echo "🚨 Found new, unignored vulnerabilities:"
+  echo "-------------------------------------"
+  echo "$UNIGNORED_VULNS"
+  echo "-------------------------------------"
+  echo "Exiting with an error. ❌"
+  exit 1
+else
+  echo "🎉 No new vulnerabilities found. All clear! ✨"
+  exit 0
+fi
@@ -4,6 +4,7 @@ $ProgressPreference = "SilentlyContinue"

 $env:TARGET_OS = "windows"
 $env:LOCAL_OS = "windows"
+$TIMESTAMP_RFC3161 = "http://timestamp.digicert.com"

 New-Item -Path ".\artifacts" -ItemType Directory

@@ -13,6 +14,8 @@ $env:LOCAL_ARCH = "amd64"
 $env:CGO_ENABLED = 1
 & make cloudflared
 if ($LASTEXITCODE -ne 0) { throw "Failed to build cloudflared for amd64" }
+# Sign build
+azuresigntool.exe sign -kvu $env:KEY_VAULT_URL -kvi "$env:KEY_VAULT_CLIENT_ID" -kvs "$env:KEY_VAULT_SECRET" -kvc "$env:KEY_VAULT_CERTIFICATE" -kvt "$env:KEY_VAULT_TENANT_ID" -tr "$TIMESTAMP_RFC3161" -d "Cloudflare Tunnel Daemon" .\cloudflared.exe
 copy .\cloudflared.exe .\artifacts\cloudflared-windows-amd64.exe

 Write-Output "Building for 386"
@@ -21,4 +24,6 @@ $env:LOCAL_ARCH = "386"
 $env:CGO_ENABLED = 0
 & make cloudflared
 if ($LASTEXITCODE -ne 0) { throw "Failed to build cloudflared for 386" }
+## Sign build
+azuresigntool.exe sign -kvu $env:KEY_VAULT_URL -kvi "$env:KEY_VAULT_CLIENT_ID" -kvs "$env:KEY_VAULT_SECRET" -kvc "$env:KEY_VAULT_CERTIFICATE" -kvt "$env:KEY_VAULT_TENANT_ID" -tr "$TIMESTAMP_RFC3161" -d "Cloudflare Tunnel Daemon" .\cloudflared.exe
 copy .\cloudflared.exe .\artifacts\cloudflared-windows-386.exe
@@ -0,0 +1,26 @@
+# Sign Windows artifacts using azuretool
+# This script processes MSI files from the artifacts directory
+
+$ErrorActionPreference = "Stop"
+
+# Define paths
+$ARTIFACT_DIR = "artifacts"
+$TIMESTAMP_RFC3161 = "http://timestamp.digicert.com"
+
+Write-Host "Looking for Windows artifacts to sign in $ARTIFACT_DIR..."
+
+# Find all Windows MSI files
+$msiFiles = Get-ChildItem -Path $ARTIFACT_DIR -Filter "cloudflared-windows-*.msi" -ErrorAction SilentlyContinue
+
+if ($msiFiles.Count -eq 0) {
+    Write-Host "No Windows MSI files found in $ARTIFACT_DIR"
+    exit 1
+}
+
+Write-Host "Found $($msiFiles.Count) file(s) to sign:"
+foreach ($file in $msiFiles) {
+    Write-Host "Running azuretool sign for $($file.Name)"
+    azuresigntool.exe sign -kvu $env:KEY_VAULT_URL -kvi "$env:KEY_VAULT_CLIENT_ID" -kvs "$env:KEY_VAULT_SECRET" -kvc "$env:KEY_VAULT_CERTIFICATE" -kvt "$env:KEY_VAULT_TENANT_ID" -tr "$TIMESTAMP_RFC3161" -d "Cloudflare Tunnel Daemon" .\\$ARTIFACT_DIR\\$($file.Name)
+}
+
+Write-Host "Signing process completed"
@@ -14,11 +14,11 @@ include:
 ##########################################
 ### Build Cloudflared Windows Binaries ###
 ##########################################
-build-cloudflared-windows:
+windows-build-cloudflared:
  <<: *windows-build-defaults
  stage: build
  script:
-    - powershell -ExecutionPolicy Bypass -File ".\.ci\scripts\windows\go-wrapper.ps1" "${GO_VERSION}" ".\.ci\scripts\windows\builds.ps1"
+    - powershell -ExecutionPolicy Bypass -File ".\.ci\scripts\windows\go-wrapper.ps1" "${WIN_GO_VERSION}" ".\.ci\scripts\windows\builds.ps1"
  artifacts:
    paths:
      - artifacts/*
@@ -26,7 +26,7 @@ build-cloudflared-windows:
 ######################################################
 ### Load Environment Variables for Component Tests ###
 ######################################################
-load-windows-env-variables:
+windows-load-env-variables:
  stage: pre-build
  extends: .component-tests
  script:
@@ -35,8 +35,29 @@ load-windows-env-variables:
    - echo "DNS_API_TOKEN=$DNS_API_TOKEN" >> windows.env
    # We have to encode the `COMPONENT_TESTS_ORIGINCERT` secret, because it content is a file, otherwise we can't export it using gitlab
    - echo "COMPONENT_TESTS_ORIGINCERT=$(echo "$COMPONENT_TESTS_ORIGINCERT" | base64 -w0)" >> windows.env
+    - echo "KEY_VAULT_URL=$KEY_VAULT_URL" >> windows.env
+    - echo "KEY_VAULT_CLIENT_ID=$KEY_VAULT_CLIENT_ID" >> windows.env
+    - echo "KEY_VAULT_TENANT_ID=$KEY_VAULT_TENANT_ID" >> windows.env
+    - echo "KEY_VAULT_SECRET=$KEY_VAULT_SECRET" >> windows.env
+    - echo "KEY_VAULT_CERTIFICATE=$KEY_VAULT_CERTIFICATE" >> windows.env
  variables:
-    COMPONENT_TESTS_CONFIG_CONTENT: Y2xvdWRmbGFyZWRfYmluYXJ5OiBjbG91ZGZsYXJlZC5leGUKY3JlZGVudGlhbHNfZmlsZTogY3JlZC5qc29uCm9yaWdpbmNlcnQ6IGNlcnQucGVtCnpvbmVfZG9tYWluOiBhcmdvdHVubmVsdGVzdC5jb20Kem9uZV90YWc6IDQ4Nzk2ZjFlNzBiYjc2NjljMjliYjUxYmEyODJiZjY1
+    COMPONENT_TESTS_CONFIG_CONTENT: Y2xvdWRmbGFyZWRfYmluYXJ5OiAuL2Nsb3VkZmxhcmVkLmV4ZQpjcmVkZW50aWFsc19maWxlOiBjcmVkLmpzb24Kb3JpZ2luY2VydDogY2VydC5wZW0Kem9uZV9kb21haW46IGFyZ290dW5uZWx0ZXN0LmNvbQp6b25lX3RhZzogNDg3OTZmMWU3MGJiNzY2OWMyOWJiNTFiYTI4MmJmNjU=
+  secrets:
+    KEY_VAULT_URL:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/app_info/key_vault_url@kv
+      file: false
+    KEY_VAULT_CLIENT_ID:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/app_info/key_vault_client_id@kv
+      file: false
+    KEY_VAULT_TENANT_ID:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/app_info/key_vault_tenant_id@kv
+      file: false
+    KEY_VAULT_SECRET:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/secret/key_vault_secret@kv
+      file: false
+    KEY_VAULT_CERTIFICATE:
+      vault: gitlab/cloudflare/tun/cloudflared/_dev/azure_vault/certificate/key_vault_certificate@kv
+      file: false
  artifacts:
    access: 'none'
    reports:
@@ -45,14 +66,14 @@ load-windows-env-variables:
 ###################################
 ### Run Windows Component Tests ###
 ###################################
-component-tests-cloudflared-windows:
+windows-component-tests-cloudflared:
  <<: *windows-build-defaults
  stage: test
-  needs: ["load-windows-env-variables"]
+  needs: ["windows-load-env-variables"]
  script:
-    # We have to decode the secret we encoded on the `load-windows-env-variables` job
+    # We have to decode the secret we encoded on the `windows-load-env-variables` job
    - $env:COMPONENT_TESTS_ORIGINCERT = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($env:COMPONENT_TESTS_ORIGINCERT))
-    - powershell -ExecutionPolicy Bypass -File ".\.ci\scripts\windows\go-wrapper.ps1" "${GO_VERSION}" ".\.ci\scripts\windows\component-test.ps1"
+    - powershell -ExecutionPolicy Bypass -File ".\.ci\scripts\windows\go-wrapper.ps1" "${WIN_GO_VERSION}" ".\.ci\scripts\windows\component-test.ps1"
  artifacts:
    reports:
      junit: report.xml
@@ -60,13 +81,13 @@ component-tests-cloudflared-windows:
 ################################
 ### Package Windows Binaries ###
 ################################
-package-windows:
+windows-package:
  rules:
    - !reference [.default-rules, run-on-master]
  stage: package
  needs:
    - ci-image-get-image-ref
-    - build-cloudflared-windows
+    - windows-build-cloudflared
  image: $BUILD_IMAGE
  script:
    - .ci/scripts/package-windows.sh
@@ -74,3 +95,20 @@ package-windows:
  artifacts:
    paths:
      - artifacts/*
+
+#############################
+### Sign Windows Binaries ###
+#############################
+windows-package-sign:
+  <<: *windows-build-defaults
+  rules:
+    - !reference [.default-rules, run-on-master]
+  stage: package
+  needs:
+    - windows-package
+    - windows-load-env-variables
+  script:
+    - powershell -ExecutionPolicy Bypass -File ".\.ci\scripts\windows\sign-msi.ps1"
+  artifacts:
+    paths:
+      - artifacts/*
@@ -18,3 +18,4 @@ ssh_server_tests/.env
 /.cover
 built_artifacts/
 component-tests/.venv
+/artifacts
@@ -1,5 +1,7 @@
 variables:
-  GO_VERSION: "go1.24.6"
+  GO_VERSION: "1.24.13"
+  MAC_GO_VERSION: "go@$GO_VERSION"
+  WIN_GO_VERSION: "go$GO_VERSION"
  GIT_DEPTH: "0"

 default:
@@ -7,7 +9,7 @@ default:
    VAULT_ID_TOKEN:
      aud: https://vault.cfdata.org

-stages: [pre-build, build, validate, test, package, release]
+stages: [sync, pre-build, build, validate, test, package, release, release-internal, review]

 include:
  #####################################################
@@ -15,6 +17,11 @@ include:
  #####################################################
  - local: .ci/commons.gitlab-ci.yml

+  #####################################################
+  ########### Sync Repository with Github #############
+  #####################################################
+  - local: .ci/github.gitlab-ci.yml
+
  #####################################################
  ############# Build or Fetch CI Image ###############
  #####################################################
@@ -39,3 +46,15 @@ include:
  ################# Release Packages ##################
  #####################################################
  - local: .ci/release.gitlab-ci.yml
+
+  #####################################################
+  ########## Release Packages Internally ##############
+  #####################################################
+  - local: .ci/apt-internal.gitlab-ci.yml
+
+  #####################################################
+  ############## Manual Claude Review #################
+  #####################################################
+  - component: $CI_SERVER_FQDN/cloudflare/ci/ai/review@~latest
+    inputs:
+      whenToRun: "manual"
@@ -0,0 +1,2 @@
+# Add vulnerability IDs (e.g., GO-2022-0450) to ignore, one per line.
+# You can also add comments on the same line after the ID.
@@ -1,3 +1,14 @@
+## 2026.2.0
+### Breaking Change
+- Removes the `proxy-dns` feature from cloudflared. This feature allowed running a local DNS over HTTPS (DoH) proxy.
+  Users who relied on this functionality should migrate to alternative solutions.
+  
+  Removed commands and flags:
+  - `cloudflared proxy-dns`
+  - `cloudflared tunnel proxy-dns` 
+  - `--proxy-dns`, `--proxy-dns-port`, `--proxy-dns-address`, `--proxy-dns-upstream`, `--proxy-dns-max-upstream-conns`, `--proxy-dns-bootstrap`
+  - `resolver` section in configuration file
+
 ## 2025.7.1
 ### Notices
 - `cloudflared` will no longer officially support Debian and Ubuntu distros that reached end-of-life: `buster`, `bullseye`, `impish`, `trusty`.
@@ -1,7 +1,7 @@
 # use a builder image for building cloudflare
 ARG TARGET_GOOS
 ARG TARGET_GOARCH
-FROM golang:1.24.4 AS builder
+FROM golang:1.24.13 AS builder
 ENV GO111MODULE=on \
  CGO_ENABLED=0 \
  TARGET_GOOS=${TARGET_GOOS} \
@@ -20,7 +20,7 @@ COPY . .
 RUN make cloudflared

 # use a distroless base image with glibc
-FROM gcr.io/distroless/base-debian12:nonroot
+FROM gcr.io/distroless/base-debian13:nonroot

 LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared"

@@ -1,5 +1,5 @@
 # use a builder image for building cloudflare
-FROM golang:1.24.4 AS builder
+FROM golang:1.24.13 AS builder
 ENV GO111MODULE=on \
  CGO_ENABLED=0 \
  # the CONTAINER_BUILD envvar is used set github.com/cloudflare/cloudflared/metrics.Runtime=virtual
@@ -15,7 +15,7 @@ COPY . .
 RUN GOOS=linux GOARCH=amd64 make cloudflared

 # use a distroless base image with glibc
-FROM gcr.io/distroless/base-debian12:nonroot
+FROM gcr.io/distroless/base-debian13:nonroot

 LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared"

@@ -1,5 +1,5 @@
 # use a builder image for building cloudflare
-FROM golang:1.24.4 AS builder
+FROM golang:1.24.13 AS builder
 ENV GO111MODULE=on \
  CGO_ENABLED=0 \
  # the CONTAINER_BUILD envvar is used set github.com/cloudflare/cloudflared/metrics.Runtime=virtual
@@ -15,7 +15,7 @@ COPY . .
 RUN GOOS=linux GOARCH=arm64 make cloudflared

 # use a distroless base image with glibc
-FROM gcr.io/distroless/base-debian12:nonroot-arm64
+FROM gcr.io/distroless/base-debian13:nonroot-arm64

 LABEL org.opencontainers.image.source="https://github.com/cloudflare/cloudflared"

@@ -36,7 +36,7 @@ ifdef PACKAGE_MANAGER
 	VERSION_FLAGS := $(VERSION_FLAGS) -X "github.com/cloudflare/cloudflared/cmd/cloudflared/updater.BuiltForPackageManager=$(PACKAGE_MANAGER)"
 endif

-ifdef CONTAINER_BUILD 
+ifdef CONTAINER_BUILD
 	VERSION_FLAGS := $(VERSION_FLAGS) -X "github.com/cloudflare/cloudflared/metrics.Runtime=virtual"
 endif

@@ -119,7 +119,7 @@ ifneq ($(TARGET_ARM), )
 	ARM_COMMAND := GOARM=$(TARGET_ARM)
 endif

-ifeq ($(TARGET_ARM), 7) 
+ifeq ($(TARGET_ARM), 7)
 	PACKAGE_ARCH := armhf
 else
 	PACKAGE_ARCH := $(TARGET_ARCH)
@@ -139,7 +139,7 @@ clean:

 .PHONY: vulncheck
 vulncheck:
-	@go run -mod=readonly golang.org/x/vuln/cmd/govulncheck@latest ./...
+	@./.ci/scripts/vuln-check.sh

 .PHONY: cloudflared
 cloudflared:
@@ -182,7 +182,7 @@ fuzz:
 	@go test -fuzz=FuzzIPDecoder -fuzztime=600s ./packet
 	@go test -fuzz=FuzzICMPDecoder -fuzztime=600s ./packet
 	@go test -fuzz=FuzzSessionWrite -fuzztime=600s ./quic/v3
-	@go test -fuzz=FuzzSessionServe -fuzztime=600s ./quic/v3
+	@go test -fuzz=FuzzSessionRead -fuzztime=600s ./quic/v3
 	@go test -fuzz=FuzzRegistrationDatagram -fuzztime=600s ./quic/v3
 	@go test -fuzz=FuzzPayloadDatagram -fuzztime=600s ./quic/v3
 	@go test -fuzz=FuzzRegistrationResponseDatagram -fuzztime=600s ./quic/v3
@@ -221,10 +221,6 @@ cloudflared-deb: cloudflared cloudflared.1
 cloudflared-rpm: cloudflared cloudflared.1
 	$(call build_package,rpm)

-.PHONY: cloudflared-pkg
-cloudflared-pkg: cloudflared cloudflared.1
-	$(call build_package,osxpkg)
-
 .PHONY: cloudflared-msi
 cloudflared-msi:
 	wixl --define Version=$(VERSION) --define Path=$(EXECUTABLE_PATH) --output cloudflared-$(VERSION)-$(TARGET_ARCH).msi cloudflared.wxs
@@ -235,17 +231,18 @@ github-release-dryrun:

 .PHONY: github-release
 github-release:
-	python3 github_release.py --path $(PWD)/built_artifacts --release-version $(VERSION)
-	python3 github_message.py --release-version $(VERSION)
-
-.PHONY: gitlab-release
-gitlab-release:
 	python3 github_release.py --path $(PWD)/artifacts/ --release-version $(VERSION)
+	python3 github_message.py --release-version $(VERSION)

 .PHONY: r2-linux-release
 r2-linux-release:
 	python3 ./release_pkgs.py

+.PHONY: r2-next-linux-release
+# Publishes to a separate R2 repository during GPG key rollover, using dual-key signing.
+r2-next-linux-release:
+	python3 ./release_pkgs.py --upload-repo-file
+
 .PHONY: capnp
 capnp:
 	which capnp  # https://capnproto.org/install.html
@@ -3,14 +3,14 @@
 Contains the command-line client for Cloudflare Tunnel, a tunneling daemon that proxies traffic from the Cloudflare network to your origins.
 This daemon sits between Cloudflare network and your origin (e.g. a webserver). Cloudflare attracts client requests and sends them to you
 via this daemon, without requiring you to poke holes on your firewall --- your origin can remain as closed as possible.
-Extensive documentation can be found in the [Cloudflare Tunnel section](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps) of the Cloudflare Docs.
+Extensive documentation can be found in the [Cloudflare Tunnel section](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel) of the Cloudflare Docs.
 All usages related with proxying to your origins are available under `cloudflared tunnel help`.

 You can also use `cloudflared` to access Tunnel origins (that are protected with `cloudflared tunnel`) for TCP traffic
 at Layer 4 (i.e., not HTTP/websocket), which is relevant for use cases such as SSH, RDP, etc.
 Such usages are available under `cloudflared access help`.

-You can instead use [WARP client](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/private-networks)
+You can instead use [WARP client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/warp/)
 to access private origins behind Tunnels for Layer 4 traffic without requiring `cloudflared access` commands on the client side.


@@ -19,41 +19,41 @@ to access private origins behind Tunnels for Layer 4 traffic without requiring `
 Before you use Cloudflare Tunnel, you'll need to complete a few steps in the Cloudflare dashboard: you need to add a
 website to your Cloudflare account. Note that today it is possible to use Tunnel without a website (e.g. for private
 routing), but for legacy reasons this requirement is still necessary:
-1. [Add a website to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-Creating-a-Cloudflare-account-and-adding-a-website)
-2. [Change your domain nameservers to Cloudflare](https://support.cloudflare.com/hc/en-us/articles/205195708)
+1. [Add a website to Cloudflare](https://developers.cloudflare.com/fundamentals/manage-domains/add-site/)
+2. [Change your domain nameservers to Cloudflare](https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/)


 ## Installing `cloudflared`

 Downloads are available as standalone binaries, a Docker image, and Debian, RPM, and Homebrew packages. You can also find releases [here](https://github.com/cloudflare/cloudflared/releases) on the `cloudflared` GitHub repository.

-* You can [install on macOS](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#macos) via Homebrew or by downloading the [latest Darwin amd64 release](https://github.com/cloudflare/cloudflared/releases)
-* Binaries, Debian, and RPM packages for Linux [can be found here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#linux)
+* You can [install on macOS](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/#macos) via Homebrew or by downloading the [latest Darwin amd64 release](https://github.com/cloudflare/cloudflared/releases)
+* Binaries, Debian, and RPM packages for Linux [can be found here](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/#linux)
 * A Docker image of `cloudflared` is [available on DockerHub](https://hub.docker.com/r/cloudflare/cloudflared)
-* You can install on Windows machines with the [steps here](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation#windows)
+* You can install on Windows machines with the [steps here](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/#windows)
 * To build from source, install the required version of go, mentioned in the [Development](#development) section below. Then you can run `make cloudflared`.

-User documentation for Cloudflare Tunnel can be found at https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
+User documentation for Cloudflare Tunnel can be found at https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/


 ## Creating Tunnels and routing traffic

 Once installed, you can authenticate `cloudflared` into your Cloudflare account and begin creating Tunnels to serve traffic to your origins.

-* Create a Tunnel with [these instructions](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/)
+* Create a Tunnel with [these instructions](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/)
 * Route traffic to that Tunnel:
-  * Via public [DNS records in Cloudflare](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/dns)
-  * Or via a public hostname guided by a [Cloudflare Load Balancer](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/routing-to-tunnel/lb)
-  * Or from [WARP client private traffic](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/private-net/)
+  * Via public [DNS records in Cloudflare](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/dns/)
+  * Or via a public hostname guided by a [Cloudflare Load Balancer](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/public-load-balancers/)
+  * Or from [WARP client private traffic](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/)


 ## TryCloudflare

-Want to test Cloudflare Tunnel before adding a website to Cloudflare? You can do so with TryCloudflare using the documentation [available here](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/).
+Want to test Cloudflare Tunnel before adding a website to Cloudflare? You can do so with TryCloudflare using the documentation [available here](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare/).

 ## Deprecated versions

-Cloudflare currently supports versions of cloudflared that are **within one year** of the most recent release. Breaking changes unrelated to feature availability may be introduced that will impact versions released more than one year ago. You can read more about upgrading cloudflared in our [developer documentation](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/#updating-cloudflared).
+Cloudflare currently supports versions of cloudflared that are **within one year** of the most recent release. Breaking changes unrelated to feature availability may be introduced that will impact versions released more than one year ago. You can read more about upgrading cloudflared in our [developer documentation](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/update-cloudflared/).

 For example, as of January 2023 Cloudflare will support cloudflared version 2023.1.1 to cloudflared 2022.1.1.

@@ -1,3 +1,66 @@
+2026.2.0
+- 2026-02-06 TUN-10216: TUN fix cloudflare vulnerabilities GO-2026-4340 and GO-2026-4341
+- 2026-02-02 TUN-9858: Remove proxy-dns feature from cloudflared
+
+2026.1.2
+- 2026-01-23 Revert "TUN-9863: Update pipelines to use cloudflared EV Certificate"
+- 2026-01-21 Revert "TUN-9886 notarize cloudflared"
+- 2025-12-12 TUN-9886 notarize cloudflared
+
+2026.1.1
+- 2026-01-19 fix: Update boto3 to run on trixie
+- 2026-01-19 fix: Fix wixl bundling tool for windows msi packages
+- 2026-01-19 fix: rpm bundling and rpm key import
+
+2026.1.0
+- 2026-01-13 TUN-10162: Update go to 1.24.11 and Debian distroless to debian13
+- 2025-11-21 Replace jira.cfops.it with jira.cfdata.org in connection/http2_test.go
+- 2025-11-19 TUN-9863: Update pipelines to use cloudflared EV Certificate
+- 2025-11-07 TUN-9800: Migrate apt internal builds to Gitlab
+- 2025-11-04 TUN-9998: Don't need to read origin cert to determine if the endpoint is fedramp
+- 2025-10-13 TUN-9910: Make the metadata key to carry HTTP status over QUIC transport a constant
+
+2025.11.1
+- 2025-11-07 TUN-9800: Fix docker hub push step
+
+2025.11.0
+- 2025-11-06 TUN-9863: Introduce Code Signing for Windows Builds
+- 2025-11-06 TUN-9800: Prefix gitlab steps with operating system
+- 2025-11-04 chore: Update cloudflared signing key name in index.html
+- 2025-10-31 chore: add claude review
+- 2025-10-31 Chore: Update documentation links in README
+- 2025-10-31 TUN-9800: Add pipelines for linux packaging
+
+2025.10.1
+- 2025-10-30 chore: Update ci image to use goboring 1.24.9
+- 2025-10-28 TUN-9849: Add cf-proxy-* to control response headers
+- 2025-10-24 TUN-9961: Add pkg.cloudflared.com index.html to git repo
+- 2025-10-23 TUN-9954: Update from go1.24.6 to go1.24.9
+- 2025-10-23 Fix systemd service installation hanging
+- 2025-10-21 TUN-9941: Use new GPG key for RPM builds
+- 2025-10-21 TUN-9941: Fix typo causing r2-release-next deployment to fail
+- 2025-10-21 TUN-9941: Lookup correct key for RPM signature
+- 2025-10-15 TUN-9919: Make RPM postinstall scriplet idempotent
+- 2025-10-14 TUN-9916: Fix the cloudflared binary path used in the component test
+
+2025.10.0
+- 2025-10-14 chore: Fix upload of RPM repo file during double signing
+- 2025-10-13 TUN-9882: Bump datagram v3 write channel capacity
+- 2025-10-10 chore: Fix import of GPG keys when two keys are provided
+- 2025-10-10 chore: Fix parameter order when uploading RPM .repo file to R2
+- 2025-10-10 TUN-9883: Add new datagram v3 feature flag
+- 2025-10-09 chore: Force usage of go-boring 1.24
+- 2025-10-08 TUN-9882: Improve metrics for datagram v3
+- 2025-10-07 GRC-16749: Add fedramp tags to catalog
+- 2025-10-07 TUN-9882: Add buffers for UDP and ICMP datagrams in datagram v3
+- 2025-10-07 TUN-9882: Add write deadline for UDP origin writes
+- 2025-09-29 TUN-9776: Support signing Debian packages with two keys for rollover
+- 2025-09-22 TUN-9800: Add pipeline to sync between gitlab and github repos
+
+2025.9.1
+- 2025-09-22 TUN-9855: Create script to ignore vulnerabilities from govuln check
+- 2025-09-19 TUN-9852: Remove fmt.Println from cloudflared access command
+
 2025.9.0
 - 2025-09-15 TUN-9820: Add support for FedRAMP in originRequest Access config
 - 2025-09-11 TUN-9800: Migrate cloudflared-ci pipelines to Gitlab CI
@@ -1,48 +0,0 @@
-#!/bin/bash
-VERSION=$(git describe --tags --always --match "[0-9][0-9][0-9][0-9].*.*")
-echo $VERSION
-
-# Disable FIPS module in go-boring
-export GOEXPERIMENT=noboringcrypto
-export CGO_ENABLED=0
-
-# This controls the directory the built artifacts go into
-export ARTIFACT_DIR=artifacts/
-mkdir -p $ARTIFACT_DIR
-
-linuxArchs=("386" "amd64" "arm" "armhf" "arm64")
-export TARGET_OS=linux
-for arch in ${linuxArchs[@]}; do
-    unset TARGET_ARM
-    export TARGET_ARCH=$arch
-
-    ## Support for arm platforms without hardware FPU enabled
-    if [[ $arch == arm ]] ; then
-        export TARGET_ARCH=arm
-        export TARGET_ARM=5
-    fi
-    
-    ## Support for armhf builds 
-    if [[ $arch == armhf ]] ; then
-        export TARGET_ARCH=arm
-        export TARGET_ARM=7 
-    fi
-    
-    make cloudflared-deb
-    mv cloudflared\_$VERSION\_$arch.deb $ARTIFACT_DIR/cloudflared-linux-$arch.deb
-
-    # rpm packages invert the - and _ and use x86_64 instead of amd64.
-    RPMVERSION=$(echo $VERSION|sed -r 's/-/_/g')
-    RPMARCH=$arch
-    if [ $arch == "amd64" ];then
-        RPMARCH="x86_64"
-    fi
-    if [ $arch == "arm64" ]; then
-        RPMARCH="aarch64"
-    fi
-    make cloudflared-rpm
-    mv cloudflared-$RPMVERSION-1.$RPMARCH.rpm $ARTIFACT_DIR/cloudflared-linux-$RPMARCH.rpm
-
-    # finally move the linux binary as well.
-    mv ./cloudflared $ARTIFACT_DIR/cloudflared-linux-$arch
-done
@@ -14,4 +14,7 @@ spec:
  lifecycle: "Active"
  owner: "teams/tunnel-teams-routing"
  cf:
+    compliance:
+      fedramp-high: "pending"
+      fedramp-moderate: "yes"
    FIPS: "required"
@@ -1,234 +1,2 @@
-pinned_go: &pinned_go go-boring=1.24.4-1
-
-build_dir: &build_dir /cfsetup_build
-default-flavor: bookworm
-
-bookworm: &bookworm
-  build-linux:
-    build_dir: *build_dir
-    builddeps: &build_deps
-      - *pinned_go
-      - build-essential
-      - fakeroot
-      - rubygem-fpm
-      - rpm
-      - libffi-dev
-      - golangci-lint=1.64.8-2
-    pre-cache: &build_pre_cache
-      - export GOCACHE=/cfsetup_build/.cache/go-build
-      - go install golang.org/x/tools/cmd/goimports@v0.30.0
-    post-cache:
-      # Linting
-      - make lint
-      - make fmt-check
-      # Build binary for component test
-      - GOOS=linux GOARCH=amd64 make cloudflared
-  build-linux-fips:
-    build_dir: *build_dir
-    builddeps: *build_deps
-    pre-cache: *build_pre_cache
-    post-cache:
-      - export FIPS=true
-      # Build binary for component test
-      - GOOS=linux GOARCH=amd64 make cloudflared
-  cover:
-    build_dir: *build_dir
-    builddeps: *build_deps
-    pre-cache: *build_pre_cache
-    post-cache:
-      - make cover
-  # except FIPS and macos
-  build-linux-release:
-    build_dir: *build_dir
-    builddeps: &build_deps_release
-      - *pinned_go
-      - build-essential
-      - fakeroot
-      - rubygem-fpm
-      - rpm
-      - libffi-dev
-      - python3-dev
-      - python3-pip
-      - python3-setuptools
-      - wget
-      - python3-venv
-    post-cache:
-      - python3 -m venv env
-      - . /cfsetup_build/env/bin/activate
-      - pip install pynacl==1.4.0 pygithub==1.55 boto3==1.22.9 python-gnupg==0.4.9
-      # build all packages (except macos and FIPS) and move them to /cfsetup/built_artifacts
-      - ./build-packages.sh
-  # handle FIPS separately so that we built with gofips compiler
-  build-linux-fips-release:
-    build_dir: *build_dir
-    builddeps: *build_deps_release
-    post-cache:
-      # same logic as above, but for FIPS packages only
-      - ./build-packages-fips.sh
-  generate-versions-file:
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go
-      - build-essential
-    post-cache:
-      - make generate-docker-version
-  build-deb:
-    build_dir: *build_dir
-    builddeps: &build_deb_deps
-      - *pinned_go
-      - build-essential
-      - fakeroot
-      - rubygem-fpm
-    post-cache:
-      - export GOOS=linux
-      - export GOARCH=amd64
-      - make cloudflared-deb
-  build-fips-internal-deb:
-    build_dir: *build_dir
-    builddeps: &build_fips_deb_deps
-      - *pinned_go
-      - build-essential
-      - fakeroot
-      - rubygem-fpm
-    post-cache:
-      - export GOOS=linux
-      - export GOARCH=amd64
-      - export FIPS=true
-      - export ORIGINAL_NAME=true
-      - make cloudflared-deb
-  build-internal-deb-nightly-amd64:
-    build_dir: *build_dir
-    builddeps: *build_fips_deb_deps
-    post-cache:
-      - export GOOS=linux
-      - export GOARCH=amd64
-      - export NIGHTLY=true
-      - export FIPS=true
-      - export ORIGINAL_NAME=true
-      - make cloudflared-deb
-  build-internal-deb-nightly-arm64:
-    build_dir: *build_dir
-    builddeps: *build_fips_deb_deps
-    post-cache:
-      - export GOOS=linux
-      - export GOARCH=arm64
-      - export NIGHTLY=true
-      # - export FIPS=true # TUN-7595
-      - export ORIGINAL_NAME=true
-      - make cloudflared-deb
-  build-deb-arm64:
-    build_dir: *build_dir
-    builddeps: *build_deb_deps
-    post-cache:
-      - export GOOS=linux
-      - export GOARCH=arm64
-      - make cloudflared-deb
-  test:
-    build_dir: *build_dir
-    builddeps: &build_deps_tests
-      - *pinned_go
-      - build-essential
-      - fakeroot
-      - rubygem-fpm
-      - rpm
-      - libffi-dev
-      - gotest-to-teamcity
-    pre-cache: *build_pre_cache
-    post-cache:
-      - export GOOS=linux
-      - export GOARCH=amd64
-      - export PATH="$HOME/go/bin:$PATH"
-      - make test | gotest-to-teamcity
-  test-fips:
-    build_dir: *build_dir
-    builddeps: *build_deps_tests
-    pre-cache: *build_pre_cache
-    post-cache:
-      - export GOOS=linux
-      - export GOARCH=amd64
-      - export FIPS=true
-      - export PATH="$HOME/go/bin:$PATH"
-      - make test | gotest-to-teamcity
-  component-test:
-    build_dir: *build_dir
-    builddeps: &build_deps_component_test
-      - *pinned_go
-      - python3
-      - python3-pip
-      - python3-setuptools
-      # procps installs the ps command which is needed in test_sysv_service
-      # because the init script uses ps pid to determine if the agent is
-      # running
-      - procps
-      - python3-venv
-    pre-cache-copy-paths:
-      - component-tests/requirements.txt
-    post-cache: &component_test_post_cache
-      - python3 -m venv env
-      - . env/bin/activate
-      - pip install --upgrade -r component-tests/requirements.txt
-      # Creates and routes a Named Tunnel for this build. Also constructs
-      # config file from env vars.
-      - python3 component-tests/setup.py --type create
-      - pytest component-tests -o log_cli=true --log-cli-level=INFO
-      # The Named Tunnel is deleted and its route unprovisioned here.
-      - python3 component-tests/setup.py --type cleanup
-  component-test-fips:
-    build_dir: *build_dir
-    builddeps: *build_deps_component_test
-    pre-cache-copy-paths:
-      - component-tests/requirements.txt
-    post-cache: *component_test_post_cache
-  github-release-dryrun:
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go
-      - build-essential
-      - python3-dev
-      - libffi-dev
-      - python3-setuptools
-      - python3-pip
-      - python3-venv
-    post-cache:
-      - python3 -m venv env
-      - . env/bin/activate
-      - pip install pynacl==1.4.0 pygithub==1.55
-      - make github-release-dryrun
-  github-release:
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go
-      - build-essential
-      - python3-dev
-      - libffi-dev
-      - python3-setuptools
-      - python3-pip
-      - python3-venv
-    post-cache:
-      - python3 -m venv env
-      - . env/bin/activate
-      - pip install pynacl==1.4.0 pygithub==1.55
-      - make github-release
-  r2-linux-release:
-    build_dir: *build_dir
-    builddeps:
-      - *pinned_go
-      - build-essential
-      - fakeroot
-      - rubygem-fpm
-      - rpm
-      - wget
-      - python3-dev
-      - libffi-dev
-      - python3-setuptools
-      - python3-pip
-      - reprepro
-      - createrepo-c
-      - python3-venv
-    post-cache:
-      - python3 -m venv env
-      - . env/bin/activate
-      - pip install pynacl==1.4.0 pygithub==1.55 boto3==1.22.9 python-gnupg==0.4.9
-      - make r2-linux-release
-
-trixie: *bookworm
+# A valid cfsetup.yaml is required but we dont have any real config to specify
+dummy_key: true
@@ -45,6 +45,6 @@ func (m *mockFeatureSelector) Snapshot() features.FeatureSnapshot {
 	return features.FeatureSnapshot{
 		PostQuantum:     features.PostQuantumPrefer,
 		DatagramVersion: features.DatagramV3,
-		FeaturesList:    []string{features.FeaturePostQuantum, features.FeatureDatagramV3_1},
+		FeaturesList:    []string{features.FeaturePostQuantum, features.FeatureDatagramV3_2},
 	}
 }
@@ -1,87 +0,0 @@
-package main
-
-import (
-	"github.com/rs/zerolog"
-
-	"github.com/cloudflare/cloudflared/config"
-	"github.com/cloudflare/cloudflared/tunneldns"
-)
-
-const (
-	// ResolverServiceType is used to identify what kind of overwatch service this is
-	ResolverServiceType = "resolver"
-
-	LogFieldResolverAddress          = "resolverAddress"
-	LogFieldResolverPort             = "resolverPort"
-	LogFieldResolverMaxUpstreamConns = "resolverMaxUpstreamConns"
-)
-
-// ResolverService is used to wrap the tunneldns package's DNS over HTTP
-// into a service model for the overwatch package.
-// it also holds a reference to the config object that represents its state
-type ResolverService struct {
-	resolver config.DNSResolver
-	shutdown chan struct{}
-	log      *zerolog.Logger
-}
-
-// NewResolverService creates a new resolver service
-func NewResolverService(r config.DNSResolver, log *zerolog.Logger) *ResolverService {
-	return &ResolverService{resolver: r,
-		shutdown: make(chan struct{}),
-		log:      log,
-	}
-}
-
-// Name is used to figure out this service is related to the others (normally the addr it binds to)
-// this is just "resolver" since there can only be one DNS resolver running
-func (s *ResolverService) Name() string {
-	return ResolverServiceType
-}
-
-// Type is used to identify what kind of overwatch service this is
-func (s *ResolverService) Type() string {
-	return ResolverServiceType
-}
-
-// Hash is used to figure out if this forwarder is the unchanged or not from the config file updates
-func (s *ResolverService) Hash() string {
-	return s.resolver.Hash()
-}
-
-// Shutdown stops the tunneldns listener
-func (s *ResolverService) Shutdown() {
-	s.shutdown <- struct{}{}
-}
-
-// Run is the run loop that is started by the overwatch service
-func (s *ResolverService) Run() error {
-	// create a listener
-	l, err := tunneldns.CreateListener(s.resolver.AddressOrDefault(), s.resolver.PortOrDefault(),
-		s.resolver.UpstreamsOrDefault(), s.resolver.BootstrapsOrDefault(), s.resolver.MaxUpstreamConnectionsOrDefault(), s.log)
-	if err != nil {
-		return err
-	}
-
-	// start the listener.
-	readySignal := make(chan struct{})
-	err = l.Start(readySignal)
-	if err != nil {
-		_ = l.Stop()
-		return err
-	}
-	<-readySignal
-
-	resolverLog := s.log.With().
-		Str(LogFieldResolverAddress, s.resolver.AddressOrDefault()).
-		Uint16(LogFieldResolverPort, s.resolver.PortOrDefault()).
-		Int(LogFieldResolverMaxUpstreamConns, s.resolver.MaxUpstreamConnectionsOrDefault()).
-		Logger()
-
-	resolverLog.Info().Msg("Starting resolver")
-
-	// wait for shutdown signal
-	<-s.shutdown
-	resolverLog.Info().Msg("Shutting down resolver")
-	return l.Stop()
-}
@@ -8,7 +8,7 @@ import (
 )

 // AppService is the main service that runs when no command lines flags are passed to cloudflared
-// it manages all the running services such as tunnels, forwarders, DNS resolver, etc
+// it manages all the running services such as tunnels, forwarders, etc
 type AppService struct {
 	configManager    config.Manager
 	serviceManager   overwatch.Manager
@@ -73,14 +73,6 @@ func (s *AppService) handleConfigUpdate(c config.Root) {
 		activeServices[service.Name()] = struct{}{}
 	}

-	// handle resolver changes
-	if c.Resolver.Enabled {
-		service := NewResolverService(c.Resolver, s.log)
-		s.serviceManager.Add(service)
-		activeServices[service.Name()] = struct{}{}
-
-	}
-
 	// TODO: TUN-1451 - tunnels

 	// remove any services that are no longer active
@@ -111,9 +111,6 @@ const (
 	// ICMPV6Src is the command line flag to set the source address and the interface name to send/receive ICMPv6 messages
 	ICMPV6Src = "icmpv6-src"

-	// ProxyDns is the command line flag to run DNS server over HTTPS
-	ProxyDns = "proxy-dns"
-
 	// Name is the command line to set the name of the tunnel
 	Name = "name"

@@ -60,7 +60,7 @@ After=network-online.target
 Wants=network-online.target

 [Service]
-TimeoutStartSec=0
+TimeoutStartSec=15
 Type=notify
 ExecStart={{ .Path }} --no-autoupdate{{ range .ExtraArgs }} {{ . }}{{ end }}
 Restart=on-failure
@@ -149,7 +149,7 @@ To determine if an update happened in a script, check for error code 11.`,
 		},
 	}
 	cmds = append(cmds, tunnel.Commands()...)
-	cmds = append(cmds, proxydns.Command(false))
+	cmds = append(cmds, proxydns.Command()) // removed feature, only here for error message
 	cmds = append(cmds, access.Commands()...)
 	cmds = append(cmds, tail.Command())
 	return cmds
@@ -1,115 +1,54 @@
 package proxydns

 import (
-	"context"
-	"net"
-	"os"
-	"os/signal"
-	"syscall"
+	"errors"

 	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v2/altsrc"

 	"github.com/cloudflare/cloudflared/cmd/cloudflared/cliutil"
 	"github.com/cloudflare/cloudflared/logger"
-	"github.com/cloudflare/cloudflared/metrics"
-	"github.com/cloudflare/cloudflared/tunneldns"
 )

-func Command(hidden bool) *cli.Command {
-	return &cli.Command{
-		Name:   "proxy-dns",
-		Action: cliutil.ConfiguredAction(Run),
+const removedMessage = "dns-proxy feature is not supported, since version 2026.2.0"

-		Usage: "Run a DNS over HTTPS proxy server.",
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:    "metrics",
-				Value:   "localhost:",
-				Usage:   "Listen address for metrics reporting.",
-				EnvVars: []string{"TUNNEL_METRICS"},
-			},
-			&cli.StringFlag{
-				Name:    "address",
-				Usage:   "Listen address for the DNS over HTTPS proxy server.",
-				Value:   "localhost",
-				EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
-			},
-			// Note TUN-3758 , we use Int because UInt is not supported with altsrc
-			&cli.IntFlag{
-				Name:    "port",
-				Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
-				Value:   53,
-				EnvVars: []string{"TUNNEL_DNS_PORT"},
-			},
-			&cli.StringSliceFlag{
-				Name:    "upstream",
-				Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
-				Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
-				EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
-			},
-			&cli.StringSliceFlag{
-				Name:    "bootstrap",
-				Usage:   "bootstrap endpoint URL, you can specify multiple endpoints for redundancy.",
-				Value:   cli.NewStringSlice("https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query"),
-				EnvVars: []string{"TUNNEL_DNS_BOOTSTRAP"},
-			},
-			&cli.IntFlag{
-				Name:    "max-upstream-conns",
-				Usage:   "Maximum concurrent connections to upstream. Setting to 0 means unlimited.",
-				Value:   tunneldns.MaxUpstreamConnsDefault,
-				EnvVars: []string{"TUNNEL_DNS_MAX_UPSTREAM_CONNS"},
-			},
-		},
-		ArgsUsage: " ", // can't be the empty string or we get the default output
-		Hidden:    hidden,
+func Command() *cli.Command {
+	return &cli.Command{
+		Name:            "proxy-dns",
+		Action:          cliutil.ConfiguredAction(Run),
+		Usage:           removedMessage,
+		SkipFlagParsing: true,
 	}
 }

-// Run implements a foreground runner
 func Run(c *cli.Context) error {
 	log := logger.CreateLoggerFromContext(c, logger.EnableTerminalLog)
+	err := errors.New(removedMessage)
+	log.Err(err).Msg("DNS Proxy is no longer supported")

-	metricsListener, err := net.Listen("tcp", c.String("metrics"))
-	if err != nil {
-		log.Fatal().Err(err).Msg("Failed to open the metrics listener")
-	}
-
-	go metrics.ServeMetrics(metricsListener, context.Background(), metrics.Config{}, log)
-
-	listener, err := tunneldns.CreateListener(
-		c.String("address"),
-		// Note TUN-3758 , we use Int because UInt is not supported with altsrc
-		uint16(c.Int("port")),
-		c.StringSlice("upstream"),
-		c.StringSlice("bootstrap"),
-		c.Int("max-upstream-conns"),
-		log,
-	)
-
-	if err != nil {
-		log.Err(err).Msg("Failed to create the listeners")
-		return err
-	}
-
-	// Try to start the server
-	readySignal := make(chan struct{})
-	err = listener.Start(readySignal)
-	if err != nil {
-		log.Err(err).Msg("Failed to start the listeners")
-		return listener.Stop()
-	}
-	<-readySignal
-
-	// Wait for signal
-	signals := make(chan os.Signal, 10)
-	signal.Notify(signals, syscall.SIGTERM, syscall.SIGINT)
-	defer signal.Stop(signals)
-	<-signals
-
-	// Shut down server
-	err = listener.Stop()
-	if err != nil {
-		log.Err(err).Msg("failed to stop")
-	}
 	return err
 }
+
+// Old flags used by the proxy-dns command, only kept to not break any script that might be setting these flags
+func ConfigureProxyDNSFlags(shouldHide bool) []cli.Flag {
+	return []cli.Flag{
+		altsrc.NewBoolFlag(&cli.BoolFlag{
+			Name: "proxy-dns",
+		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name: "proxy-dns-port",
+		}),
+		altsrc.NewStringFlag(&cli.StringFlag{
+			Name: "proxy-dns-address",
+		}),
+		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
+			Name: "proxy-dns-upstream",
+		}),
+		altsrc.NewIntFlag(&cli.IntFlag{
+			Name: "proxy-dns-max-upstream-conns",
+		}),
+		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
+			Name: "proxy-dns-bootstrap",
+		}),
+	}
+}
@@ -39,7 +39,6 @@ import (
 	"github.com/cloudflare/cloudflared/signal"
 	"github.com/cloudflare/cloudflared/supervisor"
 	"github.com/cloudflare/cloudflared/tlsconfig"
-	"github.com/cloudflare/cloudflared/tunneldns"
 	"github.com/cloudflare/cloudflared/tunnelstate"
 	"github.com/cloudflare/cloudflared/validation"
 )
@@ -115,12 +114,6 @@ var (
 		cfdflags.LogFile,
 		cfdflags.LogDirectory,
 		cfdflags.TraceOutput,
-		cfdflags.ProxyDns,
-		"proxy-dns-port",
-		"proxy-dns-address",
-		"proxy-dns-upstream",
-		"proxy-dns-max-upstream-conns",
-		"proxy-dns-bootstrap",
 		cfdflags.IsAutoUpdated,
 		cfdflags.Edge,
 		cfdflags.Region,
@@ -181,8 +174,7 @@ func Commands() []*cli.Command {
 		buildCleanupCommand(),
 		buildTokenCommand(),
 		buildDiagCommand(),
-		// for compatibility, allow following as tunnel subcommands
-		proxydns.Command(true),
+		proxydns.Command(), // removed feature, only here for error message
 		cliutil.RemovedCommand("db-connect"),
 	}

@@ -258,9 +250,8 @@ func TunnelCommand(c *cli.Context) error {

 	// Run a quick tunnel
 	// A unauthenticated named tunnel hosted on <random>.<quick-tunnels-service>.com
-	// We don't support running proxy-dns and a quick tunnel at the same time as the same process
 	shouldRunQuickTunnel := c.IsSet("url") || c.IsSet(ingress.HelloWorldFlag)
-	if !c.IsSet(cfdflags.ProxyDns) && c.String("quick-service") != "" && shouldRunQuickTunnel {
+	if c.String("quick-service") != "" && shouldRunQuickTunnel {
 		return RunQuickTunnel(sc)
 	}

@@ -274,16 +265,6 @@ func TunnelCommand(c *cli.Context) error {
 		return errDeprecatedClassicTunnel
 	}

-	if c.IsSet(cfdflags.ProxyDns) {
-		if shouldRunQuickTunnel {
-			return fmt.Errorf("running a quick tunnel with `proxy-dns` is not supported")
-		}
-		// NamedTunnelProperties are nil since proxy dns server does not need it.
-		// This is supported for legacy reasons: dns proxy server is not a tunnel and ideally should
-		// not run as part of cloudflared tunnel.
-		return StartServer(sc.c, buildInfo, nil, sc.log)
-	}
-
 	return errors.New(tunnelCmdErrorMessage)
 }

@@ -393,24 +374,12 @@ func StartServer(

 	go waitForSignal(graceShutdownC, log)

-	if c.IsSet(cfdflags.ProxyDns) {
-		dnsReadySignal := make(chan struct{})
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			errC <- runDNSProxyServer(c, dnsReadySignal, ctx.Done(), log)
-		}()
-		// Wait for proxy-dns to come up (if used)
-		<-dnsReadySignal
-	}
-
 	connectedSignal := signal.New(make(chan struct{}))
 	go notifySystemd(connectedSignal)
 	if c.IsSet("pidfile") {
 		go writePidFile(connectedSignal, c.String("pidfile"), log)
 	}

-	// update needs to be after DNS proxy is up to resolve equinox server address
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
@@ -420,11 +389,8 @@ func StartServer(
 		errC <- autoupdater.Run(ctx)
 	}()

-	// Serve DNS proxy stand-alone if no tunnel type (quick, adhoc, named) is going to run
-	if dnsProxyStandAlone(c, namedTunnel) {
-		connectedSignal.Notify()
-		// no grace period, handle SIGINT/SIGTERM immediately
-		return waitToShutdown(&wg, cancel, errC, graceShutdownC, 0, log)
+	if namedTunnel == nil {
+		return fmt.Errorf("namedTunnel is nil")
 	}

 	logTransport := logger.CreateTransportLoggerFromContext(c, logger.EnableTerminalLog)
@@ -432,10 +398,7 @@ func StartServer(
 	observer := connection.NewObserver(log, logTransport)

 	// Send Quick Tunnel URL to UI if applicable
-	var quickTunnelURL string
-	if namedTunnel != nil {
-		quickTunnelURL = namedTunnel.QuickTunnelUrl
-	}
+	quickTunnelURL := namedTunnel.QuickTunnelUrl
 	if quickTunnelURL != "" {
 		observer.SendURL(quickTunnelURL)
 	}
@@ -459,14 +422,7 @@ func StartServer(
 		}
 	}

-	userCreds, err := credentials.Read(c.String(cfdflags.OriginCert), log)
-	var isFEDEndpoint bool
-	if err != nil {
-		isFEDEndpoint = false
-	} else {
-		isFEDEndpoint = userCreds.IsFEDEndpoint()
-	}
-
+	isFEDEndpoint := namedTunnel.Credentials.Endpoint == credentials.FedEndpoint
 	var managementHostname string
 	if isFEDEndpoint {
 		managementHostname = credentials.FedRampHostname
@@ -647,7 +603,7 @@ func tunnelFlags(shouldHide bool) []cli.Flag {
 	flags := configureCloudflaredFlags(shouldHide)
 	flags = append(flags, configureProxyFlags(shouldHide)...)
 	flags = append(flags, cliutil.ConfigureLoggingFlags(shouldHide)...)
-	flags = append(flags, configureProxyDNSFlags(shouldHide)...)
+	flags = append(flags, proxydns.ConfigureProxyDNSFlags(shouldHide)...) // removed feature, only kept to not break any script that might be setting these flags
 	flags = append(flags, []cli.Flag{
 		credentialsFileFlag,
 		altsrc.NewBoolFlag(&cli.BoolFlag{
@@ -1178,57 +1134,6 @@ func sshFlags(shouldHide bool) []cli.Flag {
 	}
 }

-func configureProxyDNSFlags(shouldHide bool) []cli.Flag {
-	return []cli.Flag{
-		altsrc.NewBoolFlag(&cli.BoolFlag{
-			Name:    cfdflags.ProxyDns,
-			Usage:   "Run a DNS over HTTPS proxy server.",
-			EnvVars: []string{"TUNNEL_DNS"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewIntFlag(&cli.IntFlag{
-			Name:    "proxy-dns-port",
-			Value:   53,
-			Usage:   "Listen on given port for the DNS over HTTPS proxy server.",
-			EnvVars: []string{"TUNNEL_DNS_PORT"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringFlag(&cli.StringFlag{
-			Name:    "proxy-dns-address",
-			Usage:   "Listen address for the DNS over HTTPS proxy server.",
-			Value:   "localhost",
-			EnvVars: []string{"TUNNEL_DNS_ADDRESS"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
-			Name:    "proxy-dns-upstream",
-			Usage:   "Upstream endpoint URL, you can specify multiple endpoints for redundancy.",
-			Value:   cli.NewStringSlice("https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"),
-			EnvVars: []string{"TUNNEL_DNS_UPSTREAM"},
-			Hidden:  shouldHide,
-		}),
-		altsrc.NewIntFlag(&cli.IntFlag{
-			Name:    "proxy-dns-max-upstream-conns",
-			Usage:   "Maximum concurrent connections to upstream. Setting to 0 means unlimited.",
-			Value:   tunneldns.MaxUpstreamConnsDefault,
-			Hidden:  shouldHide,
-			EnvVars: []string{"TUNNEL_DNS_MAX_UPSTREAM_CONNS"},
-		}),
-		altsrc.NewStringSliceFlag(&cli.StringSliceFlag{
-			Name:  "proxy-dns-bootstrap",
-			Usage: "bootstrap endpoint URL, you can specify multiple endpoints for redundancy.",
-			Value: cli.NewStringSlice(
-				"https://162.159.36.1/dns-query",
-				"https://162.159.46.1/dns-query",
-				"https://[2606:4700:4700::1111]/dns-query",
-				"https://[2606:4700:4700::1001]/dns-query",
-			),
-			EnvVars: []string{"TUNNEL_DNS_BOOTSTRAP"},
-			Hidden:  shouldHide,
-		}),
-	}
-}
-
 func stdinControl(reconnectCh chan supervisor.ReconnectSignal, log *zerolog.Logger) {
 	for {
 		scanner := bufio.NewScanner(os.Stdin)
@@ -111,13 +111,6 @@ func isSecretEnvVar(key string) bool {
 	return false
 }

-func dnsProxyStandAlone(c *cli.Context, namedTunnel *connection.TunnelProperties) bool {
-	return c.IsSet(flags.ProxyDns) &&
-		!(c.IsSet(flags.Name) || // adhoc-named tunnel
-			c.IsSet(ingress.HelloWorldFlag) || // quick or named tunnel
-			namedTunnel != nil) // named tunnel
-}
-
 func prepareTunnelConfig(
 	ctx context.Context,
 	c *cli.Context,
@@ -63,12 +63,14 @@ func (s searchByID) Path() (string, error) {
 		Str("originCertPath", originCertPath).
 		Logger()

-	// Fallback to look for tunnel credentials in the origin cert directory
-	if originCertPath, err := credentials.FindOriginCert(originCertPath, &originCertLog); err == nil {
-		originCertDir := filepath.Dir(originCertPath)
-		if filePath, err := tunnelFilePath(s.id, originCertDir); err == nil {
-			if s.fs.validFilePath(filePath) {
-				return filePath, nil
+	if originCertPath != "" {
+		// Look for tunnel credentials in the origin cert directory if the flag is provided
+		if originCertPath, err := credentials.FindOriginCert(originCertPath, &originCertLog); err == nil {
+			originCertDir := filepath.Dir(originCertPath)
+			if filePath, err := tunnelFilePath(s.id, originCertDir); err == nil {
+				if s.fs.validFilePath(filePath) {
+					return filePath, nil
+				}
 			}
 		}
 	}
@@ -1,37 +0,0 @@
-package tunnel
-
-import (
-	"fmt"
-
-	"github.com/cloudflare/cloudflared/tunneldns"
-
-	"github.com/pkg/errors"
-	"github.com/rs/zerolog"
-	"github.com/urfave/cli/v2"
-)
-
-func runDNSProxyServer(c *cli.Context, dnsReadySignal chan struct{}, shutdownC <-chan struct{}, log *zerolog.Logger) error {
-	port := c.Int("proxy-dns-port")
-	if port <= 0 || port > 65535 {
-		return errors.New("The 'proxy-dns-port' must be a valid port number in <1, 65535> range.")
-	}
-	maxUpstreamConnections := c.Int("proxy-dns-max-upstream-conns")
-	if maxUpstreamConnections < 0 {
-		return fmt.Errorf("'%s' must be 0 or higher", "proxy-dns-max-upstream-conns")
-	}
-	listener, err := tunneldns.CreateListener(c.String("proxy-dns-address"), uint16(port), c.StringSlice("proxy-dns-upstream"), c.StringSlice("proxy-dns-bootstrap"), maxUpstreamConnections, log)
-	if err != nil {
-		close(dnsReadySignal)
-		listener.Stop()
-		return errors.Wrap(err, "Cannot create the DNS over HTTPS proxy server")
-	}
-
-	err = listener.Start(dnsReadySignal)
-	if err != nil {
-		return errors.Wrap(err, "Cannot start the DNS over HTTPS proxy server")
-	}
-	<-shutdownC
-	_ = listener.Stop()
-	log.Info().Msg("DNS server stopped")
-	return nil
-}
@@ -5,7 +5,7 @@ import base64

 from dataclasses import dataclass, InitVar

-from constants import METRICS_PORT, PROXY_DNS_PORT
+from constants import METRICS_PORT

 # frozen=True raises exception when assigning to fields. This emulates immutability

@@ -99,10 +99,3 @@ class QuickTunnelConfig(BaseConfig):
        object.__setattr__(self, 'full_config',
                           self.merge_config(additional_config))

-@dataclass(frozen=True)
-class ProxyDnsConfig(BaseConfig):
-    full_config = {
-        "port": PROXY_DNS_PORT,
-        "no-autoupdate": True,
-    }
-
@@ -5,15 +5,14 @@ from time import sleep
 import pytest
 import yaml

-from config import NamedTunnelConfig, ProxyDnsConfig, QuickTunnelConfig
-from constants import BACKOFF_SECS, PROXY_DNS_PORT
+from config import NamedTunnelConfig, QuickTunnelConfig
+from constants import BACKOFF_SECS
 from util import LOGGER


 class CfdModes(Enum):
    NAMED = auto()
    QUICK = auto()
-    PROXY_DNS = auto()


@pytest.fixture(scope="session")
@@ -26,16 +25,7 @@ def component_tests_config():
        config = yaml.safe_load(stream)
        LOGGER.info(f"component tests base config {config}")

-        def _component_tests_config(additional_config={}, cfd_mode=CfdModes.NAMED, run_proxy_dns=True, provide_ingress=True):
-            if run_proxy_dns:
-                # Regression test for TUN-4177, running with proxy-dns should not prevent tunnels from running.
-                # So we run all tests with it.
-                additional_config["proxy-dns"] = True
-                additional_config["proxy-dns-port"] = PROXY_DNS_PORT
-            else:
-                additional_config.pop("proxy-dns", None)
-                additional_config.pop("proxy-dns-port", None)
-
+        def _component_tests_config(additional_config={}, cfd_mode=CfdModes.NAMED, provide_ingress=True):
            # Allows the ingress rules to be omitted from the provided config
            ingress = []
            if provide_ingress:
@@ -51,8 +41,6 @@ def component_tests_config():
                                         credentials_file=config['credentials_file'],
                                         ingress=ingress,
                                         hostname=hostname)
-            elif cfd_mode is CfdModes.PROXY_DNS:
-                return ProxyDnsConfig(cloudflared_binary=config['cloudflared_binary'])
            elif cfd_mode is CfdModes.QUICK:
                return QuickTunnelConfig(additional_config=additional_config, cloudflared_binary=config['cloudflared_binary'])
            else:
@@ -3,7 +3,6 @@ MAX_RETRIES = 5
 BACKOFF_SECS = 7
 MAX_LOG_LINES = 50

-PROXY_DNS_PORT = 9053
 MANAGEMENT_HOST_NAME = "management.argotunnel.com"


@@ -25,7 +25,7 @@ class TestManagement:
        # Skipping this test for windows for now and will address it as part of tun-7377
        if platform.system() == "Windows":
            return
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
+        config = component_tests_config(cfd_mode=CfdModes.NAMED, provide_ingress=False)
        LOGGER.debug(config)
        headers = {}
        headers["Content-Type"] = "application/json"
@@ -52,7 +52,7 @@ class TestManagement:
        # Skipping this test for windows for now and will address it as part of tun-7377
        if platform.system() == "Windows":
            return
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
+        config = component_tests_config(cfd_mode=CfdModes.NAMED, provide_ingress=False)
        LOGGER.debug(config)
        config_path = write_config(tmp_path, config.full_config)
        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], new_process=True):
@@ -73,7 +73,7 @@ class TestManagement:
        # Skipping this test for windows for now and will address it as part of tun-7377
        if platform.system() == "Windows":
            return
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
+        config = component_tests_config(cfd_mode=CfdModes.NAMED, provide_ingress=False)
        LOGGER.debug(config)
        config_path = write_config(tmp_path, config.full_config)
        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], new_process=True):
@@ -94,7 +94,7 @@ class TestManagement:
        # Skipping this test for windows for now and will address it as part of tun-7377
        if platform.system() == "Windows":
            return
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
+        config = component_tests_config(cfd_mode=CfdModes.NAMED, provide_ingress=False)
        LOGGER.debug(config)
        config_path = write_config(tmp_path, config.full_config)
        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1", "--management-diagnostics=false"], new_process=True):
@@ -107,7 +107,13 @@ class TestManagement:
            assert resp.status_code == 404, "Expected cloudflared to return 404 for /metrics"


+
+
@retry(stop_max_attempt_number=MAX_RETRIES, wait_fixed=BACKOFF_SECS * 1000)
 def send_request(url, headers={}):
    with requests.Session() as s:
-        return s.get(url, timeout=BACKOFF_SECS, headers=headers)
+        resp = s.get(url, timeout=BACKOFF_SECS, headers=headers)
+        if resp.status_code == 530:
+            LOGGER.debug(f"Received 530 status, retrying request to {url}")
+            raise Exception(f"Received 530 status code from {url}")
+        return resp
@@ -1,62 +0,0 @@
-#!/usr/bin/env python
-import socket
-from time import sleep
-
-import constants
-from conftest import CfdModes
-from util import start_cloudflared, wait_tunnel_ready, check_tunnel_not_connected
-
-
-# Sanity checks that test that we only run Proxy DNS and Tunnel when we really expect them to be there.
-class TestProxyDns:
-    def test_proxy_dns_with_named_tunnel(self, tmp_path, component_tests_config):
-        run_test_scenario(tmp_path, component_tests_config, CfdModes.NAMED, run_proxy_dns=True)
-
-    def test_proxy_dns_alone(self, tmp_path, component_tests_config):
-        run_test_scenario(tmp_path, component_tests_config, CfdModes.PROXY_DNS, run_proxy_dns=True)
-
-    def test_named_tunnel_alone(self, tmp_path, component_tests_config):
-        run_test_scenario(tmp_path, component_tests_config, CfdModes.NAMED, run_proxy_dns=False)
-
-
-def run_test_scenario(tmp_path, component_tests_config, cfd_mode, run_proxy_dns):
-    expect_proxy_dns = run_proxy_dns
-    expect_tunnel = False
-
-    if cfd_mode == CfdModes.NAMED:
-        expect_tunnel = True
-        pre_args = ["tunnel", "--ha-connections", "1"]
-        args = ["run"]
-    elif cfd_mode == CfdModes.PROXY_DNS:
-        expect_proxy_dns = True
-        pre_args = []
-        args = ["proxy-dns", "--port", str(constants.PROXY_DNS_PORT)]
-    else:
-        assert False, f"Unknown cfd_mode {cfd_mode}"
-
-    config = component_tests_config(cfd_mode=cfd_mode, run_proxy_dns=run_proxy_dns)
-    with start_cloudflared(tmp_path, config, cfd_pre_args=pre_args, cfd_args=args, new_process=True, capture_output=False):
-        if expect_tunnel:
-            wait_tunnel_ready()
-        else:
-            check_tunnel_not_connected()
-        verify_proxy_dns(expect_proxy_dns)
-
-
-def verify_proxy_dns(should_be_running):
-    # Wait for the Proxy DNS listener to come up.
-    sleep(constants.BACKOFF_SECS)
-    had_failure = False
-    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-    try:
-        sock.connect(('localhost', constants.PROXY_DNS_PORT))
-        sock.send(b"anything")
-    except:
-        if should_be_running:
-            assert False, "Expected Proxy DNS to be running, but it was not."
-        had_failure = True
-    finally:
-        sock.close()
-
-    if not should_be_running and not had_failure:
-        assert False, "Proxy DNS should not have been running, but it was."
@@ -6,7 +6,7 @@ from util import LOGGER, start_cloudflared, wait_tunnel_ready, get_quicktunnel_u

 class TestQuickTunnels:
    def test_quick_tunnel(self, tmp_path, component_tests_config):
-        config = component_tests_config(cfd_mode=CfdModes.QUICK, run_proxy_dns=False)
+        config = component_tests_config(cfd_mode=CfdModes.QUICK)
        LOGGER.debug(config)
        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], cfd_args=["--hello-world"], new_process=True):
            wait_tunnel_ready(require_min_connections=1)
@@ -15,22 +15,10 @@ class TestQuickTunnels:
            send_requests(url, 3, True)
    
    def test_quick_tunnel_url(self, tmp_path, component_tests_config):
-        config = component_tests_config(cfd_mode=CfdModes.QUICK, run_proxy_dns=False)
+        config = component_tests_config(cfd_mode=CfdModes.QUICK)
        LOGGER.debug(config)
        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"], cfd_args=["--url", f"http://localhost:{METRICS_PORT}/"], new_process=True):
            wait_tunnel_ready(require_min_connections=1)
            time.sleep(10)
            url = get_quicktunnel_url()
            send_requests(url+"/ready", 3, True)
-
-    def test_quick_tunnel_proxy_dns_url(self, tmp_path, component_tests_config):
-        config = component_tests_config(cfd_mode=CfdModes.QUICK, run_proxy_dns=True)
-        LOGGER.debug(config)
-        failed_start = start_cloudflared(tmp_path, config, cfd_args=["--url", f"http://localhost:{METRICS_PORT}/"], expect_success=False)
-        assert failed_start.returncode == 1, "Expected cloudflared to fail to run with `proxy-dns` and `hello-world`"
-    
-    def test_quick_tunnel_proxy_dns_hello_world(self, tmp_path, component_tests_config):
-        config = component_tests_config(cfd_mode=CfdModes.QUICK, run_proxy_dns=True)
-        LOGGER.debug(config)
-        failed_start = start_cloudflared(tmp_path, config, cfd_args=["--hello-world"], expect_success=False)
-        assert failed_start.returncode == 1, "Expected cloudflared to fail to run with `proxy-dns` and `url`"
@@ -19,7 +19,7 @@ class TestTail:
        with the access token and start and stop streaming on-demand.
        """
        print("test_start_stop_streaming")
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
+        config = component_tests_config(cfd_mode=CfdModes.NAMED, provide_ingress=False)
        LOGGER.debug(config)
        config_path = write_config(tmp_path, config.full_config)
        with start_cloudflared(tmp_path, config, cfd_args=["run", "--hello-world"], new_process=True):
@@ -38,7 +38,7 @@ class TestTail:
        Validates that a streaming logs connection will stream logs
        """
        print("test_streaming_logs")
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
+        config = component_tests_config(cfd_mode=CfdModes.NAMED, provide_ingress=False)
        LOGGER.debug(config)
        config_path = write_config(tmp_path, config.full_config)
        with start_cloudflared(tmp_path, config, cfd_args=["run", "--hello-world"], new_process=True):
@@ -65,7 +65,7 @@ class TestTail:
        but not http when filters applied.
        """
        print("test_streaming_logs_filters")
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
+        config = component_tests_config(cfd_mode=CfdModes.NAMED, provide_ingress=False)
        LOGGER.debug(config)
        config_path = write_config(tmp_path, config.full_config)
        with start_cloudflared(tmp_path, config, cfd_args=["run", "--hello-world"], new_process=True):
@@ -92,7 +92,7 @@ class TestTail:
        Validates that a streaming logs connection will stream logs with sampling.
        """
        print("test_streaming_logs_sampling")
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
+        config = component_tests_config(cfd_mode=CfdModes.NAMED, provide_ingress=False)
        LOGGER.debug(config)
        config_path = write_config(tmp_path, config.full_config)
        with start_cloudflared(tmp_path, config, cfd_args=["run", "--hello-world"], new_process=True):
@@ -120,7 +120,7 @@ class TestTail:
        Validates that a streaming logs session can be overriden by the same actor 
        """
        print("test_streaming_logs_actor_override")
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
+        config = component_tests_config(cfd_mode=CfdModes.NAMED, provide_ingress=False)
        LOGGER.debug(config)
        config_path = write_config(tmp_path, config.full_config)
        with start_cloudflared(tmp_path, config, cfd_args=["run", "--hello-world"], new_process=True):
@@ -11,14 +11,14 @@ class TestTunnel:
    '''Test tunnels with no ingress rules from config.yaml but ingress rules from CLI only'''

    def test_tunnel_hello_world(self, tmp_path, component_tests_config):
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
+        config = component_tests_config(cfd_mode=CfdModes.NAMED, provide_ingress=False)
        LOGGER.debug(config)
        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"],  cfd_args=["run", "--hello-world"], new_process=True):
            wait_tunnel_ready(tunnel_url=config.get_url(),
                              require_min_connections=1)
    
    def test_tunnel_url(self, tmp_path, component_tests_config):
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
+        config = component_tests_config(cfd_mode=CfdModes.NAMED, provide_ingress=False)
        LOGGER.debug(config)
        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"],  cfd_args=["run", "--url", f"http://localhost:{METRICS_PORT}/"], new_process=True):
            wait_tunnel_ready(require_min_connections=1)
@@ -29,17 +29,24 @@ class TestTunnel:
        Running a tunnel with no ingress rules provided from either config.yaml or CLI will still work but return 503
        for all incoming requests.
        '''
-        config = component_tests_config(cfd_mode=CfdModes.NAMED, run_proxy_dns=False, provide_ingress=False)
+        config = component_tests_config(cfd_mode=CfdModes.NAMED, provide_ingress=False)
        LOGGER.debug(config)
        with start_cloudflared(tmp_path, config, cfd_pre_args=["tunnel", "--ha-connections", "1"],  cfd_args=["run"], new_process=True):
            wait_tunnel_ready(require_min_connections=1)
-            resp = send_request(config.get_url()+"/")
-            assert resp.status_code == 503, "Expected cloudflared to return 503 for all requests with no ingress defined"
-            resp = send_request(config.get_url()+"/test")
-            assert resp.status_code == 503, "Expected cloudflared to return 503 for all requests with no ingress defined"
+            expected_status_code = 503
+            resp = send_request(config.get_url()+"/", expected_status_code)
+            assert resp.status_code == expected_status_code, "Expected cloudflared to return 503 for all requests with no ingress defined"
+            resp = send_request(config.get_url()+"/test", expected_status_code)
+            assert resp.status_code == expected_status_code, "Expected cloudflared to return 503 for all requests with no ingress defined"

+def retry_if_result_none(result):
+    '''
+    Returns True if the result is None, indicating that the function should be retried.
+    '''
+    return result is None

-@retry(stop_max_attempt_number=MAX_RETRIES, wait_fixed=BACKOFF_SECS * 1000)
-def send_request(url, headers={}):
+@retry(retry_on_result=retry_if_result_none, stop_max_attempt_number=MAX_RETRIES, wait_fixed=BACKOFF_SECS * 1000)
+def send_request(url, expected_status_code=200):
    with requests.Session() as s:
-        return s.get(url, timeout=BACKOFF_SECS, headers=headers)
+        resp = s.get(url, timeout=BACKOFF_SECS)
+        return resp if resp.status_code == expected_status_code else None
@@ -4,9 +4,6 @@ import (
 	"crypto/sha256"
 	"fmt"
 	"io"
-	"strings"
-
-	"github.com/cloudflare/cloudflared/tunneldns"
 )

 // Forwarder represents a client side listener to forward traffic to the edge
@@ -26,23 +23,13 @@ type Tunnel struct {
 	ProtocolType string `json:"type"`
 }

-// DNSResolver represents a client side DNS resolver
-type DNSResolver struct {
-	Enabled                bool     `json:"enabled"`
-	Address                string   `json:"address,omitempty"`
-	Port                   uint16   `json:"port,omitempty"`
-	Upstreams              []string `json:"upstreams,omitempty"`
-	Bootstraps             []string `json:"bootstraps,omitempty"`
-	MaxUpstreamConnections int      `json:"max_upstream_connections,omitempty"`
-}
-
-// Root is the base options to configure the service
+// Root is the base options to configure the service.
 type Root struct {
 	LogDirectory string      `json:"log_directory" yaml:"logDirectory,omitempty"`
 	LogLevel     string      `json:"log_level" yaml:"logLevel,omitempty"`
 	Forwarders   []Forwarder `json:"forwarders,omitempty" yaml:"forwarders,omitempty"`
 	Tunnels      []Tunnel    `json:"tunnels,omitempty" yaml:"tunnels,omitempty"`
-	Resolver     DNSResolver `json:"resolver,omitempty" yaml:"resolver,omitempty"`
+	// `resolver` key is reserved for a removed feature (proxy-dns) and should not be used.
 }

 // Hash returns the computed values to see if the forwarder values change
@@ -55,60 +42,3 @@ func (f *Forwarder) Hash() string {
 	_, _ = io.WriteString(h, f.Destination)
 	return fmt.Sprintf("%x", h.Sum(nil))
 }
-
-// Hash returns the computed values to see if the forwarder values change
-func (r *DNSResolver) Hash() string {
-	h := sha256.New()
-	_, _ = io.WriteString(h, r.Address)
-	_, _ = io.WriteString(h, strings.Join(r.Bootstraps, ","))
-	_, _ = io.WriteString(h, strings.Join(r.Upstreams, ","))
-	_, _ = io.WriteString(h, fmt.Sprintf("%d", r.Port))
-	_, _ = io.WriteString(h, fmt.Sprintf("%d", r.MaxUpstreamConnections))
-	_, _ = io.WriteString(h, fmt.Sprintf("%v", r.Enabled))
-	return fmt.Sprintf("%x", h.Sum(nil))
-}
-
-// EnabledOrDefault returns the enabled property
-func (r *DNSResolver) EnabledOrDefault() bool {
-	return r.Enabled
-}
-
-// AddressOrDefault returns the address or returns the default if empty
-func (r *DNSResolver) AddressOrDefault() string {
-	if r.Address != "" {
-		return r.Address
-	}
-	return "localhost"
-}
-
-// PortOrDefault return the port or returns the default if 0
-func (r *DNSResolver) PortOrDefault() uint16 {
-	if r.Port > 0 {
-		return r.Port
-	}
-	return 53
-}
-
-// UpstreamsOrDefault returns the upstreams or returns the default if empty
-func (r *DNSResolver) UpstreamsOrDefault() []string {
-	if len(r.Upstreams) > 0 {
-		return r.Upstreams
-	}
-	return []string{"https://1.1.1.1/dns-query", "https://1.0.0.1/dns-query"}
-}
-
-// BootstrapsOrDefault returns the bootstraps or returns the default if empty
-func (r *DNSResolver) BootstrapsOrDefault() []string {
-	if len(r.Bootstraps) > 0 {
-		return r.Bootstraps
-	}
-	return []string{"https://162.159.36.1/dns-query", "https://162.159.46.1/dns-query", "https://[2606:4700:4700::1111]/dns-query", "https://[2606:4700:4700::1001]/dns-query"}
-}
-
-// MaxUpstreamConnectionsOrDefault return the max upstream connections or returns the default if negative
-func (r *DNSResolver) MaxUpstreamConnectionsOrDefault() int {
-	if r.MaxUpstreamConnections >= 0 {
-		return r.MaxUpstreamConnections
-	}
-	return tunneldns.MaxUpstreamConnsDefault
-}
@@ -53,7 +53,8 @@ var headerEncoding = base64.RawStdEncoding
 func IsControlResponseHeader(headerName string) bool {
 	return strings.HasPrefix(headerName, ":") ||
 		strings.HasPrefix(headerName, "cf-int-") ||
-		strings.HasPrefix(headerName, "cf-cloudflared-")
+		strings.HasPrefix(headerName, "cf-cloudflared-") ||
+		strings.HasPrefix(headerName, "cf-proxy-")
 }

 // isWebsocketClientHeader returns true if the header name is required by the client to upgrade properly
@@ -1,18 +1,17 @@
 package connection

 import (
-	"fmt"
 	"net/http"
 	"reflect"
 	"sort"
 	"testing"

-	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )

 func TestSerializeHeaders(t *testing.T) {
 	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
+	require.NoError(t, err)

 	mockHeaders := http.Header{
 		"Mock-Header-One":        {"Mock header one value", "three"},
@@ -39,22 +38,22 @@ func TestSerializeHeaders(t *testing.T) {
 	serializedHeaders := SerializeHeaders(request.Header)

 	// Sanity check: the headers serialized to something that's not an empty string
-	assert.NotEqual(t, "", serializedHeaders)
+	require.NotEqual(t, "", serializedHeaders)

 	// Deserialize back, and ensure we get the same set of headers
 	deserializedHeaders, err := DeserializeHeaders(serializedHeaders)
-	assert.NoError(t, err)
+	require.NoError(t, err)

-	assert.Equal(t, 13, len(deserializedHeaders))
+	require.Len(t, deserializedHeaders, 13)
 	expectedHeaders := headerToReqHeader(mockHeaders)

 	sort.Sort(ByName(deserializedHeaders))
 	sort.Sort(ByName(expectedHeaders))

-	assert.True(
+	require.True(
 		t,
 		reflect.DeepEqual(expectedHeaders, deserializedHeaders),
-		fmt.Sprintf("got = %#v, want = %#v\n", deserializedHeaders, expectedHeaders),
+		"got = %#v, want = %#v\n", deserializedHeaders, expectedHeaders,
 	)
 }

@@ -82,12 +81,12 @@ func headerToReqHeader(headers http.Header) (reqHeaders []HTTPHeader) {

 func TestSerializeNoHeaders(t *testing.T) {
 	request, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
-	assert.NoError(t, err)
+	require.NoError(t, err)

 	serializedHeaders := SerializeHeaders(request.Header)
 	deserializedHeaders, err := DeserializeHeaders(serializedHeaders)
-	assert.NoError(t, err)
-	assert.Equal(t, 0, len(deserializedHeaders))
+	require.NoError(t, err)
+	require.Empty(t, deserializedHeaders)
 }

 func TestDeserializeMalformed(t *testing.T) {
@@ -102,21 +101,22 @@ func TestDeserializeMalformed(t *testing.T) {

 	for _, malformedValue := range malformedData {
 		_, err = DeserializeHeaders(malformedValue)
-		assert.Error(t, err)
+		require.Error(t, err)
 	}
 }

 func TestIsControlResponseHeader(t *testing.T) {
 	controlResponseHeaders := []string{
-		// Anything that begins with cf-int- or cf-cloudflared-
+		// Anything that begins with cf-int-, cf-cloudflared- or cf-proxy-
 		"cf-int-sample-header",
 		"cf-cloudflared-sample-header",
+		"cf-proxy-sample-header",
 		// Any http2 pseudoheader
 		":sample-pseudo-header",
 	}

 	for _, header := range controlResponseHeaders {
-		assert.True(t, IsControlResponseHeader(header))
+		require.True(t, IsControlResponseHeader(header))
 	}
 }

@@ -130,6 +130,6 @@ func TestIsNotControlResponseHeader(t *testing.T) {
 	}

 	for _, header := range notControlResponseHeaders {
-		assert.False(t, IsControlResponseHeader(header))
+		require.False(t, IsControlResponseHeader(header))
 	}
 }
@@ -295,7 +295,7 @@ func TestServeWS(t *testing.T) {
 	require.False(t, respWriter.panicked)
 }

-// TestNoWriteAfterServeHTTPReturns is a regression test of https://jira.cfops.it/browse/TUN-5184
+// TestNoWriteAfterServeHTTPReturns is a regression test of https://jira.cfdata.org/browse/TUN-5184
 // to make sure we don't write to the ResponseWriter after the ServeHTTP method returns
 func TestNoWriteAfterServeHTTPReturns(t *testing.T) {
 	cfdHTTP2Conn, edgeTCPConn := newTestHTTP2Connection()
@@ -33,6 +33,8 @@ const (
 	HTTPMethodKey = "HttpMethod"
 	// HTTPHostKey is used to get or set http host in QUIC ALPN if the underlying proxy connection type is HTTP.
 	HTTPHostKey = "HttpHost"
+	// HTTPStatus is used to return http status code in QUIC ALPN if the underlying proxy connection type is HTTP.
+	HTTPStatus = "HttpStatus"

 	QUICMetadataFlowID = "FlowID"
 )
@@ -287,7 +289,7 @@ func (hrw *httpResponseAdapter) AddTrailer(trailerName, trailerValue string) {

 func (hrw *httpResponseAdapter) WriteRespHeaders(status int, header http.Header) error {
 	metadata := make([]pogs.Metadata, 0)
-	metadata = append(metadata, pogs.Metadata{Key: "HttpStatus", Val: strconv.Itoa(status)})
+	metadata = append(metadata, pogs.Metadata{Key: HTTPStatus, Val: strconv.Itoa(status)})
 	for k, vv := range header {
 		for _, v := range vv {
 			httpHeaderKey := fmt.Sprintf("%s:%s", HTTPHeaderKey, k)
@@ -327,7 +329,7 @@ func (hrw *httpResponseAdapter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
 }

 func (hrw *httpResponseAdapter) WriteErrorResponse(err error) {
-	_ = hrw.WriteConnectResponseData(err, pogs.Metadata{Key: "HttpStatus", Val: strconv.Itoa(http.StatusBadGateway)})
+	_ = hrw.WriteConnectResponseData(err, pogs.Metadata{Key: HTTPStatus, Val: strconv.Itoa(http.StatusBadGateway)})
 }

 func (hrw *httpResponseAdapter) WriteConnectResponseData(respErr error, metadata ...pogs.Metadata) error {
@@ -10,9 +10,10 @@ const (
 	FeaturePostQuantum       = "postquantum"
 	FeatureQUICSupportEOF    = "support_quic_eof"
 	FeatureManagementLogs    = "management_logs"
-	FeatureDatagramV3_1      = "support_datagram_v3_1"
+	FeatureDatagramV3_2      = "support_datagram_v3_2"

-	DeprecatedFeatureDatagramV3 = "support_datagram_v3" // Deprecated: TUN-9291
+	DeprecatedFeatureDatagramV3   = "support_datagram_v3"   // Deprecated: TUN-9291
+	DeprecatedFeatureDatagramV3_1 = "support_datagram_v3_1" // Deprecated: TUN-9883
 )

 var defaultFeatures = []string{
@@ -26,6 +27,7 @@ var defaultFeatures = []string{
 // List of features that are no longer in-use.
 var deprecatedFeatures = []string{
 	DeprecatedFeatureDatagramV3,
+	DeprecatedFeatureDatagramV3_1,
 }

 // Features set by user provided flags
@@ -58,7 +60,7 @@ const (
 	// DatagramV2 is the currently supported datagram protocol for UDP and ICMP packets
 	DatagramV2 DatagramVersion = FeatureDatagramV2
 	// DatagramV3 is a new datagram protocol for UDP and ICMP packets. It is not backwards compatible with datagram v2.
-	DatagramV3 DatagramVersion = FeatureDatagramV3_1
+	DatagramV3 DatagramVersion = FeatureDatagramV3_2
 )

 // Remove any duplicate features from the list and remove deprecated features
@@ -23,9 +23,10 @@ const (
 // If the TXT record is missing a key, the field will unmarshal to the default Go value

 type featuresRecord struct {
-	DatagramV3Percentage uint32 `json:"dv3_1"`
+	DatagramV3Percentage uint32 `json:"dv3_2"`

 	// DatagramV3Percentage int32 `json:"dv3"` // Removed in TUN-9291
+	// DatagramV3Percentage uint32 `json:"dv3_1"` // Removed in TUN-9883
 	// PostQuantumPercentage int32 `json:"pq"` // Removed in TUN-7970
 }

@@ -105,7 +106,7 @@ func (fs *featureSelector) postQuantumMode() PostQuantumMode {

 func (fs *featureSelector) datagramVersion() DatagramVersion {
 	// If user provides the feature via the cli, we take it as priority over remote feature evaluation
-	if slices.Contains(fs.cliFeatures, FeatureDatagramV3_1) {
+	if slices.Contains(fs.cliFeatures, FeatureDatagramV3_2) {
 		return DatagramV3
 	}
 	// If the user specifies DatagramV2, we also take that over remote
@@ -22,15 +22,15 @@ func TestUnmarshalFeaturesRecord(t *testing.T) {
 		expectedPercentage uint32
 	}{
 		{
-			record:             []byte(`{"dv3_1":0}`),
+			record:             []byte(`{"dv3_2":0}`),
 			expectedPercentage: 0,
 		},
 		{
-			record:             []byte(`{"dv3_1":39}`),
+			record:             []byte(`{"dv3_2":39}`),
 			expectedPercentage: 39,
 		},
 		{
-			record:             []byte(`{"dv3_1":100}`),
+			record:             []byte(`{"dv3_2":100}`),
 			expectedPercentage: 100,
 		},
 		{
@@ -40,7 +40,7 @@ func TestUnmarshalFeaturesRecord(t *testing.T) {
 			record: []byte(`{"kyber":768}`), // Unmarshal to default struct if key is not present
 		},
 		{
-			record: []byte(`{"pq": 101,"dv3":100}`), // Expired keys don't unmarshal to anything
+			record: []byte(`{"pq": 101,"dv3":100,"dv3_1":100}`), // Expired keys don't unmarshal to anything
 		},
 	}

@@ -111,10 +111,10 @@ func TestFeaturePrecedenceEvaluationDatagramVersion(t *testing.T) {
 		},
 		{
 			name:             "user_specified_v3",
-			cli:              []string{FeatureDatagramV3_1},
+			cli:              []string{FeatureDatagramV3_2},
 			remote:           featuresRecord{},
-			expectedFeatures: dedupAndRemoveFeatures(append(defaultFeatures, FeatureDatagramV3_1)),
-			expectedVersion:  FeatureDatagramV3_1,
+			expectedFeatures: dedupAndRemoveFeatures(append(defaultFeatures, FeatureDatagramV3_2)),
+			expectedVersion:  FeatureDatagramV3_2,
 		},
 	}

@@ -150,6 +150,12 @@ func TestDeprecatedFeaturesRemoved(t *testing.T) {
 			remote:           featuresRecord{},
 			expectedFeatures: defaultFeatures,
 		},
+		{
+			name:             "support_datagram_v3_1",
+			cli:              []string{DeprecatedFeatureDatagramV3_1},
+			remote:           featuresRecord{},
+			expectedFeatures: defaultFeatures,
+		},
 	}

 	for _, test := range tests {
@@ -3,7 +3,6 @@ module github.com/cloudflare/cloudflared
 go 1.24

 require (
-	github.com/coredns/coredns v1.12.2
 	github.com/coreos/go-oidc/v3 v3.10.0
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/facebookgo/grace v0.0.0-20180706040059-75cf19382434
@@ -19,7 +18,6 @@ require (
 	github.com/gorilla/websocket v1.5.0
 	github.com/json-iterator/go v1.1.12
 	github.com/mattn/go-colorable v0.1.13
-	github.com/miekg/dns v1.1.66
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.22.0
@@ -50,18 +48,15 @@ require (

 require (
 	github.com/BurntSushi/toml v1.2.0 // indirect
-	github.com/apparentlymart/go-cidr v1.1.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bytedance/sonic v1.12.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/coredns/caddy v1.1.2-0.20241029205200-8de985351a98 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/facebookgo/ensure v0.0.0-20160127193407-b4ab57deab51 // indirect
 	github.com/facebookgo/freeport v0.0.0-20150612182905-d4adf43b75b9 // indirect
 	github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 // indirect
 	github.com/facebookgo/subset v0.0.0-20150612182917-8dac2c3c4870 // indirect
-	github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 // indirect
 	github.com/gin-gonic/gin v1.9.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
@@ -69,24 +64,21 @@ require (
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/pprof v0.0.0-20250418163039-24c5476c6587 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
-	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.5 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/onsi/ginkgo/v2 v2.23.4 // indirect
-	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.9 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/common v0.64.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/tinylib/msgp v1.6.3 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/otel/metric v1.35.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect
@@ -1,8 +1,6 @@
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.2.0 h1:Rt8g24XnyGTyglgET/PRUNlrUeu9F5L+7FilkXfZgs0=
 github.com/BurntSushi/toml v1.2.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
-github.com/apparentlymart/go-cidr v1.1.0 h1:2mAhrMoF+nhXqxTzSZMUzDHkLjmIHC+Zzn4tdgBZjnU=
-github.com/apparentlymart/go-cidr v1.1.0/go.mod h1:EBcsNrHc3zQeuaeCeCtQruQm+n9/YjEn/vI25Lg7Gwc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bytedance/sonic v1.12.0 h1:YGPgxF9xzaCNvd/ZKdQ28yRovhfMFZQjuk6fKBzZ3ls=
@@ -17,10 +15,6 @@ github.com/cloudwego/base64x v0.1.4 h1:jwCgWpFanWmN8xoIUHa2rtzmkd5J2plF/dnLS6Xd/
 github.com/cloudwego/base64x v0.1.4/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
 github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg=
 github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY=
-github.com/coredns/caddy v1.1.2-0.20241029205200-8de985351a98 h1:c+Epklw9xk6BZ1OFBPWLA2PcL8QalKvl3if8CP9x8uw=
-github.com/coredns/caddy v1.1.2-0.20241029205200-8de985351a98/go.mod h1:A6ntJQlAWuQfFlsd9hvigKbo2WS0VUs2l1e2F+BawD4=
-github.com/coredns/coredns v1.12.2 h1:G4oDfi340zlVsriZ8nYiUemiQIew7nqOO+QPvPxIA4Y=
-github.com/coredns/coredns v1.12.2/go.mod h1:GFz31oVOfCyMArFoypfu1SoaFoNkbdh6lDxtF1B6vfU=
 github.com/coreos/go-oidc/v3 v3.10.0 h1:tDnXHnLyiTVyT/2zLDGj09pFPkhND8Gl8lnTRhoEaJU=
 github.com/coreos/go-oidc/v3 v3.10.0/go.mod h1:5j11xcw0D3+SGxn6Z/WFADsgcWVMyNAlSQupk0KK3ac=
 github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
@@ -43,8 +37,6 @@ github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 h1:JWuenKqqX8nojt
 github.com/facebookgo/stack v0.0.0-20160209184415-751773369052/go.mod h1:UbMTZqLaRiH3MsBH8va0n7s1pQYcu3uTb8G4tygF4Zg=
 github.com/facebookgo/subset v0.0.0-20150612182917-8dac2c3c4870 h1:E2s37DuLxFhQDg5gKsWoLBOB0n+ZW8s599zru8FJ2/Y=
 github.com/facebookgo/subset v0.0.0-20150612182917-8dac2c3c4870/go.mod h1:5tD+neXqOorC30/tWg0LCSkrqj/AR6gu8yY8/fpw1q0=
-github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 h1:BHsljHzVlRcyQhjrss6TZTdY2VfCqZPbv5k3iBFa2ZQ=
-github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
@@ -95,7 +87,6 @@ github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/K
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
 github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
@@ -109,7 +100,6 @@ github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
 github.com/google/pprof v0.0.0-20250418163039-24c5476c6587 h1:b/8HpQhvKLSNzH5oTXN2WkNcMl6YB5K3FRbb+i+Ml34=
 github.com/google/pprof v0.0.0-20250418163039-24c5476c6587/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
-github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
@@ -117,8 +107,6 @@ github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWm
 github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
-github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 h1:MJG/KsmcqMwFAkh8mTnAwhyKoB+sTAnY4CACC110tbU=
-github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645/go.mod h1:6iZfnjpejD4L/4DwD7NryNaJyCQdzwWwH2MWhCA90Kw=
 github.com/ipostelnik/cli/v2 v2.3.1-0.20210324024421-b6ea8234fe3d h1:PRDnysJ9dF1vUMmEzBu6aHQeUluSQy4eWH3RsSSy/vI=
 github.com/ipostelnik/cli/v2 v2.3.1-0.20210324024421-b6ea8234fe3d/go.mod h1:LJmUH05zAU44vOAcrfzZQKsZbVcdbOG8rtL3/XcUArI=
 github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
@@ -144,10 +132,6 @@ github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Ky
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
-github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
-github.com/miekg/dns v1.1.66 h1:FeZXOS3VCVsKnEAd+wBkjMC3D2K+ww66Cq3VnCINuJE=
-github.com/miekg/dns v1.1.66/go.mod h1:jGFzBsSNbJw6z1HYut1RKBKHA9PBdxeHrZG8J+gC2WE=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -162,12 +146,10 @@ github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus
 github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
 github.com/onsi/gomega v1.36.3 h1:hID7cr8t3Wp26+cYnfcjR6HpJ00fdogN6dqZ1t6IylU=
 github.com/onsi/gomega v1.36.3/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
-github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
-github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/pelletier/go-toml/v2 v2.0.9 h1:uH2qQXheeefCCkuBBSLi7jCiSmj3VRh2+Goq2N7Xxu0=
 github.com/pelletier/go-toml/v2 v2.0.9/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
-github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c h1:dAMKvw0MlJT1GshSTtih8C2gDs04w8dReiOGXrGLNoY=
-github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
+github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
+github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pingcap/errors v0.11.4 h1:lFuQV/oaUMGcD2tqt+01ROSmJs75VG1ToEOkZIZ4nE4=
 github.com/pingcap/errors v0.11.4/go.mod h1:Oi8TUi2kEtXXLMJk9l1cGmz20kV3TaQ0usTwv5KuLY8=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -206,8 +188,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/tinylib/msgp v1.2.5 h1:WeQg1whrXRFiZusidTQqzETkRpGjFjcIhW6uqWH09po=
-github.com/tinylib/msgp v1.2.5/go.mod h1:ykjzy2wzgrlvpDCRc4LA8UXy6D8bzMSuAF3WD57Gok0=
+github.com/tinylib/msgp v1.6.3 h1:bCSxiTz386UTgyT1i0MSCvdbWjVW+8sG3PjkGsZQt4s=
+github.com/tinylib/msgp v1.6.3/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go v1.1.7 h1:/68gy2h+1mWMrwZFeD1kQialdSzAb432dtpeJ42ovdo=
@@ -257,7 +239,6 @@ golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
 golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
 golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
 golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
 golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
@@ -11,6 +11,8 @@ import (
 	"github.com/rs/zerolog"
 )

+const writeDeadlineUDP = 200 * time.Millisecond
+
 // OriginTCPDialer provides a TCP dial operation to a requested address.
 type OriginTCPDialer interface {
 	DialTCP(ctx context.Context, addr netip.AddrPort) (net.Conn, error)
@@ -141,6 +143,21 @@ func (d *Dialer) DialUDP(dest netip.AddrPort) (net.Conn, error) {
 	if err != nil {
 		return nil, fmt.Errorf("unable to dial udp to origin %s: %w", dest, err)
 	}
-
-	return conn, nil
+	return &writeDeadlineConn{
+		Conn: conn,
+	}, nil
+}
+
+// writeDeadlineConn is a wrapper around a net.Conn that sets a write deadline of 200ms.
+// This is to prevent the socket from blocking on the write operation if it were to occur. However,
+// we typically never expect this to occur except under high load or kernel issues.
+type writeDeadlineConn struct {
+	net.Conn
+}
+
+func (w *writeDeadlineConn) Write(b []byte) (int, error) {
+	if err := w.SetWriteDeadline(time.Now().Add(writeDeadlineUDP)); err != nil {
+		return 0, err
+	}
+	return w.Conn.Write(b)
 }
@@ -1,5 +1,5 @@
 #!/bin/bash
 set -eu
-ln -s /usr/bin/cloudflared /usr/local/bin/cloudflared
+ln -sf /usr/bin/cloudflared /usr/local/bin/cloudflared
 mkdir -p /usr/local/etc/cloudflared/
 touch /usr/local/etc/cloudflared/.installedFromPackageManager || true
@@ -1,6 +1,7 @@
 package v3_test

 import (
+	"crypto/rand"
 	"encoding/binary"
 	"errors"
 	"net/netip"
@@ -14,12 +15,18 @@ import (

 func makePayload(size int) []byte {
 	payload := make([]byte, size)
-	for i := range len(payload) {
-		payload[i] = 0xfc
-	}
+	_, _ = rand.Read(payload)
 	return payload
 }

+func makePayloads(size int, count int) [][]byte {
+	payloads := make([][]byte, count)
+	for i := range payloads {
+		payloads[i] = makePayload(size)
+	}
+	return payloads
+}
+
 func TestSessionRegistration_MarshalUnmarshal(t *testing.T) {
 	payload := makePayload(1280)
 	tests := []*v3.UDPSessionRegistrationDatagram{
@@ -9,28 +9,59 @@ import (
 )

 const (
-	namespace = "cloudflared"
-	subsystem = "udp"
+	namespace      = "cloudflared"
+	subsystem_udp  = "udp"
+	subsystem_icmp = "icmp"

 	commandMetricLabel = "command"
+	reasonMetricLabel  = "reason"
 )

+type DroppedReason int
+
+const (
+	DroppedWriteFailed DroppedReason = iota
+	DroppedWriteDeadlineExceeded
+	DroppedWriteFull
+	DroppedWriteFlowUnknown
+	DroppedReadFailed
+	// Origin payloads that are too large to proxy.
+	DroppedReadTooLarge
+)
+
+var droppedReason = map[DroppedReason]string{
+	DroppedWriteFailed:           "write_failed",
+	DroppedWriteDeadlineExceeded: "write_deadline_exceeded",
+	DroppedWriteFull:             "write_full",
+	DroppedWriteFlowUnknown:      "write_flow_unknown",
+	DroppedReadFailed:            "read_failed",
+	DroppedReadTooLarge:          "read_too_large",
+}
+
+func (dr DroppedReason) String() string {
+	return droppedReason[dr]
+}
+
 type Metrics interface {
 	IncrementFlows(connIndex uint8)
 	DecrementFlows(connIndex uint8)
-	PayloadTooLarge(connIndex uint8)
+	FailedFlow(connIndex uint8)
 	RetryFlowResponse(connIndex uint8)
 	MigrateFlow(connIndex uint8)
 	UnsupportedRemoteCommand(connIndex uint8, command string)
+	DroppedUDPDatagram(connIndex uint8, reason DroppedReason)
+	DroppedICMPPackets(connIndex uint8, reason DroppedReason)
 }

 type metrics struct {
 	activeUDPFlows            *prometheus.GaugeVec
 	totalUDPFlows             *prometheus.CounterVec
-	payloadTooLarge           *prometheus.CounterVec
 	retryFlowResponses        *prometheus.CounterVec
 	migratedFlows             *prometheus.CounterVec
 	unsupportedRemoteCommands *prometheus.CounterVec
+	droppedUDPDatagrams       *prometheus.CounterVec
+	droppedICMPPackets        *prometheus.CounterVec
+	failedFlows               *prometheus.CounterVec
 }

 func (m *metrics) IncrementFlows(connIndex uint8) {
@@ -42,8 +73,8 @@ func (m *metrics) DecrementFlows(connIndex uint8) {
 	m.activeUDPFlows.WithLabelValues(fmt.Sprintf("%d", connIndex)).Dec()
 }

-func (m *metrics) PayloadTooLarge(connIndex uint8) {
-	m.payloadTooLarge.WithLabelValues(fmt.Sprintf("%d", connIndex)).Inc()
+func (m *metrics) FailedFlow(connIndex uint8) {
+	m.failedFlows.WithLabelValues(fmt.Sprintf("%d", connIndex)).Inc()
 }

 func (m *metrics) RetryFlowResponse(connIndex uint8) {
@@ -58,52 +89,74 @@ func (m *metrics) UnsupportedRemoteCommand(connIndex uint8, command string) {
 	m.unsupportedRemoteCommands.WithLabelValues(fmt.Sprintf("%d", connIndex), command).Inc()
 }

+func (m *metrics) DroppedUDPDatagram(connIndex uint8, reason DroppedReason) {
+	m.droppedUDPDatagrams.WithLabelValues(fmt.Sprintf("%d", connIndex), reason.String()).Inc()
+}
+
+func (m *metrics) DroppedICMPPackets(connIndex uint8, reason DroppedReason) {
+	m.droppedICMPPackets.WithLabelValues(fmt.Sprintf("%d", connIndex), reason.String()).Inc()
+}
+
 func NewMetrics(registerer prometheus.Registerer) Metrics {
 	m := &metrics{
 		activeUDPFlows: prometheus.NewGaugeVec(prometheus.GaugeOpts{
 			Namespace: namespace,
-			Subsystem: subsystem,
+			Subsystem: subsystem_udp,
 			Name:      "active_flows",
 			Help:      "Concurrent count of UDP flows that are being proxied to any origin",
 		}, []string{quic.ConnectionIndexMetricLabel}),
 		totalUDPFlows: prometheus.NewCounterVec(prometheus.CounterOpts{ //nolint:promlinter
 			Namespace: namespace,
-			Subsystem: subsystem,
+			Subsystem: subsystem_udp,
 			Name:      "total_flows",
 			Help:      "Total count of UDP flows that have been proxied to any origin",
 		}, []string{quic.ConnectionIndexMetricLabel}),
-		payloadTooLarge: prometheus.NewCounterVec(prometheus.CounterOpts{ //nolint:promlinter
+		failedFlows: prometheus.NewCounterVec(prometheus.CounterOpts{ //nolint:promlinter
 			Namespace: namespace,
-			Subsystem: subsystem,
-			Name:      "payload_too_large",
-			Help:      "Total count of UDP flows that have had origin payloads that are too large to proxy",
+			Subsystem: subsystem_udp,
+			Name:      "failed_flows",
+			Help:      "Total count of flows that errored and closed",
 		}, []string{quic.ConnectionIndexMetricLabel}),
 		retryFlowResponses: prometheus.NewCounterVec(prometheus.CounterOpts{ //nolint:promlinter
 			Namespace: namespace,
-			Subsystem: subsystem,
+			Subsystem: subsystem_udp,
 			Name:      "retry_flow_responses",
 			Help:      "Total count of UDP flows that have had to send their registration response more than once",
 		}, []string{quic.ConnectionIndexMetricLabel}),
 		migratedFlows: prometheus.NewCounterVec(prometheus.CounterOpts{ //nolint:promlinter
 			Namespace: namespace,
-			Subsystem: subsystem,
+			Subsystem: subsystem_udp,
 			Name:      "migrated_flows",
 			Help:      "Total count of UDP flows have been migrated across local connections",
 		}, []string{quic.ConnectionIndexMetricLabel}),
-		unsupportedRemoteCommands: prometheus.NewCounterVec(prometheus.CounterOpts{
+		unsupportedRemoteCommands: prometheus.NewCounterVec(prometheus.CounterOpts{ //nolint:promlinter
 			Namespace: namespace,
-			Subsystem: subsystem,
+			Subsystem: subsystem_udp,
 			Name:      "unsupported_remote_command_total",
-			Help:      "Total count of unsupported remote RPC commands for the ",
+			Help:      "Total count of unsupported remote RPC commands called",
 		}, []string{quic.ConnectionIndexMetricLabel, commandMetricLabel}),
+		droppedUDPDatagrams: prometheus.NewCounterVec(prometheus.CounterOpts{ //nolint:promlinter
+			Namespace: namespace,
+			Subsystem: subsystem_udp,
+			Name:      "dropped_datagrams",
+			Help:      "Total count of UDP dropped datagrams",
+		}, []string{quic.ConnectionIndexMetricLabel, reasonMetricLabel}),
+		droppedICMPPackets: prometheus.NewCounterVec(prometheus.CounterOpts{ //nolint:promlinter
+			Namespace: namespace,
+			Subsystem: subsystem_icmp,
+			Name:      "dropped_packets",
+			Help:      "Total count of ICMP dropped datagrams",
+		}, []string{quic.ConnectionIndexMetricLabel, reasonMetricLabel}),
 	}
 	registerer.MustRegister(
 		m.activeUDPFlows,
 		m.totalUDPFlows,
-		m.payloadTooLarge,
+		m.failedFlows,
 		m.retryFlowResponses,
 		m.migratedFlows,
 		m.unsupportedRemoteCommands,
+		m.droppedUDPDatagrams,
+		m.droppedICMPPackets,
 	)
 	return m
 }
@@ -1,10 +1,15 @@
 package v3_test

+import v3 "github.com/cloudflare/cloudflared/quic/v3"
+
 type noopMetrics struct{}

-func (noopMetrics) IncrementFlows(connIndex uint8)                           {}
-func (noopMetrics) DecrementFlows(connIndex uint8)                           {}
-func (noopMetrics) PayloadTooLarge(connIndex uint8)                          {}
-func (noopMetrics) RetryFlowResponse(connIndex uint8)                        {}
-func (noopMetrics) MigrateFlow(connIndex uint8)                              {}
-func (noopMetrics) UnsupportedRemoteCommand(connIndex uint8, command string) {}
+func (noopMetrics) IncrementFlows(connIndex uint8)                              {}
+func (noopMetrics) DecrementFlows(connIndex uint8)                              {}
+func (noopMetrics) FailedFlow(connIndex uint8)                                  {}
+func (noopMetrics) PayloadTooLarge(connIndex uint8)                             {}
+func (noopMetrics) RetryFlowResponse(connIndex uint8)                           {}
+func (noopMetrics) MigrateFlow(connIndex uint8)                                 {}
+func (noopMetrics) UnsupportedRemoteCommand(connIndex uint8, command string)    {}
+func (noopMetrics) DroppedUDPDatagram(connIndex uint8, reason v3.DroppedReason) {}
+func (noopMetrics) DroppedICMPPackets(connIndex uint8, reason v3.DroppedReason) {}
@@ -17,6 +17,9 @@ const (
 	// Allocating a 16 channel buffer here allows for the writer to be slightly faster than the reader.
 	// This has worked previously well for datagramv2, so we will start with this as well
 	demuxChanCapacity = 16
+	// This provides a small buffer for the PacketRouter to poll ICMP packets from the QUIC connection
+	// before writing them to the origin.
+	icmpDatagramChanCapacity = 128

 	logSrcKey      = "src"
 	logDstKey      = "dst"
@@ -59,14 +62,15 @@ type QuicConnection interface {
 }

 type datagramConn struct {
-	conn           QuicConnection
-	index          uint8
-	sessionManager SessionManager
-	icmpRouter     ingress.ICMPRouter
-	metrics        Metrics
-	logger         *zerolog.Logger
-	datagrams      chan []byte
-	readErrors     chan error
+	conn             QuicConnection
+	index            uint8
+	sessionManager   SessionManager
+	icmpRouter       ingress.ICMPRouter
+	metrics          Metrics
+	logger           *zerolog.Logger
+	datagrams        chan []byte
+	icmpDatagramChan chan *ICMPDatagram
+	readErrors       chan error

 	icmpEncoderPool sync.Pool // a pool of *packet.Encoder
 	icmpDecoderPool sync.Pool
@@ -75,14 +79,15 @@ type datagramConn struct {
 func NewDatagramConn(conn QuicConnection, sessionManager SessionManager, icmpRouter ingress.ICMPRouter, index uint8, metrics Metrics, logger *zerolog.Logger) DatagramConn {
 	log := logger.With().Uint8("datagramVersion", 3).Logger()
 	return &datagramConn{
-		conn:           conn,
-		index:          index,
-		sessionManager: sessionManager,
-		icmpRouter:     icmpRouter,
-		metrics:        metrics,
-		logger:         &log,
-		datagrams:      make(chan []byte, demuxChanCapacity),
-		readErrors:     make(chan error, 2),
+		conn:             conn,
+		index:            index,
+		sessionManager:   sessionManager,
+		icmpRouter:       icmpRouter,
+		metrics:          metrics,
+		logger:           &log,
+		datagrams:        make(chan []byte, demuxChanCapacity),
+		icmpDatagramChan: make(chan *ICMPDatagram, icmpDatagramChanCapacity),
+		readErrors:       make(chan error, 2),
 		icmpEncoderPool: sync.Pool{
 			New: func() any {
 				return packet.NewEncoder()
@@ -168,6 +173,9 @@ func (c *datagramConn) Serve(ctx context.Context) error {
 	readCtx, cancel := context.WithCancel(connCtx)
 	defer cancel()
 	go c.pollDatagrams(readCtx)
+	// Processing ICMP datagrams also monitors the reader context since the ICMP datagrams from the reader are the input
+	// for the routine.
+	go c.processICMPDatagrams(readCtx)
 	for {
 		// We make sure to monitor the context of cloudflared and the underlying connection to return if any errors occur.
 		var datagram []byte
@@ -181,58 +189,59 @@ func (c *datagramConn) Serve(ctx context.Context) error {
 		// Monitor for any hard errors from reading the connection
 		case err := <-c.readErrors:
 			return err
-		// Otherwise, wait and dequeue datagrams as they come in
+		// Wait and dequeue datagrams as they come in
 		case d := <-c.datagrams:
 			datagram = d
 		}

 		// Each incoming datagram will be processed in a new go routine to handle the demuxing and action associated.
-		go func() {
-			typ, err := ParseDatagramType(datagram)
+		typ, err := ParseDatagramType(datagram)
+		if err != nil {
+			c.logger.Err(err).Msgf("unable to parse datagram type: %d", typ)
+			continue
+		}
+		switch typ {
+		case UDPSessionRegistrationType:
+			reg := &UDPSessionRegistrationDatagram{}
+			err := reg.UnmarshalBinary(datagram)
 			if err != nil {
-				c.logger.Err(err).Msgf("unable to parse datagram type: %d", typ)
-				return
+				c.logger.Err(err).Msgf("unable to unmarshal session registration datagram")
+				continue
 			}
-			switch typ {
-			case UDPSessionRegistrationType:
-				reg := &UDPSessionRegistrationDatagram{}
-				err := reg.UnmarshalBinary(datagram)
-				if err != nil {
-					c.logger.Err(err).Msgf("unable to unmarshal session registration datagram")
-					return
-				}
-				logger := c.logger.With().Str(logFlowID, reg.RequestID.String()).Logger()
-				// We bind the new session to the quic connection context instead of cloudflared context to allow for the
-				// quic connection to close and close only the sessions bound to it. Closing of cloudflared will also
-				// initiate the close of the quic connection, so we don't have to worry about the application context
-				// in the scope of a session.
-				c.handleSessionRegistrationDatagram(connCtx, reg, &logger)
-			case UDPSessionPayloadType:
-				payload := &UDPSessionPayloadDatagram{}
-				err := payload.UnmarshalBinary(datagram)
-				if err != nil {
-					c.logger.Err(err).Msgf("unable to unmarshal session payload datagram")
-					return
-				}
-				logger := c.logger.With().Str(logFlowID, payload.RequestID.String()).Logger()
-				c.handleSessionPayloadDatagram(payload, &logger)
-			case ICMPType:
-				packet := &ICMPDatagram{}
-				err := packet.UnmarshalBinary(datagram)
-				if err != nil {
-					c.logger.Err(err).Msgf("unable to unmarshal icmp datagram")
-					return
-				}
-				c.handleICMPPacket(packet)
-			case UDPSessionRegistrationResponseType:
-				// cloudflared should never expect to receive UDP session responses as it will not initiate new
-				// sessions towards the edge.
-				c.logger.Error().Msgf("unexpected datagram type received: %d", UDPSessionRegistrationResponseType)
-				return
-			default:
-				c.logger.Error().Msgf("unknown datagram type received: %d", typ)
+			logger := c.logger.With().Str(logFlowID, reg.RequestID.String()).Logger()
+			// We bind the new session to the quic connection context instead of cloudflared context to allow for the
+			// quic connection to close and close only the sessions bound to it. Closing of cloudflared will also
+			// initiate the close of the quic connection, so we don't have to worry about the application context
+			// in the scope of a session.
+			//
+			// Additionally, we spin out the registration into a separate go routine to handle the Serve'ing of the
+			// session in a separate routine from the demuxer.
+			go c.handleSessionRegistrationDatagram(connCtx, reg, &logger)
+		case UDPSessionPayloadType:
+			payload := &UDPSessionPayloadDatagram{}
+			err := payload.UnmarshalBinary(datagram)
+			if err != nil {
+				c.logger.Err(err).Msgf("unable to unmarshal session payload datagram")
+				continue
 			}
-		}()
+			logger := c.logger.With().Str(logFlowID, payload.RequestID.String()).Logger()
+			c.handleSessionPayloadDatagram(payload, &logger)
+		case ICMPType:
+			packet := &ICMPDatagram{}
+			err := packet.UnmarshalBinary(datagram)
+			if err != nil {
+				c.logger.Err(err).Msgf("unable to unmarshal icmp datagram")
+				continue
+			}
+			c.handleICMPPacket(packet)
+		case UDPSessionRegistrationResponseType:
+			// cloudflared should never expect to receive UDP session responses as it will not initiate new
+			// sessions towards the edge.
+			c.logger.Error().Msgf("unexpected datagram type received: %d", UDPSessionRegistrationResponseType)
+			continue
+		default:
+			c.logger.Error().Msgf("unknown datagram type received: %d", typ)
+		}
 	}
 }

@@ -243,24 +252,21 @@ func (c *datagramConn) handleSessionRegistrationDatagram(ctx context.Context, da
 		Str(logDstKey, datagram.Dest.String()).
 		Logger()
 	session, err := c.sessionManager.RegisterSession(datagram, c)
-	switch err {
-	case nil:
-		// Continue as normal
-	case ErrSessionAlreadyRegistered:
-		// Session is already registered and likely the response got lost
-		c.handleSessionAlreadyRegistered(datagram.RequestID, &log)
-		return
-	case ErrSessionBoundToOtherConn:
-		// Session is already registered but to a different connection
-		c.handleSessionMigration(datagram.RequestID, &log)
-		return
-	case ErrSessionRegistrationRateLimited:
-		// There are too many concurrent sessions so we return an error to force a retry later
-		c.handleSessionRegistrationRateLimited(datagram, &log)
-		return
-	default:
-		log.Err(err).Msg("flow registration failure")
-		c.handleSessionRegistrationFailure(datagram.RequestID, &log)
+	if err != nil {
+		switch err {
+		case ErrSessionAlreadyRegistered:
+			// Session is already registered and likely the response got lost
+			c.handleSessionAlreadyRegistered(datagram.RequestID, &log)
+		case ErrSessionBoundToOtherConn:
+			// Session is already registered but to a different connection
+			c.handleSessionMigration(datagram.RequestID, &log)
+		case ErrSessionRegistrationRateLimited:
+			// There are too many concurrent sessions so we return an error to force a retry later
+			c.handleSessionRegistrationRateLimited(datagram, &log)
+		default:
+			log.Err(err).Msg("flow registration failure")
+			c.handleSessionRegistrationFailure(datagram.RequestID, &log)
+		}
 		return
 	}
 	log = log.With().Str(logSrcKey, session.LocalAddr().String()).Logger()
@@ -362,30 +368,54 @@ func (c *datagramConn) handleSessionRegistrationRateLimited(datagram *UDPSession
 func (c *datagramConn) handleSessionPayloadDatagram(datagram *UDPSessionPayloadDatagram, logger *zerolog.Logger) {
 	s, err := c.sessionManager.GetSession(datagram.RequestID)
 	if err != nil {
+		c.metrics.DroppedUDPDatagram(c.index, DroppedWriteFlowUnknown)
 		logger.Err(err).Msgf("unable to find flow")
 		return
 	}
-	// We ignore the bytes written to the socket because any partial write must return an error.
-	_, err = s.Write(datagram.Payload)
-	if err != nil {
-		logger.Err(err).Msgf("unable to write payload for the flow")
-		return
-	}
+	s.Write(datagram.Payload)
 }

-// Handles incoming ICMP datagrams.
+// Handles incoming ICMP datagrams into a serialized channel to be handled by a single consumer.
 func (c *datagramConn) handleICMPPacket(datagram *ICMPDatagram) {
 	if c.icmpRouter == nil {
 		// ICMPRouter is disabled so we drop the current packet and ignore all incoming ICMP packets
 		return
 	}
+	select {
+	case c.icmpDatagramChan <- datagram:
+	default:
+		// If the ICMP datagram channel is full, drop any additional incoming.
+		c.metrics.DroppedICMPPackets(c.index, DroppedWriteFull)
+		c.logger.Warn().Msg("failed to write icmp packet to origin: dropped")
+	}
+}

+// Consumes from the ICMP datagram channel to write out the ICMP requests to an origin.
+func (c *datagramConn) processICMPDatagrams(ctx context.Context) {
+	if c.icmpRouter == nil {
+		// ICMPRouter is disabled so we ignore all incoming ICMP packets
+		return
+	}
+
+	for {
+		select {
+		// If the provided context is closed we want to exit the write loop
+		case <-ctx.Done():
+			return
+		case datagram := <-c.icmpDatagramChan:
+			c.writeICMPPacket(datagram)
+		}
+	}
+}
+
+func (c *datagramConn) writeICMPPacket(datagram *ICMPDatagram) {
 	// Decode the provided ICMPDatagram as an ICMP packet
 	rawPacket := packet.RawPacket{Data: datagram.Payload}
 	cachedDecoder := c.icmpDecoderPool.Get()
 	defer c.icmpDecoderPool.Put(cachedDecoder)
 	decoder, ok := cachedDecoder.(*packet.ICMPDecoder)
 	if !ok {
+		c.metrics.DroppedICMPPackets(c.index, DroppedWriteFailed)
 		c.logger.Error().Msg("Could not get ICMPDecoder from the pool. Dropping packet")
 		return
 	}
@@ -393,6 +423,7 @@ func (c *datagramConn) handleICMPPacket(datagram *ICMPDatagram) {
 	icmp, err := decoder.Decode(rawPacket)

 	if err != nil {
+		c.metrics.DroppedICMPPackets(c.index, DroppedWriteFailed)
 		c.logger.Err(err).Msgf("unable to marshal icmp packet")
 		return
 	}
@@ -400,6 +431,7 @@ func (c *datagramConn) handleICMPPacket(datagram *ICMPDatagram) {
 	// If the ICMP packet's TTL is expired, we won't send it to the origin and immediately return a TTL Exceeded Message
 	if icmp.TTL <= 1 {
 		if err := c.SendICMPTTLExceed(icmp, rawPacket); err != nil {
+			c.metrics.DroppedICMPPackets(c.index, DroppedWriteFailed)
 			c.logger.Err(err).Msg("failed to return ICMP TTL exceed error")
 		}
 		return
@@ -411,6 +443,7 @@ func (c *datagramConn) handleICMPPacket(datagram *ICMPDatagram) {
 	// connection context which will have no tracing information available.
 	err = c.icmpRouter.Request(c.conn.Context(), icmp, newPacketResponder(c, c.index))
 	if err != nil {
+		c.metrics.DroppedICMPPackets(c.index, DroppedWriteFailed)
 		c.logger.Err(err).
 			Str(logSrcKey, icmp.Src.String()).
 			Str(logDstKey, icmp.Dst.String()).
@@ -13,6 +13,7 @@ import (
 	"testing"
 	"time"

+	"github.com/fortytw2/leaktest"
 	"github.com/google/gopacket/layers"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
@@ -92,7 +93,7 @@ func TestDatagramConn_New(t *testing.T) {
 		DefaultDialer:   testDefaultDialer,
 		TCPWriteTimeout: 0,
 	}, &log)
-	conn := v3.NewDatagramConn(newMockQuicConn(), v3.NewSessionManager(&noopMetrics{}, &log, originDialerService, cfdflow.NewLimiter(0)), &noopICMPRouter{}, 0, &noopMetrics{}, &log)
+	conn := v3.NewDatagramConn(newMockQuicConn(t.Context()), v3.NewSessionManager(&noopMetrics{}, &log, originDialerService, cfdflow.NewLimiter(0)), &noopICMPRouter{}, 0, &noopMetrics{}, &log)
 	if conn == nil {
 		t.Fatal("expected valid connection")
 	}
@@ -104,7 +105,9 @@ func TestDatagramConn_SendUDPSessionDatagram(t *testing.T) {
 		DefaultDialer:   testDefaultDialer,
 		TCPWriteTimeout: 0,
 	}, &log)
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	conn := v3.NewDatagramConn(quic, v3.NewSessionManager(&noopMetrics{}, &log, originDialerService, cfdflow.NewLimiter(0)), &noopICMPRouter{}, 0, &noopMetrics{}, &log)

 	payload := []byte{0xef, 0xef}
@@ -123,7 +126,9 @@ func TestDatagramConn_SendUDPSessionResponse(t *testing.T) {
 		DefaultDialer:   testDefaultDialer,
 		TCPWriteTimeout: 0,
 	}, &log)
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	conn := v3.NewDatagramConn(quic, v3.NewSessionManager(&noopMetrics{}, &log, originDialerService, cfdflow.NewLimiter(0)), &noopICMPRouter{}, 0, &noopMetrics{}, &log)

 	err := conn.SendUDPSessionResponse(testRequestID, v3.ResponseDestinationUnreachable)
@@ -149,7 +154,9 @@ func TestDatagramConnServe_ApplicationClosed(t *testing.T) {
 		DefaultDialer:   testDefaultDialer,
 		TCPWriteTimeout: 0,
 	}, &log)
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	conn := v3.NewDatagramConn(quic, v3.NewSessionManager(&noopMetrics{}, &log, originDialerService, cfdflow.NewLimiter(0)), &noopICMPRouter{}, 0, &noopMetrics{}, &log)

 	ctx, cancel := context.WithTimeout(t.Context(), 1*time.Second)
@@ -166,7 +173,9 @@ func TestDatagramConnServe_ConnectionClosed(t *testing.T) {
 		DefaultDialer:   testDefaultDialer,
 		TCPWriteTimeout: 0,
 	}, &log)
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	ctx, cancel := context.WithTimeout(t.Context(), 1*time.Second)
 	defer cancel()
 	quic.ctx = ctx
@@ -195,15 +204,17 @@ func TestDatagramConnServe_ReceiveDatagramError(t *testing.T) {

 func TestDatagramConnServe_SessionRegistrationRateLimit(t *testing.T) {
 	log := zerolog.Nop()
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	sessionManager := &mockSessionManager{
 		expectedRegErr: v3.ErrSessionRegistrationRateLimited,
 	}
 	conn := v3.NewDatagramConn(quic, sessionManager, &noopICMPRouter{}, 0, &noopMetrics{}, &log)

 	// Setup the muxer
-	ctx, cancel := context.WithCancel(t.Context())
-	defer cancel()
+	ctx, cancel := context.WithCancelCause(t.Context())
+	defer cancel(context.Canceled)
 	done := make(chan error, 1)
 	go func() {
 		done <- conn.Serve(ctx)
@@ -223,9 +234,12 @@ func TestDatagramConnServe_SessionRegistrationRateLimit(t *testing.T) {

 	require.EqualValues(t, testRequestID, resp.RequestID)
 	require.EqualValues(t, v3.ResponseTooManyActiveFlows, resp.ResponseType)
+
+	assertContextClosed(t, ctx, done, cancel)
 }

 func TestDatagramConnServe_ErrorDatagramTypes(t *testing.T) {
+	defer leaktest.Check(t)()
 	for _, test := range []struct {
 		name     string
 		input    []byte
@@ -250,7 +264,9 @@ func TestDatagramConnServe_ErrorDatagramTypes(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			logOutput := new(LockedBuffer)
 			log := zerolog.New(logOutput)
-			quic := newMockQuicConn()
+			connCtx, connCancel := context.WithCancelCause(t.Context())
+			defer connCancel(context.Canceled)
+			quic := newMockQuicConn(connCtx)
 			quic.send <- test.input
 			conn := v3.NewDatagramConn(quic, &mockSessionManager{}, &noopICMPRouter{}, 0, &noopMetrics{}, &log)

@@ -289,8 +305,11 @@ func (b *LockedBuffer) String() string {
 }

 func TestDatagramConnServe_RegisterSession_SessionManagerError(t *testing.T) {
+	defer leaktest.Check(t)()
 	log := zerolog.Nop()
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	expectedErr := errors.New("unable to register session")
 	sessionManager := mockSessionManager{expectedRegErr: expectedErr}
 	conn := v3.NewDatagramConn(quic, &sessionManager, &noopICMPRouter{}, 0, &noopMetrics{}, &log)
@@ -324,8 +343,11 @@ func TestDatagramConnServe_RegisterSession_SessionManagerError(t *testing.T) {
 }

 func TestDatagramConnServe(t *testing.T) {
+	defer leaktest.Check(t)()
 	log := zerolog.Nop()
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	session := newMockSession()
 	sessionManager := mockSessionManager{session: &session}
 	conn := v3.NewDatagramConn(quic, &sessionManager, &noopICMPRouter{}, 0, &noopMetrics{}, &log)
@@ -372,8 +394,11 @@ func TestDatagramConnServe(t *testing.T) {
 // instances causes inteference resulting in multiple different raw packets being decoded
 // as the same decoded packet.
 func TestDatagramConnServeDecodeMultipleICMPInParallel(t *testing.T) {
+	defer leaktest.Check(t)()
 	log := zerolog.Nop()
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	session := newMockSession()
 	sessionManager := mockSessionManager{session: &session}
 	router := newMockICMPRouter()
@@ -413,10 +438,14 @@ func TestDatagramConnServeDecodeMultipleICMPInParallel(t *testing.T) {
 	wg := sync.WaitGroup{}
 	var receivedPackets []*packet.ICMP
 	go func() {
-		for ctx.Err() == nil {
-			icmpPacket := <-router.recv
-			receivedPackets = append(receivedPackets, icmpPacket)
-			wg.Done()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case icmpPacket := <-router.recv:
+				receivedPackets = append(receivedPackets, icmpPacket)
+				wg.Done()
+			}
 		}
 	}()

@@ -452,8 +481,11 @@ func TestDatagramConnServeDecodeMultipleICMPInParallel(t *testing.T) {
 }

 func TestDatagramConnServe_RegisterTwice(t *testing.T) {
+	defer leaktest.Check(t)()
 	log := zerolog.Nop()
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	session := newMockSession()
 	sessionManager := mockSessionManager{session: &session}
 	conn := v3.NewDatagramConn(quic, &sessionManager, &noopICMPRouter{}, 0, &noopMetrics{}, &log)
@@ -514,12 +546,17 @@ func TestDatagramConnServe_RegisterTwice(t *testing.T) {
 }

 func TestDatagramConnServe_MigrateConnection(t *testing.T) {
+	defer leaktest.Check(t)()
 	log := zerolog.Nop()
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	session := newMockSession()
 	sessionManager := mockSessionManager{session: &session}
 	conn := v3.NewDatagramConn(quic, &sessionManager, &noopICMPRouter{}, 0, &noopMetrics{}, &log)
-	quic2 := newMockQuicConn()
+	conn2Ctx, conn2Cancel := context.WithCancelCause(t.Context())
+	defer conn2Cancel(context.Canceled)
+	quic2 := newMockQuicConn(conn2Ctx)
 	conn2 := v3.NewDatagramConn(quic2, &sessionManager, &noopICMPRouter{}, 1, &noopMetrics{}, &log)

 	// Setup the muxer
@@ -597,8 +634,11 @@ func TestDatagramConnServe_MigrateConnection(t *testing.T) {
 }

 func TestDatagramConnServe_Payload_GetSessionError(t *testing.T) {
+	defer leaktest.Check(t)()
 	log := zerolog.Nop()
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	// mockSessionManager will return the ErrSessionNotFound for any session attempting to be queried by the muxer
 	sessionManager := mockSessionManager{session: nil, expectedGetErr: v3.ErrSessionNotFound}
 	conn := v3.NewDatagramConn(quic, &sessionManager, &noopICMPRouter{}, 0, &noopMetrics{}, &log)
@@ -624,9 +664,12 @@ func TestDatagramConnServe_Payload_GetSessionError(t *testing.T) {
 	assertContextClosed(t, ctx, done, cancel)
 }

-func TestDatagramConnServe_Payload(t *testing.T) {
+func TestDatagramConnServe_Payloads(t *testing.T) {
+	defer leaktest.Check(t)()
 	log := zerolog.Nop()
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	session := newMockSession()
 	sessionManager := mockSessionManager{session: &session}
 	conn := v3.NewDatagramConn(quic, &sessionManager, &noopICMPRouter{}, 0, &noopMetrics{}, &log)
@@ -639,15 +682,26 @@ func TestDatagramConnServe_Payload(t *testing.T) {
 		done <- conn.Serve(ctx)
 	}()

-	// Send new session registration
-	expectedPayload := []byte{0xef, 0xef}
-	datagram := newSessionPayloadDatagram(testRequestID, expectedPayload)
-	quic.send <- datagram
+	// Send session payloads
+	expectedPayloads := makePayloads(256, 16)
+	go func() {
+		for _, payload := range expectedPayloads {
+			datagram := newSessionPayloadDatagram(testRequestID, payload)
+			quic.send <- datagram
+		}
+	}()

-	// Session should receive the payload
-	payload := <-session.recv
-	if !slices.Equal(expectedPayload, payload) {
-		t.Fatalf("expected session receieve the payload sent via the muxer")
+	// Session should receive the payloads (in-order)
+	for i, payload := range expectedPayloads {
+		select {
+		case recv := <-session.recv:
+			if !slices.Equal(recv, payload) {
+				t.Fatalf("expected session receieve the payload[%d] sent via the muxer: (%x) (%x)", i, recv[:16], payload[:16])
+			}
+		case err := <-ctx.Done():
+			// we expect the payload to return before the context to cancel on the session
+			t.Fatal(err)
+		}
 	}

 	// Cancel the muxer Serve context and make sure it closes with the expected error
@@ -655,8 +709,11 @@ func TestDatagramConnServe_Payload(t *testing.T) {
 }

 func TestDatagramConnServe_ICMPDatagram_TTLDecremented(t *testing.T) {
+	defer leaktest.Check(t)()
 	log := zerolog.Nop()
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	router := newMockICMPRouter()
 	conn := v3.NewDatagramConn(quic, &mockSessionManager{}, router, 0, &noopMetrics{}, &log)

@@ -701,8 +758,11 @@ func TestDatagramConnServe_ICMPDatagram_TTLDecremented(t *testing.T) {
 }

 func TestDatagramConnServe_ICMPDatagram_TTLExceeded(t *testing.T) {
+	defer leaktest.Check(t)()
 	log := zerolog.Nop()
-	quic := newMockQuicConn()
+	connCtx, connCancel := context.WithCancelCause(t.Context())
+	defer connCancel(context.Canceled)
+	quic := newMockQuicConn(connCtx)
 	router := newMockICMPRouter()
 	conn := v3.NewDatagramConn(quic, &mockSessionManager{}, router, 0, &noopMetrics{}, &log)

@@ -821,9 +881,9 @@ type mockQuicConn struct {
 	recv chan []byte
 }

-func newMockQuicConn() *mockQuicConn {
+func newMockQuicConn(ctx context.Context) *mockQuicConn {
 	return &mockQuicConn{
-		ctx:  context.Background(),
+		ctx:  ctx,
 		send: make(chan []byte, 1),
 		recv: make(chan []byte, 1),
 	}
@@ -841,7 +901,12 @@ func (m *mockQuicConn) SendDatagram(payload []byte) error {
 }

 func (m *mockQuicConn) ReceiveDatagram(_ context.Context) ([]byte, error) {
-	return <-m.send, nil
+	select {
+	case <-m.ctx.Done():
+		return nil, m.ctx.Err()
+	case b := <-m.send:
+		return b, nil
+	}
 }

 type mockQuicConnReadError struct {
@@ -905,11 +970,10 @@ func (m *mockSession) Serve(ctx context.Context) error {
 	return v3.SessionCloseErr
 }

-func (m *mockSession) Write(payload []byte) (n int, err error) {
+func (m *mockSession) Write(payload []byte) {
 	b := make([]byte, len(payload))
 	copy(b, payload)
 	m.recv <- b
-	return len(b), nil
 }

 func (m *mockSession) Close() error {
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"os"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -22,6 +23,11 @@ const (
 	// this value (maxDatagramPayloadLen).
 	maxOriginUDPPacketSize = 1500

+	// The maximum amount of datagrams a session will queue up before it begins dropping datagrams.
+	// This channel buffer is small because we assume that the dedicated writer to the origin is typically
+	// fast enought to keep the channel empty.
+	writeChanCapacity = 512
+
 	logFlowID        = "flowID"
 	logPacketSizeKey = "packetSize"
 )
@@ -49,7 +55,7 @@ func newSessionIdleErr(timeout time.Duration) error {
 }

 type Session interface {
-	io.WriteCloser
+	io.Closer
 	ID() RequestID
 	ConnectionID() uint8
 	RemoteAddr() net.Addr
@@ -58,6 +64,7 @@ type Session interface {
 	Migrate(eyeball DatagramConn, ctx context.Context, logger *zerolog.Logger)
 	// Serve starts the event loop for processing UDP packets
 	Serve(ctx context.Context) error
+	Write(payload []byte)
 }

 type session struct {
@@ -67,12 +74,18 @@ type session struct {
 	originAddr     net.Addr
 	localAddr      net.Addr
 	eyeball        atomic.Pointer[DatagramConn]
+	writeChan      chan []byte
 	// activeAtChan is used to communicate the last read/write time
 	activeAtChan chan time.Time
-	closeChan    chan error
-	contextChan  chan context.Context
-	metrics      Metrics
-	log          *zerolog.Logger
+	errChan      chan error
+	// The close channel signal only exists for the write loop because the read loop is always waiting on a read
+	// from the UDP socket to the origin. To close the read loop we close the socket.
+	// Additionally, we can't close the writeChan to indicate that writes are complete because the producer (edge)
+	// side may still be trying to write to this session.
+	closeWrite  chan struct{}
+	contextChan chan context.Context
+	metrics     Metrics
+	log         *zerolog.Logger

 	// A special close function that we wrap with sync.Once to make sure it is only called once
 	closeFn func() error
@@ -89,10 +102,12 @@ func NewSession(
 	log *zerolog.Logger,
 ) Session {
 	logger := log.With().Str(logFlowID, id.String()).Logger()
-	// closeChan has two slots to allow for both writers (the closeFn and the Serve routine) to both be able to
-	// write to the channel without blocking since there is only ever one value read from the closeChan by the
+	writeChan := make(chan []byte, writeChanCapacity)
+	// errChan has three slots to allow for all writers (the closeFn, the read loop and the write loop) to
+	// write to the channel without blocking since there is only ever one value read from the errChan by the
 	// waitForCloseCondition.
-	closeChan := make(chan error, 2)
+	errChan := make(chan error, 3)
+	closeWrite := make(chan struct{})
 	session := &session{
 		id:             id,
 		closeAfterIdle: closeAfterIdle,
@@ -100,10 +115,12 @@ func NewSession(
 		originAddr:     originAddr,
 		localAddr:      localAddr,
 		eyeball:        atomic.Pointer[DatagramConn]{},
+		writeChan:      writeChan,
 		// activeAtChan has low capacity. It can be full when there are many concurrent read/write. markActive() will
 		// drop instead of blocking because last active time only needs to be an approximation
 		activeAtChan: make(chan time.Time, 1),
-		closeChan:    closeChan,
+		errChan:      errChan,
+		closeWrite:   closeWrite,
 		// contextChan is an unbounded channel to help enforce one active migration of a session at a time.
 		contextChan: make(chan context.Context),
 		metrics:     metrics,
@@ -111,9 +128,12 @@ func NewSession(
 		closeFn: sync.OnceValue(func() error {
 			// We don't want to block on sending to the close channel if it is already full
 			select {
-			case closeChan <- SessionCloseErr:
+			case errChan <- SessionCloseErr:
 			default:
 			}
+			// Indicate to the write loop that the session is now closed
+			close(closeWrite)
+			// Close the socket directly to unblock the read loop and cause it to also end
 			return origin.Close()
 		}),
 	}
@@ -154,66 +174,115 @@ func (s *session) Migrate(eyeball DatagramConn, ctx context.Context, logger *zer
 }

 func (s *session) Serve(ctx context.Context) error {
-	go func() {
-		// QUIC implementation copies data to another buffer before returning https://github.com/quic-go/quic-go/blob/v0.24.0/session.go#L1967-L1975
-		// This makes it safe to share readBuffer between iterations
-		readBuffer := [maxOriginUDPPacketSize + DatagramPayloadHeaderLen]byte{}
-		// To perform a zero copy write when passing the datagram to the connection, we prepare the buffer with
-		// the required datagram header information. We can reuse this buffer for this session since the header is the
-		// same for the each read.
-		_ = MarshalPayloadHeaderTo(s.id, readBuffer[:DatagramPayloadHeaderLen])
-		for {
-			// Read from the origin UDP socket
-			n, err := s.origin.Read(readBuffer[DatagramPayloadHeaderLen:])
-			if err != nil {
-				if errors.Is(err, io.EOF) ||
-					errors.Is(err, io.ErrUnexpectedEOF) {
-					s.log.Debug().Msgf("flow (origin) connection closed: %v", err)
-				}
-				s.closeChan <- err
-				return
-			}
-			if n < 0 {
-				s.log.Warn().Int(logPacketSizeKey, n).Msg("flow (origin) packet read was negative and was dropped")
-				continue
-			}
-			if n > maxDatagramPayloadLen {
-				connectionIndex := s.ConnectionID()
-				s.metrics.PayloadTooLarge(connectionIndex)
-				s.log.Error().Int(logPacketSizeKey, n).Msg("flow (origin) packet read was too large and was dropped")
-				continue
-			}
-			// We need to synchronize on the eyeball in-case that the connection was migrated. This should be rarely a point
-			// of lock contention, as a migration can only happen during startup of a session before traffic flow.
-			eyeball := *(s.eyeball.Load())
-			// Sending a packet to the session does block on the [quic.Connection], however, this is okay because it
-			// will cause back-pressure to the kernel buffer if the writes are not fast enough to the edge.
-			err = eyeball.SendUDPSessionDatagram(readBuffer[:DatagramPayloadHeaderLen+n])
-			if err != nil {
-				s.closeChan <- err
-				return
-			}
-			// Mark the session as active since we proxied a valid packet from the origin.
-			s.markActive()
-		}
-	}()
+	go s.writeLoop()
+	go s.readLoop()
 	return s.waitForCloseCondition(ctx, s.closeAfterIdle)
 }

-func (s *session) Write(payload []byte) (n int, err error) {
-	n, err = s.origin.Write(payload)
-	if err != nil {
-		s.log.Err(err).Msg("failed to write payload to flow (remote)")
-		return n, err
+// Read datagrams from the origin and write them to the connection.
+func (s *session) readLoop() {
+	// QUIC implementation copies data to another buffer before returning https://github.com/quic-go/quic-go/blob/v0.24.0/session.go#L1967-L1975
+	// This makes it safe to share readBuffer between iterations
+	readBuffer := [maxOriginUDPPacketSize + DatagramPayloadHeaderLen]byte{}
+	// To perform a zero copy write when passing the datagram to the connection, we prepare the buffer with
+	// the required datagram header information. We can reuse this buffer for this session since the header is the
+	// same for the each read.
+	_ = MarshalPayloadHeaderTo(s.id, readBuffer[:DatagramPayloadHeaderLen])
+	for {
+		// Read from the origin UDP socket
+		n, err := s.origin.Read(readBuffer[DatagramPayloadHeaderLen:])
+		if err != nil {
+			if isConnectionClosed(err) {
+				s.log.Debug().Msgf("flow (read) connection closed: %v", err)
+			}
+			s.closeSession(err)
+			return
+		}
+		if n < 0 {
+			s.metrics.DroppedUDPDatagram(s.ConnectionID(), DroppedReadFailed)
+			s.log.Warn().Int(logPacketSizeKey, n).Msg("flow (origin) packet read was negative and was dropped")
+			continue
+		}
+		if n > maxDatagramPayloadLen {
+			s.metrics.DroppedUDPDatagram(s.ConnectionID(), DroppedReadTooLarge)
+			s.log.Error().Int(logPacketSizeKey, n).Msg("flow (origin) packet read was too large and was dropped")
+			continue
+		}
+		// We need to synchronize on the eyeball in-case that the connection was migrated. This should be rarely a point
+		// of lock contention, as a migration can only happen during startup of a session before traffic flow.
+		eyeball := *(s.eyeball.Load())
+		// Sending a packet to the session does block on the [quic.Connection], however, this is okay because it
+		// will cause back-pressure to the kernel buffer if the writes are not fast enough to the edge.
+		err = eyeball.SendUDPSessionDatagram(readBuffer[:DatagramPayloadHeaderLen+n])
+		if err != nil {
+			s.closeSession(err)
+			return
+		}
+		// Mark the session as active since we proxied a valid packet from the origin.
+		s.markActive()
 	}
-	// Write must return a non-nil error if it returns n < len(p). https://pkg.go.dev/io#Writer
-	if n < len(payload) {
-		s.log.Err(io.ErrShortWrite).Msg("failed to write the full payload to flow (remote)")
-		return n, io.ErrShortWrite
+}
+
+func (s *session) Write(payload []byte) {
+	select {
+	case s.writeChan <- payload:
+	default:
+		s.metrics.DroppedUDPDatagram(s.ConnectionID(), DroppedWriteFull)
+		s.log.Error().Msg("failed to write flow payload to origin: dropped")
+	}
+}
+
+// Read datagrams from the write channel to the origin.
+func (s *session) writeLoop() {
+	for {
+		select {
+		case <-s.closeWrite:
+			// When the closeWrite channel is closed, we will no longer write to the origin and end this
+			// goroutine since the session is now closed.
+			return
+		case payload := <-s.writeChan:
+			n, err := s.origin.Write(payload)
+			if err != nil {
+				// Check if this is a write deadline exceeded to the connection
+				if errors.Is(err, os.ErrDeadlineExceeded) {
+					s.metrics.DroppedUDPDatagram(s.ConnectionID(), DroppedWriteDeadlineExceeded)
+					s.log.Warn().Err(err).Msg("flow (write) deadline exceeded: dropping packet")
+					continue
+				}
+				if isConnectionClosed(err) {
+					s.log.Debug().Msgf("flow (write) connection closed: %v", err)
+				}
+				s.log.Err(err).Msg("failed to write flow payload to origin")
+				s.closeSession(err)
+				// If we fail to write to the origin socket, we need to end the writer and close the session
+				return
+			}
+			// Write must return a non-nil error if it returns n < len(p). https://pkg.go.dev/io#Writer
+			if n < len(payload) {
+				s.metrics.DroppedUDPDatagram(s.ConnectionID(), DroppedWriteFailed)
+				s.log.Err(io.ErrShortWrite).Msg("failed to write the full flow payload to origin")
+				continue
+			}
+			// Mark the session as active since we successfully proxied a packet to the origin.
+			s.markActive()
+		}
+	}
+}
+
+func isConnectionClosed(err error) bool {
+	return errors.Is(err, net.ErrClosed) || errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF)
+}
+
+// Send an error to the error channel to report that an error has either happened on the tunnel or origin side of the
+// proxied connection.
+func (s *session) closeSession(err error) {
+	select {
+	case s.errChan <- err:
+	default:
+		// In the case that the errChan is already full, we will skip over it and return as to not block
+		// the caller because we should start cleaning up the session.
+		s.log.Warn().Msg("error channel was full")
 	}
-	// Mark the session as active since we proxied a packet to the origin.
-	s.markActive()
-	return n, err
 }

 // ResetIdleTimer will restart the current idle timer.
@@ -240,7 +309,8 @@ func (s *session) Close() error {

 func (s *session) waitForCloseCondition(ctx context.Context, closeAfterIdle time.Duration) error {
 	connCtx := ctx
-	// Closing the session at the end cancels read so Serve() can return
+	// Closing the session at the end cancels read so Serve() can return, additionally, it closes the
+	// closeWrite channel which indicates to the write loop to return.
 	defer s.Close()
 	if closeAfterIdle == 0 {
 		// Provided that the default caller doesn't specify one
@@ -260,7 +330,10 @@ func (s *session) waitForCloseCondition(ctx context.Context, closeAfterIdle time
 			// still be active on the existing connection.
 			connCtx = newContext
 			continue
-		case reason := <-s.closeChan:
+		case reason := <-s.errChan:
+			// Any error returned here is from the read or write loops indicating that it can no longer process datagrams
+			// and as such the session needs to close.
+			s.metrics.FailedFlow(s.ConnectionID())
 			return reason
 		case <-checkIdleTimer.C:
 			// The check idle timer will only return after an idle period since the last active
@@ -4,20 +4,24 @@ import (
 	"testing"
 )

-// FuzzSessionWrite verifies that we don't run into any panics when writing variable sized payloads to the origin.
+// FuzzSessionWrite verifies that we don't run into any panics when writing a single variable sized payload to the origin.
 func FuzzSessionWrite(f *testing.F) {
-	f.Fuzz(func(t *testing.T, b []byte) {
-		testSessionWrite(t, b)
-	})
-}
-
-// FuzzSessionServe verifies that we don't run into any panics when reading variable sized payloads from the origin.
-func FuzzSessionServe(f *testing.F) {
 	f.Fuzz(func(t *testing.T, b []byte) {
 		// The origin transport read is bound to 1280 bytes
 		if len(b) > 1280 {
 			b = b[:1280]
 		}
-		testSessionServe_Origin(t, b)
+		testSessionWrite(t, [][]byte{b})
+	})
+}
+
+// FuzzSessionRead verifies that we don't run into any panics when reading a single variable sized payload from the origin.
+func FuzzSessionRead(f *testing.F) {
+	f.Fuzz(func(t *testing.T, b []byte) {
+		// The origin transport read is bound to 1280 bytes
+		if len(b) > 1280 {
+			b = b[:1280]
+		}
+		testSessionRead(t, [][]byte{b})
 	})
 }
@@ -31,60 +31,61 @@ func TestSessionNew(t *testing.T) {
 	}
 }

-func testSessionWrite(t *testing.T, payload []byte) {
+func testSessionWrite(t *testing.T, payloads [][]byte) {
 	log := zerolog.Nop()
 	origin, server := net.Pipe()
 	defer origin.Close()
 	defer server.Close()
-	// Start origin server read
-	serverRead := make(chan []byte, 1)
+	// Start origin server reads
+	serverRead := make(chan []byte, len(payloads))
 	go func() {
-		read := make([]byte, 1500)
-		_, _ = server.Read(read[:])
-		serverRead <- read
+		for range len(payloads) {
+			buf := make([]byte, 1500)
+			_, _ = server.Read(buf[:])
+			serverRead <- buf
+		}
+		close(serverRead)
 	}()
-	// Create session and write to origin
+
+	// Create a session
 	session := v3.NewSession(testRequestID, 5*time.Second, origin, testOriginAddr, testLocalAddr, &noopEyeball{}, &noopMetrics{}, &log)
-	n, err := session.Write(payload)
 	defer session.Close()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if n != len(payload) {
-		t.Fatal("unable to write the whole payload")
+	// Start the Serve to begin the writeLoop
+	ctx, cancel := context.WithCancelCause(t.Context())
+	defer cancel(context.Canceled)
+	done := make(chan error)
+	go func() {
+		done <- session.Serve(ctx)
+	}()
+	// Write the payloads to the session
+	for _, payload := range payloads {
+		session.Write(payload)
 	}

-	read := <-serverRead
-	if !slices.Equal(payload, read[:len(payload)]) {
-		t.Fatal("payload provided from origin and read value are not the same")
+	// Read from the origin to ensure the payloads were received (in-order)
+	for i, payload := range payloads {
+		read := <-serverRead
+		if !slices.Equal(payload, read[:len(payload)]) {
+			t.Fatalf("payload[%d] provided from origin and read value are not the same (%x) and (%x)", i, payload[:16], read[:16])
+		}
+	}
+	_, more := <-serverRead
+	if more {
+		t.Fatalf("expected the session to have all of the origin payloads received: %d", len(serverRead))
+	}
+
+	assertContextClosed(t, ctx, done, cancel)
+}
+
+func TestSessionWrite(t *testing.T) {
+	defer leaktest.Check(t)()
+	for i := range 1280 {
+		payloads := makePayloads(i, 16)
+		testSessionWrite(t, payloads)
 	}
 }

-func TestSessionWrite_Max(t *testing.T) {
-	defer leaktest.Check(t)()
-	payload := makePayload(1280)
-	testSessionWrite(t, payload)
-}
-
-func TestSessionWrite_Min(t *testing.T) {
-	defer leaktest.Check(t)()
-	payload := makePayload(0)
-	testSessionWrite(t, payload)
-}
-
-func TestSessionServe_OriginMax(t *testing.T) {
-	defer leaktest.Check(t)()
-	payload := makePayload(1280)
-	testSessionServe_Origin(t, payload)
-}
-
-func TestSessionServe_OriginMin(t *testing.T) {
-	defer leaktest.Check(t)()
-	payload := makePayload(0)
-	testSessionServe_Origin(t, payload)
-}
-
-func testSessionServe_Origin(t *testing.T, payload []byte) {
+func testSessionRead(t *testing.T, payloads [][]byte) {
 	log := zerolog.Nop()
 	origin, server := net.Pipe()
 	defer origin.Close()
@@ -100,37 +101,42 @@ func testSessionServe_Origin(t *testing.T, payload []byte) {
 		done <- session.Serve(ctx)
 	}()

-	// Write from the origin server
-	_, err := server.Write(payload)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	select {
-	case data := <-eyeball.recvData:
-		// check received data matches provided from origin
-		expectedData := makePayload(1500)
-		_ = v3.MarshalPayloadHeaderTo(testRequestID, expectedData[:])
-		copy(expectedData[17:], payload)
-		if !slices.Equal(expectedData[:v3.DatagramPayloadHeaderLen+len(payload)], data) {
-			t.Fatal("expected datagram did not equal expected")
+	// Write from the origin server to the eyeball
+	go func() {
+		for _, payload := range payloads {
+			_, _ = server.Write(payload)
+		}
+	}()
+
+	// Read from the eyeball to ensure the payloads were received (in-order)
+	for i, payload := range payloads {
+		select {
+		case data := <-eyeball.recvData:
+			// check received data matches provided from origin
+			expectedData := makePayload(1500)
+			_ = v3.MarshalPayloadHeaderTo(testRequestID, expectedData[:])
+			copy(expectedData[17:], payload)
+			if !slices.Equal(expectedData[:v3.DatagramPayloadHeaderLen+len(payload)], data) {
+				t.Fatalf("expected datagram[%d] did not equal expected", i)
+			}
+		case err := <-ctx.Done():
+			// we expect the payload to return before the context to cancel on the session
+			t.Fatal(err)
 		}
-		cancel(errExpectedContextCanceled)
-	case err := <-ctx.Done():
-		// we expect the payload to return before the context to cancel on the session
-		t.Fatal(err)
 	}

-	err = <-done
-	if !errors.Is(err, context.Canceled) {
-		t.Fatal(err)
-	}
-	if !errors.Is(context.Cause(ctx), errExpectedContextCanceled) {
-		t.Fatal(err)
+	assertContextClosed(t, ctx, done, cancel)
+}
+
+func TestSessionRead(t *testing.T) {
+	defer leaktest.Check(t)()
+	for i := range 1280 {
+		payloads := makePayloads(i, 16)
+		testSessionRead(t, payloads)
 	}
 }

-func TestSessionServe_OriginTooLarge(t *testing.T) {
+func TestSessionRead_OriginTooLarge(t *testing.T) {
 	defer leaktest.Check(t)()
 	log := zerolog.Nop()
 	eyeball := newMockEyeball()
@@ -317,6 +323,8 @@ func TestSessionServe_IdleTimeout(t *testing.T) {
 	closeAfterIdle := 2 * time.Second
 	session := v3.NewSession(testRequestID, closeAfterIdle, origin, testOriginAddr, testLocalAddr, &noopEyeball{}, &noopMetrics{}, &log)
 	err := session.Serve(t.Context())
+
+	// Session should idle timeout if no reads or writes occur
 	if !errors.Is(err, v3.SessionIdleErr{}) {
 		t.Fatal(err)
 	}
@@ -0,0 +1,212 @@
+<!-- TODO(TUN-9963): Create pipeline to push this file to repo automatically -->
+
+<html>
+<body>
+<h1>Cloudflare packages</h1>
+<ul>
+    <li><a href="#cloudflared-packages">Cloudflared packages</a></li>
+    <li><a href="#gokeyless-packages">Gokeyless Packages</a></li>
+</ul>
+
+<br>
+<h2><a name="cloudflared-packages">Cloudflared</a></h2>
+
+<ul>
+    <li><a href="#debian-any">Any Debian Based Distribution (Recommended)</a></li>
+    <li><a href="#debian-bookworm">Debian Bookworm</a></li>
+    <li><a href="#ubuntu-focal">Ubuntu 20.04 (Focal Fossa)</a></li>
+    <li><a href="#ubuntu-jammy">Ubuntu 22.04 (Jammy Jellyfish)</a></li>
+    <li><a href="#ubuntu-noble">Ubuntu 24.04 (Noble Numbat)</a></li>
+    <li><a href="#Amazon-Linux">Amazon Linux</a></li>
+    <li><a href="#RHEL-generic">RHEL Generic</a></li>
+    <li><a href="#centos-7">Centos 7</a></li>
+    <li><a href="#centos-8">Centos 8</a></li>
+    <li><a href="#centos-stream">Centos Stream</a></li>
+</ul>
+
+<h3 style="color: #d9534f;">Warning: Public Key Rollover (30 October 2025)</h3>
+<p style="background-color: #fff3cd; border-left: 4px solid #ffc107; padding: 10px; margin: 10px 0;">
+    <strong>We have rolled our public key for package signing.</strong> If you are using RPM-based distributions (RHEL,
+    CentOS, Amazon Linux, etc.) or Debian Trixie and have the old key installed, RPM/Deb packages will no longer work with the old key.
+    Please update your repository configuration using the instructions below to ensure you can continue receiving
+    package updates. The previous keys will still work for other distributions for the time being, but it is now DEPRECATED and will be removed on 30 April 2026
+</p>
+
+<h3><a name="debian-any">Any Debian Based Distribution (Recommended)</a></h3>
+<pre>
+# Add cloudflare gpg key
+sudo mkdir -p --mode=0755 /usr/share/keyrings
+curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
+
+# Add this repo to your apt repositories
+# Stable
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
+# Nightly
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://next.pkg.cloudflare.com/cloudflared any main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
+
+# install cloudflared
+sudo apt-get update && sudo apt-get install cloudflared
+</pre>
+
+<h3><a name="debian-bookworm">Debian Bookworm</a></h3>
+<pre>
+# Add cloudflare gpg key
+sudo mkdir -p --mode=0755 /usr/share/keyrings
+curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
+
+# Add this repo to your apt repositories
+# Stable
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared bookworm main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
+# Nightly
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://next.pkg.cloudflare.com/cloudflared bookworm main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
+
+# install cloudflared
+sudo apt-get update && sudo apt-get install cloudflared
+</pre>
+
+<h3><a name="ubuntu-focal">Ubuntu 20.04 (Focal Fossa)</a></h3>
+<pre>
+# Add cloudflare gpg key
+sudo mkdir -p --mode=0755 /usr/share/keyrings
+curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
+
+# Add this repo to your apt repositories
+# Stable
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared focal main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
+# Nightly
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://next.pkg.cloudflare.com/cloudflared focal main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
+
+# install cloudflared
+sudo apt-get update && sudo apt-get install cloudflared
+</pre>
+
+<h3><a name="ubuntu-jammy">Ubuntu 22.04 (Jammy Jellyfish)</a></h3>
+<pre>
+# Add cloudflare gpg key
+sudo mkdir -p --mode=0755 /usr/share/keyrings
+curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
+
+# Add this repo to your apt repositories
+# Stable
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared jammy main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
+# Nightly
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://next.pkg.cloudflare.com/cloudflared jammy main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
+
+# install cloudflared
+sudo apt-get update && sudo apt-get install cloudflared
+</pre>
+
+<h3><a name="ubuntu-noble">Ubuntu 24.04 (Noble Numbat)</a></h3>
+<pre>
+# Add cloudflare gpg key
+sudo mkdir -p --mode=0755 /usr/share/keyrings
+curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
+
+# Add this repo to your apt repositories
+# Stable
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared noble main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
+# Nightly
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://next.pkg.cloudflare.com/cloudflared noble main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
+
+# install cloudflared
+sudo apt-get update && sudo apt-get install cloudflared
+</pre>
+
+<h3><a name="Amazon-Linux">Amazon Linux</a></h3>
+<pre>
+# Add cloudflared.repo to /etc/yum.repos.d/
+# Stable
+curl -fsSl https://pkg.cloudflare.com/cloudflared.repo | sudo tee /etc/yum.repos.d/cloudflared.repo
+# Nightly
+curl -fsSl https://next.pkg.cloudflare.com/cloudflared.repo | sudo tee /etc/yum.repos.d/cloudflared.repo
+
+#update repo
+sudo yum update
+
+# install cloudflared
+sudo yum install cloudflared
+</pre>
+
+
+<h3><a name="RHEL-generic">RHEL Generic</a></h3>
+<pre>
+# Add cloudflared.repo to /etc/yum.repos.d/
+# Stable
+curl -fsSl https://pkg.cloudflare.com/cloudflared.repo | sudo tee /etc/yum.repos.d/cloudflared.repo
+# Nightly
+curl -fsSl https://next.pkg.cloudflare.com/cloudflared.repo | sudo tee /etc/yum.repos.d/cloudflared.repo
+
+#update repo
+sudo yum update
+
+# install cloudflared
+sudo yum install cloudflared
+</pre>
+
+
+<h3><a name="centos-7">Centos 7</a></h3>
+<pre>
+# This requires yum config-manager
+sudo yum install yum-utils
+
+# Add cloudflared.repo to config-manager
+# Stable
+sudo yum-config-manager --add-repo https://pkg.cloudflare.com/cloudflared.repo
+# Nightly
+sudo yum-config-manager --add-repo https://next.pkg.cloudflare.com/cloudflared.repo
+
+# install cloudflared
+yum install cloudflared
+</pre>
+
+<h3><a name="centos-8">Centos 8</a></h3>
+<pre>
+# This requires dnf config-manager
+# Add cloudflared.repo to config-manager
+# Stable
+sudo dnf config-manager --add-repo https://pkg.cloudflare.com/cloudflared.repo
+# Nightly
+sudo dnf config-manager --add-repo https://next.pkg.cloudflare.com/cloudflared.repo
+
+# install cloudflared
+sudo dnf install cloudflared
+</pre>
+
+<h3><a name="centos-stream">Centos Stream</a></h3>
+<pre>
+# This requires dnf config-manager
+# Add cloudflared.repo to config-manager
+# Stable
+sudo dnf config-manager --add-repo https://pkg.cloudflare.com/cloudflared.repo
+# Nightly
+sudo dnf config-manager --add-repo https://next.pkg.cloudflare.com/cloudflared.repo
+
+# install cloudflared
+sudo dnf install cloudflared
+</pre>
+
+
+<h2><a name="gokeyless-packages"></a>Gokeyless</a></h2>
+<h3><a name="go-keyless-debian">Debian</a></h3>
+<pre>
+sudo mkdir -p --mode=0755 /usr/share/keyrings
+curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
+
+# Add this repo to your apt repositories
+echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/gokeyless buster main' | sudo tee /etc/apt/sources.list.d/cloudflare.list
+
+# install gokeyless
+sudo apt-get update && sudo apt-get install gokeyless
+</pre>
+
+<h3><a name="go-keyless-centos">Centos 8</a></h3>
+<pre>
+# This requires dnf config-manager
+# Add gokeyless.repo to config-manager
+sudo dnf config-manager --add-repo https://pkg.cloudflare.com/gokeyless.repo
+
+# install gokeyless
+sudo dnf install gokeyless
+</pre>
+</body>
+</html>
@@ -50,7 +50,7 @@ class PkgUploader:
            config=config,
        )

-        print(f"uploading asset: {filename} to {upload_file_path} in bucket{self.bucket_name}...")
+        print(f"uploading asset: {filename} to {upload_file_path} in bucket {self.bucket_name}...")
        try:
            r2.upload_file(filename, self.bucket_name, upload_file_path)
        except ClientError as e:
@@ -133,16 +133,19 @@ class PkgCreator:
    """

    def create_repo_file(self, file_path, binary_name, baseurl, gpgkey_url):
-        with open(os.path.join(file_path, binary_name + '.repo'), "w+") as repo_file:
-            repo_file.write(f"[{binary_name}-stable]")
-            repo_file.write(f"{binary_name}-stable")
-            repo_file.write(f"baseurl={baseurl}/rpm")
-            repo_file.write("enabled=1")
-            repo_file.write("type=rpm")
-            repo_file.write("gpgcheck=1")
-            repo_file.write(f"gpgkey={gpgkey_url}")
+        repo_file_path = os.path.join(file_path, binary_name + '.repo')
+        with open(repo_file_path, "w+") as repo_file:
+            repo_file.write(f"[{binary_name}-stable]\n")
+            repo_file.write(f"name={binary_name}-stable\n")
+            repo_file.write(f"baseurl={baseurl}/rpm\n")
+            repo_file.write("enabled=1\n")
+            repo_file.write("type=rpm\n")
+            repo_file.write("gpgcheck=1\n")
+            repo_file.write(f"gpgkey={gpgkey_url}\n")
+        return repo_file_path

-    def _sign_rpms(self, file_path):
+
+    def _sign_rpms(self, file_path, gpg_key_name):
        p = Popen(["rpm", "--define", f"_gpg_name {gpg_key_name}", "--addsign", file_path], stdout=PIPE, stderr=PIPE)
        out, err = p.communicate()
        if p.returncode != 0:
@@ -150,7 +153,7 @@ class PkgCreator:
            raise

    def _sign_repomd(self):
-        p = Popen(["gpg", "--batch", "--detach-sign", "--armor", "./rpm/repodata/repomd.xml"], stdout=PIPE, stderr=PIPE)
+        p = Popen(["gpg", "--batch", "--yes", "--detach-sign", "--armor", "./rpm/repodata/repomd.xml"], stdout=PIPE, stderr=PIPE)
        out, err = p.communicate()
        if p.returncode != 0:
            print(f"sign repomd result => {out}, {err}")
@@ -176,7 +179,7 @@ class PkgCreator:
                        old_path = os.path.join(root, file)
                        new_path = os.path.join(new_dir, file)
                        shutil.copyfile(old_path, new_path)
-                        self._sign_rpms(new_path)
+                        self._sign_rpms(new_path, gpg_key_name)

    """
        imports gpg keys into the system so reprepro and createrepo can use it to sign packages.
@@ -186,11 +189,34 @@ class PkgCreator:
    def import_gpg_keys(self, private_key, public_key):
        gpg = gnupg.GPG()
        private_key = base64.b64decode(private_key)
-        gpg.import_keys(private_key)
+        import_result = gpg.import_keys(private_key)
+        if not import_result.fingerprints:
+            raise Exception("Failed to import private key")
+
        public_key = base64.b64decode(public_key)
        gpg.import_keys(public_key)
+
+        imported_fingerprint = import_result.fingerprints[0]
        data = gpg.list_keys(secret=True)
-        return (data[0]["fingerprint"], data[0]["uids"][0])
+
+        # Find the specific key we just imported by comparing fingerprints
+        for key in data:
+            if key["fingerprint"] == imported_fingerprint:
+                return (key["fingerprint"], key["uids"][0])
+
+        raise Exception(f"Could not find imported key with fingerprint {imported_fingerprint}")
+
+    def import_multiple_gpg_keys(self, primary_private_key, primary_public_key, secondary_private_key=None, secondary_public_key=None):
+        """
+        Import one or two GPG keypairs. Returns a list of (fingerprint, uid) with the primary first.
+        """
+        results = []
+        if primary_private_key and primary_public_key:
+            results.append(self.import_gpg_keys(primary_private_key, primary_public_key))
+        if secondary_private_key and secondary_public_key:
+            # Ensure secondary is imported and appended
+            results.append(self.import_gpg_keys(secondary_private_key, secondary_public_key))
+        return results

    """
        basically rpm --import <key_file>
@@ -234,7 +260,7 @@ def upload_from_directories(pkg_uploader, directory, release, binary):


 """ 
-    1. looks into a built_artifacts folder for cloudflared debs
+    1. looks into a artifacts folder for cloudflared debs
    2. creates Packages.gz, InRelease (signed) files
    3. uploads them to Cloudflare R2 

@@ -247,11 +273,13 @@ def upload_from_directories(pkg_uploader, directory, release, binary):
 """


-def create_deb_packaging(pkg_creator, pkg_uploader, releases, gpg_key_id, binary_name, archs, package_component,
+def create_deb_packaging(pkg_creator, pkg_uploader, releases, primary_gpg_key_id, secondary_gpg_key_id, binary_name, archs, package_component,
                         release_version):
    # set configuration for package creation.
    print(f"initialising configuration for {binary_name} , {archs}")
    Path("./conf").mkdir(parents=True, exist_ok=True)
+    # If in rollover mode (secondary provided), tell reprepro to sign with both keys.
+    sign_with_ids = primary_gpg_key_id if not secondary_gpg_key_id else f"{primary_gpg_key_id} {secondary_gpg_key_id}"
    pkg_creator.create_distribution_conf(
        "./conf/distributions",
        binary_name,
@@ -260,13 +288,13 @@ def create_deb_packaging(pkg_creator, pkg_uploader, releases, gpg_key_id, binary
        archs,
        package_component,
        f"apt repository for {binary_name}",
-        gpg_key_id)
+        sign_with_ids)

    # create deb pkgs
    for release in releases:
        for arch in archs:
            print(f"creating deb pkgs for {release} and {arch}...")
-            pkg_creator.create_deb_pkgs(release, f"./built_artifacts/cloudflared-linux-{arch}.deb")
+            pkg_creator.create_deb_pkgs(release, f"./artifacts/cloudflared-linux-{arch}.deb")

    print("uploading latest to r2...")
    upload_from_directories(pkg_uploader, "dists", None, binary_name)
@@ -287,15 +315,19 @@ def create_rpm_packaging(
        gpg_key_name,
        base_url,
        gpg_key_url,
+        upload_repo_file=False,
 ):
    print(f"creating rpm pkgs...")
    pkg_creator.create_rpm_pkgs(artifacts_path, gpg_key_name)
-    pkg_creator.create_repo_file(artifacts_path, binary_name, base_url, gpg_key_url)
+    repo_file = pkg_creator.create_repo_file(artifacts_path, binary_name, base_url, gpg_key_url)
+
+    print("Uploading repo file")
+    pkg_uploader.upload_pkg_to_r2(repo_file, binary_name + ".repo")

    print("uploading latest to r2...")
    upload_from_directories(pkg_uploader, "rpm", None, binary_name)

-    if release_version:
+    if upload_repo_file:
        print(f"uploading versioned release {release_version} to r2...")
        upload_from_directories(pkg_uploader, "rpm", release_version, binary_name)

@@ -336,6 +368,14 @@ def parse_args():
            signing packages"
    )

+    # Optional secondary keypair for key rollover
+    parser.add_argument(
+        "--gpg-private-key-2", default=os.environ.get("LINUX_SIGNING_PRIVATE_KEY_2"), help="Secondary GPG private key for rollover"
+    )
+    parser.add_argument(
+        "--gpg-public-key-2", default=os.environ.get("LINUX_SIGNING_PUBLIC_KEY_2"), help="Secondary GPG public key for rollover"
+    )
+
    parser.add_argument(
        "--gpg-public-key-url", default=os.environ.get("GPG_PUBLIC_KEY_URL"), help="GPG public key url that\
            downloaders can use to verify signing"
@@ -355,6 +395,10 @@ def parse_args():
            it is the caller's responsiblity to ensure that these debs are already present in a directory. This script\
            will not build binaries or create their debs."
    )
+
+    parser.add_argument(
+        "--upload-repo-file", action='store_true', help="Upload RPM repo file to R2"
+    )
    args = parser.parse_args()

    return args
@@ -368,21 +412,51 @@ if __name__ == "__main__":
        exit(1)

    pkg_creator = PkgCreator()
-    (gpg_key_id, gpg_key_name) = pkg_creator.import_gpg_keys(args.gpg_private_key, args.gpg_public_key)
-    pkg_creator.import_rpm_key(args.gpg_public_key)
+    # Import one or two keypairs; primary first
+    key_results = pkg_creator.import_multiple_gpg_keys(
+        args.gpg_private_key,
+        args.gpg_public_key,
+        args.gpg_private_key_2,
+        args.gpg_public_key_2,
+    )
+    if not key_results or len(key_results) == 0:
+        raise SystemExit("No GPG keys were provided for signing")
+    primary_gpg_key_id, primary_gpg_key_name = key_results[0]
+    secondary_gpg_key_id = None
+    secondary_gpg_key_name = None
+    if len(key_results) > 1:
+        secondary_gpg_key_id, secondary_gpg_key_name = key_results[1]
+
+    if args.gpg_private_key_2:
+        print(f"signing RPM with secondary gpg_key: {secondary_gpg_key_id}")
+        pkg_creator.import_rpm_key(args.gpg_public_key_2)
+    else:
+        print(f"signing RPM with primary gpg_key: {primary_gpg_key_name}")
+        pkg_creator.import_rpm_key(args.gpg_public_key)
+

    pkg_uploader = PkgUploader(args.account, args.bucket, args.id, args.secret)
-    print(f"signing with gpg_key: {gpg_key_id}")
-    create_deb_packaging(pkg_creator, pkg_uploader, args.deb_based_releases, gpg_key_id, args.binary, args.archs,
-                         "main", args.release_tag)
+    print(f"signing deb with primary gpg_key: {primary_gpg_key_id} and secondary gpg_key: {secondary_gpg_key_id}")
+    create_deb_packaging(
+        pkg_creator,
+        pkg_uploader,
+        args.deb_based_releases,
+        primary_gpg_key_id,
+        secondary_gpg_key_id,
+        args.binary,
+        args.archs,
+        "main",
+        args.release_tag,
+    )

    create_rpm_packaging(
        pkg_creator,
        pkg_uploader,
-        "./built_artifacts",
+        "./artifacts",
        args.release_tag,
        args.binary,
-        gpg_key_name,
-        args.gpg_public_key_url,
+        secondary_gpg_key_name,
        args.pkg_upload_url,
+        args.gpg_public_key_url,
+        args.upload_repo_file,
    )
@@ -255,7 +255,6 @@ func getToken(appURL *url.URL, appInfo *AppInfo, useHostOnly bool, autoClose boo
 // getTokensFromEdge will attempt to use the transfer service to retrieve an app and org token, save them to disk,
 // and return the app token.
 func getTokensFromEdge(appURL *url.URL, appAUD, appTokenPath, orgTokenPath string, useHostOnly bool, autoClose bool, isFedramp bool, log *zerolog.Logger) (string, error) {
-	fmt.Println("Get tokens from edge ", autoClose)
 	// If no org token exists or if it couldn't be exchanged for an app token, then run the transfer service flow.

 	// this weird parameter is the resource name (token) and the key/value
@@ -1,39 +0,0 @@
-package tunneldns
-
-import (
-	"context"
-
-	"github.com/coredns/coredns/plugin"
-	"github.com/miekg/dns"
-	"github.com/pkg/errors"
-)
-
-// Upstream is a simplified interface for proxy destination
-type Upstream interface {
-	Exchange(ctx context.Context, query *dns.Msg) (*dns.Msg, error)
-}
-
-// ProxyPlugin is a simplified DNS proxy using a generic upstream interface
-type ProxyPlugin struct {
-	Upstreams []Upstream
-	Next      plugin.Handler
-}
-
-// ServeDNS implements interface for CoreDNS plugin
-func (p ProxyPlugin) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
-	var reply *dns.Msg
-	var backendErr error
-
-	for _, upstream := range p.Upstreams {
-		reply, backendErr = upstream.Exchange(ctx, r)
-		if backendErr == nil {
-			w.WriteMsg(reply)
-			return 0, nil
-		}
-	}
-
-	return dns.RcodeServerFailure, errors.Wrap(backendErr, "failed to contact any of the upstreams")
-}
-
-// Name implements interface for CoreDNS plugin
-func (p ProxyPlugin) Name() string { return "proxy" }
@@ -1,145 +0,0 @@
-package tunneldns
-
-import (
-	"bytes"
-	"context"
-	"crypto/tls"
-	"fmt"
-	"io"
-	"net"
-	"net/http"
-	"net/url"
-	"time"
-
-	"github.com/miekg/dns"
-	"github.com/pkg/errors"
-	"github.com/rs/zerolog"
-	"golang.org/x/net/http2"
-)
-
-const (
-	defaultTimeout = 5 * time.Second
-)
-
-// UpstreamHTTPS is the upstream implementation for DNS over HTTPS service
-type UpstreamHTTPS struct {
-	client     *http.Client
-	endpoint   *url.URL
-	bootstraps []string
-	log        *zerolog.Logger
-}
-
-// NewUpstreamHTTPS creates a new DNS over HTTPS upstream from endpoint
-func NewUpstreamHTTPS(endpoint string, bootstraps []string, maxConnections int, log *zerolog.Logger) (Upstream, error) {
-	u, err := url.Parse(endpoint)
-	if err != nil {
-		return nil, err
-	}
-	return &UpstreamHTTPS{client: configureClient(u.Hostname(), maxConnections), endpoint: u, bootstraps: bootstraps, log: log}, nil
-}
-
-// Exchange provides an implementation for the Upstream interface
-func (u *UpstreamHTTPS) Exchange(ctx context.Context, query *dns.Msg) (*dns.Msg, error) {
-	queryBuf, err := query.Pack()
-	if err != nil {
-		return nil, errors.Wrap(err, "failed to pack DNS query")
-	}
-
-	if len(query.Question) > 0 && query.Question[0].Name == fmt.Sprintf("%s.", u.endpoint.Hostname()) {
-		for _, bootstrap := range u.bootstraps {
-			endpoint, client, err := configureBootstrap(bootstrap)
-			if err != nil {
-				u.log.Err(err).Msgf("failed to configure bootstrap upstream %s", bootstrap)
-				continue
-			}
-			msg, err := exchange(queryBuf, query.Id, endpoint, client, u.log)
-			if err != nil {
-				u.log.Err(err).Msgf("failed to connect to a bootstrap upstream %s", bootstrap)
-				continue
-			}
-			return msg, nil
-		}
-		return nil, fmt.Errorf("failed to reach any bootstrap upstream: %v", u.bootstraps)
-	}
-
-	return exchange(queryBuf, query.Id, u.endpoint, u.client, u.log)
-}
-
-func exchange(msg []byte, queryID uint16, endpoint *url.URL, client *http.Client, log *zerolog.Logger) (*dns.Msg, error) {
-	// No content negotiation for now, use DNS wire format
-	buf, backendErr := exchangeWireformat(msg, endpoint, client)
-	if backendErr == nil {
-		response := &dns.Msg{}
-		if err := response.Unpack(buf); err != nil {
-			return nil, errors.Wrap(err, "failed to unpack DNS response from body")
-		}
-
-		response.Id = queryID
-		return response, nil
-	}
-
-	log.Err(backendErr).Msgf("failed to connect to an HTTPS backend %q", endpoint)
-	return nil, backendErr
-}
-
-// Perform message exchange with the default UDP wireformat defined in current draft
-// https://datatracker.ietf.org/doc/draft-ietf-doh-dns-over-https
-func exchangeWireformat(msg []byte, endpoint *url.URL, client *http.Client) ([]byte, error) {
-	req, err := http.NewRequest("POST", endpoint.String(), bytes.NewBuffer(msg))
-	if err != nil {
-		return nil, errors.Wrap(err, "failed to create an HTTPS request")
-	}
-
-	req.Header.Add("Content-Type", "application/dns-message")
-	req.Host = endpoint.Host
-
-	resp, err := client.Do(req)
-	if err != nil {
-		return nil, errors.Wrap(err, "failed to perform an HTTPS request")
-	}
-
-	// Check response status code
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("returned status code %d", resp.StatusCode)
-	}
-
-	// Read wireformat response from the body
-	buf, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, errors.Wrap(err, "failed to read the response body")
-	}
-
-	return buf, nil
-}
-
-func configureBootstrap(bootstrap string) (*url.URL, *http.Client, error) {
-	b, err := url.Parse(bootstrap)
-	if err != nil {
-		return nil, nil, err
-	}
-	if ip := net.ParseIP(b.Hostname()); ip == nil {
-		return nil, nil, fmt.Errorf("bootstrap address of %s must be an IP address", b.Hostname())
-	}
-
-	return b, configureClient(b.Hostname(), MaxUpstreamConnsDefault), nil
-}
-
-// configureClient will configure a HTTPS client for upstream DoH requests
-func configureClient(hostname string, maxUpstreamConnections int) *http.Client {
-	// Update TLS and HTTP client configuration
-	tlsConfig := &tls.Config{ServerName: hostname}
-	transport := &http.Transport{
-		TLSClientConfig:    tlsConfig,
-		DisableCompression: true,
-		MaxIdleConns:       1,
-		MaxConnsPerHost:    maxUpstreamConnections,
-		Proxy:              http.ProxyFromEnvironment,
-	}
-	_ = http2.ConfigureTransport(transport)
-
-	return &http.Client{
-		Timeout:   defaultTimeout,
-		Transport: transport,
-	}
-}
@@ -1,44 +0,0 @@
-package tunneldns
-
-import (
-	"context"
-
-	"github.com/coredns/coredns/plugin"
-	"github.com/coredns/coredns/plugin/metrics"
-	"github.com/coredns/coredns/plugin/metrics/vars"
-	"github.com/coredns/coredns/plugin/pkg/dnstest"
-	"github.com/coredns/coredns/plugin/pkg/rcode"
-	"github.com/coredns/coredns/request"
-	"github.com/miekg/dns"
-)
-
-const (
-	pluginName = "cloudflared"
-)
-
-// MetricsPlugin is an adapter for CoreDNS and built-in metrics
-type MetricsPlugin struct {
-	Next plugin.Handler
-}
-
-// NewMetricsPlugin creates a plugin with configured metrics
-func NewMetricsPlugin(next plugin.Handler) *MetricsPlugin {
-	return &MetricsPlugin{Next: next}
-}
-
-// ServeDNS implements the CoreDNS plugin interface
-func (p MetricsPlugin) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
-	state := request.Request{W: w, Req: r}
-
-	rw := dnstest.NewRecorder(w)
-	status, err := plugin.NextOrFailure(p.Name(), p.Next, ctx, rw, r)
-
-	// Update built-in metrics
-	server := metrics.WithServer(ctx)
-	vars.Report(server, state, ".", "", rcode.ToString(rw.Rcode), pluginName, rw.Len, rw.Start)
-
-	return status, err
-}
-
-// Name implements the CoreDNS plugin interface
-func (p MetricsPlugin) Name() string { return "metrics" }
@@ -1,109 +0,0 @@
-package tunneldns
-
-import (
-	"net"
-	"strconv"
-	"sync"
-
-	"github.com/coredns/coredns/core/dnsserver"
-	"github.com/coredns/coredns/plugin"
-	"github.com/coredns/coredns/plugin/cache"
-	"github.com/pkg/errors"
-	"github.com/rs/zerolog"
-)
-
-const (
-	LogFieldAddress         = "address"
-	LogFieldURL             = "url"
-	MaxUpstreamConnsDefault = 5
-)
-
-// Listener is an adapter between CoreDNS server and Warp runnable
-type Listener struct {
-	server *dnsserver.Server
-	wg     sync.WaitGroup
-	log    *zerolog.Logger
-}
-
-// Create a CoreDNS server plugin from configuration
-func createConfig(address string, port uint16, p plugin.Handler) *dnsserver.Config {
-	c := &dnsserver.Config{
-		Zone:        ".",
-		Transport:   "dns",
-		ListenHosts: []string{address},
-		Port:        strconv.FormatUint(uint64(port), 10),
-	}
-
-	c.AddPlugin(func(next plugin.Handler) plugin.Handler { return p })
-	return c
-}
-
-// Start blocks for serving requests
-func (l *Listener) Start(readySignal chan struct{}) error {
-	defer close(readySignal)
-	l.log.Info().Str(LogFieldAddress, l.server.Address()).Msg("Starting DNS over HTTPS proxy server")
-
-	// Start UDP listener
-	if udp, err := l.server.ListenPacket(); err == nil {
-		l.wg.Add(1)
-		go func() {
-			_ = l.server.ServePacket(udp)
-			l.wg.Done()
-		}()
-	} else {
-		return errors.Wrap(err, "failed to create a UDP listener")
-	}
-
-	// Start TCP listener
-	tcp, err := l.server.Listen()
-	if err == nil {
-		l.wg.Add(1)
-		go func() {
-			_ = l.server.Serve(tcp)
-			l.wg.Done()
-		}()
-	}
-
-	return errors.Wrap(err, "failed to create a TCP listener")
-}
-
-// Stop signals server shutdown and blocks until completed
-func (l *Listener) Stop() error {
-	if err := l.server.Stop(); err != nil {
-		return err
-	}
-
-	l.wg.Wait()
-	return nil
-}
-
-// CreateListener configures the server and bound sockets
-func CreateListener(address string, port uint16, upstreams []string, bootstraps []string, maxUpstreamConnections int, log *zerolog.Logger) (*Listener, error) {
-	// Build the list of upstreams
-	upstreamList := make([]Upstream, 0)
-	for _, url := range upstreams {
-		log.Info().Str(LogFieldURL, url).Msg("Adding DNS upstream")
-		upstream, err := NewUpstreamHTTPS(url, bootstraps, maxUpstreamConnections, log)
-		if err != nil {
-			return nil, errors.Wrap(err, "failed to create HTTPS upstream")
-		}
-		upstreamList = append(upstreamList, upstream)
-	}
-
-	// Create a local cache with HTTPS proxy plugin
-	chain := cache.New()
-	chain.Next = ProxyPlugin{
-		Upstreams: upstreamList,
-	}
-
-	// Format an endpoint
-	endpoint := "dns://" + net.JoinHostPort(address, strconv.FormatUint(uint64(port), 10))
-
-	// Create the actual middleware server
-	server, err := dnsserver.NewServer(endpoint, []*dnsserver.Config{createConfig(address, port, NewMetricsPlugin(chain))})
-	if err != nil {
-		return nil, err
-	}
-
-	return &Listener{server: server, log: log}, nil
-}
@@ -1,19 +0,0 @@
-Copyright (c) 2015 Martin Atkins
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
@@ -1,236 +0,0 @@
-// Package cidr is a collection of assorted utilities for computing
-// network and host addresses within network ranges.
-//
-// It expects a CIDR-type address structure where addresses are divided into
-// some number of prefix bits representing the network and then the remaining
-// suffix bits represent the host.
-//
-// For example, it can help to calculate addresses for sub-networks of a
-// parent network, or to calculate host addresses within a particular prefix.
-//
-// At present this package is prioritizing simplicity of implementation and
-// de-prioritizing speed and memory usage. Thus caution is advised before
-// using this package in performance-critical applications or hot codepaths.
-// Patches to improve the speed and memory usage may be accepted as long as
-// they do not result in a significant increase in code complexity.
-package cidr
-
-import (
-	"fmt"
-	"math/big"
-	"net"
-)
-
-// Subnet takes a parent CIDR range and creates a subnet within it
-// with the given number of additional prefix bits and the given
-// network number.
-//
-// For example, 10.3.0.0/16, extended by 8 bits, with a network number
-// of 5, becomes 10.3.5.0/24 .
-func Subnet(base *net.IPNet, newBits int, num int) (*net.IPNet, error) {
-	return SubnetBig(base, newBits, big.NewInt(int64(num)))
-}
-
-// SubnetBig takes a parent CIDR range and creates a subnet within it with the
-// given number of additional prefix bits and the given network number. It
-// differs from Subnet in that it takes a *big.Int for the num, instead of an int.
-//
-// For example, 10.3.0.0/16, extended by 8 bits, with a network number of 5,
-// becomes 10.3.5.0/24 .
-func SubnetBig(base *net.IPNet, newBits int, num *big.Int) (*net.IPNet, error) {
-	ip := base.IP
-	mask := base.Mask
-
-	parentLen, addrLen := mask.Size()
-	newPrefixLen := parentLen + newBits
-
-	if newPrefixLen > addrLen {
-		return nil, fmt.Errorf("insufficient address space to extend prefix of %d by %d", parentLen, newBits)
-	}
-
-	maxNetNum := uint64(1<<uint64(newBits)) - 1
-	if num.Uint64() > maxNetNum {
-		return nil, fmt.Errorf("prefix extension of %d does not accommodate a subnet numbered %d", newBits, num)
-	}
-
-	return &net.IPNet{
-		IP:   insertNumIntoIP(ip, num, newPrefixLen),
-		Mask: net.CIDRMask(newPrefixLen, addrLen),
-	}, nil
-}
-
-// Host takes a parent CIDR range and turns it into a host IP address with the
-// given host number.
-//
-// For example, 10.3.0.0/16 with a host number of 2 gives 10.3.0.2.
-func Host(base *net.IPNet, num int) (net.IP, error) {
-	return HostBig(base, big.NewInt(int64(num)))
-}
-
-// HostBig takes a parent CIDR range and turns it into a host IP address with
-// the given host number. It differs from Host in that it takes a *big.Int for
-// the num, instead of an int.
-//
-// For example, 10.3.0.0/16 with a host number of 2 gives 10.3.0.2.
-func HostBig(base *net.IPNet, num *big.Int) (net.IP, error) {
-	ip := base.IP
-	mask := base.Mask
-
-	parentLen, addrLen := mask.Size()
-	hostLen := addrLen - parentLen
-
-	maxHostNum := big.NewInt(int64(1))
-	maxHostNum.Lsh(maxHostNum, uint(hostLen))
-	maxHostNum.Sub(maxHostNum, big.NewInt(1))
-
-	numUint64 := big.NewInt(int64(num.Uint64()))
-	if num.Cmp(big.NewInt(0)) == -1 {
-		numUint64.Neg(num)
-		numUint64.Sub(numUint64, big.NewInt(int64(1)))
-		num.Sub(maxHostNum, numUint64)
-	}
-
-	if numUint64.Cmp(maxHostNum) == 1 {
-		return nil, fmt.Errorf("prefix of %d does not accommodate a host numbered %d", parentLen, num)
-	}
-	var bitlength int
-	if ip.To4() != nil {
-		bitlength = 32
-	} else {
-		bitlength = 128
-	}
-	return insertNumIntoIP(ip, num, bitlength), nil
-}
-
-// AddressRange returns the first and last addresses in the given CIDR range.
-func AddressRange(network *net.IPNet) (net.IP, net.IP) {
-	// the first IP is easy
-	firstIP := network.IP
-
-	// the last IP is the network address OR NOT the mask address
-	prefixLen, bits := network.Mask.Size()
-	if prefixLen == bits {
-		// Easy!
-		// But make sure that our two slices are distinct, since they
-		// would be in all other cases.
-		lastIP := make([]byte, len(firstIP))
-		copy(lastIP, firstIP)
-		return firstIP, lastIP
-	}
-
-	firstIPInt, bits := ipToInt(firstIP)
-	hostLen := uint(bits) - uint(prefixLen)
-	lastIPInt := big.NewInt(1)
-	lastIPInt.Lsh(lastIPInt, hostLen)
-	lastIPInt.Sub(lastIPInt, big.NewInt(1))
-	lastIPInt.Or(lastIPInt, firstIPInt)
-
-	return firstIP, intToIP(lastIPInt, bits)
-}
-
-// AddressCount returns the number of distinct host addresses within the given
-// CIDR range.
-//
-// Since the result is a uint64, this function returns meaningful information
-// only for IPv4 ranges and IPv6 ranges with a prefix size of at least 65.
-func AddressCount(network *net.IPNet) uint64 {
-	prefixLen, bits := network.Mask.Size()
-	return 1 << (uint64(bits) - uint64(prefixLen))
-}
-
-//VerifyNoOverlap takes a list subnets and supernet (CIDRBlock) and verifies
-//none of the subnets overlap and all subnets are in the supernet
-//it returns an error if any of those conditions are not satisfied
-func VerifyNoOverlap(subnets []*net.IPNet, CIDRBlock *net.IPNet) error {
-	firstLastIP := make([][]net.IP, len(subnets))
-	for i, s := range subnets {
-		first, last := AddressRange(s)
-		firstLastIP[i] = []net.IP{first, last}
-	}
-	for i, s := range subnets {
-		if !CIDRBlock.Contains(firstLastIP[i][0]) || !CIDRBlock.Contains(firstLastIP[i][1]) {
-			return fmt.Errorf("%s does not fully contain %s", CIDRBlock.String(), s.String())
-		}
-		for j := 0; j < len(subnets); j++ {
-			if i == j {
-				continue
-			}
-
-			first := firstLastIP[j][0]
-			last := firstLastIP[j][1]
-			if s.Contains(first) || s.Contains(last) {
-				return fmt.Errorf("%s overlaps with %s", subnets[j].String(), s.String())
-			}
-		}
-	}
-	return nil
-}
-
-// PreviousSubnet returns the subnet of the desired mask in the IP space
-// just lower than the start of IPNet provided. If the IP space rolls over
-// then the second return value is true
-func PreviousSubnet(network *net.IPNet, prefixLen int) (*net.IPNet, bool) {
-	startIP := checkIPv4(network.IP)
-	previousIP := make(net.IP, len(startIP))
-	copy(previousIP, startIP)
-	cMask := net.CIDRMask(prefixLen, 8*len(previousIP))
-	previousIP = Dec(previousIP)
-	previous := &net.IPNet{IP: previousIP.Mask(cMask), Mask: cMask}
-	if startIP.Equal(net.IPv4zero) || startIP.Equal(net.IPv6zero) {
-		return previous, true
-	}
-	return previous, false
-}
-
-// NextSubnet returns the next available subnet of the desired mask size
-// starting for the maximum IP of the offset subnet
-// If the IP exceeds the maxium IP then the second return value is true
-func NextSubnet(network *net.IPNet, prefixLen int) (*net.IPNet, bool) {
-	_, currentLast := AddressRange(network)
-	mask := net.CIDRMask(prefixLen, 8*len(currentLast))
-	currentSubnet := &net.IPNet{IP: currentLast.Mask(mask), Mask: mask}
-	_, last := AddressRange(currentSubnet)
-	last = Inc(last)
-	next := &net.IPNet{IP: last.Mask(mask), Mask: mask}
-	if last.Equal(net.IPv4zero) || last.Equal(net.IPv6zero) {
-		return next, true
-	}
-	return next, false
-}
-
-//Inc increases the IP by one this returns a new []byte for the IP
-func Inc(IP net.IP) net.IP {
-	IP = checkIPv4(IP)
-	incIP := make([]byte, len(IP))
-	copy(incIP, IP)
-	for j := len(incIP) - 1; j >= 0; j-- {
-		incIP[j]++
-		if incIP[j] > 0 {
-			break
-		}
-	}
-	return incIP
-}
-
-//Dec decreases the IP by one this returns a new []byte for the IP
-func Dec(IP net.IP) net.IP {
-	IP = checkIPv4(IP)
-	decIP := make([]byte, len(IP))
-	copy(decIP, IP)
-	decIP = checkIPv4(decIP)
-	for j := len(decIP) - 1; j >= 0; j-- {
-		decIP[j]--
-		if decIP[j] < 255 {
-			break
-		}
-	}
-	return decIP
-}
-
-func checkIPv4(ip net.IP) net.IP {
-	// Go for some reason allocs IPv6len for IPv4 so we have to correct it
-	if v4 := ip.To4(); v4 != nil {
-		return v4
-	}
-	return ip
-}
@@ -1,37 +0,0 @@
-package cidr
-
-import (
-	"fmt"
-	"math/big"
-	"net"
-)
-
-func ipToInt(ip net.IP) (*big.Int, int) {
-	val := &big.Int{}
-	val.SetBytes([]byte(ip))
-	if len(ip) == net.IPv4len {
-		return val, 32
-	} else if len(ip) == net.IPv6len {
-		return val, 128
-	} else {
-		panic(fmt.Errorf("Unsupported address length %d", len(ip)))
-	}
-}
-
-func intToIP(ipInt *big.Int, bits int) net.IP {
-	ipBytes := ipInt.Bytes()
-	ret := make([]byte, bits/8)
-	// Pack our IP bytes into the end of the return array,
-	// since big.Int.Bytes() removes front zero padding.
-	for i := 1; i <= len(ipBytes); i++ {
-		ret[len(ret)-i] = ipBytes[len(ipBytes)-i]
-	}
-	return net.IP(ret)
-}
-
-func insertNumIntoIP(ip net.IP, bigNum *big.Int, prefixLen int) net.IP {
-	ipInt, totalBits := ipToInt(ip)
-	bigNum.Lsh(bigNum, uint(totalBits-prefixLen))
-	ipInt.Or(ipInt, bigNum)
-	return intToIP(ipInt, totalBits)
-}
@@ -1,21 +0,0 @@
-# shell scripts should not use tabs to indent!
-*.bash    text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-*.sh      text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-
-# files for systemd (shell-similar)
-*.path    text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-*.service text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-*.timer   text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-
-# go fmt will enforce this, but in case a user has not called "go fmt" allow GIT to catch this:
-*.go      text eol=lf core.whitespace whitespace=indent-with-non-tab,trailing-space,tabwidth=4
-go.mod    text eol=lf
-go.sum    text eol=lf
-
-*.txt     text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-*.tpl     text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-*.htm     text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-*.html    text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-*.md      text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-*.yml     text eol=lf core.whitespace whitespace=tab-in-indent,trailing-space,tabwidth=2
-.git*     text eol=auto core.whitespace whitespace=trailing-space
@@ -1,22 +0,0 @@
-.DS_Store
-Thumbs.db
-_gitignore/
-Vagrantfile
-.vagrant/
-/.idea
-
-dist/builds/
-dist/release/
-
-error.log
-access.log
-
-/*.conf
-Caddyfile
-!caddyfile/
-
-og_static/
-
-.vscode/
-
-*.bat
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
@@ -1,203 +0,0 @@
-THIS IS A FORK OF CADDY v1 - EVERYTHING IS STRIPPED EXCEPT THE PIECES NEEDED IN COREDNS.
-
-Issues are not enabled in this repository. Please raise any issues in coredns/coredns.
-
---
-
-
-Caddy is a **production-ready** open-source web server that is fast, easy to use, and makes you more productive.
-
-Available for Windows, Mac, Linux, BSD, Solaris, and [Android](https://github.com/caddyserver/caddy/wiki/Running-Caddy-on-Android).
-
-<p align="center">
-	<b>Thanks to our special sponsor:</b>
-	<br><br>
-	<a href="https://relicabackup.com"><img src="https://caddyserver.com/resources/images/sponsors/relica.png" width="220" alt="Relica - Cross-platform file backup to the cloud, local disks, or other computers"></a>
-</p>
-
-## Menu
-
- [Features](#features)
- [Install](#install)
- [Quick Start](#quick-start)
- [Running in Production](#running-in-production)
- [Contributing](#contributing)
- [Donors](#donors)
- [About the Project](#about-the-project)
-
-## Features
-
- **Easy configuration** with the Caddyfile
- **Automatic HTTPS** on by default (via [Let's Encrypt](https://letsencrypt.org))
- **HTTP/2** by default
- **Virtual hosting** so multiple sites just work
- Experimental **QUIC support** for cutting-edge transmissions
- TLS session ticket **key rotation** for more secure connections
- **Extensible with plugins** because a convenient web server is a helpful one
- **Runs anywhere** with **no external dependencies** (not even libc)
-
-[See a more complete list of features built into Caddy.](https://caddyserver.com/#features) On top of all those, Caddy does even more with plugins: choose which plugins you want at [download](https://caddyserver.com/download).
-
-Altogether, Caddy can do things other web servers simply cannot do. Its features and plugins save you time and mistakes, and will cheer you up. Your Caddy instance takes care of the details for you!
-
-
-<p align="center">
-	<b>Powered by</b>
-	<br>
-	<a href="https://github.com/mholt/certmagic"><img src="https://user-images.githubusercontent.com/1128849/49704830-49d37200-fbd5-11e8-8385-767e0cd033c3.png" alt="CertMagic" width="250"></a>
-</p>
-
-
-## Install
-
-Caddy binaries have no dependencies and are available for every platform. Get Caddy any of these ways:
-
- **[Download page](https://caddyserver.com/download)** (RECOMMENDED) allows you to customize your build in the browser
- **[Latest release](https://github.com/caddyserver/caddy/releases/latest)** for pre-built, vanilla binaries
- **[AWS Marketplace](https://aws.amazon.com/marketplace/pp/B07J1WNK75?qid=1539015041932&sr=0-1&ref_=srh_res_product_title&cl_spe=C)** makes it easy to deploy directly to your cloud environment. <a href="https://aws.amazon.com/marketplace/pp/B07J1WNK75?qid=1539015041932&sr=0-1&ref_=srh_res_product_title&cl_spe=C" target="_blank">
-<img src="https://s3.amazonaws.com/cloudformation-examples/cloudformation-launch-stack.png" alt="Get Caddy on the AWS Marketplace" height="25"/></a>
-
-
-## Build
-
-To build from source you need **[Git](https://git-scm.com/downloads)** and **[Go](https://golang.org/doc/install)** (1.13 or newer).
-
-**To build Caddy without plugins:**
-
- Run `go get github.com/caddyserver/caddy/caddy`
-
-Caddy will be installed to your `$GOPATH/bin` folder.
-
-With these instructions, the binary will not have embedded version information (see [golang/go#29228](https://github.com/golang/go/issues/29228)), but it is fine for a quick start.
-
-**To build Caddy with plugins (and with version information):**
-
-There is no need to modify the Caddy code to build it with plugins. We will create a simple Go module with our own `main()` that you can use to make custom Caddy builds.
- Create a new folder anywhere and within create a Go file (with an extension of `.go`, such as `main.go`) with the contents below, adjusting to import the plugins you want to include:
-```go
-package main
-
-import (
-	"github.com/caddyserver/caddy/caddy/caddymain"
-
-	// plug in plugins here, for example:
-	// _ "import/path/here"
-)
-
-func main() {
-	// optional: disable telemetry
-	// caddymain.EnableTelemetry = false
-	caddymain.Run()
-}
-```
-3. `go mod init caddy`
-4. Run `go get github.com/caddyserver/caddy`
-5. `go install` will then create your binary at `$GOPATH/bin`, or `go build` will put it in the current directory.
-
-**To install Caddy's source code for development:**
-
- Run `git clone https://github.com/caddyserver/caddy.git` in any folder (doesn't have to be in GOPATH).
-
-You can make changes to the source code from that clone and checkout any commit or tag you wish to develop on.
-
-When building from source, telemetry is enabled by default. You can disable it by changing `caddymain.EnableTelemetry = false` in run.go, or use the `-disabled-metrics` flag at runtime to disable only certain metrics.
-
-
-## Quick Start
-
-To serve static files from the current working directory, run:
-
-```
-caddy
-```
-
-Caddy's default port is 2015, so open your browser to [http://localhost:2015](http://localhost:2015).
-
-### Go from 0 to HTTPS in 5 seconds
-
-If the `caddy` binary has permission to bind to low ports and your domain name's DNS records point to the machine you're on:
-
-```
-caddy -host example.com
-```
-
-This command serves static files from the current directory over HTTPS. Certificates are automatically obtained and renewed for you! Caddy is also automatically configuring ports 80 and 443 for you, and redirecting HTTP to HTTPS. Cool, huh?
-
-### Customizing your site
-
-To customize how your site is served, create a file named Caddyfile by your site and paste this into it:
-
-```plain
-localhost
-
-push
-browse
-websocket /echo cat
-ext    .html
-log    /var/log/access.log
-proxy  /api 127.0.0.1:7005
-header /api Access-Control-Allow-Origin *
-```
-
-When you run `caddy` in that directory, it will automatically find and use that Caddyfile.
-
-This simple file enables server push (via Link headers), allows directory browsing (for folders without an index file), hosts a WebSocket echo server at /echo, serves clean URLs, logs requests to an access log, proxies all API requests to a backend on port 7005, and adds the coveted  `Access-Control-Allow-Origin: *` header for all responses from the API.
-
-Wow! Caddy can do a lot with just a few lines.
-
-### Doing more with Caddy
-
-To host multiple sites and do more with the Caddyfile, please see the [Caddyfile tutorial](https://caddyserver.com/tutorial/caddyfile).
-
-Sites with qualifying hostnames are served over [HTTPS by default](https://caddyserver.com/docs/automatic-https).
-
-Caddy has a nice little command line interface. Run `caddy -h` to view basic help or see the [CLI documentation](https://caddyserver.com/docs/cli) for details.
-
-
-## Running in Production
-
-Caddy is production-ready if you find it to be a good fit for your site and workflow.
-
-**Running as root:** We advise against this. You can still listen on ports < 1024 on Linux using setcap like so: `sudo setcap cap_net_bind_service=+ep ./caddy`
-
-The Caddy project does not officially maintain any system-specific integrations nor suggest how to administer your own system. But your download file includes [unofficial resources](https://github.com/caddyserver/caddy/tree/master/dist/init) contributed by the community that you may find helpful for running Caddy in production.
-
-How you choose to run Caddy is up to you. Many users are satisfied with `nohup caddy &`. Others use `screen`. Users who need Caddy to come back up after reboots either do so in the script that caused the reboot, add a command to an init script, or configure a service with their OS.
-
-If you have questions or concerns about Caddy' underlying crypto implementations, consult Go's [crypto packages](https://golang.org/pkg/crypto), starting with their documentation, then issues, then the code itself; as Caddy uses mainly those libraries.
-
-
-## Contributing
-
-**[Join our forum](https://caddy.community) where you can chat with other Caddy users and developers!** To get familiar with the code base, try [Caddy code search on Sourcegraph](https://sourcegraph.com/github.com/caddyserver/caddy/)!
-
-Please see our [contributing guidelines](https://github.com/caddyserver/caddy/blob/master/.github/CONTRIBUTING.md) for instructions. If you want to write a plugin, check out the [developer wiki](https://github.com/caddyserver/caddy/wiki).
-
-We use GitHub issues and pull requests only for discussing bug reports and the development of specific changes. We welcome all other topics on the [forum](https://caddy.community)!
-
-If you want to contribute to the documentation, please [submit an issue](https://github.com/caddyserver/caddy/issues/new) describing the change that should be made.
-
-### Good First Issue
-
-If you are looking for somewhere to start and would like to help out by working on an existing issue, take a look at our [`Good First Issue`](https://github.com/caddyserver/caddy/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) tag
-
-Thanks for making Caddy -- and the Web -- better!
-
-
-## Donors
-
- [DigitalOcean](https://m.do.co/c/6d7bdafccf96) is hosting the Caddy project.
- [DNSimple](https://dnsimple.link/resolving-caddy) provides DNS services for Caddy's sites.
- [DNS Spy](https://dnsspy.io) keeps an eye on Caddy's DNS properties.
-
-We thank them for their services. **If you want to help keep Caddy free, please [become a sponsor](https://github.com/sponsors/mholt)!**
-
-
-## About the Project
-
-Caddy was born out of the need for a "batteries-included" web server that runs anywhere and doesn't have to take its configuration with it. Caddy took inspiration from [spark](https://github.com/rif/spark), [nginx](https://github.com/nginx/nginx), lighttpd,
-[Websocketd](https://github.com/joewalnes/websocketd) and [Vagrant](https://www.vagrantup.com/), which provides a pleasant mixture of features from each of them.
-
-**The name "Caddy" is trademarked:** The name of the software is "Caddy", not "Caddy Server" or "CaddyServer". Please call it "Caddy" or, if you wish to clarify, "the Caddy web server". See [brand guidelines](https://caddyserver.com/brand). Caddy is a registered trademark of Light Code Labs, LLC.
-
-*Author on Twitter: [@mholt6](https://twitter.com/mholt6)*
@@ -1,48 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddy
-
-import (
-	"os"
-	"path/filepath"
-	"runtime"
-)
-
-// AssetsPath returns the path to the folder
-// where the application may store data. If
-// CADDYPATH env variable is set, that value
-// is used. Otherwise, the path is the result
-// of evaluating "$HOME/.caddy".
-func AssetsPath() string {
-	if caddyPath := os.Getenv("CADDYPATH"); caddyPath != "" {
-		return caddyPath
-	}
-	return filepath.Join(userHomeDir(), ".caddy")
-}
-
-// userHomeDir returns the user's home directory according to
-// environment variables.
-//
-// Credit: http://stackoverflow.com/a/7922977/1048862
-func userHomeDir() string {
-	if runtime.GOOS == "windows" {
-		home := os.Getenv("HOMEDRIVE") + os.Getenv("HOMEPATH")
-		if home == "" {
-			home = os.Getenv("USERPROFILE")
-		}
-		return home
-	}
-	return os.Getenv("HOME")
-}
@@ -1,260 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddyfile
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"strings"
-)
-
-// Dispenser is a type that dispenses tokens, similarly to a lexer,
-// except that it can do so with some notion of structure and has
-// some really convenient methods.
-type Dispenser struct {
-	filename string
-	tokens   []Token
-	cursor   int
-	nesting  int
-}
-
-// NewDispenser returns a Dispenser, ready to use for parsing the given input.
-func NewDispenser(filename string, input io.Reader) Dispenser {
-	tokens, _ := allTokens(input) // ignoring error because nothing to do with it
-	return Dispenser{
-		filename: filename,
-		tokens:   tokens,
-		cursor:   -1,
-	}
-}
-
-// NewDispenserTokens returns a Dispenser filled with the given tokens.
-func NewDispenserTokens(filename string, tokens []Token) Dispenser {
-	return Dispenser{
-		filename: filename,
-		tokens:   tokens,
-		cursor:   -1,
-	}
-}
-
-// Next loads the next token. Returns true if a token
-// was loaded; false otherwise. If false, all tokens
-// have been consumed.
-func (d *Dispenser) Next() bool {
-	if d.cursor < len(d.tokens)-1 {
-		d.cursor++
-		return true
-	}
-	return false
-}
-
-// NextArg loads the next token if it is on the same
-// line. Returns true if a token was loaded; false
-// otherwise. If false, all tokens on the line have
-// been consumed. It handles imported tokens correctly.
-func (d *Dispenser) NextArg() bool {
-	if d.cursor < 0 {
-		d.cursor++
-		return true
-	}
-	if d.cursor >= len(d.tokens) {
-		return false
-	}
-	if d.cursor < len(d.tokens)-1 &&
-		d.tokens[d.cursor].File == d.tokens[d.cursor+1].File &&
-		d.tokens[d.cursor].Line+d.numLineBreaks(d.cursor) == d.tokens[d.cursor+1].Line {
-		d.cursor++
-		return true
-	}
-	return false
-}
-
-// NextLine loads the next token only if it is not on the same
-// line as the current token, and returns true if a token was
-// loaded; false otherwise. If false, there is not another token
-// or it is on the same line. It handles imported tokens correctly.
-func (d *Dispenser) NextLine() bool {
-	if d.cursor < 0 {
-		d.cursor++
-		return true
-	}
-	if d.cursor >= len(d.tokens) {
-		return false
-	}
-	if d.cursor < len(d.tokens)-1 &&
-		(d.tokens[d.cursor].File != d.tokens[d.cursor+1].File ||
-			d.tokens[d.cursor].Line+d.numLineBreaks(d.cursor) < d.tokens[d.cursor+1].Line) {
-		d.cursor++
-		return true
-	}
-	return false
-}
-
-// NextBlock can be used as the condition of a for loop
-// to load the next token as long as it opens a block or
-// is already in a block. It returns true if a token was
-// loaded, or false when the block's closing curly brace
-// was loaded and thus the block ended. Nested blocks are
-// not supported.
-func (d *Dispenser) NextBlock() bool {
-	if d.nesting > 0 {
-		d.Next()
-		if d.Val() == "}" {
-			d.nesting--
-			return false
-		}
-		return true
-	}
-	if !d.NextArg() { // block must open on same line
-		return false
-	}
-	if d.Val() != "{" {
-		d.cursor-- // roll back if not opening brace
-		return false
-	}
-	d.Next()
-	if d.Val() == "}" {
-		// Open and then closed right away
-		return false
-	}
-	d.nesting++
-	return true
-}
-
-// Val gets the text of the current token. If there is no token
-// loaded, it returns empty string.
-func (d *Dispenser) Val() string {
-	if d.cursor < 0 || d.cursor >= len(d.tokens) {
-		return ""
-	}
-	return d.tokens[d.cursor].Text
-}
-
-// Line gets the line number of the current token. If there is no token
-// loaded, it returns 0.
-func (d *Dispenser) Line() int {
-	if d.cursor < 0 || d.cursor >= len(d.tokens) {
-		return 0
-	}
-	return d.tokens[d.cursor].Line
-}
-
-// File gets the filename of the current token. If there is no token loaded,
-// it returns the filename originally given when parsing started.
-func (d *Dispenser) File() string {
-	if d.cursor < 0 || d.cursor >= len(d.tokens) {
-		return d.filename
-	}
-	if tokenFilename := d.tokens[d.cursor].File; tokenFilename != "" {
-		return tokenFilename
-	}
-	return d.filename
-}
-
-// Args is a convenience function that loads the next arguments
-// (tokens on the same line) into an arbitrary number of strings
-// pointed to in targets. If there are fewer tokens available
-// than string pointers, the remaining strings will not be changed
-// and false will be returned. If there were enough tokens available
-// to fill the arguments, then true will be returned.
-func (d *Dispenser) Args(targets ...*string) bool {
-	enough := true
-	for i := 0; i < len(targets); i++ {
-		if !d.NextArg() {
-			enough = false
-			break
-		}
-		*targets[i] = d.Val()
-	}
-	return enough
-}
-
-// RemainingArgs loads any more arguments (tokens on the same line)
-// into a slice and returns them. Open curly brace tokens also indicate
-// the end of arguments, and the curly brace is not included in
-// the return value nor is it loaded.
-func (d *Dispenser) RemainingArgs() []string {
-	var args []string
-
-	for d.NextArg() {
-		if d.Val() == "{" {
-			d.cursor--
-			break
-		}
-		args = append(args, d.Val())
-	}
-
-	return args
-}
-
-// ArgErr returns an argument error, meaning that another
-// argument was expected but not found. In other words,
-// a line break or open curly brace was encountered instead of
-// an argument.
-func (d *Dispenser) ArgErr() error {
-	if d.Val() == "{" {
-		return d.Err("Unexpected token '{', expecting argument")
-	}
-	return d.Errf("Wrong argument count or unexpected line ending after '%s'", d.Val())
-}
-
-// SyntaxErr creates a generic syntax error which explains what was
-// found and what was expected.
-func (d *Dispenser) SyntaxErr(expected string) error {
-	msg := fmt.Sprintf("%s:%d - Syntax error: Unexpected token '%s', expecting '%s'", d.File(), d.Line(), d.Val(), expected)
-	return errors.New(msg)
-}
-
-// EOFErr returns an error indicating that the dispenser reached
-// the end of the input when searching for the next token.
-func (d *Dispenser) EOFErr() error {
-	return d.Errf("Unexpected EOF")
-}
-
-// Err generates a custom parse-time error with a message of msg.
-func (d *Dispenser) Err(msg string) error {
-	msg = fmt.Sprintf("%s:%d - Error during parsing: %s", d.File(), d.Line(), msg)
-	return errors.New(msg)
-}
-
-// Errf is like Err, but for formatted error messages
-func (d *Dispenser) Errf(format string, args ...interface{}) error {
-	return d.Err(fmt.Sprintf(format, args...))
-}
-
-// numLineBreaks counts how many line breaks are in the token
-// value given by the token index tknIdx. It returns 0 if the
-// token does not exist or there are no line breaks.
-func (d *Dispenser) numLineBreaks(tknIdx int) int {
-	if tknIdx < 0 || tknIdx >= len(d.tokens) {
-		return 0
-	}
-	return strings.Count(d.tokens[tknIdx].Text, "\n")
-}
-
-// isNewLine determines whether the current token is on a different
-// line (higher line number) than the previous token. It handles imported
-// tokens correctly. If there isn't a previous token, it returns true.
-func (d *Dispenser) isNewLine() bool {
-	if d.cursor < 1 {
-		return true
-	}
-	if d.cursor > len(d.tokens)-1 {
-		return false
-	}
-	return d.tokens[d.cursor-1].File != d.tokens[d.cursor].File ||
-		d.tokens[d.cursor-1].Line+d.numLineBreaks(d.cursor-1) < d.tokens[d.cursor].Line
-}
@@ -1,198 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddyfile
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"sort"
-	"strconv"
-	"strings"
-)
-
-const filename = "Caddyfile"
-
-// ToJSON converts caddyfile to its JSON representation.
-func ToJSON(caddyfile []byte) ([]byte, error) {
-	var j EncodedCaddyfile
-
-	serverBlocks, err := Parse(filename, bytes.NewReader(caddyfile), nil)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, sb := range serverBlocks {
-		block := EncodedServerBlock{
-			Keys: sb.Keys,
-			Body: [][]interface{}{},
-		}
-
-		// Extract directives deterministically by sorting them
-		var directives = make([]string, len(sb.Tokens))
-		for dir := range sb.Tokens {
-			directives = append(directives, dir)
-		}
-		sort.Strings(directives)
-
-		// Convert each directive's tokens into our JSON structure
-		for _, dir := range directives {
-			disp := NewDispenserTokens(filename, sb.Tokens[dir])
-			for disp.Next() {
-				block.Body = append(block.Body, constructLine(&disp))
-			}
-		}
-
-		// tack this block onto the end of the list
-		j = append(j, block)
-	}
-
-	result, err := json.Marshal(j)
-	if err != nil {
-		return nil, err
-	}
-
-	return result, nil
-}
-
-// constructLine transforms tokens into a JSON-encodable structure;
-// but only one line at a time, to be used at the top-level of
-// a server block only (where the first token on each line is a
-// directive) - not to be used at any other nesting level.
-func constructLine(d *Dispenser) []interface{} {
-	var args []interface{}
-
-	args = append(args, d.Val())
-
-	for d.NextArg() {
-		if d.Val() == "{" {
-			args = append(args, constructBlock(d))
-			continue
-		}
-		args = append(args, d.Val())
-	}
-
-	return args
-}
-
-// constructBlock recursively processes tokens into a
-// JSON-encodable structure. To be used in a directive's
-// block. Goes to end of block.
-func constructBlock(d *Dispenser) [][]interface{} {
-	block := [][]interface{}{}
-
-	for d.Next() {
-		if d.Val() == "}" {
-			break
-		}
-		block = append(block, constructLine(d))
-	}
-
-	return block
-}
-
-// FromJSON converts JSON-encoded jsonBytes to Caddyfile text
-func FromJSON(jsonBytes []byte) ([]byte, error) {
-	var j EncodedCaddyfile
-	var result string
-
-	err := json.Unmarshal(jsonBytes, &j)
-	if err != nil {
-		return nil, err
-	}
-
-	for sbPos, sb := range j {
-		if sbPos > 0 {
-			result += "\n\n"
-		}
-		for i, key := range sb.Keys {
-			if i > 0 {
-				result += ", "
-			}
-			//result += standardizeScheme(key)
-			result += key
-		}
-		result += jsonToText(sb.Body, 1)
-	}
-
-	return []byte(result), nil
-}
-
-// jsonToText recursively transforms a scope of JSON into plain
-// Caddyfile text.
-func jsonToText(scope interface{}, depth int) string {
-	var result string
-
-	switch val := scope.(type) {
-	case string:
-		if strings.ContainsAny(val, "\" \n\t\r") {
-			result += `"` + strings.Replace(val, "\"", "\\\"", -1) + `"`
-		} else {
-			result += val
-		}
-	case int:
-		result += strconv.Itoa(val)
-	case float64:
-		result += fmt.Sprintf("%v", val)
-	case bool:
-		result += fmt.Sprintf("%t", val)
-	case [][]interface{}:
-		result += " {\n"
-		for _, arg := range val {
-			result += strings.Repeat("\t", depth) + jsonToText(arg, depth+1) + "\n"
-		}
-		result += strings.Repeat("\t", depth-1) + "}"
-	case []interface{}:
-		for i, v := range val {
-			if block, ok := v.([]interface{}); ok {
-				result += "{\n"
-				for _, arg := range block {
-					result += strings.Repeat("\t", depth) + jsonToText(arg, depth+1) + "\n"
-				}
-				result += strings.Repeat("\t", depth-1) + "}"
-				continue
-			}
-			result += jsonToText(v, depth)
-			if i < len(val)-1 {
-				result += " "
-			}
-		}
-	}
-
-	return result
-}
-
-// TODO: Will this function come in handy somewhere else?
-/*
-// standardizeScheme turns an address like host:https into https://host,
-// or "host:" into "host".
-func standardizeScheme(addr string) string {
-	if hostname, port, err := net.SplitHostPort(addr); err == nil {
-		if port == "http" || port == "https" {
-			addr = port + "://" + hostname
-		}
-	}
-	return strings.TrimSuffix(addr, ":")
-}
-*/
-
-// EncodedCaddyfile encapsulates a slice of EncodedServerBlocks.
-type EncodedCaddyfile []EncodedServerBlock
-
-// EncodedServerBlock represents a server block ripe for encoding.
-type EncodedServerBlock struct {
-	Keys []string        `json:"keys"`
-	Body [][]interface{} `json:"body"`
-}
@@ -1,153 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddyfile
-
-import (
-	"bufio"
-	"io"
-	"unicode"
-)
-
-type (
-	// lexer is a utility which can get values, token by
-	// token, from a Reader. A token is a word, and tokens
-	// are separated by whitespace. A word can be enclosed
-	// in quotes if it contains whitespace.
-	lexer struct {
-		reader *bufio.Reader
-		token  Token
-		line   int
-	}
-
-	// Token represents a single parsable unit.
-	Token struct {
-		File string
-		Line int
-		Text string
-	}
-)
-
-// load prepares the lexer to scan an input for tokens.
-// It discards any leading byte order mark.
-func (l *lexer) load(input io.Reader) error {
-	l.reader = bufio.NewReader(input)
-	l.line = 1
-
-	// discard byte order mark, if present
-	firstCh, _, err := l.reader.ReadRune()
-	if err != nil {
-		if err == io.EOF {
-			return nil
-		}
-		return err
-	}
-	if firstCh != 0xFEFF {
-		err := l.reader.UnreadRune()
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// next loads the next token into the lexer.
-// A token is delimited by whitespace, unless
-// the token starts with a quotes character (")
-// in which case the token goes until the closing
-// quotes (the enclosing quotes are not included).
-// Inside quoted strings, quotes may be escaped
-// with a preceding \ character. No other chars
-// may be escaped. The rest of the line is skipped
-// if a "#" character is read in. Returns true if
-// a token was loaded; false otherwise.
-func (l *lexer) next() bool {
-	var val []rune
-	var comment, quoted, escaped bool
-
-	makeToken := func() bool {
-		l.token.Text = string(val)
-		return true
-	}
-
-	for {
-		ch, _, err := l.reader.ReadRune()
-		if err != nil {
-			if len(val) > 0 {
-				return makeToken()
-			}
-			if err == io.EOF {
-				return false
-			}
-			panic(err)
-		}
-
-		if quoted {
-			if !escaped {
-				if ch == '\\' {
-					escaped = true
-					continue
-				} else if ch == '"' {
-					quoted = false
-					return makeToken()
-				}
-			}
-			if ch == '\n' {
-				l.line++
-			}
-			if escaped {
-				// only escape quotes
-				if ch != '"' {
-					val = append(val, '\\')
-				}
-			}
-			val = append(val, ch)
-			escaped = false
-			continue
-		}
-
-		if unicode.IsSpace(ch) {
-			if ch == '\r' {
-				continue
-			}
-			if ch == '\n' {
-				l.line++
-				comment = false
-			}
-			if len(val) > 0 {
-				return makeToken()
-			}
-			continue
-		}
-
-		if ch == '#' {
-			comment = true
-		}
-
-		if comment {
-			continue
-		}
-
-		if len(val) == 0 {
-			l.token = Token{Line: l.line}
-			if ch == '"' {
-				quoted = true
-				continue
-			}
-		}
-
-		val = append(val, ch)
-	}
-}
@@ -1,490 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddyfile
-
-import (
-	"io"
-	"log"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-// Parse parses the input just enough to group tokens, in
-// order, by server block. No further parsing is performed.
-// Server blocks are returned in the order in which they appear.
-// Directives that do not appear in validDirectives will cause
-// an error. If you do not want to check for valid directives,
-// pass in nil instead.
-func Parse(filename string, input io.Reader, validDirectives []string) ([]ServerBlock, error) {
-	p := parser{Dispenser: NewDispenser(filename, input), validDirectives: validDirectives}
-	return p.parseAll()
-}
-
-// allTokens lexes the entire input, but does not parse it.
-// It returns all the tokens from the input, unstructured
-// and in order.
-func allTokens(input io.Reader) ([]Token, error) {
-	l := new(lexer)
-	err := l.load(input)
-	if err != nil {
-		return nil, err
-	}
-	var tokens []Token
-	for l.next() {
-		tokens = append(tokens, l.token)
-	}
-	return tokens, nil
-}
-
-type parser struct {
-	Dispenser
-	block           ServerBlock // current server block being parsed
-	validDirectives []string    // a directive must be valid or it's an error
-	eof             bool        // if we encounter a valid EOF in a hard place
-	definedSnippets map[string][]Token
-}
-
-func (p *parser) parseAll() ([]ServerBlock, error) {
-	var blocks []ServerBlock
-
-	for p.Next() {
-		err := p.parseOne()
-		if err != nil {
-			return blocks, err
-		}
-		if len(p.block.Keys) > 0 {
-			blocks = append(blocks, p.block)
-		}
-	}
-
-	return blocks, nil
-}
-
-func (p *parser) parseOne() error {
-	p.block = ServerBlock{Tokens: make(map[string][]Token)}
-
-	return p.begin()
-}
-
-func (p *parser) begin() error {
-	if len(p.tokens) == 0 {
-		return nil
-	}
-
-	err := p.addresses()
-
-	if err != nil {
-		return err
-	}
-
-	if p.eof {
-		// this happens if the Caddyfile consists of only
-		// a line of addresses and nothing else
-		return nil
-	}
-
-	if ok, name := p.isSnippet(); ok {
-		if p.definedSnippets == nil {
-			p.definedSnippets = map[string][]Token{}
-		}
-		if _, found := p.definedSnippets[name]; found {
-			return p.Errf("redeclaration of previously declared snippet %s", name)
-		}
-		// consume all tokens til matched close brace
-		tokens, err := p.snippetTokens()
-		if err != nil {
-			return err
-		}
-		p.definedSnippets[name] = tokens
-		// empty block keys so we don't save this block as a real server.
-		p.block.Keys = nil
-		return nil
-	}
-
-	return p.blockContents()
-}
-
-func (p *parser) addresses() error {
-	var expectingAnother bool
-
-	for {
-		tkn := replaceEnvVars(p.Val())
-
-		// special case: import directive replaces tokens during parse-time
-		if tkn == "import" && p.isNewLine() {
-			err := p.doImport()
-			if err != nil {
-				return err
-			}
-			continue
-		}
-
-		// Open brace definitely indicates end of addresses
-		if tkn == "{" {
-			if expectingAnother {
-				return p.Errf("Expected another address but had '%s' - check for extra comma", tkn)
-			}
-			break
-		}
-
-		if tkn != "" { // empty token possible if user typed ""
-			// Trailing comma indicates another address will follow, which
-			// may possibly be on the next line
-			if tkn[len(tkn)-1] == ',' {
-				tkn = tkn[:len(tkn)-1]
-				expectingAnother = true
-			} else {
-				expectingAnother = false // but we may still see another one on this line
-			}
-
-			p.block.Keys = append(p.block.Keys, tkn)
-		}
-
-		// Advance token and possibly break out of loop or return error
-		hasNext := p.Next()
-		if expectingAnother && !hasNext {
-			return p.EOFErr()
-		}
-		if !hasNext {
-			p.eof = true
-			break // EOF
-		}
-		if !expectingAnother && p.isNewLine() {
-			break
-		}
-	}
-
-	return nil
-}
-
-func (p *parser) blockContents() error {
-	errOpenCurlyBrace := p.openCurlyBrace()
-	if errOpenCurlyBrace != nil {
-		// single-server configs don't need curly braces
-		p.cursor--
-	}
-
-	err := p.directives()
-	if err != nil {
-		return err
-	}
-
-	// Only look for close curly brace if there was an opening
-	if errOpenCurlyBrace == nil {
-		err = p.closeCurlyBrace()
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-// directives parses through all the lines for directives
-// and it expects the next token to be the first
-// directive. It goes until EOF or closing curly brace
-// which ends the server block.
-func (p *parser) directives() error {
-	for p.Next() {
-		// end of server block
-		if p.Val() == "}" {
-			break
-		}
-
-		// special case: import directive replaces tokens during parse-time
-		if p.Val() == "import" {
-			err := p.doImport()
-			if err != nil {
-				return err
-			}
-			p.cursor-- // cursor is advanced when we continue, so roll back one more
-			continue
-		}
-
-		// normal case: parse a directive on this line
-		if err := p.directive(); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// doImport swaps out the import directive and its argument
-// (a total of 2 tokens) with the tokens in the specified file
-// or globbing pattern. When the function returns, the cursor
-// is on the token before where the import directive was. In
-// other words, call Next() to access the first token that was
-// imported.
-func (p *parser) doImport() error {
-	// syntax checks
-	if !p.NextArg() {
-		return p.ArgErr()
-	}
-	importPattern := replaceEnvVars(p.Val())
-	if importPattern == "" {
-		return p.Err("Import requires a non-empty filepath")
-	}
-	if p.NextArg() {
-		return p.Err("Import takes only one argument (glob pattern or file)")
-	}
-	// splice out the import directive and its argument (2 tokens total)
-	tokensBefore := p.tokens[:p.cursor-1]
-	tokensAfter := p.tokens[p.cursor+1:]
-	var importedTokens []Token
-
-	// first check snippets. That is a simple, non-recursive replacement
-	if p.definedSnippets != nil && p.definedSnippets[importPattern] != nil {
-		importedTokens = p.definedSnippets[importPattern]
-	} else {
-		// make path relative to the file of the _token_ being processed rather
-		// than current working directory (issue #867) and then use glob to get
-		// list of matching filenames
-		absFile, err := filepath.Abs(p.Dispenser.File())
-		if err != nil {
-			return p.Errf("Failed to get absolute path of file: %s: %v", p.Dispenser.filename, err)
-		}
-
-		var matches []string
-		var globPattern string
-		if !filepath.IsAbs(importPattern) {
-			globPattern = filepath.Join(filepath.Dir(absFile), importPattern)
-		} else {
-			globPattern = importPattern
-		}
-		if strings.Count(globPattern, "*") > 1 || strings.Count(globPattern, "?") > 1 ||
-			(strings.Contains(globPattern, "[") && strings.Contains(globPattern, "]")) {
-			// See issue #2096 - a pattern with many glob expansions can hang for too long
-			return p.Errf("Glob pattern may only contain one wildcard (*), but has others: %s", globPattern)
-		}
-		matches, err = filepath.Glob(globPattern)
-
-		if err != nil {
-			return p.Errf("Failed to use import pattern %s: %v", importPattern, err)
-		}
-		if len(matches) == 0 {
-			if strings.ContainsAny(globPattern, "*?[]") {
-				log.Printf("[WARNING] No files matching import glob pattern: %s", importPattern)
-			} else {
-				return p.Errf("File to import not found: %s", importPattern)
-			}
-		}
-
-		// collect all the imported tokens
-
-		for _, importFile := range matches {
-			newTokens, err := p.doSingleImport(importFile)
-			if err != nil {
-				return err
-			}
-			importedTokens = append(importedTokens, newTokens...)
-		}
-	}
-
-	// splice the imported tokens in the place of the import statement
-	// and rewind cursor so Next() will land on first imported token
-	p.tokens = append(tokensBefore, append(importedTokens, tokensAfter...)...)
-	p.cursor--
-
-	return nil
-}
-
-// doSingleImport lexes the individual file at importFile and returns
-// its tokens or an error, if any.
-func (p *parser) doSingleImport(importFile string) ([]Token, error) {
-	file, err := os.Open(importFile)
-	if err != nil {
-		return nil, p.Errf("Could not import %s: %v", importFile, err)
-	}
-	defer file.Close()
-
-	if info, err := file.Stat(); err != nil {
-		return nil, p.Errf("Could not import %s: %v", importFile, err)
-	} else if info.IsDir() {
-		return nil, p.Errf("Could not import %s: is a directory", importFile)
-	}
-
-	importedTokens, err := allTokens(file)
-	if err != nil {
-		return nil, p.Errf("Could not read tokens while importing %s: %v", importFile, err)
-	}
-
-	// Tack the file path onto these tokens so errors show the imported file's name
-	// (we use full, absolute path to avoid bugs: issue #1892)
-	filename, err := filepath.Abs(importFile)
-	if err != nil {
-		return nil, p.Errf("Failed to get absolute path of file: %s: %v", p.Dispenser.filename, err)
-	}
-	for i := 0; i < len(importedTokens); i++ {
-		importedTokens[i].File = filename
-	}
-
-	return importedTokens, nil
-}
-
-// directive collects tokens until the directive's scope
-// closes (either end of line or end of curly brace block).
-// It expects the currently-loaded token to be a directive
-// (or } that ends a server block). The collected tokens
-// are loaded into the current server block for later use
-// by directive setup functions.
-func (p *parser) directive() error {
-	dir := replaceEnvVars(p.Val())
-	nesting := 0
-
-	// TODO: More helpful error message ("did you mean..." or "maybe you need to install its server type")
-	if !p.validDirective(dir) {
-		return p.Errf("Unknown directive '%s'", dir)
-	}
-
-	// The directive itself is appended as a relevant token
-	p.block.Tokens[dir] = append(p.block.Tokens[dir], p.tokens[p.cursor])
-
-	for p.Next() {
-		if p.Val() == "{" {
-			nesting++
-		} else if p.isNewLine() && nesting == 0 {
-			p.cursor-- // read too far
-			break
-		} else if p.Val() == "}" && nesting > 0 {
-			nesting--
-		} else if p.Val() == "}" && nesting == 0 {
-			return p.Err("Unexpected '}' because no matching opening brace")
-		} else if p.Val() == "import" && p.isNewLine() {
-			if err := p.doImport(); err != nil {
-				return err
-			}
-			p.cursor-- // cursor is advanced when we continue, so roll back one more
-			continue
-		}
-		p.tokens[p.cursor].Text = replaceEnvVars(p.tokens[p.cursor].Text)
-		p.block.Tokens[dir] = append(p.block.Tokens[dir], p.tokens[p.cursor])
-	}
-
-	if nesting > 0 {
-		return p.EOFErr()
-	}
-	return nil
-}
-
-// openCurlyBrace expects the current token to be an
-// opening curly brace. This acts like an assertion
-// because it returns an error if the token is not
-// a opening curly brace. It does NOT advance the token.
-func (p *parser) openCurlyBrace() error {
-	if p.Val() != "{" {
-		return p.SyntaxErr("{")
-	}
-	return nil
-}
-
-// closeCurlyBrace expects the current token to be
-// a closing curly brace. This acts like an assertion
-// because it returns an error if the token is not
-// a closing curly brace. It does NOT advance the token.
-func (p *parser) closeCurlyBrace() error {
-	if p.Val() != "}" {
-		return p.SyntaxErr("}")
-	}
-	return nil
-}
-
-// validDirective returns true if dir is in p.validDirectives.
-func (p *parser) validDirective(dir string) bool {
-	if p.validDirectives == nil {
-		return true
-	}
-	for _, d := range p.validDirectives {
-		if d == dir {
-			return true
-		}
-	}
-	return false
-}
-
-// replaceEnvVars replaces environment variables that appear in the token
-// and understands both the $UNIX and %WINDOWS% syntaxes.
-func replaceEnvVars(s string) string {
-	s = replaceEnvReferences(s, "{%", "%}")
-	s = replaceEnvReferences(s, "{$", "}")
-	return s
-}
-
-// replaceEnvReferences performs the actual replacement of env variables
-// in s, given the placeholder start and placeholder end strings.
-func replaceEnvReferences(s, refStart, refEnd string) string {
-	index := strings.Index(s, refStart)
-	for index != -1 {
-		endIndex := strings.Index(s[index:], refEnd)
-		if endIndex == -1 {
-			break
-		}
-
-		endIndex += index
-		if endIndex > index+len(refStart) {
-			ref := s[index : endIndex+len(refEnd)]
-			s = strings.Replace(s, ref, os.Getenv(ref[len(refStart):len(ref)-len(refEnd)]), -1)
-		} else {
-			return s
-		}
-		index = strings.Index(s, refStart)
-	}
-	return s
-}
-
-// ServerBlock associates any number of keys (usually addresses
-// of some sort) with tokens (grouped by directive name).
-type ServerBlock struct {
-	Keys   []string
-	Tokens map[string][]Token
-}
-
-func (p *parser) isSnippet() (bool, string) {
-	keys := p.block.Keys
-	// A snippet block is a single key with parens. Nothing else qualifies.
-	if len(keys) == 1 && strings.HasPrefix(keys[0], "(") && strings.HasSuffix(keys[0], ")") {
-		return true, strings.TrimSuffix(keys[0][1:], ")")
-	}
-	return false, ""
-}
-
-// read and store everything in a block for later replay.
-func (p *parser) snippetTokens() ([]Token, error) {
-	// TODO: disallow imports in snippets for simplicity at import time
-	// snippet must have curlies.
-	err := p.openCurlyBrace()
-	if err != nil {
-		return nil, err
-	}
-	count := 1
-	tokens := []Token{}
-	for p.Next() {
-		if p.Val() == "}" {
-			count--
-			if count == 0 {
-				break
-			}
-		}
-		if p.Val() == "{" {
-			count++
-		}
-		tokens = append(tokens, p.tokens[p.cursor])
-	}
-	// make sure we're matched up
-	if count != 0 {
-		return nil, p.SyntaxErr("}")
-	}
-	return tokens, nil
-}
@@ -1,133 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddy
-
-import (
-	"errors"
-	"runtime"
-	"unicode"
-
-	"github.com/flynn/go-shlex"
-)
-
-var runtimeGoos = runtime.GOOS
-
-// SplitCommandAndArgs takes a command string and parses it shell-style into the
-// command and its separate arguments.
-func SplitCommandAndArgs(command string) (cmd string, args []string, err error) {
-	var parts []string
-
-	if runtimeGoos == "windows" {
-		parts = parseWindowsCommand(command) // parse it Windows-style
-	} else {
-		parts, err = parseUnixCommand(command) // parse it Unix-style
-		if err != nil {
-			err = errors.New("error parsing command: " + err.Error())
-			return
-		}
-	}
-
-	if len(parts) == 0 {
-		err = errors.New("no command contained in '" + command + "'")
-		return
-	}
-
-	cmd = parts[0]
-	if len(parts) > 1 {
-		args = parts[1:]
-	}
-
-	return
-}
-
-// parseUnixCommand parses a unix style command line and returns the
-// command and its arguments or an error
-func parseUnixCommand(cmd string) ([]string, error) {
-	return shlex.Split(cmd)
-}
-
-// parseWindowsCommand parses windows command lines and
-// returns the command and the arguments as an array. It
-// should be able to parse commonly used command lines.
-// Only basic syntax is supported:
-//  - spaces in double quotes are not token delimiters
-//  - double quotes are escaped by either backspace or another double quote
-//  - except for the above case backspaces are path separators (not special)
-//
-// Many sources point out that escaping quotes using backslash can be unsafe.
-// Use two double quotes when possible. (Source: http://stackoverflow.com/a/31413730/2616179 )
-//
-// This function has to be used on Windows instead
-// of the shlex package because this function treats backslash
-// characters properly.
-func parseWindowsCommand(cmd string) []string {
-	const backslash = '\\'
-	const quote = '"'
-
-	var parts []string
-	var part string
-	var inQuotes bool
-	var lastRune rune
-
-	for i, ch := range cmd {
-
-		if i != 0 {
-			lastRune = rune(cmd[i-1])
-		}
-
-		if ch == backslash {
-			// put it in the part - for now we don't know if it's an
-			// escaping char or path separator
-			part += string(ch)
-			continue
-		}
-
-		if ch == quote {
-			if lastRune == backslash {
-				// remove the backslash from the part and add the escaped quote instead
-				part = part[:len(part)-1]
-				part += string(ch)
-				continue
-			}
-
-			if lastRune == quote {
-				// revert the last change of the inQuotes state
-				// it was an escaping quote
-				inQuotes = !inQuotes
-				part += string(ch)
-				continue
-			}
-
-			// normal escaping quotes
-			inQuotes = !inQuotes
-			continue
-
-		}
-
-		if unicode.IsSpace(ch) && !inQuotes && len(part) > 0 {
-			parts = append(parts, part)
-			part = ""
-			continue
-		}
-
-		part += string(ch)
-	}
-
-	if len(part) > 0 {
-		parts = append(parts, part)
-	}
-
-	return parts
-}
@@ -1,145 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddy
-
-import (
-	"strings"
-
-	"github.com/coredns/caddy/caddyfile"
-)
-
-// Controller is given to the setup function of directives which
-// gives them access to be able to read tokens with which to
-// configure themselves. It also stores state for the setup
-// functions, can get the current context, and can be used to
-// identify a particular server block using the Key field.
-type Controller struct {
-	caddyfile.Dispenser
-
-	// The instance in which the setup is occurring
-	instance *Instance
-
-	// Key is the key from the top of the server block, usually
-	// an address, hostname, or identifier of some sort.
-	Key string
-
-	// OncePerServerBlock is a function that executes f
-	// exactly once per server block, no matter how many
-	// hosts are associated with it. If it is the first
-	// time, the function f is executed immediately
-	// (not deferred) and may return an error which is
-	// returned by OncePerServerBlock.
-	OncePerServerBlock func(f func() error) error
-
-	// ServerBlockIndex is the 0-based index of the
-	// server block as it appeared in the input.
-	ServerBlockIndex int
-
-	// ServerBlockKeyIndex is the 0-based index of this
-	// key as it appeared in the input at the head of the
-	// server block.
-	ServerBlockKeyIndex int
-
-	// ServerBlockKeys is a list of keys that are
-	// associated with this server block. All these
-	// keys, consequently, share the same tokens.
-	ServerBlockKeys []string
-
-	// ServerBlockStorage is used by a directive's
-	// setup function to persist state between all
-	// the keys on a server block.
-	ServerBlockStorage interface{}
-}
-
-// ServerType gets the name of the server type that is being set up.
-func (c *Controller) ServerType() string {
-	return c.instance.serverType
-}
-
-// OnFirstStartup adds fn to the list of callback functions to execute
-// when the server is about to be started NOT as part of a restart.
-func (c *Controller) OnFirstStartup(fn func() error) {
-	c.instance.OnFirstStartup = append(c.instance.OnFirstStartup, fn)
-}
-
-// OnStartup adds fn to the list of callback functions to execute
-// when the server is about to be started (including restarts).
-func (c *Controller) OnStartup(fn func() error) {
-	c.instance.OnStartup = append(c.instance.OnStartup, fn)
-}
-
-// OnRestart adds fn to the list of callback functions to execute
-// when the server is about to be restarted.
-func (c *Controller) OnRestart(fn func() error) {
-	c.instance.OnRestart = append(c.instance.OnRestart, fn)
-}
-
-// OnRestartFailed adds fn to the list of callback functions to execute
-// if the server failed to restart.
-func (c *Controller) OnRestartFailed(fn func() error) {
-	c.instance.OnRestartFailed = append(c.instance.OnRestartFailed, fn)
-}
-
-// OnShutdown adds fn to the list of callback functions to execute
-// when the server is about to be shut down (including restarts).
-func (c *Controller) OnShutdown(fn func() error) {
-	c.instance.OnShutdown = append(c.instance.OnShutdown, fn)
-}
-
-// OnFinalShutdown adds fn to the list of callback functions to execute
-// when the server is about to be shut down NOT as part of a restart.
-func (c *Controller) OnFinalShutdown(fn func() error) {
-	c.instance.OnFinalShutdown = append(c.instance.OnFinalShutdown, fn)
-}
-
-// Context gets the context associated with the instance associated with c.
-func (c *Controller) Context() Context {
-	return c.instance.context
-}
-
-// Get safely gets a value from the Instance's storage.
-func (c *Controller) Get(key interface{}) interface{} {
-	c.instance.StorageMu.RLock()
-	defer c.instance.StorageMu.RUnlock()
-	return c.instance.Storage[key]
-}
-
-// Set safely sets a value on the Instance's storage.
-func (c *Controller) Set(key, val interface{}) {
-	c.instance.StorageMu.Lock()
-	c.instance.Storage[key] = val
-	c.instance.StorageMu.Unlock()
-}
-
-// NewTestController creates a new Controller for
-// the server type and input specified. The filename
-// is "Testfile". If the server type is not empty and
-// is plugged in, a context will be created so that
-// the results of setup functions can be checked for
-// correctness.
-//
-// Used only for testing, but exported so plugins can
-// use this for convenience.
-func NewTestController(serverType, input string) *Controller {
-	testInst := &Instance{serverType: serverType, Storage: make(map[interface{}]interface{})}
-	if stype, err := getServerType(serverType); err == nil {
-		testInst.context = stype.NewContext(testInst)
-	}
-	return &Controller{
-		instance:           testInst,
-		Dispenser:          caddyfile.NewDispenser("Testfile", strings.NewReader(input)),
-		OncePerServerBlock: func(f func() error) error { return f() },
-	}
-}
@@ -1,450 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddy
-
-import (
-	"fmt"
-	"log"
-	"net"
-	"sort"
-	"sync"
-
-	"github.com/coredns/caddy/caddyfile"
-)
-
-// These are all the registered plugins.
-var (
-	// serverTypes is a map of registered server types.
-	serverTypes = make(map[string]ServerType)
-
-	// plugins is a map of server type to map of plugin name to
-	// Plugin. These are the "general" plugins that may or may
-	// not be associated with a specific server type. If it's
-	// applicable to multiple server types or the server type is
-	// irrelevant, the key is empty string (""). But all plugins
-	// must have a name.
-	plugins = make(map[string]map[string]Plugin)
-
-	// eventHooks is a map of hook name to Hook. All hooks plugins
-	// must have a name.
-	eventHooks = &sync.Map{}
-
-	// parsingCallbacks maps server type to map of directive
-	// to list of callback functions. These aren't really
-	// plugins on their own, but are often registered from
-	// plugins.
-	parsingCallbacks = make(map[string]map[string][]ParsingCallback)
-
-	// caddyfileLoaders is the list of all Caddyfile loaders
-	// in registration order.
-	caddyfileLoaders []caddyfileLoader
-)
-
-// DescribePlugins returns a string describing the registered plugins.
-func DescribePlugins() string {
-	pl := ListPlugins()
-
-	str := ""
-	for _, name := range pl["others"] {
-		if len(name) > 3 {
-			str += name[4:] + "\n" // drop dns. prefix caddy adds
-		} else {
-			str += name + "\n"
-		}
-	}
-
-	return str
-}
-
-// ListPlugins makes a list of the registered plugins,
-// keyed by plugin type.
-func ListPlugins() map[string][]string {
-	p := make(map[string][]string)
-
-	// server type plugins
-	for name := range serverTypes {
-		p["server_types"] = append(p["server_types"], name)
-	}
-
-	// caddyfile loaders in registration order
-	for _, loader := range caddyfileLoaders {
-		p["caddyfile_loaders"] = append(p["caddyfile_loaders"], loader.name)
-	}
-	if defaultCaddyfileLoader.name != "" {
-		p["caddyfile_loaders"] = append(p["caddyfile_loaders"], defaultCaddyfileLoader.name)
-	}
-
-	// List the event hook plugins
-	eventHooks.Range(func(k, _ interface{}) bool {
-		p["event_hooks"] = append(p["event_hooks"], k.(string))
-		return true
-	})
-
-	// alphabetize the rest of the plugins
-	var others []string
-	for stype, stypePlugins := range plugins {
-		for name := range stypePlugins {
-			var s string
-			if stype != "" {
-				s = stype + "."
-			}
-			s += name
-			others = append(others, s)
-		}
-	}
-
-	sort.Strings(others)
-	for _, name := range others {
-		p["others"] = append(p["others"], name)
-	}
-
-	return p
-}
-
-// ValidDirectives returns the list of all directives that are
-// recognized for the server type serverType. However, not all
-// directives may be installed. This makes it possible to give
-// more helpful error messages, like "did you mean ..." or
-// "maybe you need to plug in ...".
-func ValidDirectives(serverType string) []string {
-	stype, err := getServerType(serverType)
-	if err != nil {
-		return nil
-	}
-	return stype.Directives()
-}
-
-// ServerListener pairs a server to its listener and/or packetconn.
-type ServerListener struct {
-	server   Server
-	listener net.Listener
-	packet   net.PacketConn
-}
-
-// LocalAddr returns the local network address of the packetconn. It returns
-// nil when it is not set.
-func (s ServerListener) LocalAddr() net.Addr {
-	if s.packet == nil {
-		return nil
-	}
-	return s.packet.LocalAddr()
-}
-
-// Addr returns the listener's network address. It returns nil when it is
-// not set.
-func (s ServerListener) Addr() net.Addr {
-	if s.listener == nil {
-		return nil
-	}
-	return s.listener.Addr()
-}
-
-// Context is a type which carries a server type through
-// the load and setup phase; it maintains the state
-// between loading the Caddyfile, then executing its
-// directives, then making the servers for Caddy to
-// manage. Typically, such state involves configuration
-// structs, etc.
-type Context interface {
-	// Called after the Caddyfile is parsed into server
-	// blocks but before the directives are executed,
-	// this method gives you an opportunity to inspect
-	// the server blocks and prepare for the execution
-	// of directives. Return the server blocks (which
-	// you may modify, if desired) and an error, if any.
-	// The first argument is the name or path to the
-	// configuration file (Caddyfile).
-	//
-	// This function can be a no-op and simply return its
-	// input if there is nothing to do here.
-	InspectServerBlocks(string, []caddyfile.ServerBlock) ([]caddyfile.ServerBlock, error)
-
-	// This is what Caddy calls to make server instances.
-	// By this time, all directives have been executed and,
-	// presumably, the context has enough state to produce
-	// server instances for Caddy to start.
-	MakeServers() ([]Server, error)
-}
-
-// RegisterServerType registers a server type srv by its
-// name, typeName.
-func RegisterServerType(typeName string, srv ServerType) {
-	if _, ok := serverTypes[typeName]; ok {
-		panic("server type already registered")
-	}
-	serverTypes[typeName] = srv
-}
-
-// ServerType contains information about a server type.
-type ServerType struct {
-	// Function that returns the list of directives, in
-	// execution order, that are valid for this server
-	// type. Directives should be one word if possible
-	// and lower-cased.
-	Directives func() []string
-
-	// DefaultInput returns a default config input if none
-	// is otherwise loaded. This is optional, but highly
-	// recommended, otherwise a blank Caddyfile will be
-	// used.
-	DefaultInput func() Input
-
-	// The function that produces a new server type context.
-	// This will be called when a new Caddyfile is being
-	// loaded, parsed, and executed independently of any
-	// startup phases before this one. It's a way to keep
-	// each set of server instances separate and to reduce
-	// the amount of global state you need.
-	NewContext func(inst *Instance) Context
-}
-
-// Plugin is a type which holds information about a plugin.
-type Plugin struct {
-	// ServerType is the type of server this plugin is for.
-	// Can be empty if not applicable, or if the plugin
-	// can associate with any server type.
-	ServerType string
-
-	// Action is the plugin's setup function, if associated
-	// with a directive in the Caddyfile.
-	Action SetupFunc
-}
-
-// RegisterPlugin plugs in plugin. All plugins should register
-// themselves, even if they do not perform an action associated
-// with a directive. It is important for the process to know
-// which plugins are available.
-//
-// The plugin MUST have a name: lower case and one word.
-// If this plugin has an action, it must be the name of
-// the directive that invokes it. A name is always required
-// and must be unique for the server type.
-func RegisterPlugin(name string, plugin Plugin) {
-	if name == "" {
-		panic("plugin must have a name")
-	}
-	if _, ok := plugins[plugin.ServerType]; !ok {
-		plugins[plugin.ServerType] = make(map[string]Plugin)
-	}
-	if _, dup := plugins[plugin.ServerType][name]; dup {
-		panic("plugin named " + name + " already registered for server type " + plugin.ServerType)
-	}
-	plugins[plugin.ServerType][name] = plugin
-}
-
-// EventName represents the name of an event used with event hooks.
-type EventName string
-
-// Define names for the various events
-const (
-	StartupEvent         EventName = "startup"
-	ShutdownEvent                  = "shutdown"
-	CertRenewEvent                 = "certrenew"
-	InstanceStartupEvent           = "instancestartup"
-	InstanceRestartEvent           = "instancerestart"
-)
-
-// EventHook is a type which holds information about a startup hook plugin.
-type EventHook func(eventType EventName, eventInfo interface{}) error
-
-// RegisterEventHook plugs in hook. All the hooks should register themselves
-// and they must have a name.
-func RegisterEventHook(name string, hook EventHook) {
-	if name == "" {
-		panic("event hook must have a name")
-	}
-	_, dup := eventHooks.LoadOrStore(name, hook)
-	if dup {
-		panic("hook named " + name + " already registered")
-	}
-}
-
-// EmitEvent executes the different hooks passing the EventType as an
-// argument. This is a blocking function. Hook developers should
-// use 'go' keyword if they don't want to block Caddy.
-func EmitEvent(event EventName, info interface{}) {
-	eventHooks.Range(func(k, v interface{}) bool {
-		err := v.(EventHook)(event, info)
-		if err != nil {
-			log.Printf("error on '%s' hook: %v", k.(string), err)
-		}
-		return true
-	})
-}
-
-// cloneEventHooks return a clone of the event hooks *sync.Map
-func cloneEventHooks() *sync.Map {
-	c := &sync.Map{}
-	eventHooks.Range(func(k, v interface{}) bool {
-		c.Store(k, v)
-		return true
-	})
-	return c
-}
-
-// purgeEventHooks purges all event hooks from the map
-func purgeEventHooks() {
-	eventHooks.Range(func(k, _ interface{}) bool {
-		eventHooks.Delete(k)
-		return true
-	})
-}
-
-// restoreEventHooks restores eventHooks with a provided *sync.Map
-func restoreEventHooks(m *sync.Map) {
-	// Purge old event hooks
-	purgeEventHooks()
-
-	// Restore event hooks
-	m.Range(func(k, v interface{}) bool {
-		eventHooks.Store(k, v)
-		return true
-	})
-}
-
-// ParsingCallback is a function that is called after
-// a directive's setup functions have been executed
-// for all the server blocks.
-type ParsingCallback func(Context) error
-
-// RegisterParsingCallback registers callback to be called after
-// executing the directive afterDir for server type serverType.
-func RegisterParsingCallback(serverType, afterDir string, callback ParsingCallback) {
-	if _, ok := parsingCallbacks[serverType]; !ok {
-		parsingCallbacks[serverType] = make(map[string][]ParsingCallback)
-	}
-	parsingCallbacks[serverType][afterDir] = append(parsingCallbacks[serverType][afterDir], callback)
-}
-
-// SetupFunc is used to set up a plugin, or in other words,
-// execute a directive. It will be called once per key for
-// each server block it appears in.
-type SetupFunc func(c *Controller) error
-
-// DirectiveAction gets the action for directive dir of
-// server type serverType.
-func DirectiveAction(serverType, dir string) (SetupFunc, error) {
-	if stypePlugins, ok := plugins[serverType]; ok {
-		if plugin, ok := stypePlugins[dir]; ok {
-			return plugin.Action, nil
-		}
-	}
-	if genericPlugins, ok := plugins[""]; ok {
-		if plugin, ok := genericPlugins[dir]; ok {
-			return plugin.Action, nil
-		}
-	}
-	return nil, fmt.Errorf("no action found for directive '%s' with server type '%s' (missing a plugin?)",
-		dir, serverType)
-}
-
-// Loader is a type that can load a Caddyfile.
-// It is passed the name of the server type.
-// It returns an error only if something went
-// wrong, not simply if there is no Caddyfile
-// for this loader to load.
-//
-// A Loader should only load the Caddyfile if
-// a certain condition or requirement is met,
-// as returning a non-nil Input value along with
-// another Loader will result in an error.
-// In other words, loading the Caddyfile must
-// be deliberate & deterministic, not haphazard.
-//
-// The exception is the default Caddyfile loader,
-// which will be called only if no other Caddyfile
-// loaders return a non-nil Input. The default
-// loader may always return an Input value.
-type Loader interface {
-	Load(serverType string) (Input, error)
-}
-
-// LoaderFunc is a convenience type similar to http.HandlerFunc
-// that allows you to use a plain function as a Load() method.
-type LoaderFunc func(serverType string) (Input, error)
-
-// Load loads a Caddyfile.
-func (lf LoaderFunc) Load(serverType string) (Input, error) {
-	return lf(serverType)
-}
-
-// RegisterCaddyfileLoader registers loader named name.
-func RegisterCaddyfileLoader(name string, loader Loader) {
-	caddyfileLoaders = append(caddyfileLoaders, caddyfileLoader{name: name, loader: loader})
-}
-
-// SetDefaultCaddyfileLoader registers loader by name
-// as the default Caddyfile loader if no others produce
-// a Caddyfile. If another Caddyfile loader has already
-// been set as the default, this replaces it.
-//
-// Do not call RegisterCaddyfileLoader on the same
-// loader; that would be redundant.
-func SetDefaultCaddyfileLoader(name string, loader Loader) {
-	defaultCaddyfileLoader = caddyfileLoader{name: name, loader: loader}
-}
-
-// loadCaddyfileInput iterates the registered Caddyfile loaders
-// and, if needed, calls the default loader, to load a Caddyfile.
-// It is an error if any of the loaders return an error or if
-// more than one loader returns a Caddyfile.
-func loadCaddyfileInput(serverType string) (Input, error) {
-	var loadedBy string
-	var caddyfileToUse Input
-	for _, l := range caddyfileLoaders {
-		cdyfile, err := l.loader.Load(serverType)
-		if err != nil {
-			return nil, fmt.Errorf("loading Caddyfile via %s: %v", l.name, err)
-		}
-		if cdyfile != nil {
-			if caddyfileToUse != nil {
-				return nil, fmt.Errorf("Caddyfile loaded multiple times; first by %s, then by %s", loadedBy, l.name)
-			}
-			loaderUsed = l
-			caddyfileToUse = cdyfile
-			loadedBy = l.name
-		}
-	}
-	if caddyfileToUse == nil && defaultCaddyfileLoader.loader != nil {
-		cdyfile, err := defaultCaddyfileLoader.loader.Load(serverType)
-		if err != nil {
-			return nil, err
-		}
-		if cdyfile != nil {
-			loaderUsed = defaultCaddyfileLoader
-			caddyfileToUse = cdyfile
-		}
-	}
-	return caddyfileToUse, nil
-}
-
-// OnProcessExit is a list of functions to run when the process
-// exits -- they are ONLY for cleanup and should not block,
-// return errors, or do anything fancy. They will be run with
-// every signal, even if "shutdown callbacks" are not executed.
-// This variable must only be modified in the main goroutine
-// from init() functions.
-var OnProcessExit []func()
-
-// caddyfileLoader pairs the name of a loader to the loader.
-type caddyfileLoader struct {
-	name   string
-	loader Loader
-}
-
-var (
-	defaultCaddyfileLoader caddyfileLoader // the default loader if all else fail
-	loaderUsed             caddyfileLoader // the loader that was used (relevant for reloads)
-)
@@ -1,22 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// +build windows plan9 nacl js
-
-package caddy
-
-// checkFdlimit issues a warning if the OS limit for
-// max file descriptors is below a recommended minimum.
-func checkFdlimit() {
-}
@@ -1,37 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// +build !windows,!plan9,!nacl,!js
-
-package caddy
-
-import (
-	"fmt"
-	"syscall"
-)
-
-// checkFdlimit issues a warning if the OS limit for
-// max file descriptors is below a recommended minimum.
-func checkFdlimit() {
-	const min = 8192
-
-	// Warn if ulimit is too low for production sites
-	rlimit := &syscall.Rlimit{}
-	err := syscall.Getrlimit(syscall.RLIMIT_NOFILE, rlimit)
-	if err == nil && rlimit.Cur < min {
-		fmt.Printf("WARNING: File descriptor limit %d is too low for production servers. "+
-			"At least %d is recommended. Fix with `ulimit -n %d`.\n", rlimit.Cur, min, min)
-	}
-
-}
@@ -1,103 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddy
-
-import (
-	"log"
-	"os"
-	"os/signal"
-	"sync"
-)
-
-// TrapSignals create signal handlers for all applicable signals for this
-// system. If your Go program uses signals, this is a rather invasive
-// function; best to implement them yourself in that case. Signals are not
-// required for the caddy package to function properly, but this is a
-// convenient way to allow the user to control this part of your program.
-func TrapSignals() {
-	trapSignalsCrossPlatform()
-	trapSignalsPosix()
-}
-
-// trapSignalsCrossPlatform captures SIGINT, which triggers forceful
-// shutdown that executes shutdown callbacks first. A second interrupt
-// signal will exit the process immediately.
-func trapSignalsCrossPlatform() {
-	go func() {
-		shutdown := make(chan os.Signal, 1)
-		signal.Notify(shutdown, os.Interrupt)
-
-		for i := 0; true; i++ {
-			<-shutdown
-
-			if i > 0 {
-				log.Println("[INFO] SIGINT: Force quit")
-				for _, f := range OnProcessExit {
-					f() // important cleanup actions only
-				}
-				os.Exit(2)
-			}
-
-			log.Println("[INFO] SIGINT: Shutting down")
-
-			// important cleanup actions before shutdown callbacks
-			for _, f := range OnProcessExit {
-				f()
-			}
-
-			go func() {
-				os.Exit(executeShutdownCallbacks("SIGINT"))
-			}()
-		}
-	}()
-}
-
-// executeShutdownCallbacks executes the shutdown callbacks as initiated
-// by signame. It logs any errors and returns the recommended exit status.
-// This function is idempotent; subsequent invocations always return 0.
-func executeShutdownCallbacks(signame string) (exitCode int) {
-	shutdownCallbacksOnce.Do(func() {
-		// execute third-party shutdown hooks
-		EmitEvent(ShutdownEvent, signame)
-
-		errs := allShutdownCallbacks()
-		if len(errs) > 0 {
-			for _, err := range errs {
-				log.Printf("[ERROR] %s shutdown: %v", signame, err)
-			}
-			exitCode = 4
-		}
-	})
-	return
-}
-
-// allShutdownCallbacks executes all the shutdown callbacks
-// for all the instances, and returns all the errors generated
-// during their execution. An error executing one shutdown
-// callback does not stop execution of others. Only one shutdown
-// callback is executed at a time.
-func allShutdownCallbacks() []error {
-	var errs []error
-	instancesMu.Lock()
-	for _, inst := range instances {
-		errs = append(errs, inst.ShutdownCallbacks()...)
-	}
-	instancesMu.Unlock()
-	return errs
-}
-
-// shutdownCallbacksOnce ensures that shutdown callbacks
-// for all instances are only executed once.
-var shutdownCallbacksOnce sync.Once
@@ -1,19 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// +build windows plan9 nacl js
-
-package caddy
-
-func trapSignalsPosix() {}
@@ -1,106 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// +build !windows,!plan9,!nacl,!js
-
-package caddy
-
-import (
-	"log"
-	"os"
-	"os/signal"
-	"syscall"
-)
-
-// trapSignalsPosix captures POSIX-only signals.
-func trapSignalsPosix() {
-	go func() {
-		sigchan := make(chan os.Signal, 1)
-		signal.Notify(sigchan, syscall.SIGTERM, syscall.SIGHUP, syscall.SIGQUIT, syscall.SIGUSR1, syscall.SIGUSR2)
-
-		for sig := range sigchan {
-			switch sig {
-			case syscall.SIGQUIT:
-				log.Println("[INFO] SIGQUIT: Quitting process immediately")
-				for _, f := range OnProcessExit {
-					f() // only perform important cleanup actions
-				}
-				os.Exit(0)
-
-			case syscall.SIGTERM:
-				log.Println("[INFO] SIGTERM: Shutting down servers then terminating")
-				exitCode := executeShutdownCallbacks("SIGTERM")
-				for _, f := range OnProcessExit {
-					f() // only perform important cleanup actions
-				}
-				err := Stop()
-				if err != nil {
-					log.Printf("[ERROR] SIGTERM stop: %v", err)
-					exitCode = 3
-				}
-
-				os.Exit(exitCode)
-
-			case syscall.SIGUSR1:
-				log.Println("[INFO] SIGUSR1: Reloading")
-
-				// Start with the existing Caddyfile
-				caddyfileToUse, inst, err := getCurrentCaddyfile()
-				if err != nil {
-					log.Printf("[ERROR] SIGUSR1: %v", err)
-					continue
-				}
-				if loaderUsed.loader == nil {
-					// This also should never happen
-					log.Println("[ERROR] SIGUSR1: no Caddyfile loader with which to reload Caddyfile")
-					continue
-				}
-
-				// Load the updated Caddyfile
-				newCaddyfile, err := loaderUsed.loader.Load(inst.serverType)
-				if err != nil {
-					log.Printf("[ERROR] SIGUSR1: loading updated Caddyfile: %v", err)
-					continue
-				}
-				if newCaddyfile != nil {
-					caddyfileToUse = newCaddyfile
-				}
-
-				// Backup old event hooks
-				oldEventHooks := cloneEventHooks()
-
-				// Purge the old event hooks
-				purgeEventHooks()
-
-				// Kick off the restart; our work is done
-				EmitEvent(InstanceRestartEvent, nil)
-				_, err = inst.Restart(caddyfileToUse)
-				if err != nil {
-					restoreEventHooks(oldEventHooks)
-
-					log.Printf("[ERROR] SIGUSR1: %v", err)
-				}
-
-			case syscall.SIGUSR2:
-				log.Println("[INFO] SIGUSR2: Upgrading")
-				if err := Upgrade(); err != nil {
-					log.Printf("[ERROR] SIGUSR2: upgrading: %v", err)
-				}
-
-			case syscall.SIGHUP:
-				// ignore; this signal is sometimes sent outside of the user's control
-			}
-		}
-	}()
-}
@@ -1,232 +0,0 @@
-// Copyright 2015 Light Code Labs, LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package caddy
-
-import (
-	"encoding/gob"
-	"fmt"
-	"io/ioutil"
-	"log"
-	"os"
-	"os/exec"
-	"sync"
-)
-
-func init() {
-	// register CaddyfileInput with gob so it knows into
-	// which concrete type to decode an Input interface
-	gob.Register(CaddyfileInput{})
-}
-
-// IsUpgrade returns true if this process is part of an upgrade
-// where a parent caddy process spawned this one to upgrade
-// the binary.
-func IsUpgrade() bool {
-	mu.Lock()
-	defer mu.Unlock()
-	return isUpgrade
-}
-
-// Upgrade re-launches the process, preserving the listeners
-// for a graceful upgrade. It does NOT load new configuration;
-// it only starts the process anew with the current config.
-// This makes it possible to perform zero-downtime binary upgrades.
-//
-// TODO: For more information when debugging, see:
-// https://forum.golangbridge.org/t/bind-address-already-in-use-even-after-listener-closed/1510?u=matt
-// https://github.com/mholt/shared-conn
-func Upgrade() error {
-	log.Println("[INFO] Upgrading")
-
-	// use existing Caddyfile; do not change configuration during upgrade
-	currentCaddyfile, _, err := getCurrentCaddyfile()
-	if err != nil {
-		return err
-	}
-
-	if len(os.Args) == 0 { // this should never happen, but...
-		os.Args = []string{""}
-	}
-
-	// tell the child that it's a restart
-	env := os.Environ()
-	if !IsUpgrade() {
-		env = append(env, "CADDY__UPGRADE=1")
-	}
-
-	// prepare our payload to the child process
-	cdyfileGob := transferGob{
-		ListenerFds: make(map[string]uintptr),
-		Caddyfile:   currentCaddyfile,
-	}
-
-	// prepare a pipe to the fork's stdin so it can get the Caddyfile
-	rpipe, wpipe, err := os.Pipe()
-	if err != nil {
-		return err
-	}
-
-	// prepare a pipe that the child process will use to communicate
-	// its success with us by sending > 0 bytes
-	sigrpipe, sigwpipe, err := os.Pipe()
-	if err != nil {
-		return err
-	}
-
-	// pass along relevant file descriptors to child process; ordering
-	// is very important since we rely on these being in certain positions.
-	extraFiles := []*os.File{sigwpipe} // fd 3
-
-	// add file descriptors of all the sockets
-	for i, j := 0, 0; ; i++ {
-		instancesMu.Lock()
-		if i >= len(instances) {
-			instancesMu.Unlock()
-			break
-		}
-		inst := instances[i]
-		instancesMu.Unlock()
-
-		for _, s := range inst.servers {
-			gs, gracefulOk := s.server.(GracefulServer)
-			ln, lnOk := s.listener.(Listener)
-			pc, pcOk := s.packet.(PacketConn)
-			if gracefulOk {
-				if lnOk {
-					lnFile, _ := ln.File()
-					extraFiles = append(extraFiles, lnFile)
-					cdyfileGob.ListenerFds["tcp"+gs.Address()] = uintptr(4 + j) // 4 fds come before any of the listeners
-					j++
-				}
-				if pcOk {
-					pcFile, _ := pc.File()
-					extraFiles = append(extraFiles, pcFile)
-					cdyfileGob.ListenerFds["udp"+gs.Address()] = uintptr(4 + j) // 4 fds come before any of the listeners
-					j++
-				}
-			}
-		}
-	}
-
-	// set up the command
-	cmd := exec.Command(os.Args[0], os.Args[1:]...)
-	cmd.Stdin = rpipe      // fd 0
-	cmd.Stdout = os.Stdout // fd 1
-	cmd.Stderr = os.Stderr // fd 2
-	cmd.ExtraFiles = extraFiles
-	cmd.Env = env
-
-	// spawn the child process
-	err = cmd.Start()
-	if err != nil {
-		return err
-	}
-
-	// immediately close our dup'ed fds and the write end of our signal pipe
-	for _, f := range extraFiles {
-		err = f.Close()
-		if err != nil {
-			return err
-		}
-	}
-
-	// feed Caddyfile to the child
-	err = gob.NewEncoder(wpipe).Encode(cdyfileGob)
-	if err != nil {
-		return err
-	}
-	err = wpipe.Close()
-	if err != nil {
-		return err
-	}
-
-	// determine whether child startup succeeded
-	answer, readErr := ioutil.ReadAll(sigrpipe)
-	if len(answer) == 0 {
-		cmdErr := cmd.Wait() // get exit status
-		errStr := fmt.Sprintf("child failed to initialize: %v", cmdErr)
-		if readErr != nil {
-			errStr += fmt.Sprintf(" - additionally, error communicating with child process: %v", readErr)
-		}
-		return fmt.Errorf(errStr)
-	}
-
-	// looks like child is successful; we can exit gracefully.
-	log.Println("[INFO] Upgrade finished")
-	return Stop()
-}
-
-// getCurrentCaddyfile gets the Caddyfile used by the
-// current (first) Instance and returns both of them.
-func getCurrentCaddyfile() (Input, *Instance, error) {
-	instancesMu.Lock()
-	if len(instances) == 0 {
-		instancesMu.Unlock()
-		return nil, nil, fmt.Errorf("no server instances are fully running")
-	}
-	inst := instances[0]
-	instancesMu.Unlock()
-
-	currentCaddyfile := inst.caddyfileInput
-	if currentCaddyfile == nil {
-		// hmm, did spawning process forget to close stdin? Anyhow, this is unusual.
-		return nil, inst, fmt.Errorf("no Caddyfile to reload (was stdin left open?)")
-	}
-	return currentCaddyfile, inst, nil
-}
-
-// signalSuccessToParent tells the parent our status using pipe at index 3.
-// If this process is not a restart, this function does nothing.
-// Calling this function once this process has successfully initialized
-// is vital so that the parent process can unblock and kill itself.
-// This function is idempotent; it executes at most once per process.
-func signalSuccessToParent() {
-	signalParentOnce.Do(func() {
-		if IsUpgrade() {
-			ppipe := os.NewFile(3, "")               // parent is reading from pipe at index 3
-			_, err := ppipe.Write([]byte("success")) // we must send some bytes to the parent
-			if err != nil {
-				log.Printf("[ERROR] Communicating successful init to parent: %v", err)
-			}
-			ppipe.Close()
-		}
-	})
-}
-
-// signalParentOnce is used to make sure that the parent is only
-// signaled once; doing so more than once breaks whatever socket is
-// at fd 4 (TODO: the reason for this is still unclear - to reproduce,
-// call Stop() and Start() in succession at least once after a
-// restart, then try loading first host of Caddyfile in the browser
-// - this was pre-v0.9; this code and godoc is borrowed from the
-// implementation then, but I'm not sure if it's been fixed yet, as
-// of v0.10.7). Do not use this directly; call signalSuccessToParent
-// instead.
-var signalParentOnce sync.Once
-
-// transferGob is used if this is a child process as part of
-// a graceful upgrade; it is used to map listeners to their
-// index in the list of inherited file descriptors. This
-// variable is not safe for concurrent access.
-var loadedGob transferGob
-
-// transferGob maps bind address to index of the file descriptor
-// in the Files array passed to the child process. It also contains
-// the Caddyfile contents and any other state needed by the new process.
-// Used only during graceful upgrades.
-type transferGob struct {
-	ListenerFds map[string]uintptr
-	Caddyfile   Input
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
João "Pisco" Fernandes	66587173e2	Release 2026.2.0	2026-02-06 14:21:32 +00:00
João "Pisco" Fernandes	9388e7f48c	TUN-9858: Remove proxy-dns feature from cloudflared Remove the DNS over HTTPS (DoH) proxy feature built on CoreDNS due to security vulnerabilities (GO-2025-3942, GO-2026-4289). This removes: - Standalone proxy-dns command (cloudflared proxy-dns) - Tunnel subcommand (cloudflared tunnel proxy-dns) - Proxy-dns flags for tunnel run (--proxy-dns, --proxy-dns-port, etc.) - Config file resolver section support - tunneldns/ package (CoreDNS-based implementation) - Related component tests BREAKING CHANGE: The proxy-dns feature is no longer available. Users should migrate to alternative DNS over HTTPS solutions.	2026-02-06 12:43:53 +00:00
Luis Neto	d6cb78aeb4	TUN-10216: TUN fix cloudflare vulnerabilities GO-2026-4340 and GO-2026-4341 * TUN-10216: TUN fix cloudflare vulnerabilities GO-2026-4340 and GO-2026-4341 Closes TUN-10216	2026-02-06 10:01:07 +00:00
João "Pisco" Fernandes	d7c62aed71	Release 2026.1.2	2026-01-23 12:45:53 +00:00
João "Pisco" Fernandes	2b95c61044	Revert "TUN-9863: Update pipelines to use cloudflared EV Certificate" This reverts commit `789a9b110d`.	2026-01-23 12:45:36 +00:00
João "Pisco" Fernandes	efd0189121	Revert "TUN-9886 notarize cloudflared" This reverts commit `9abcfece66`.	2026-01-21 13:33:53 +00:00
Andi Anderson	9abcfece66	TUN-9886 notarize cloudflared	2026-01-21 12:14:06 +00:00
João "Pisco" Fernandes	8aebc38b2f	Release 2026.1.1	2026-01-19 18:11:47 +00:00
João "Pisco" Fernandes	b4f675c082	fix: rpm bundling and rpm key import	2026-01-19 18:10:47 +00:00
João "Pisco" Fernandes	a29afd842e	fix: Fix wixl bundling tool for windows msi packages	2026-01-19 12:48:30 +00:00
João "Pisco" Fernandes	d9cdd49eec	fix: Update boto3 to run on trixie	2026-01-19 12:47:30 +00:00
João "Pisco" Fernandes	8af01d583c	Release 2026.1.0	2026-01-16 17:48:15 +00:00
chungthuang	3e6d8ed216	TUN-9998: Don't need to read origin cert to determine if the endpoint is fedramp	2026-01-14 15:07:51 +00:00
chungthuang	1e907e99b5	TUN-9910: Make the metadata key to carry HTTP status over QUIC transport a constant	2026-01-14 14:28:08 +00:00
João "Pisco" Fernandes	18eab5879f	TUN-10162: Update go to 1.24.11 and Debian distroless to debian13	2026-01-13 13:08:16 +00:00
GitLab Maintenance Bot	0d2a7a0385	Replace jira.cfops.it with jira.cfdata.org in connection/http2_test.go	2025-11-21 05:33:09 +00:00
João "Pisco" Fernandes	789a9b110d	TUN-9863: Update pipelines to use cloudflared EV Certificate	2025-11-19 18:05:33 +00:00
João "Pisco" Fernandes	31f45fb505	TUN-9800: Migrate apt internal builds to Gitlab	2025-11-10 14:43:10 +00:00
João "Pisco" Fernandes	17533b124c	Release 2025.11.1	2025-11-07 16:30:58 +00:00
João "Pisco" Fernandes	9ce16c5aac	TUN-9800: Fix docker hub push step	2025-11-07 15:26:22 +00:00
GoncaloGarcia	29e8d936f2	Release 2025.11.0	2025-11-07 08:15:20 +00:00
João "Pisco" Fernandes	4cfebb8319	TUN-9800: Prefix gitlab steps with operating system	2025-11-06 16:00:05 +00:00
Gonçalo Garcia	eedbcf46d4	TUN-9863: Introduce Code Signing for Windows Builds * TUN-9863: Introduce Code Signing for Windows Builds This commit adds a signing step to the build script for windows binaries. Since we package the MSI on Linux, this commit adds another CI step that depends on package-windows and signs all of the windows packages. To do so, we use azuresigntool which relies on a certificate stored in Azure Vault. Closes TUN-9863	2025-11-06 11:41:21 +00:00
João "Pisco" Fernandes	a8fdbb83d0	TUN-9800: Add pipelines for linux packaging	2025-11-05 10:45:04 +00:00
Gonçalo Garcia	70658b863b	chore: Update cloudflared signing key name in index.html * chore: Update cloudflared signing key name in index.html We want to preserve the old key name so that we don't have to update the dev docs. We will have the same key under this name and the v2 name to account for everyone who has already updated.	2025-11-04 16:59:30 +00:00
Chung-Ting	334300bae7	Chore: Update documentation links in README	2025-10-31 19:45:17 +00:00
Luis Neto	e9f0628555	chore: add claude review * chore: add claude review	2025-10-31 14:03:45 +00:00
João "Pisco" Fernandes	0caf31c543	Release 2025.10.1	2025-10-30 16:38:01 +00:00
GoncaloGarcia	4faa03dfed	TUN-9961: Add pkg.cloudflared.com index.html to git repo This makes it easier to track changes and allows us to update it in a gitlab pipeline if we choose to in the future	2025-10-30 16:37:33 +00:00
João "Pisco" Fernandes	58519d1268	chore: Update ci image to use goboring 1.24.9	2025-10-30 16:37:04 +00:00
chungthuang	1367b967b3	TUN-9849: Add cf-proxy-* to control response headers These headers will not be returned to the eyeball	2025-10-28 09:17:05 -05:00
Christopher Meng	114683f49e	Fix systemd service installation hanging * Fix systemd service installation hanging --- This kills the hanging when there is a network issue (port blocking or no Internet) and the installation cannot be completed with no error sent to the output. Before (killed manually since it hangs forever): ![499987567-de9003f9-4aaa-4667-9495-1d4b01069bed](/uploads/01063e6c2cf81fdd91ac8fbcd7f04a1b/499987567-de9003f9-4aaa-4667-9495-1d4b01069bed.png){width=817 height=69} After: ![499986549-f031035f-1633-46c0-a896-d9fd37054e83](/uploads/00c273f37d415617104b44736921b3d7/499986549-f031035f-1633-46c0-a896-d9fd37054e83.png){width=825 height=78} ---	2025-10-23 14:38:09 +00:00
João "Pisco" Fernandes	2b456b9a79	TUN-9954: Update from go1.24.6 to go1.24.9	2025-10-23 10:54:18 +01:00
Gonçalo Garcia	3a71c1bcd8	TUN-9941: Lookup correct key for RPM signature * TUN-9941: Lookup correct key for RPM signature Closes TUN-9941	2025-10-21 15:51:57 +00:00
Gonçalo Garcia	95642486c6	TUN-9941: Fix typo causing r2-release-next deployment to fail * TUN-9941: Fix typo causing r2-release-next deployment to fail Closes TUN-9941	2025-10-21 13:11:33 +00:00
Gonçalo Garcia	691550a6f2	TUN-9941: Use new GPG key for RPM builds * TUN-9941: Use new GPG key for RPM builds Closes TUN-9941	2025-10-21 09:57:22 +00:00
chungthuang	12c2a8e144	TUN-9916: Fix the cloudflared binary path used in the component test	2025-10-15 14:34:54 +00:00
Gonçalo Garcia	d943602d21	TUN-9919: Make RPM postinstall scriplet idempotent * TUN-9919: Make RPM postinstall scriplet idempotent Before this commit the postinstall scriptlet isn't idempotent, meaning the users see this error in their upgrade logs: `ln: failed to create symbolic link '/usr/local/bin/cloudflared': File exists warning: %post(cloudflared-2025.10.0-1.x86_64) scriptlet failed, exit status 1` This doesn't break the upgrade (which is why we haven't touched this in 5 years), but adding the -f (force) flag to the symlink command prevents this issue from happening Closes TUN-9919	2025-10-15 14:33:43 +00:00
Devin Carr	e10e072599	Release 2025.10.0	2025-10-14 09:16:36 -07:00
Gonçalo Garcia	686347cf91	chore: Fix upload of RPM repo file during double signing * chore: Fix upload of RPM repo file during double signing This commit fixes a variable that was supposed to hold the path of the repo file, but instead was being overwritten with the repo file handle	2025-10-14 09:12:54 +00:00
Devin Carr	f45b3a1baf	TUN-9882: Bump datagram v3 write channel capacity Bumping from 16 to 512 gives each flow a bit more buffer if the local OS is having trouble writing to the origin. Closes TUN-9882	2025-10-13 17:18:22 -07:00
Devin Carr	1ac6c45dad	TUN-9883: Add new datagram v3 feature flag After the previous rollout was reverted, the original `support_datagram_v3_1` is deprecated and replaced with `support_datagram_v3_2`. Closes TUN-9883	2025-10-10 13:55:31 -07:00
Gonçalo Garcia	d78e64c8cc	chore: Fix parameter order when uploading RPM .repo file to R2 * chore: Fix parameter order when uploading RPM .repo file to R2	2025-10-10 15:44:28 +00:00
Gonçalo Garcia	7987d01a6e	chore: Fix import of GPG keys when two keys are provided * chore: Fix import of GPG keys when two keys are provided We were only retrieving the first output of gpg.list keys because previously we were only running import_gpg_keys once. Now that we run it twice we need to ensure that the key we select from the list matches the one we've imported.	2025-10-10 07:58:55 +00:00
Gonçalo Garcia	e1dacbcea8	chore: Force usage of go-boring 1.24 * chore: Force usage of go-boring 1.24	2025-10-09 13:18:29 +00:00
Devin Carr	1cc15c6ffa	TUN-9882: Improve metrics for datagram v3 Adds new metrics for: - Dropped UDP datagrams for reads and write paths - Dropped ICMP packets for write paths - Failures that preemptively close UDP flows Closes TUN-9882	2025-10-08 12:17:23 -07:00
Devin Carr	51c5ef726c	TUN-9882: Add write deadline for UDP origin writes Add a deadline for origin writes as a preventative measure in the case that the kernel blocks any writes for too long. In the case that the socket exceeds the write deadline, the datagram will be dropped. Closes TUN-9882	2025-10-07 19:54:42 -07:00
Devin Carr	1fb466941a	TUN-9882: Add buffers for UDP and ICMP datagrams in datagram v3 Instead of creating a go routine to process each incoming datagram from the tunnel, a single consumer (the demuxer) will process each of the datagrams in serial. Registration datagrams will still be spun out into separate go routines since they are responsible for managing the lifetime of the session once started via the `Serve` method. UDP payload datagrams will be handled in separate channels to allow for parallel writing inside of the scope of a session via a new write loop. This channel will have a small buffer to help unblock the demuxer from dequeueing other datagrams. ICMP datagrams will be funneled into a single channel across all possible origins with a single consumer to write to their respective destinations. Each of these changes is to prevent datagram reordering from occurring when dequeuing from the tunnel connection. By establishing a single demuxer that serializes the writes per session, each session will be able to write sequentially, but in parallel to their respective origins. Closes TUN-9882	2025-10-07 16:14:01 -07:00
João Oliveirinha	fff1fc7390	GRC-16749: Add fedramp tags to catalog * GRC-16749: Add fedramp tags to catalog	2025-10-07 11:27:41 +00:00
Gonçalo Garcia	9551f2a381	TUN-9776: Support signing Debian packages with two keys for rollover * TUN-9776: Support signing Debian packages with two keys for rollover Debian Trixie doesn't support the SHA-1 algo for GPG keys. This commit leverages the ability of providing two keys in the reprepro configuration in order to have two signatures in InRelease and Release.gpg files. This allows users that have the old key to continue fetching the binaries with the old key while allowing us to provide a new key that can be used in Trixie. Unfortunately current versions of RPM (since 2002) don't support double signing, so we can't apply the same logic for RPM Closes TUN-9776	2025-09-29 14:48:12 +00:00
João "Pisco" Fernandes	71448c1f7f	TUN-9800: Add pipeline to sync between gitlab and github repos	2025-09-22 16:34:33 +01:00
João "Pisco" Fernandes	80b1634515	Release 2025.9.1	2025-09-22 13:02:11 +01:00
João "Pisco" Fernandes	4ac0c1f2d7	TUN-9852: Remove fmt.Println from cloudflared access command	2025-09-22 12:01:48 +01:00
João "Pisco" Fernandes	4dafc15f22	TUN-9855: Create script to ignore vulnerabilities from govuln check	2025-09-22 12:01:38 +01:00