fix(self-host): resolve caddy-l4 "unrecognized global option: layer4" error (#10106)

The self-hosted Caddy image relied on the abandoned
RussellLuo/caddy-ext/layer4 shim to provide the `layer4` Caddyfile
global option, alongside an old (May 2024) pin of mholt/caddy-l4 that
predated native Caddyfile support. This combination is fragile:

- If the image is ever built without the RussellLuo shim, the `layer4`
  global option disappears and Caddy fails with
  "unrecognized global option: layer4" — the reported bug.
- Bumping mholt/caddy-l4 to any version with native Caddyfile support
  makes both modules register `layer4`, panicking at startup with
  "global option 'layer4' already registered".

mholt/caddy-l4 now natively registers the `layer4` global option, so
drop the RussellLuo dependency entirely and switch the Caddyfile to the
native `route { proxy { upstream ... } }` syntax. The adapted layer4
JSON is byte-identical to the previous output, so runtime behavior is
unchanged.

Also bump the Caddy base image to 2.11.4 (required by current
caddy-l4) and add a path-filtered push trigger so the published
`:latest` image is rebuilt whenever the Caddy Dockerfile changes,
instead of only on manual dispatch (which is how `:latest` drifted out
of sync with the checked-in Caddyfile in the first place).

Fixes GIT-903

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/build-caddy-l4-image.yml

@@ -5,6 +5,12 @@ env:
 name: Build caddy-l4
 on:
   workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - docker/DockerfileCaddyL4
+      - .github/workflows/build-caddy-l4-image.yml
 
 permissions: write-all
 

Caddyfile

@@ -1,8 +1,10 @@
 {
 	layer4 {
 		:25 {
-			proxy {
-				to windmill_server:2525
+			route {
+				proxy {
+					upstream windmill_server:2525
+				}
 			}
 		}
 	}

docker/DockerfileCaddyL4

@@ -1,10 +1,12 @@
-FROM caddy:2.8.4-builder-alpine AS builder
+FROM caddy:2.11.4-builder-alpine AS builder
 
+# caddy-l4 natively registers the `layer4` global option used by the Caddyfile.
+# Do NOT also add RussellLuo/caddy-ext/layer4: it registers the same global
+# option, and building both panics with "global option 'layer4' already registered".
 RUN xcaddy build \
-  --with github.com/mholt/caddy-l4@145ec36251a44286f05a10d231d8bfb3a8192e09 \
-  --with github.com/RussellLuo/caddy-ext/layer4@ab1e18cfe426012af351a68463937ae2e934a2a1
+  --with github.com/mholt/caddy-l4@bd96009ea7373869bb07d61055554f966b1f5088
 
 
-FROM caddy:2.8.4-alpine
+FROM caddy:2.11.4-alpine
 
-COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy

flake.nix

@@ -354,8 +354,7 @@
           (pkgs.writeScriptBin "wm-caddy" ''
             cd ./frontend
             xcaddy build "$@" \
-              --with github.com/mholt/caddy-l4@145ec36251a44286f05a10d231d8bfb3a8192e09 \
-              --with github.com/RussellLuo/caddy-ext/layer4@ab1e18cfe426012af351a68463937ae2e934a2a1
+              --with github.com/mholt/caddy-l4@bd96009ea7373869bb07d61055554f966b1f5088
           '')
           (pkgs.writeScriptBin "wm-setup" ''
             sqlx database create