Installazione

Requisiti: Go 1.25+ solo se compili dai sorgenti. Tutti gli altri metodi forniscono un binario statico (CGO_ENABLED=0) per Linux / macOS / Windows su amd64, arm64, arm. Verifica ogni metodo subito dopo l'installazione.

Linux / macOS — install.sh

Rileva SO/architettura, scarica tar.gz + checksums.txt, verifica SHA256 e cosign facoltativo.

curl -sSfL https://raw.githubusercontent.com/lenny-ts/caddy-analyzer/main/install.sh | bash

Verifica

caddy-analyze --version
which caddy-analyze
# expected: /usr/local/bin/caddy-analyze  and  v0.6.1

Se /usr/local/bin non è scrivibile, lo script usa sudo mv. L'installer installa attualmente in /usr/local/bin; usa l'archivio della release o go install se ti serve una posizione utente.

Windows — install.ps1

iwr -useb https://raw.githubusercontent.com/lenny-ts/caddy-analyzer/main/install.ps1 | iex

Verifica

caddy-analyze --version
# close and re-open PowerShell if PATH was updated
Get-Command caddy-analyze | Format-List
# expected: Source  C:\Users\YOU\AppData\Local\caddy-analyze\caddy-analyze.exe

Toolchain Go

go install github.com/lenny-ts/caddy-analyzer/cmd/caddy-analyze@latest

Verifica

caddy-analyze --version
# if "command not found", add Go bin to PATH:
export PATH="$HOME/go/bin:$PATH"
go env GOPATH
# expected: .../go/bin/caddy-analyze

Docker

Go non richiesto. Immagine: ghcr.io/lenny-ts/caddy-analyzer (Alpine, utente non-root caddy).

docker pull ghcr.io/lenny-ts/caddy-analyzer:latest
# analyze a file
docker run --rm -v /var/log/caddy:/logs ghcr.io/lenny-ts/caddy-analyzer /logs/access.log
# stream from Docker
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock ghcr.io/lenny-ts/caddy-analyzer docker://caddy

Verifica

docker run --rm ghcr.io/lenny-ts/caddy-analyzer --version
docker images ghcr.io/lenny-ts/caddy-analyzer --format "{{.Tag}} {{.Size}}"

Binari precompilati

Scarica da GitHub Releases. Ogni *.tar.gz (o .zip su Windows) contiene caddy-analyze + checksums.txt + cosign .sig/.pem.

# example Linux amd64 — replace v0.6.1 with latest
curl -sSfL https://github.com/lenny-ts/caddy-analyzer/releases/download/v0.6.1/caddy-analyzer_v0.6.1_linux_amd64.tar.gz -o /tmp/caddy.tgz
curl -sSfL https://github.com/lenny-ts/caddy-analyzer/releases/download/v0.6.1/checksums.txt -o /tmp/checksums.txt
grep caddy-analyzer_v0.6.1_linux_amd64.tar.gz /tmp/checksums.txt | (cd /tmp && sha256sum -c)
tar -xzf /tmp/caddy.tgz -C /tmp && sudo mv /tmp/caddy-analyze /usr/local/bin/

Verifica

caddy-analyze --version
ls -l /usr/local/bin/caddy-analyze
# optional cosign: cosign verify-blob --certificate-identity ... --signature checksums.txt.sig checksums.txt

Systemd (demone guard)

Per usare guard come servizio. Richiede root per iptables.

sudo tee /etc/systemd/system/caddy-guard.service >/dev/null <<'EOF'
[Unit]
Description=caddy-analyzer Security Guard Daemon
After=network.target caddy.service
[Service]
Type=simple
ExecStart=/usr/local/bin/caddy-analyze guard --limit 50 --window 1m /var/log/caddy/access.log
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now caddy-guard

Verifica

systemctl status caddy-guard --no-pager
journalctl -u caddy-guard -n 20 --no-pager
# should show "guard started" and no "permission denied" on /var/log/caddy/access.log

Aggiornamento

caddy-analyze update --check   # check without installing
caddy-analyze update           # install latest (cosign + SHA256 verified)
caddy-analyze update --version v0.6.1 --force  # pin / downgrade

Risoluzione dei problemi

• curl: command not found → sudo apt-get install curl oppure usa il download del binario.
• permission denied sul log → sudo caddy-analyze … oppure sudo usermod -aG caddy $USER, poi effettua nuovamente l'accesso.
• Proxy aziendale → imposta https_proxy prima di curl.