Caddy-analyzer — Native log analysis + security detection for Caddy v2 - Showcase - Caddy Community = 40rem)" rel="stylesheet" data-target="chat_desktop" /> = 40rem)" rel="stylesheet" data-target="discourse-reactions_desktop" /> = 40rem)" rel="stylesheet" data-target="poll_desktop" /> = 40rem)" rel="stylesheet" data-target="desktop_theme" data-theme-id="1" data-theme-name="caddy custom"/> Caddy-analyzer — Native log analysis + security detection for Caddy v2 Showcase lenny (Lenny) July 30, 2026, 8:36pm 1 Hey Caddy community, I built caddy-analyzer, a CLI tool written in Go that natively parses Caddy v2’s structured JSON logs — no config, no regex hacking. Caddy’s JSON log format is great, but tools like goaccess, lnav, or grep/awk pipelines can’t parse it out of the box. This fills that gap. Full analysis — aggregate stats, RPS, latency percentiles (P50/P95/P99), status breakdown, bandwidth, top paths/IPs/UAs Security detection engine — 22 attack categories (SQLi, XSS, SSTI, SSRF, RCE, LFI, Log4j, GraphQL introspection, prototype pollution, scanner detection, etc.) with a dual-pass engine that catches double-encoded and multibyte-encoded bypass attempts Real-time iptables guard (caddy-analyze guard) — auto-blocks offending IPs at the firewall with configurable thresholds Multi-source readers — local files, stdin, Docker (docker://container), Kubernetes (k8s://pod), systemd journalctl TUI dashboard (–watch) — 6-tab interactive interface (summary, live stream, security alerts, top IPs/paths/UAs) Diff engine — compare two log files for RPS/5xx/latency regressions Output formats — table, JSON, CSV, standalone HTML report Filters — time range, CIDR, status classes, methods, path globs, bot/crawler classification Quick start curl -sSfL https://raw.githubusercontent.com/L9Lenny/caddy-analyzer/main/install.sh | sh Analyze your Caddy logs with security detection caddy-analyze --detect /var/log/caddy/access.log Or tail live from a Docker container caddy-analyze tail --detect docker://my-caddy Generate an HTML report caddy-analyze -f html -o report.html --detect Launch the TUI caddy-analyze --watch Links GitHub: GitHub - L9Lenny/caddy-analyzer: Fast, zero-dependency access log analyzer, security threat inspector, and TUI dashboard for Caddy v2 · GitHub Docs: caddy-analyzer — Documentation Install: one-liner above, or go install, or Docker It’s MIT licensed, PRs/issues welcome. Would love feedback from the community! 1 Like