proxy > upstream > tls_trust_pool http > tls block causes runtime panic

Minimal repro: ``` { layer4 { :80 { route { proxy { upstream { dial google.com:443 tls tls_trust_pool http { endpoints https://curl.se/ca/cacert.pem tls { } } } } } } } } ``` Built with this Dockerfile: ``` ARG CADDY_VERSION="2.10.2" FROM caddy:${CADDY_VERSION}-builder-alpine AS builder RUN xcaddy build \ --with github.com/mholt/caddy-l4 FROM caddy:${CADDY_VERSION}-alpine COPY --from=builder /usr/bin/caddy /usr/bin/caddy COPY ./Caddyfile /etc/caddy/Caddyfile ``` Results in: ``` 2026/02/03 01:11:08.658 INFO maxprocs: Leaving GOMAXPROCS=32: CPU quota undefined 2026/02/03 01:11:08.659 INFO GOMEMLIMIT is updated {"package": "github.com/KimMachineGun/automemlimit/memlimit", "GOMEMLIMIT": 182230028697, "previous": 9223372036854775807} 2026/02/03 01:11:08.659 INFO using config from file {"file": "/etc/caddy/Caddyfile"} 2026/02/03 01:11:08.660 INFO adapted config to JSON {"adapter": "caddyfile"} 2026/02/03 01:11:08.660 WARN Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies {"adapter": "caddyfile", "file": "/etc/caddy/Caddyfile", "line": 2} 2026/02/03 01:11:08.661 INFO admin admin endpoint started {"address": "localhost:2019", "enforce_origin": false, "origins": ["//[::1]:2019", "//127.0.0.1:2019", "//localhost:2019"]} 2026/02/03 01:11:08.662 INFO maxprocs: No GOMAXPROCS change to reset panic: interface conversion: interface {} is nil, not *caddy.Replacer goroutine 1 [running]: github.com/caddyserver/caddy/v2/modules/caddytls.(*TLSConfig).makeTLSClientConfig(0xc0006bc140, {{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc0002e4880, 0x3, 0x4}, {0x0, 0x0, ...}, ...}) github.com/caddyserver/caddy/v2@v2.10.2/modules/caddytls/capools.go:503 +0x4b4 github.com/caddyserver/caddy/v2/modules/caddytls.(*HTTPCertPool).Provision(0xc00017de90, {{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc0002e4880, 0x3, 0x4}, {0x0, 0x0, ...}, ...}) github.com/caddyserver/caddy/v2@v2.10.2/modules/caddytls/capools.go:574 +0xfc github.com/caddyserver/caddy/v2.Context.LoadModuleByID({{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc0002e4880, 0x3, 0x4}, {0x0, 0x0, 0x0}, ...}, ...) github.com/caddyserver/caddy/v2@v2.10.2/context.go:417 +0x895 github.com/caddyserver/caddy/v2.Context.loadModuleInline({{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc00033c460, 0x2, 0x2}, {0x0, 0x0, 0x0}, ...}, ...) github.com/caddyserver/caddy/v2@v2.10.2/context.go:475 +0xf0 github.com/caddyserver/caddy/v2.Context.LoadModule({{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc00033c460, 0x2, 0x2}, {0x0, 0x0, 0x0}, ...}, ...) github.com/caddyserver/caddy/v2@v2.10.2/context.go:209 +0x426 github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy.(*TLSConfig).MakeTLSClientConfig(0xc0004e4c40, {{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc00033c460, 0x2, 0x2}, {0x0, 0x0, ...}, ...}) github.com/caddyserver/caddy/v2@v2.10.2/modules/caddyhttp/reverseproxy/httptransport.go:714 +0x5f7 github.com/mholt/caddy-l4/modules/l4proxy.(*Upstream).provision(0xc0006bc0a0, {{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc00033c460, 0x2, 0x2}, {0x0, 0x0, ...}, ...}, ...) github.com/mholt/caddy-l4@v0.0.0-20260127203130-040d25cc886a/modules/l4proxy/upstream.go:87 +0x518 github.com/mholt/caddy-l4/modules/l4proxy.(*Handler).Provision(0xc0007666c0, {{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc00033c460, 0x2, 0x2}, {0x0, 0x0, ...}, ...}) github.com/mholt/caddy-l4@v0.0.0-20260127203130-040d25cc886a/modules/l4proxy/proxy.go:104 +0x47c github.com/caddyserver/caddy/v2.Context.LoadModuleByID({{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc00033c460, 0x2, 0x2}, {0x0, 0x0, 0x0}, ...}, ...) github.com/caddyserver/caddy/v2@v2.10.2/context.go:417 +0x895 github.com/caddyserver/caddy/v2.Context.loadModuleInline({{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc000543760, 0x1, 0x1}, {0x0, 0x0, 0x0}, ...}, ...) github.com/caddyserver/caddy/v2@v2.10.2/context.go:475 +0xf0 github.com/caddyserver/caddy/v2.Context.LoadModule({{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc000543760, 0x1, 0x1}, {0x0, 0x0, 0x0}, ...}, ...) github.com/caddyserver/caddy/v2@v2.10.2/context.go:222 +0x6e6 github.com/mholt/caddy-l4/layer4.(*Route).Provision(0xc0006a62a0, {{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc000543760, 0x1, 0x1}, {0x0, 0x0, ...}, ...}) github.com/mholt/caddy-l4@v0.0.0-20260127203130-040d25cc886a/layer4/routes.go:64 +0x11b github.com/mholt/caddy-l4/layer4.RouteList.Provision({0xc000a14368, 0x1, 0xc00052c928?}, {{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc000543760, 0x1, 0x1}, ...}) github.com/mholt/caddy-l4@v0.0.0-20260127203130-040d25cc886a/layer4/routes.go:89 +0x7b github.com/mholt/caddy-l4/layer4.(*Server).Provision(0xc0002b50a0, {{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc000543760, 0x1, 0x1}, {0x0, 0x0, ...}, ...}, ...) github.com/mholt/caddy-l4@v0.0.0-20260127203130-040d25cc886a/layer4/server.go:81 +0x4f8 github.com/mholt/caddy-l4/layer4.(*App).Provision(0xc0007a73f0, {{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc000543760, 0x1, 0x1}, {0x0, 0x0, ...}, ...}) github.com/mholt/caddy-l4@v0.0.0-20260127203130-040d25cc886a/layer4/app.go:56 +0x17b github.com/caddyserver/caddy/v2.Context.LoadModuleByID({{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0xc000543760, 0x1, 0x1}, {0x0, 0x0, 0x0}, ...}, ...) github.com/caddyserver/caddy/v2@v2.10.2/context.go:417 +0x895 github.com/caddyserver/caddy/v2.Context.App({{0x2124f70, 0xc000731130}, 0xc000819e60, 0xc000324480, {0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}, ...}, ...) github.com/caddyserver/caddy/v2@v2.10.2/context.go:505 +0x1ce github.com/caddyserver/caddy/v2.provisionContext.func3(...) github.com/caddyserver/caddy/v2@v2.10.2/caddy.go:566 github.com/caddyserver/caddy/v2.provisionContext(0xc000536000?, 0x1) github.com/caddyserver/caddy/v2@v2.10.2/caddy.go:571 +0x5dc github.com/caddyserver/caddy/v2.run(0xc00052d5d8?, 0x1) github.com/caddyserver/caddy/v2@v2.10.2/caddy.go:404 +0x85 github.com/caddyserver/caddy/v2.unsyncedDecodeAndRun({0xc0001464b0, 0xe9, 0xf0}, 0x1) github.com/caddyserver/caddy/v2@v2.10.2/caddy.go:347 +0x145 github.com/caddyserver/caddy/v2.changeConfig({0x1b74a08, 0x4}, {0x1b7a6d3, 0x7}, {0xc0001463c0, 0xe9, 0xf0}, {0x0, 0x0}, 0x1) github.com/caddyserver/caddy/v2@v2.10.2/caddy.go:238 +0x6a5 github.com/caddyserver/caddy/v2.Load({0xc0001463c0, 0xe9, 0xf0}, 0x1) github.com/caddyserver/caddy/v2@v2.10.2/caddy.go:137 +0x22d github.com/caddyserver/caddy/v2/cmd.cmdRun({0x0?}) github.com/caddyserver/caddy/v2@v2.10.2/cmd/commandfuncs.go:240 +0x80d github.com/caddyserver/caddy/v2/cmd.init.1.func2.WrapCommandFuncForCobra.1(0xc000904608, {0x1b74a64?, 0x4?, 0x1b74a3c?}) github.com/caddyserver/caddy/v2@v2.10.2/cmd/cobra.go:141 +0x2f github.com/spf13/cobra.(*Command).execute(0xc000904608, {0xc000614240, 0x4, 0x4}) github.com/spf13/cobra@v1.10.1/command.go:1015 +0xb02 github.com/spf13/cobra.(*Command).ExecuteC(0xc000904008) github.com/spf13/cobra@v1.10.1/command.go:1148 +0x465 github.com/spf13/cobra.(*Command).Execute(...) github.com/spf13/cobra@v1.10.1/command.go:1071 github.com/caddyserver/caddy/v2/cmd.Main() github.com/caddyserver/caddy/v2@v2.10.2/cmd/main.go:72 +0x65 main.main() caddy/main.go:12 +0xf ```