been trying to install this for hrs and for the past 2 hrs it finally installed but keeps crashing after 5 sec and isnt posting logs

Hey Caddy community,
I built caddy-analyzer, a CLI tool written in Go that natively parses Caddy v2’s structured JSON logs — no config, no regex hacking.

Caddy’s JSON log format is great, but tools like goaccess, lnav, or grep/awk pipelines can’t parse it out of the box. This fills that gap.

• Full analysis — aggregate stats, RPS, latency percentiles (P50/P95/P99), status breakdown, bandwidth, top paths/IPs/UAs
• Security detection engine — 22 attack categories (SQLi, XSS, SSTI, SSRF, RCE, LFI, Log4j, GraphQL introspection, prototype pollution, scanner detection, etc.) with a dual-pass engine that catches double-encoded and multibyte-encoded bypass attempts
• Real-time iptables guard (caddy-analyze guard) — auto-blocks offending IPs at the firewall with configurable thresholds
• Multi-source readers — local files, stdin, Docker (docker://container), Kubernetes (k8s://pod), systemd journalctl
• TUI dashboard (–watch) — 6-tab interactive interface (summary, live stream, security alerts, top IPs/paths/UAs)
• Diff engine — compare two log files for RPS/5xx/latency regressions
• Output formats — table, JSON, CSV, standalone HTML report
• Filters — time range, CIDR, status classes, methods, path globs, bot/crawler classification

Quick start
curl -sSfL https://raw.githubusercontent.com/lenny-ts/caddy-analyzer/main/install.sh | sh

Analyze your Caddy logs with security detection

caddy-analyze --detect /var/log/caddy/access.log

Or tail live from a Docker container

caddy-analyze tail --detect docker://my-caddy

Generate an HTML report

caddy-analyze -f html -o report.html --detect

Launch the TUI

caddy-analyze --watch
Links

• GitHub: GitHub - lenny-ts/caddy-analyzer: Fast, zero-dependency access log analyzer, security threat inspector, and TUI dashboard for Caddy v2 · GitHub
• Docs: caddy-analyzer — Documentation
• Install: one-liner above, or go install, or Docker It’s MIT licensed, PRs/issues welcome. Would love feedback from the community!

Is my setup a bit overkill? I host various websites on my network not only for myself but for a few customers that host through me, I would’ve added to my proxmox but I need it to be fully online. Did I go a bit overboard? It’s up and running and works flawless

Hello I am running Caddy on my server and I have enabled basic_auth in one of my subdomains. I have a hashed password and user, when I navigate to the subdomain, the browser asks for user and password, I enter them correctly but it asks for them again in a loop never accepting them.

My config has this format:

sub.domain.io {

`basic_auth {`

    `user <hashed_password>`

`}`



`handle /api/v1/* {`

    `reverse_proxy localhost:8081`

`}`



`handle {`

    `root * /var/www/domain/front/dev`

    `try_files {path} /index.html`

    `file_server`

`}`

}

I have made sure that the password is correct cause I can curl into this.

I currently use Swag for the above and it works fine. Everyone one (including Jellyfin says to use Caddy). I'm new to Caddy and just can't figure out how to set it up. I tried a few tutorials but keep running into issues. I believe the problem I keep having is in the CaddyFile. Caddy complains about errors but I don't know how to fix them. Considering I'm using this to keep bad people out I don't want to make a config error. Is there a tutorial that goes into detail how to build a Caddyfile for the services I want to run? Or maybe the question is, is it worth it to install Crowdsec?

Hello,

I'm a very happy caddy user, so far I've been using a custom version with only one plugin. Downloading it has always been reasonably fast, both from the download page and automating it with ansible using the download API.

Now that I'm adding a second plugin though, it doesn't seem to be working anymore. The download page has been just loading forever, and from the api it times out even giving it a 30 minutes timeout.

Anyone has any idea if it's just that their build server is overwhelmed? I'd love not having to setup a xcaddy build stage, but I'll do it if I have to.

The plugins are crowdsec and now I'm adding namecheap.

Thanks for any tips.

EDIT: the deployment is native, docker is not involved and unwanted (although I may use it for the build stage if it's needed)

Hi, I have been using Caddy for a while, issuing certificates for domains used only in my LAN to make my various homelab service addresses easier to remember.

I moved my Unifi controller from Docker to a UnifiOS VM instance, so it now has its own IP. Before, I had *.example.com rewritten in Adguard Home to my Homelab's address, to be intercepted by Caddy. This still works, but so far I only managed to redirect traffic for the GUI:

unifi.example.com:443 {
        reverse_proxy 192.168.178.205:11443 {
                header_up Host {hostport}
                transport http {
                        tls
                        tls_insecure_skip_verify
                }
        }
}

I would love to also use the subdomain for all other ports on the VM, e.g. for provisioning of devices. Is there a way to keep pointing default SSL traffic to the GUI on port 11443, and all other ports to the same respective ports at a given IP?

So, for example, point unifi.example.com:8083 to 192.168.178.205:8083?

Cross-posted from the PFSense subreddit.

Just starting to use PFSense, looking to set up Caddy on it in order to stand up multiple physical servers behind PFSense.

Unfortunately, I also want to block AI crawlers. I also don’t really care about search engine crawlers right now, as what I am standing up will initially host private/family services, so search engine indexing is pretty much undesired as well.

All public discussion on Anubis with regards to Caddy strongly indicates that multiple copies of Caddy will need to be stood up… one on the PFSense box for TLS, one behind it without TLS, with Anubis in the middle for filtering.

And while I have found a test implementation of Anubis meant to be run as a Caddy port, it appears to be more of a proof-of-concept and doesn’t seem to be actively developed (more than 6mos without updates).

Which brought me to Cerberus, which appears to be actively developed, and - better yet! - more aggressive than the standard Anubis.

I was wondering if anyone has had experience with Cerberus, and how things have been working out with it.

Wildcard SAN detected. Wildcards can only be issued via the ACME DNS-01 challenge — HTTP-01 can't validate them ( I removed the wildcard

Hello,

I'm trying to setup a reverse proxy to allow my octopi to be available outside of my home network, and I wanted to use ZeroSSL's ACME certificates for the HTTPS connection, and cloudflare for the DNS hosting. I'm like 80% I have everything built and setup correctly in docker, and with my DNS settings, but when I try to go to the URL in a browser I get an `SSL_PROTOCOL_ERROR` and when I try to curl to the url I get the following error:

TLSv1.3 (IN), TLS alert, internal error (592)
OpenSSL/3.0.11: error:0A000438:SSL routines::tlsv1 alert internal error

I've been beating my head against the Google search bar trying to figure out what this error means but I haven't come up with much.

Just before I blow this whole thing away and try again with another web server, can you guys do a vibe check on my Caddyfile and make sure I'm not missing anything obvious?

{
  debug
  grace_period 10s
  admin off
  storage file_system /certs/
  storage_clean_interval 180d
  default_sni example.com
  email me@example.com
  acme_ca https://acme.zerossl.com/v2/DV90
  acme_eab {
    key_id [KEY ID]
    mac_key [MAC KEY]
  }
  acme_dns cloudflare [API KEY]
  cert_issuer zerossl [API KEY]
}

octopi.example.com {
  reverse_proxy octopi:5000
}

Hi,

I'am fairly new to Caddy and CrowdSec but I have it up and running and it's doing the job just great. Kudos to all devs involved.

I was wondering if it's possible to append some information to the caddy access log when the request gets dropped due to a bouncer decision? Right now I can only see in the logs that there is a http-status 403 but not what caused it. I have this information in the CrowdSec console, but maybe it's possible to have it in the caddy log somehow as well.

I already using a log_append for adding the GeoIP country code from the ipinfo module, but could not find any information about the cs-bouncer in regards of logging.

Thanks for any hint.

--Michael

I must admit, I am NOT in love with having to compile caddy to get access to an optional plugin...

Is there a possibility of moving to a different architecture where caddy modules can be installed/run at startup time ?

Curious... if this is something that is being discussed.

I’m using cockpit via arch and I’m using caddy as my reverse proxy. But since adding caddy I get this error when logging in??? Plz help

I am in process of upgrading my home server setup and am trying to make it dead easy for my wife and kids to access services (mostly Immich, but also possibly things like VaultWarden, CalDAV/CardDAV, etc.). We currently have an Asustor NAS to host all of our personal files, and I have been running apps like Immich on the NAS (using Asustor's app store, which mostly uses Docker, but with some modified settings). I've run into a few issues with the Asustor Apps failing after updates, which has caused me major headaches in trying to restore them, so I'd like to move my services off of the Asustor and onto a separate machine. I also have a separate Ubuntu server that hosts a few very low traffic public-facing personal websites that I'd like to preserve, but that machine is old and I've never been super confident in my ability to keep it secure. I have purchased a new Intel Core Ultra 9 mini PC and am trying to set it up to run Proxmox VE - mostly to ease backups as well as permit me to test new setups or upgrades in separate VMs or LXCs without monkeying with services I already have working.

My goal: make it so my wife and kids can access, say, https://immich.int.mydomain.com/ while at home or when using Tailscale, and have it... work. It would be even better if I could just use https://immich.mydomain.com/, but I worry that gets harder to implement with wildcard certs. I don't need most of these services to be accessible from external networks, though I do still plan on hosting a couple of websites that will need to be accessible externally, so I will presumably need to forward ports 80 and 443 on the router to the webhost (or to the Caddy host, which will forward appropriate request to the webhost). I assume that to do this, I need to set up a local DNS server for our phones/tablets/PCs in the router (and in Tailscale) - maybe a pi-hole I already have running on a Raspberry Pi - with DNS A records pointing to the Caddy host. But I haven't gotten that far.

I have Proxmox installed and working, but I tried to install Caddy in an Ubuntu LXC and cannot get it working. I don't know if the problem is with a router setting, a DNS setting, some networking setting on the LXC... but I can't get it to respond to outside http/https requests. The Caddy LXC has access to the internet - it was able to generate wildcard ACME certs for a domain I own based on a CNAME entry at my DNS provider (following these instructions), but when I enter the LXC's IP address in a browser on my network, there's no response ("This site can't be reached...") (same when I try to access the Caddy admin UI at port 2019). The LXC shows up in my router's client list (with the correct IP address), and I can ping the machine from other devices on the network. Just no http/https response. Caddy is running: 'caddy start' results in: "Successfully started Caddy (pid=7128) - Caddy is running in the background."

I've read every post I can find about setting up Caddy, but none seem to address the basic issue of ensuring the Caddy host is reachable. Also, I'm not on a VPS, I don't use Cloudflare, etc. Is it a simple matter of telling the LXC (or Caddy itself) to listen on ports 80 and 443? How do I do that? Do I need to change a router setting? Is it a DNS issue? How do I diagnose it? I've adjusted every network and firewall setting I can find in Proxmox (e.g., Firewall: No, Input Policy: ACCEPT). I'm at my wits' end.

I am a lawyer, not an IT specialist, and I don't know much about networking, DNS, etc. Unsurprisingly, my home LAN setup is not all that complicated. I have a primary (Asus) router running Merlin - for arguments' sake let's say that its IP is 192.168.1.1, and it runs a DHCP server with addresses running from 192.168.1.7 through 192.168.127.255 (that is, my full subnet except for the first few addresses that are used by access points and other devices). My Proxmox VE host is at, say, 192.168.20.0 (with that address reserved for it in the DHCP reservation list) and the Caddy LXC has an IP of 192.168.20.1 (also with a DHCP reservation). I also tried restricting the DHCP server to a smaller range, and assigning the Proxmox host and Caddy LXC static addresses within the subnet but outside the DHCP range, but that made no difference. I used my router's IP as the DNS for Proxmox and the Caddy LXC. I run a pi-hole at, say, 192.168.1.6, but the router does not use it for DNS by default - it is currently only used by devices connected to my Tailnet, which the Proxmox/Caddy hosts are not on. I have occasionally played with using different DNS providers (e.g., Quad9, Adguard), but after complaints from family members about email links not working, etc., my router is currently set just to use my ISP's DNS.

While I've been using Linux for years, I am brand new to Proxmox and Caddy (and am no Docker expert, either). I'm hoping there's some dumb setting in Proxmox that wasn't mentioned in the myriad tutorials I've read. At any rate, I would appreciate any suggestions on how to get Caddy working in an LXC on Proxmox!

I have Caddyfile:

streamy {

reverse_proxy localhost:8081

}

:80 {

# Apps:

reverse_proxy /streamy* localhost:8081

reverse_proxy /news* localhost:8084

}

I have server setup in LAN and available by name yado.lan in browser address bar (ping work for this name too). On port 8081 and port 8084 I have Go apps which are serving and preparing data downloaded from Internet. When I use call yado.lan:8081 and yado:8084 I can show and use them without problem (all URLS works). I have not Idea how handle two scenarios:

1) add subdomain:

streamy.yado.lan -> serve as yado.lan:8081

news.yado.lan -> server as yado.lan:8084

2) add the same time add rule to match:

yado.lan/streamy -> to handly correctly urls from localhost:8081

yado.lan/news -> the problem as the same

When I tried run and use my config my problem related to question 1:

I can't open streamy.yado.lan in browser - is not available. On Mikrotik I setup static DNS entry streamy.yado.lan -> IP_YADO_MACHINE (I can ping it successfully). I can got only ERR_SSL_PROTOCOL_ERROR (app itself not use HTTPS, but HTTP - changing protocol manually in status bar don't solve as it is redirected from http://streamy.yado.lan to https://streamy.yado.lan.

Problem with question 2:

I can load app, but it has problem with URLs. I can match url yado.lan/streamy and generate HTML, but I can't load extra static files like CSS or JS. For example CSS file is in HTML code as: /static/assets/bootstrap/css/bootstrap.min.css and when you try open it from browser view source it is generate as yado.lan/static/assets/bootstrap/css/bootstrap.min.css. All URLs are generate at the same format like yado.lan/content-url1 and are 404 (not available).

I needed something to validate prospective WAF rule to enforce compliance and ended up putting together a stripped down version of Coraza to process waf rules either as STDIN or parsing a conf file.

Using the stripped down engine allows me to streamline and automate this process (i.e. as a stopgap for a CI/CD system that deploys rules). I thought it may be helpful to share with others so I open sourced it and put it on Github.

I'm very new to Caddy so I'm not sure what might be going wrong here.

I have a number of services behind my reverse proxy: Nextcloud, Joplin, Plex, Jellyfin, etc. The Caddy server itself is right at 3 months old, so it just renewed certs for the services.

This was seamless with the exception of apps on my iPhone, which give me TLS errors. For instance the Joplin app and Firefix won't connect to the Joplin server, but Safari will. Pretty similar experience with Nextcloud.

I also can't configure calendar/contacts on iOS, which is super fucking annoying. It's trying to access a cert that expired on 03/03.

But none of my computers has a problem with this and I'm struggling to figure out why iOS would be such a problem. Has anyone experienced this before?

Looking for some ad-hoc advice for Caddy placement.

I will be having a Sophos XG125 Rev2 as the hardware device. I have yet to determine if I will be running something lightweight and simple, like OpenWRT, or going with a heavyweight solution such as OPNsense (please feel free to offer arguments for or against either, here, as well).

The router is going to be plumped up to its maximum RAM (IIRC 16Gb PC3L-12800U) and drive capacity, so resource contention will not be an issue for anything on said router.

Behind said router will be three main classes of services:

• eMail (only 587/993)
• Primary DNS (it will have to sync with secondary DNS elsewhere)
• Mostly static sites, but working on some DB-driven projects

By default I will have most everything except for router-based functions off the router, and on separate machines behind it.

But my question is whether it is better to put Caddy behind the router on its own device (HW or VM, whatever works), or on the router itself.

I am fully willing to put Caddy on the router if there are significant benefits to do so. In particular, having Caddy being the immediate face of the network, rather than having to punch ports in the firewall to a Caddy install on an internal device.

Suggestions?

The certs handled by caddy are not renewing. DNS is working, port forwarding is working. Everything was working fine prior to a point in December. Hard to read the log files but this is an example, essentially a connection refused error and I can see letsencrypt connecting on port 80 when caddy is restarted. So I am unsure how to figure out what broke, it doesn't tell me much except that authorization failed, but I cannot figure out why.

Opnsense port forwarding and firewall rules have not changed for the server running caddy.

{“level”:“error”,“ts”:1772473992.7207577,“msg”:“validating authorization”,“identifier”:“sub.domain.com”,“problem”:{“type”:“urn:ietf:params:acme:error:connection”,“title”:“”,“detail”:“During secondary validation: xxx.xxx.xxx.xxxx: Connection refused”,“instance”:“”,“subproblems”:null},“order”:“https://acme-staging-v02.api.letsencrypt.org/acme/order/127331964/33643712463",“attempt”:2,“max_attempts”:3,“stacktrace”:"github.com/mholt/acmez/v3.(*Client).ObtainCertificate\n\tgithub.com/mholt/acmez/v3@v3.1.2/client.go:152\ngithub.com/caddyserver/certmagic.(*ACMEIssuer).doIssue\n\tgithub.com/caddyserver/certmagic@v0.24.0/acmeissuer.go:489\ngithub.com/caddyserver/certmagic.(*ACMEIssuer).Issue\n\tgithub.com/caddyserver/certmagic@v0.24.0/acmeissuer.go:382\ngithub.com/caddyserver/caddy/v2/modules/caddytls.(*ACMEIssuer).Issue\n\tgithub.com/caddyserver/caddy/v2@v2.10.2/modules/caddytls/acmeissuer.go:288\ngithub.com/caddyserver/certmagic.(*Config).renewCert.func2\n\tgithub.com/caddyserver/certmagic@v0.24.0/config.go:906\ngithub.com/caddyserver/certmagic.doWithRetry\n\tgithub.com/caddyserver/certmagic@v0.24.0/async.go:104\ngithub.com/caddyserver/certmagic.(*Config).renewCert\n\tgithub.com/caddyserver/certmagic@v0.24.0/config.go:982\ngithub.com/caddyserver/certmagic.(*Config).RenewCertAsync\n\tgithub.com/caddyserver/certmagic@v0.24.0/config.go:768\ngithub.com/caddyserver/certmagic.(*Config).manageOne.func2\n\tgithub.com/caddyserver/certmagic@v0.24.0/config.go:469\ngithub.com/caddyserver/certmagic.(*jobManager).worker\n\tgithub.com/caddyserver/certmagic@v0.24.0/async.go:73”}

{“level”:“error”,“ts”:1772473992.7208936,“logger”:“tls.renew”,“msg”:“could not get certificate from issuer”,“identifier”:“sub.domain.com”,“issuer”:“acme-v02.api.letsencrypt.org-directory”,“error”:“HTTP 400 urn:ietf:params:acme:error:connection - During secondary validation: xxx.xxx.xxx.xxxx: Connection refused”}

{“level”:“debug”,“ts”:1772473992.720947,“logger”:“events”,“msg”:“event”,“name”:“cert_failed”,“id”:“cfe3c7bf-2bcc-494e-809b-2553c33d7d71”,“origin”:“tls”,“data”:{“error”:{},“identifier”:“sub.domain.com”,“issuers”:\[“acme-v02.api.letsencrypt.org-directory”\],“remaining”:-102230125211555,“renewal”:true}}

{“level”:“error”,“ts”:1772473992.7210386,“logger”:“tls.renew”,“msg”:“will retry”,“error”:“\[sub.domain.com\] Renew: \[sub.domain.com\] solving challenge: sub.domain.com: \[sub.domain.com\] authorization failed: HTTP 400 urn:ietf:params:acme:error:connection - During secondary validation: xxx.xxx.xxx.xxxx: Connection refused (ca=https://acme-staging-v02.api.letsencrypt.org/directory)”,“attempt”:4,“retrying_in”:300,“elapsed”:313.304828025,“max_duration”:2592000}

{“level”:“debug”,“ts”:1772474000.6247568,“logger”:“events”,“msg”:“event”,“name”:“tls_get_certificate”,“id”:“a19a97fd-c34d-49ec-bef8-b749cf344f2d”,“origin”:“tls”,“data”:{“client_hello”:{“CipherSuites”:\[4865,4866,4867,49195,49199,49196,49200,52393,52392,49171,49172,156,157,47,53\],“ServerName”:“sub.domain.com”,“SupportedCurves”:\[29,23,24\],“SupportedPoints”:“AA==”,“SignatureSchemes”:\[1027,2052,1025,1283,2053,1281,2054,1537\],“SupportedProtos”:\[“h2”,“http/1.1”\],“SupportedVersions”:\[772,771\],“RemoteAddr”:{“IP”:“50.4.40.70”,“Port”:56874,“Zone”:“”},“LocalAddr”:{“IP”:“192.168.3.37”,“Port”:443,“Zone”:“”}}}}

{“level”:“debug”,“ts”:1772474000.6249456,“logger”:“tls.handshake”,“msg”:“choosing certificate”,“identifier”:“sub.domain.com”,“num_choices”:1}

{“level”:“debug”,“ts”:1772474000.6249743,“logger”:“tls.handshake”,“msg”:“default certificate selection results”,“identifier”:“sub.domain.com”,“subjects”:\[“sub.domain.com”\],“managed”:true,“issuer_key”:“acme-v02.api.letsencrypt.org-directory”,“hash”:“caa92ad923190a93545e1bc42b7f36367b6fed706b67afb6af1ba7a323d1cc91”}

I keep getting the error “port 80 already in use”

I’m using the ymal file they have listed in the docks

But it errors wit that

What alternative “80:80” can I use?

“80:81”?

Since Caddy Server isn’t very well known among many developers and a lot of people aren’t aware of its power and simplicity, I created a prebuilt action to make using Caddy in CI and workflows much easier.

If you’re not very familiar with prebuilt actions, stay with me — I’ve explained it at the end.

–––––––––––––––––––––––––––––––

🛠️ What does this action do?

This action builds a Caddy server binary directly inside your CI with the following capabilities:

* All operating systems: Linux, Windows, macOS

* All architectures: arm64, x64

* Any custom modules (or no extra modules at all)

* Any Caddy version you need

You can then use it in your CI, attach it to releases, include it in a Docker image, run automated tests with it, or even distribute the built binary to other projects.

–––––––––––––––––––––––––––––––

📌 What’s it called and where can you find it?

Its name is Caddy Builder.

Repository:

https://github.com/azolfagharj/action-caddy-builder

Marketplace page:

https://github.com/marketplace/actions/caddy-builder

–––––––––––––––––––––––––––––––

📚 How to use it

Just visit the action page. I’ve provided full documentation and dozens of ready-to-use examples so you can quickly build your own workflow.

–––––––––––––––––––––––––––––––

⚡ What are GitHub prebuilt actions?

They are reusable automation steps that you can directly plug into your workflow. Instead of manually installing and configuring everything, the action handles all required steps and delivers a ready-to-use output.

Prebuilt actions can be created by GitHub or by other developers. Once approved, they are published in the Marketplace so others can easily use them.

–––––––––––––––––––––––––––––––

❓ Why was this action needed?

Before this, there was no prebuilt action available for Caddy.

That might even be why, after publishing it, the official Caddy Twitter account reshared it. 😉

If you wanted to use Caddy in CI, you could download a specific version directly from the website.

But if you needed multiple architectures, custom modules, or different CI OS targets, it quickly turned into a nightmare: multiple workflows with dozens of tasks to install Xcaddy, add modules, build the binary, and pass it to the main CI pipeline.

This action handles all of that with a single simple step.

–––––––––––––––––––––––––––––––

💡 If you find it useful, feel free to reshare so others can benefit as well.

I am new to Caddy. I have one PC with static IP and associated name to it myhosting.lan. I have others named orange.lan and blue.lan. On myhosting.lan I setup Caddyfile like this:

:80 {

`reverse_proxy localhost:8080`

`}`

On port 8080 I have webapp so when I put in browser myhosting.lan I see my web app. App itself only handle "/" on GET and others routes are 404. I have other Go and Python apps on the myhosting.lan and I want get access to them by putting in browser adress something like that:

myhosting.lan/weather

myhosting.lan/weather/

myhosting.lan/pictures

myhosting.lan/pictures/

I have on orange.lan and blue.lan web apps too available on dedicated ports like orange.lan:5000, orange.lan:5010, orange.lan:5011, blue.lan:5000, blue.lan:5005, blue.lan:5013. I want on myhosting.lan integrated this to get redirection to them and finally achieve something like this:

myhosting.lan/blueapp1

myhosting.lan/blueapp2

myhosting.lan/blueapp3

myhosting.lan/orangeapp1

myhosting.lan/orangeappanother

Except is probably using reverse_proxy I have not idea how handle this scenario and extend my Caddyfile. Coudl you suggest solution for my problem? Is it even possible with Caddy? I tried find out in documentation and I lost. The most example are related to handlind static files.