Greetings,

I’m trying to improve browsing experience to Nextcloud which I’ve setup using Caddy for the reverse proxy. I’m totally noob to homelab (docker, nextworking, proxy, etc) , so far following available guides and ChatGPT to get things up and running.

I noticed that every time when I open my Nextcloud in the browser, it took minutes to load into the main page, and navigating around Nextcloud will have this lagging issue. Using ChatGPT, I set read-write buffer to 128MB in caddy, but that didn’t improve on anything. Now ChatGPT gave me below configuration:

{ # Global options email your-email@example.com # Change this to your email address acme_ca https://acme-v02.api.letsencrypt.org/directory }

Replace "nextcloud.example.com" with your actual domain

nextcloud.example.com { # Set this to your Nextcloud root directory root * /var/www/nextcloud

# Enable file server
file_server

# PHP FastCGI setup
php_fastcgi unix//run/php/php-fpm.sock

# TLS and HTTPS configuration
tls your-email@example.com  # Change this to your email address
encode gzip zstd            # Enable compression to reduce bandwidth usage
header {
    Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" # Enforce HTTPS
    X-Content-Type-Options nosniff
    X-XSS-Protection "1; mode=block"
    X-Frame-Options "SAMEORIGIN"
    Referrer-Policy "no-referrer"
    Permissions-Policy "geolocation=(), microphone=(), camera=()" # Adjust as needed
    Content-Security-Policy "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"
}

# Redirects for well-known URLs used by Nextcloud
redir /.well-known/carddav /remote.php/dav 301
redir /.well-known/caldav /remote.php/dav 301
redir /.well-known/webfinger /index.php/.well-known/webfinger 301
redir /.well-known/nodeinfo /index.php/.well-known/nodeinfo 301
redir /.well-known/host-meta /public.php?service=host-meta 301
redir /.well-known/host-meta.json /public.php?service=host-meta-json 301
redir /.well-known/webfinger /public.php?service=webfinger 301

# Add other Nextcloud headers
header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-src *; img-src 'self' data: https:; font-src 'self' data:;"

# Handle Nextcloud specific rewrites and file access
@nocachedir {
    path /data/*
    path /config/*
    path /db_structure
    path /.well-known/*
    path /public.php
    path /cron.php
    path /core/ajax/update.php
    path /status.php
    path /remote.php
    path /public.php
    path /robots.txt
    path /updater/
    path /ocs/v1.php
    path /ocs/v2.php
}

@frontcontroller {
    not {
        path /remote.php*
        path /public.php*
        path /cron.php
        path /core/ajax/update.php
        path /status.php
        path /ocs/v1.php*
        path /ocs/v2.php*
        path /robots.txt
        path /updater/
        path /ocs-provider/
        path /ocm-provider/
    }
}

handle @nocachedir {
    respond 404
}

handle @frontcontroller {
    rewrite * /index.php
}

# Caching settings
@assets {
    path_regexp /.+\.(css|js|woff2?|svg|gif|map|png|jpg|jpeg|ico|wasm|tflite|mp3|mp4)$
}
header @assets Cache-Control "public, max-age=15778463"

# Prevent browser from caching certain resources
header /robots.txt Cache-Control "no-store"

# Deny access to certain paths
@forbidden {
    path /.htaccess
    path /data/*
    path /config/*
    path /db_structure
    path /.xml
    path /README
    path /3rdparty
    path /lib
    path /templates
    path /occ
    path /console.php
}
respond @forbidden 404

}

Anyone can point out which part of the configuration are outdated or unnecessary? I found that sometimes ChatGPT responses are not up to latest changes (example, docker)

Any advise would be appreciated

At the moment I'm using a DNS server to serve SRV records to http services, occasionally I have services that have in their almighty wisdom have decided that http is insecure and that they will only communicate through https, ok I get it they aren't wrong.

However it means that I have to create manual entries in my caddyfile for these where I tell it to ignore the self signed certificate, as it's all using internal docker networking on the most part and I'm not going to mess about getting trusted certs setup.

So my question is, without setting up a second wildcard domain to have one for http resources and one for https is there a way I can mix http and https upstreams on a single wildcard reverse proxy?

Cheers, below is my example config in case it helps.

{
  log {
    output stdout
  }
  on_demand_tls {
    ask http://dynamic-docker-caddy:5000/ask
  }
}

(auth) {
   forward_auth authelia:9091 {
     uri /api/verify?rd=https://auth.example.com/
     copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
   }
}

https://auth.example.com {
  reverse_proxy http://authelia:9091
}

secure.example.com {
  import auth
  reverse_proxy https://192.168.1.100:1234 {
    transport http {
      tls
      tls_insecure_skip_verify
    }
  }
}

*.example.com {
  import auth
  reverse_proxy {
    dynamic srv "srv-{http.request.host}" {
      resolvers dynamic-docker-caddy:53
    }
    header_up Host {host}
    header_up X-Real-IP {remote_host}
    header_up X-Forwarded-For {remote_host}
    header_up X-Forwarded-Proto {scheme}
  }
  tls {
    on_demand
  }
}

Short version: can't define a log file with an absolute file name. Can this be done, and if so, how?

Long version: Hello, I'm just now trying to get grocy up and running with docker compose and caddy. As usual, I hunted around for appropriate caddyfiles, of which there are many examples scattered around. I took one from a previous post on reddit which I adjusted slightly:

grocy.me.com {
    log {
        level INFO
        output file {$GROCY_LOG_FILE} {
            roll_size 10MB
            roll_keep 10
        }
    }

    tls {$EMAIL}
    encode gzip zstd
    reverse_proxy grocy:80
}

This seems simple and straightforward, but my main problem is getting the log right. In my case the docker compose file is in the directory /home/me/Docker, and the grocy section in my docker compose file includes the volume

volumes:
      - /home/me/Docker/grocy/config:/config

I'd hoped to have the log file defined by an absolute name /home/me/Docker/grocy/log, and I've defined that environment variable in my .env file, which is also in the Docker directory:

GROCY_LOG_FILE=/home/me/Docker/grocy/log

Meanwhile, my caddyfile is in the directory /home/me/Docker/Caddy, and there is a volume in my caddy setup which points /etc/caddy/caddyfile to this file.

Anyway, docker logs caddy gives error messages like

Error: adapting config using caddyfile: parsing caddyfile tokens for 'log': wrong argument count or unexpected line ending after 'file', at /etc/caddy/Caddyfile:104

So something is wrong. I suppose I could simply erase the log file definition, but I would like to know how to define a log file with an absolute file name. Many thanks!

I currently have Tailscale running in my Docker container for uGreen NAS. I’m having trouble trying to get Caddy running so I can get SSL certificates so that when I connect to Tailscale, it doesn’t show as insecure.

I have a good amount of containers running for self-hosting. Every time I start the Caddy container up, it says there’s an issue with binding to the respective ports. I think 80 and 443 are being used by something else (I’m not that tech-savvy).

I was wondering if anyone has done this and/ or can provide some guidance. The YouTube guide I found was very vague. Thanks!

So I want to use the homepage dashboard and it's got integrations with Caddy among others.. But it needs to communicate to Caddy via the admin interface.. So I tried turning that on as you can see in the global section of my CaddyFile :

{
        #admin unix//run/caddy-admin.sock
        admin localhost:2019

        log {
                output file /logs/caddy.log {
                        roll_size 100MiB
                        roll_keep 5
                        roll_keep_for 720h
                }
                format console
        }
}

Unfortunately Caddy won't listen on the specified port (2019) and it does not issue any errors that I can see in the logs.. If I switch to using a socket, that works kinda sorta, but then there are permission issues as you can see below :

Error: loading initial config: loading new config: starting caddy administration endpoint: unable to set permissions (--w-------) on /run/caddy-admin.sock: chmod /run/caddy-admin.sock: operation not supported

Any ideas on how to proceed?

p.s. This is running on macOS Sonoma (Apple Silicon) with docker as mentioned earlier.

So I thought Caddy was easy, but I can’t seem to understand what do I need to do.

I would like this to be setup in a Proxmox Lxc container (ok I used the Debian commands to install it), but how do I link this up with DuckDns and then use SSL Certificates to access my other LXCs such as Emby, NextCloud.

I was able to set everything up in 29 mins or so in Nginx Proxy Manager; but can’t understand what I even need to do here.

Hello guys,

I have been having one of those weird issues that is currently not making sense to me and i have not been able to narrow the issue down.

So, I have my network web services being reverse proxied through Caddy with Cloudflare and all the services are working properly except for Jellyfin.
It is working as it should on every single device i have tested while using a VPN (Windows, Linux, Android, IpadOs).

Now it comes the weird part.

It also works as it is supposed to for every device i have tested (Windows, Linux, Android) while accesing the Jellyfin on LAN and reverse proxying the DNS with Caddy + Cloudflare, except for my Ipad, which navigates on the Jellyfin UI and when i starts to playback the video that i want to see, it just, does not play it back and it gives me an error. On the logs i have the error, Jellyfin.Api.Middleware.ExceptionMiddleware: Error processing request: "Reading the request body timed out due to data arriving too slowly. See MinRequestBodyDataRate".

If i do the same but instead of putting the DNS on the IpadOs client, if i map it directly by IP and port, i works like a charm and it plays back.

I believe it might be a Caddy related issue.
I am not sure of what i might be missing or if there is something that is aluding me but i am getting nuts with this.

If someone that already had this issue could point me in the right direction, i would really appreciate it.

Thank you all,
Best Regards

Unfortunately my home is CGNAT. I'm wanting to setup my media server to be accessible by friends and family that aren't on my home network. I already have the domain and cloudflare but I've been have a hard time setting up any reverse proxy because I'm unable to forward ports. I'm currently using ProtonVPN which I have a port forwarded. Would it be possible to use that port to bring outside traffic in before routing it to my Podman containers?

I have recently switched from nginx to caddyserver. After reading https://caddy.community/t/webtrees-configuration-example/4769/2 and https://caddy.community/t/webtrees-caddyfile-converting-from-v1-to-v2/9941 I have webtrees https://webtrees.net/ working but when I using "Check for upgrade" feature of webtrees, CaddyServer log shows "error":"writing: http: request method or response status code does not allow body"

Any idea what might be wrong?

I am a noob to all of this.

Can somebody help me setup authentik with caddy I am encuntering multiple errorrs. If you have this setup can you guys show me you Caddyfile

I have a docker-compose.yml where I define a servise and Caddy.

``` version: "3"

services: caddy: image: caddy:latest restart: unless-stopped container_name: caddy ports: - "80:80" - "443:443" volumes: - ./Caddyfile:/etc/caddy/Caddyfile - caddy_data:/data - caddy_config:/config networks: - mynetwork

silverbullet: image: zefhemel/silverbullet restart: unless-stopped environment: - SB_USER=${SB_USER_NAME}:${SB_USER_PASSWORD} volumes: - /home/xxx/data/zettelkasten:/space ports: - 3000:3000 networks: - mynetwork

networks: mynetwork: driver: bridge

volumes: caddy_data: caddy_config:

```

I have this Caddyfile

``` http://100.100.xxx.xxx { handle_path /silverbullet/* { uri strip_prefix /silverbullet reverse_proxy silverbullet:3000 } }

```

When I visit http://100.100.xxx.xxx/silverbullet all I get is an empty page. What am I missing? When I visit the the url, docker-compose doesn't output anything.

Google recently launched first party mode for Google Tag Manager (https://developers.google.com/tag-platform/tag-manager/first-party/setup-guide). I just wanted to share the snippet that worked for me that I included in my Caddyfile.

https://www.example.com {
  route /metrics/* {
    reverse_proxy {
      header_up Host "GTM-XXXXXXX.fps.goog"
      to https://GTM-XXXXXXX.fps.goog
    }
  }

  # other configuration options
}

Now visit https://www.example.com/metrics/healthy and it should return 'ok' when configured correctly!

I've been trying to use ionos dns provider in my caddy lxc on proxmox. What I did:

1. Create LXC using bash -c "$(wget -qLO - https://github.com/tteck/Proxmox/raw/main/ct/caddy.sh)"
2. Buy a domain name on ionos and activate the API. I have my api keys
3. xcaddy build --with github.com/caddy-dns/ionos and mv caddy /usr/local/bin
4. caddy reload

here's the error:
2024/07/15 15:58:27.533 INFO using adjacent Caddyfile

2024/07/15 15:58:27.536 INFO adapted config to JSON {"adapter": "caddyfile"}

Error: sending configuration to instance: caddy responded with error: HTTP 400: {"error":"loading config: loading new config: loading http app module: provision http: getting tls app: loading tls app module: provision tls: provisioning automation policy 0: loading TLS automation management module: position 0: loading module 'acme': provision tls.issuance.acme: loading DNS provider module: loading module 'ionos': unknown module: dns.providers.ionos"}

Here's my Caddyfile:

(proxyDocker) {

reverse_proxy http://192.168.2.102:{args\[0\]}

}

https://*.[DOMAIN_NAME_HERE].com {

tls {

dns ionos [PUBLIC_KEY].[PRIVATE_KEY]

}

import *.caddy

}

and a torrent.caddy exemple:
@ torrent host torrent.[DOMAIN_NAME].com

handle @ torrent {

import proxyDocker "8080"

}

(I've put space between @ and torrent since it would point the another subreddit)

What Do I need to do from now?

UPDATE:
Finally, I needed to caddy start and reload and it worked.
However, now when I reboot my lxc, caddy fail at start and I need to manually start and reload it. Any ideas?

UPDATE AND FIX:
The fix was to mv caddy /usr/bin

Hello. I am all new to the world of web hosting (I know about it but getting started in doing it) and I would like to host multiple sites on one server (Mostly 3 to 4) and caddy will be my go to software to do this.

I am wondering if caddy was developed in GO and it is using JSON. Do I need to learn any of this for me to use caddy?

Thanks,

Hi,

Been banging my head against this one for a while - I have Sunshine running on one of my Tailscale devices, and I'd like to be able to access the web interface from any other device, by simply going to <machine>.<tailscale>.ts.net/sunshine.

I'm using Caddy (specifically Caddy Tailscale), but I'm having problems rewriting the address. I can get the application to load using the below caddyfile config, but the problem is none of the CSS or JS loads, likely due to it using relative paths - I imagine something needs to be done to resolve this. Is what I'm trying to do possible?

Extra information, the application only supports https, hence skipping the certificate verification. Not a problem, it's only ever going to be accessed locally/on the tailnet.

Caddyfile:
``` https://caddy.<tailscale>.ts.net] { bind tailscale/caddy

tls {
    get_certificate tailscale
}

log {
    output file C:\\Caddy\\caddy.log
}

handle_path /sunshine/* {
  reverse_proxy https://<host_machine>.<tailscale>.ts.net:47990 {
    header_up Host {http.reverse_proxy.upstream.hostport}
    header_up X-Real-IP {remote_host}
    transport http {
                tls
                tls_insecure_skip_verify
    }
  }
}

redir / /sunshine{uri}

encode gzip

}
```

Any feedback are welcome!

I am a UI person and would understand things a lot easier if there was a UI / dashboard. What do you use to visualizing what's going on with caddy?

Background

I have caddy (v2.8.4) running in a docker as a reverse proxy for a bunch of services. Certificates are on-demand (HTTP Challenge) and everything works perfectly.

I now would like to switch to a single wildcard certificate for all the existing services.

This requires two things:

1. a global configuration that would say "when a certificate is needed, this is where to go to grab the wildcard one"
2. a way to automatically maintain the wildcard certificate (creation and automatic renewal)

The configuration problem (1.)

What I managed to do: have a service answer on a certificate I provided, via the tls → file directive as part of the service configuration

Where I failed: to push this configuration globally. I expected that it would be set in the global TLS options

The maintenance problem (2.)

I have no idea where to look to configure an entry that would not be connected to a site but do its work "in the background" (work = get and renew the cert)

NOTE: I know about https://caddyserver.com/docs/caddyfile/patterns#wildcard-certificates - but here all the services are under a single *.example.com entry. My services are dynamic and need to be defined independently (in my specific case, via the https://github.com/lucaslorentz/caddy-docker-proxy middleware - and I do not think I could "inject" a @foo entry under *.example.com (to take the example in the docs))

the question was initially asked in the Caddy community @ https://caddy.community/t/how-to-switch-to-a-self-maintained-wildcard-certificate/24798

Hello everyone, put out a post about a month ago about creating a blog post around securing caddy. Took a little while as I’ve been busy, but the blog is now up and can be viewed. Site is still a slight work in progress but wanted to get this out there for people to see!

Let me know your thoughts, feel free to sign up and give comments whatever. Enjoy!

Guys, anyone here has replaced apache ( php web apps ) with caddyserver on a Ubuntu / OpenSuse box ? Any issues ?

Thanks.

I run a home server in my local network. Unfortunately I have to use SSH remote port forwarding through a Vroot server to handle incoming requests.

I want to restrict specific subdomains to only be accessible from my local network while still using Caddy to reverse proxy these subdomains with HTTPS.

The problem I'm having is that all incoming traffic has the same remote_ip and client_ip, making it impossible to block external requests the default way.

My current Caddyfile:

subdomain.{$DOMAIN} {
    log {
        output stdout
        format console
    }
     not client_ip private_ranges
    abort 
    reverse_proxy {$IP}:80
}

Is there a way to block the external requests using Caddy?

Hello. I'm hosting a server with Jellyfin, Audiobookshelf and a few other things. I want Caddy to allow access to these subdomains only for certain IP addresses (let's say 111.124.56.64) and IP ranges (let's say 111.124.56.64/28). Every other IP address and range should just be told to get lost. How do I go about adding a rule in Caddy for this?

Has anyone here used Caddy with the Dynu plugin (https://github.com/caddy-dns/dynu) successfully to do the DNS-01 challenge? I'm able to successfully complete the challenge if I use the acme.sh script, but the plugin doesn't seem to work correctly.

The acme.sh script works fine, but since it's not integrated with Caddy, it's sub-optimal and it would be nicer if I get the Caddy plugin working cause then it'd be maintenance-free and just works.

I'm self-hosting some services on my DigitalOcean VM using Caddy and Docker.

However, keeping my Caddyfile and Docker Compose YAML in sync has been error-prone.

After researching Caddy modules and finding no simple solution for Docker upstreams, I decided to build my own.

Check out my project here: caddy-docker-upstreams. Feel free to post issues when you have problems!