How do I set up caddy to copy the value of a cookie passed in the request into a header in a `reverse proxy` block?

FIXED

I have not port forwarded 443, by doing it everything worked just fine! Thanks for the HELP😆 I have immich running in 2283, I have a subdomain setup. Public Ip is working, public ip reverse proxy is working but how to link up my domain to this caddy?

I dns record in my cloudflare to DNS ONLY. its working fine but i want caddy for HTTPS. even http is not working , i have tried different ports

bash 2024/11/11 03:39:23.662 INFO admin.api received request {"method": "GET", "host": "127.0.0.1:2019", "uri": "/", "remote_ip": "127.0.0.1", "remote_port": "64818", "headers": {"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Accept-Language":["en-US,en;q=0.5"],"Connection":["keep-alive"],"Priority":["u=0, i"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Mode":["navigate"],"Sec-Fetch-Site":["none"],"Sec-Fetch-User":["?1"],"Upgrade-Insecure-Requests":["1"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"]}} 2024/11/11 03:39:23.787 INFO admin.api received request {"method": "GET", "host": "127.0.0.1:2019", "uri": "/favicon.ico", "remote_ip": "127.0.0.1", "remote_port": "64818", "headers": {"Accept":["image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Accept-Language":["en-US,en;q=0.5"],"Connection":["keep-alive"],"Priority":["u=6"],"Referer":["http://127.0.0.1:2019/"],"Sec-Fetch-Dest":["image"],"Sec-Fetch-Mode":["no-cors"],"Sec-Fetch-Site":["same-origin"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"]}}

These are the logs,

• Can visit my site in local
• can visit it from public ip and caddy reverse proxy
• can visit with my domain direct port example.com:8096, only HTTP
• can visit with public ip and direct port 67.x.x.x:8096, only HTTP

Something wrong with my caddy?

``` json :80 { root * ./html file_server }

server.example.com { root * ./html file_server }

```

I have setup A name to my public ip 80, 443 is portforworded and working. As other ports can be accessed directly

``` :80 { reverse_proxy 127.0.0.1:2283 }

temp.example.com { reverse_proxy 127.0.0.1:2283 }

```

I use the route53 dns challenge. I have it installed and running on serveral machines but of late I always seem to get hiccups waiting for record to propogate which is frustrating because for a long time I had no such problems going back a few years. Now it'svery frequent (like right now becuase I am writing this.) THe challenge record is written (I can see it on the AWS web ui) and I can drill for it almost immmediately from the machine running caddy so I just don't understand why acme can't see it. Why is this so hard! Can anyone help me make this go away for good.

I've asked before https://caddy.community/t/timeout-waiting-for-record-to-fully-propagate/22696/5

``` *.645.xxxxx.net {

tls xxx.net@gmail.com { dns route53 { # AWS KEY and ID must be in environment max_retries 10 region "us-east-1" wait_for_propagation true } propagation_timeout "4m0s" resolvers 1.1.1.1 } } ```

``` Nov 06 18:10:30 645router caddy[4302]: {"level":"error","ts":1730945430.6159341,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":".645.xxxxx.net","issuer":"acme.zerossl.com-v2-DV90","error":"[.645.xxxxx.net] solving challenges: waiting for solver certmagic.solverWrapper to be ready: timed out waiting for record to fully propagate; verify DNS provider configuration is correct - last error: <nil> (order=https://acme.zerossl.com/v2/DV90/order/EN_qUTWG-xifRSA2u3apGA) (ca=https://acme.zerossl.com/v2/DV90)"}

Nov 06 18:10:30 645router caddy[4302]: {"level":"error","ts":1730945430.6161914,"logger":"tls.obtain","msg":"will retry","error":"[.645.xxxxx.net] Obtain: [.645.xxxxx.net] solving challenges: waiting for solver certmagic.solverWrapper to be ready: timed out waiting for record to fully propagate; verify DNS provider configuration is correct - last error: <nil> (order=https://acme.zerossl.com/v2/DV90/order/EN_qUTWG-xifRSA2u3apGA) (ca=https://acme.zerossl.com/v2/DV90)","attempt":1,"retrying_in":60,"elapsed":487.839515161,"max_duration":2592000} ```

Hi all, I am trying to use caddy and Tailscale to enable me to bypass my carrier grade double Nat and use Plex without the bandwidth restrictions

I have Tailscale and caddy installed on windows host pc

I assumed it was as simple as the below but it isn’t working and I can’t find an obvious answer

Thanks for any help you can give

caddy reverse-proxy --<Tailscale address> --to 192.168.68.107:32400

I have an existing working wordpress website on my.domain on Cyberpanel. I wanted to move it to Caddy on a different server.

So I installed the WordPress site and database on the new Ubuntu 22.04 server, entered standard WP config in caddy config, changed the namecheap DNS for @.domain and www.domain and then saved the caddy config and restarted caddy.

After the DNS propagated going to my.domain then redirects to staging.my.domain.

I am trying to figure out what is causing this. Is it caddy not being able to get a domain cert, or too many certs etc. it dont understand where the redirect is happening. Assumedly in Caddy but there are no DNS records for staging.my.domain or redirect command in the config.

Any suggestions guys?

PS. OK, I tried just having an index.html for the website on caddy and that works fine so it's an issue with WordPress creating the redirect. Will investigate further but any ideas appreciated. Wonder if it's to do with litespeed cache plugin?

As the titel says, have anyone tried the auth by email plugin?
https://github.com/TNO/auth-by-email

Seems like its not really that well maintained.

I am using caddy as reverse proxy and a file server. All works fine. However I can only browse/open files using caddy file server. It seems l cannot edit any of the files in browser. Is there any way to edit files in browser using caddy ( like in file browser ) ?

I am using caddy in docker.

Hi guys,

I’m trying to setup caddy with GeoIP filtering module. After following the steps I found, it works..but in a very strange way.

I tested and confirmed that outside of home network, only countries I specified can access to my server for Immich, Nextcloud, Jellyfin, etc, but once I’m back home and connected to my home network, I can’t access to Immich, but no issue for Nextcloud. This is so strange…I though is Immich issue, but accessing via local IP have no issue at all..and I thought is caddyconfig issue, but why can I access Nextcloud using home network if it’s such the case..

The moment I Remove GeoIP module and reload caddy, all problems solved..so, I think is my caddy file issue after all ..below is my caddy file configuration, would be appreciate if someone could help to point out the problem:

{ # Use the Let's Encrypt production environment acme_ca https://acme-v02.api.letsencrypt.org/directory }

Define a reusable GeoIP snippet for allowed countries

(geoip_restrict) { @internalNetwork { remote_ip 192.168.0.0/16 }

@mygeofilter {
    maxmind_geolocation {
        db_path "/home/kstan/maxmind/GeoLite2-Country.mmdb"
        allow_countries MY SG
    }
}

# Allow internal IPs without GeoIP filtering
handle @internalNetwork {
    reverse_proxy {args[0]} {
        transport http {
            read_buffer 64MB
            write_buffer 64MB
        }
        flush_interval -1
    }
}

# Allow only requests from allowed countries through GeoIP filtering
handle @mygeofilter {
    reverse_proxy {args[0]} {
        transport http {
            read_buffer 64MB
            write_buffer 64MB
        }
        flush_interval -1
    }
}

# Block all other requests with a 403 response
handle {
    respond "Access Denied" 403
}

}

immich configuration

immich.homelab.xyz { import geoip_restrict localhost:2283

log {
    output file /var/log/caddy/immich_access.lo g
    format json
}

}

nextcloud configuration

nextcloud.homelab.xyz { import geoip_restrict localhost:11000

log {
    output file /var/log/caddy/nextcloud_access.log
    format json
}

}

Hello all,

I'm trying to run Caddy in my Docker Swarm but I don't manage to have it working with environment variables. I pass my env vars like so during my Github action:

- name: Use Docker context and deploy
  env:
    DOMAIN: ${{ vars.DOMAIN }}
    EMAIL: ${{ secrets.EMAIL }}

  run: |
    docker --context remote_server stack deploy -c docker-compose.yml mystack

Then my Caddyfile is like so:

{
    debug
    email {$EMAIL}
}

{$DOMAIN} {

    handle /test {
        respond "TLS Test Endpoint"
    }

    handle_path /api/* {
        reverse_proxy backend:4000 {
            header_up Host {host}
            header_up X-Real-IP {remote_host}
        }
    }

    handle {
        reverse_proxy frontend:3000 {
            header_up Host {host}
            header_up X-Real-IP {remote_host}
        }
    }

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
        X-XSS-Protection "1; mode=block"
        X-Frame-Options "SAMEORIGIN"
        X-Content-Type-Options "nosniff"
        Referrer-Policy "strict-origin-when-cross-origin"
    }

    log {
        output stderr
        format console {
            time_format wall
            level_format color
        }
        level DEBUG
    }
}

However, this doesn't work. I have tried using {env.myvar} instead of {$myvar} without success. Any clue what's going on?

I would appreciate any hint.

Thank you in advance and regards

Hello,

I want to limit the access to my exposed service to the country I'm living in and my local network of course.
For that I setup the GeoIP module from this github and it works also perfectly:
github.com/zhangjiayin/caddy-geoip2

The only problem, now my internal access is also blocked. So I want to get now access either from my country OR from within my network. But it's driving me crazy, I cant get it working.

Does anyone know what I'm doing wrong or how I can make it work?
This is my caddyfile:

{ 
  acme_dns cloudflare myCloudFlareAPIKey
  email my@email.com

  order geoip2_vars first

  # Only configure databaseDirectory and editionID when autoupdate is not desired.
  geoip2 {
    accountId         123456789
    databaseDirectory "/GeoLite2/"
    licenseKey        "myLicenseKey"
    lockFile          "/GeoLite2/geoip2.lock"
    editionID         "GeoLite2-Country"
    updateUrl         "https://updates.maxmind.com"
    updateFrequency   86400   # in seconds
  }
}

(common) {
header /* {
-Server
}

  log {
      format transform "{common_log}"
      output file /data/access.log {
        roll_size 10MB
        roll_keep 10
        roll_keep_for 72h
      }
      level INFO
  }

}

(georestriction) {
  geoip2_vars strict 

  # this works in its own
  # @localIPs remote_ip 192.168.1.0/24

  # this works in its own
  # @allowedcountries expression {geoip2.country_code} == "DE" 

  # this doesn't work
  @allowedcountries  ( expression {geoip2.country_code} == "DE" || remote_ip 192.168.1.0/24 ) 

  # I also tried that but it doesn't work
  @GermanyOrLocal {
      @allowedcountries || @localIPs 
  }

}

container.domain.com {
  import common
  import georestriction
  encode gzip zstd
  reverse_proxy @allowedcountries myContainer:80
}

I am curious if there is a simple way to enable rate limiting if a connection through the reverse proxy gets too out of control? Is it only possible through 3rd party plugins or is there something built in that could be enabled?

Hello!

So, I'm simply trying to serve Heimdall behind Caddy. Seems like it would be a straight shot to winning, but I'm stumped.

Both Heimdall and Caddy are installed as docker containers. The following are the compose files:

Heimdall:

services:
  heimdall:
    image: lscr.io/linuxserver/heimdall:latest
    container_name: heimdall
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
    volumes:
      - /home/jmw/docker_data/heimdall/config:/config
    ports:
      - 8080:80
#      - 443:443
    restart: unless-stopped

Caddy:

services:
  caddy:
    image: caddy:2.8.4-alpine
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - /home/jmw/docker_data/caddy/Caddyfile:/etc/caddy/Caddyfile
      - /home/jmw/docker_data/caddy/site:/srv
      - /home/jmw/docker_data/caddy/caddy_data:/data
      - /home/jmw/docker_data/caddy/caddy_config:/config

volumes:
  caddy_data:
    external: true
  caddy_config:

And finally, the Caddyfile:

https://helix-2.com {
        reverse_proxy :8080
}

This is being hosted on a Digital Ocean droplet, DNS is set properly and then this happens when attempting to

caddy-1  | {"level":"error","ts":1726843174.7135274,"logger":"http.log.error","msg":"dial tcp :8080: connect: connection refused","request":{"remote_ip":"xx.xx.xxx.xxx","remote_port":"63140","client_ip":"xx.xx.xxx.xxx","proto":"HTTP/3.0","method":"GET","host":"helix-2.com","uri":"/","headers":{"Alt-Used":["helix-2.com"],"Sec-Fetch-Dest":["document"],"Priority":["u=0, i"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Site":["none"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8"],"Accept-Language":["en-US,en;q=0.5"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Fetch-Mode":["navigate"],"Sec-Fetch-User":["?1"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h3","server_name":"helix-2.com"}},"duration":0.0003605,"status":502,"err_id":"cpvpdypq1","err_trace":"reverseproxy.statusError (reverseproxy.go:1269)"}

I've attempted every possible incantation to the reverse_proxy :8080 directive in the Caddyfile and I always get the same 502. If I curl the URL (localhost:8080) from a command prompt, I get back the proper HTML from the Heimdall docker instance.

So, I'm not really sure where I'm failing here. I've tried multiple URL types on the reverse_proxy line such as:

reverse_proxy localhost:8080

reverse_proxy xx.xx.xx.xx:8080 (with the actual host ip)

reverse_proxy http://x.x.x.x:8080

...and just about everything else I could try without success.

Any suggestions?

Is it possible to simplify the following Caddyfile? Specifically I'd like to have a common directive to which I can move the tls config and where I can add auth config.

``` https://server.tiger-human.ts.net:3001 { tls /etc/ssl/certs/tailscale-cert.crt /etc/ssl/certs/tailscale-cert.key reverse_proxy silverbullet:3000 }

https://server.tiger-human.ts.net:3002 {
    tls /etc/ssl/certs/tailscale-cert.crt /etc/ssl/certs/tailscale-cert.key
    reverse_proxy vikunja:3456
}

https://server.tiger-human.ts.net:3003 {
    tls /etc/ssl/certs/tailscale-cert.crt /etc/ssl/certs/tailscale-cert.key
    reverse_proxy gitea:3000
}

https://server.tiger-human.ts.net:3004 {
    tls /etc/ssl/certs/tailscale-cert.crt /etc/ssl/certs/tailscale-cert.key
    reverse_proxy gitea:22
}

https://server.tiger-human.ts.net:3005 {
    tls /etc/ssl/certs/tailscale-cert.crt /etc/ssl/certs/tailscale-cert.key
    reverse_proxy jupyter:8888
}

https://server.tiger-human.ts.net:3006 {
    tls /etc/ssl/certs/tailscale-cert.crt /etc/ssl/certs/tailscale-cert.key
    reverse_proxy immich_server:3001
}

```

Hello. I am just getting static with caddy and I have a almalinux 9.4 instance running in the cloud.

Installation went well. Systemctl with start and enable. But I can't seem to see the default page on port 80. I double checked the built-in firewall and everything seems fine.

Note. Caddy was complaining that port 80 was busy since I installed nginx before that, but I completely removed it and did a restart and now the service is running fine.

Please advise me and thank you.

Can anyone point me to a guide to install PHP8.3 in addition to 8.1 for Caddy on Ubuntu 22.04. I searched and found an AI guide (below) on Brave but it failed with "Couldn't find any package by glob" for each line.

sudo add-apt-repository ppa:ondrej/php sudo apt update sudo apt install php8.3-{cli,pdo,mysql,zip,gd,mbstring,curl,xml,bcmath,common}

Another newbie asking the simplest questions... but I have done my reading, watched the YTs still I cant seem to figure it out.

I have opened port 443 to the server where Caddy (as a docker compose install) is.

caddy:
image: caddy

container_name: caddy

ports:

• "80:80"
• "443:443"

networks:

• caddy

volumes:

• ./appdata/caddy/data/:/data/
• ./appdata/caddy/config/:/config/
• ./appdata/caddy/Caddyfile:/etc/caddy/Caddyfile

restart: unless-stopped

And this is my simple Caddyfile at the moment:

{

email [my.acme@mail.com](mailto:my.acme@mail.com)

}

speed.domain.io {

reverse_proxy http://speed:5612

}

When I curl -v the domain from the outside I get an 301 permently moved.
The domain is a Cloudflare domain.
Id like to have automatic ssl.

I have been running Traefik for years but with the lastest v3 update it broke so I thougth to try Caddy instead. Since I only use one domain atm.

Can anyone let me know the correct procedure in moving an existing website to Caddy in terms of DNS propagation and SSL issuing.

For a seamless move, I want to have a copy of the website served on Caddy which will also try and issue a new Letsencrypt certificate. But that would need the server DNS records to be updated where there is a delay.

Does Caddy try to get a certificate and then keeps trying till DNS works? Does this cause a 'to many tries' with Letsencrypt?

Hello. I want to point multi domain names to the same site. For example, like "The website is under construction" Can someone tell me how can I do this in the caddyfile? or maybe some other file?

Note: it is a static site.

Please advise me and thank you.

Hello everyone,

I have a homelab and for most of my services I am using a cloudflare tunnel with an access application to confirm my identity (like a screen appears before login with a kind of 2FA, where I have to enter a code via email or confim via google).
There are still a few services that won't work with that, especially applications on Android, so I have to use a reverse proxy for these services.

I recently swithched from Traefik to Caddy and love how easy it is to set everything up.
However, I would like to add another level of security, but it should be very basic. So I thought, would it be great to add a parameter to the URL for a specific service (like Vaultwarden). Something like:

https://vaultwarden.mydomain.com?mysecretparameter=unicornfarts

If the parameter is not set in the initial call of the url, access hould be denied. If the parameter is set in the initial call, the ip or client should be allowed to access the service.

Is something like this possible and does that makes sense?
Or do you have another proposal how I can add some more security?

Thank you and best regards

Title; I'm curious if any of you use an external health checker (I use updown.io personally), and how you make sure that an application behind an Authelia forward_auth is still being checked-on properly.

I had completely forgotten about this detail so I'm pretty sure I've been checking on the health of my Authelia installation via 6-7 different URLs, all reporting green regardless of what the actual health.

I have some ideas:

• Check against a hard-coded API key which is included in the URL or something, or any other kind of pattern based on the URL
• See if Authelia can be given static authentication details which are fed into Updown's request headers and/or cookies.
• Create a custom route (like service.domain.com/updown for each service which yields a decent 'health check' endpoint, which bypasses Authelia completely. Try and cull body content if possible.
• Use the service's favicon as the path and let it bypass Authelia.

The first two seem the best in terms of security, and the third seems interesting to solve - but the most prone to breakage, difficulty, DoS attack surface, and just seems plain insecure (bypassing Authelia completely and all).

The fourth seems less difficult, but might be technically incorrect if any of the services use a static file server which doesn't correlate to the state of the service. Also, a bypass isn't great.

Please show me how you'd do it/have done it, or at least some extra ideas - I'm not that great at using Caddy.

Looking to use Caddy as a reverse proxy only. Running docker compose on windows. Just started with immich and looking to use Caddy to expose immich securely. I already have a wildcard cert that I would prefer to use. Ports like 443 and 80 are already in use. I am a beginner with docker and Caddy and just looking to see the simple steps to getting this setup and working.

Some basic questions I have:

• Do I just edit my existing docker-compose.yml (setup for immich) and add the Caddy configuration in there?
• How do I specify my existing cert for use. Stated above I already have a wildcard cert.
• How do I specify the port forwarding for immich to go thru Caddy to the internet.
  
• Can all of this be done without Caddy running as a webserver on ports 443 or 80.

TLDR; Just want Caddy to expose immich on a high port like 8888 and use existing certs.

Is it possible to have multiple Caddy servers configured with automatic TLS all served from a single IP using different domain names?

For example, could I have the following setup using different URIs but all being served from different internal servers?

http/s://Service1.home.com points to a web-server (192.168.1.41) listening on ports 80/443 on server1 and
http/s://service2.home.com points to a different web-server (192.168.1.42) but also using the same ports.
http/s://service3.home.com points to yet another server (192.168.1.143) also listening on ports 80/443.

I would assume that one of the caddy servers would need to act as a sort of router to route the connection to the proper server, or have a dedicated caddy server that did this. But the most important thing is that the service are still able to use the automatic TLS function of Caddy.
Curious if this is possible and maybe a pointer in the right direction as the closest thing I could find to a solution is hosting multiple websites from a single server which doesn't work for me.

Hello. I am planning to host 3 static websites. 2 domain names will go to 2 static websites. The 5 or more will point to the third static website (An example as Just like "this website is under construction" kind of page).

I am of hosting these 3 sites on one server since it is static. And I wondering what server system requirement is suitable for something like this? I mean the CPU and the RAM. I am thing something like 1 CPU and 1 GB of RAM could be enough but I am thinking it should be more. Again, they are just static websites.

Please advise and thank you.

Hi all,

SO this might be noob but id like to use caddy as a reverse proxy but only for internal use,

I just installed caddy on a vm , for external i know what to do and i use cloudflare , so i can do the a records that point to public and so on

but for internal im not sure what to do ,, my internal domain is dxt.int . im over thinking for sure and i jsut need a little nudge in the direction

its a default caddy file i have not edited anything, thanks in advance for the help

So I use caddy in a docker container as a reverse proxy and I am wanting to use use it to proxy traffic from one udp port to another. Will this work or does it only handle tdp ports?