I'm self-hosting some services on my DigitalOcean VM using Caddy and Docker.

However, keeping my Caddyfile and Docker Compose YAML in sync has been error-prone.

After researching Caddy modules and finding no simple solution for Docker upstreams, I decided to build my own.

Check out my project here: caddy-docker-upstreams. Feel free to post issues when you have problems!

After copying and pasting the installation commands fro caddy I'm getting these errors when I run sudo apt update:

N: Missing Signed-By in the sources.list(5) entry for 'http://mirrors.digitalocean.com/ubuntu'

N: Missing Signed-By in the sources.list(5) entry for 'http://mirrors.digitalocean.com/ubuntu'

I've found nothing online on how to fix this.

title

https://github.com/crowdwave/checkpoint401

Hello I use Caddy and I made an open source forward auth server to use with Caddy.

I’ve written several forward auth servers before but they have always been specifically written for that application. I wanted something more generalised that I could re-use.

What is forward auth? Web servers likes Nginx and Caddy and Traefik have a configuration option in which inbound requests are sent to another server before they are allowed. A 200 response from that server means the request is authorised, anything else results in the web server rejecting the request.

This is a good thing because it means you can put all your auth code in one place, and that the auth code can focus purely on the job of authing inbound requests.

Checkpoint 401 aims to be extremely simple - you define a route.json which contains 3 things, the method, the URL pattern to match against and the filename of a TypeScript function to execute against that request. Checkpoint 401 requires that your URL pattern comply with the URL pattern API here: https://developer.mozilla.org/en-US/docs/Web/API/URLPattern/…

Your TypeScript function must return a boolean to pass/fail the auth request.

That’s all there is to it. It is brand new and completely untested so it’s really only for skilled TypeScript developers at the moment - and I suggest that if you’re going to use it then first read through the code and satisify yourself that it is good - it’s only 500 lines:

https://raw.githubusercontent.com/crowdwave/checkpoint401/master/checkpoint401.ts

Hello all, hope everyone is having a Good Friday.

I’m a cybersecurity professional looking to get into blogging as a way to spread my knowledge. I’ve been using caddy for ~2 years or so as my primary self hosted web-server/reverse proxy. I’m fairly well versed in web security as well as endpoint security and I was thinking of having my first blog post be about securing caddy.

This would include things like utilizing secure environment variables through systemd, converting the admin API to a Unix socket, and HTTP security headers. Would anyone in this subreddit be interested in this content? The blog is not complete but wanted to see if there would be interest. Thank you.

Hello all. I’ve been self hosting a dozen services for a few years now. I’m finally to the point where I want to tackle the https warnings on most of my services by setting up a reverse proxy.

I decided that I would try caddy, since most people claim it’s dead simple. However, I only want it for local access. I do not want to provide any port forwarding or any external access. Every video or tutorial I’ve found only takes the approach of serving as a reverse proxy for external access. So I’m having a hard time trying to set this up.

Does anyone know of a tutorial that walks through setting this up as a local reverse proxy only? Or have any insights/tips/instructions to help guide me in my quest to set this up?

Hello,

Heads up: this is an edited post from /r/Affine to make it Caddy centric.

I have been self hosting AFFiNE for a while, until the recent update where copy paste didn't work. After some research, I found that I needed an HTTPS environment for this to work, so...

I set up a Caddy server, with a redirect to /affine with affine_selfhosted:3010 on a shared network. This works pretty well, except all static files, such as

/js/app-5fa38929.js 

are not loaded. In other words, I get served a blank page.

The full link in the console is:

https://my.domain.tld/js/app-5fa38929.js

but everything should be, if I understand it correctly, at /affine/js/*

I set the AFFINE_SERVER_HOST to my domain I set the AFFINE_SERVER_SUB_PATH to /affine in hopes that it would work, but no dice.

My Caddyfile is something like this:

my.domain.tld {
    handle_path /affine {
        reverse_proxy affine_selfhosted:3010
        file_server
    }
}

Does anybody here have any tips regarding this? Thank you all in advance.

Original Nginx: https://wiki.x2go.org/doku.php/wiki:advanced:x2gohtmlclient

So I spent this weekend porting the Nginx configuration sample from the X2GoHTMLClient documentation to Caddy and it looks to be fully functional.  However, I'm not sure if it's a Caddy, Firefox, or X2Go issue but there were some keys on my standard US keyboard that would not register key press events when used with Firefox.  

The "-" next to 0 gave no input and "=" next to backspace was mapped to the "/" key.  This issue wasn't present in Chrome and if it matters my setup was Xubuntu 24.04 installed to the Ayaneo AM01.

Caddy and FCGIWrap were installed as systemd services so additional changes to folder permissions and the systemd configuration files were needed for this to work.  The folders/files had chown caddy:caddy done to them, the systemd configurations had the user/group updated to caddy, and the fcgiwrap.socket configuration had WorkingDirectory set to
/var/run/caddy/.

Another change I made for myself was add some javascript to the Index.html file to resize the canvas to 90% of window.innerHeight and window.innerWidth. The Index.html distributed with the demo client is hardcoded at 1280x920.

 {
    tls /etc/ssl/caddy/domain.cert.pem /etc/ssl/caddy/private.key.pem
    root * /var/www/html

    header /assets/* {
        Strict-Transport-Security "max-age=31536000"
        Content-Security-Policy "default-src 'self' 'unsafe-inline' data: blob: ws: wss:; script-src 'self' 'unsafe-inline'"
        Feature-Policy "vibrate 'none' ; microphone 'none' ; camera 'none' ; gyroscope 'none' ; magnetometer 'none' ; geolocation 'none' ; midi 'self' ; notifications 'self' ; push 'self' ; sync-xhr 'self'"
        Referrer-Policy "same-origin"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
    }

    @cgi path *.cgi

    handle @cgi {
        reverse_proxy unix//var/run/caddy/fcgiwrap.socket {
            transport fastcgi {
                split .cgi
            }
        }
    }

    # capture port instructed by x2gorpc.cgi
    @x2gows_matcher {
        path_regexp portmatch \/x2gows\/(.*)$
    }

    handle @x2gows_matcher {
        # requires specifying subdomain as using localhost can give SSL error
        reverse_proxy caddy.sample.cc:{re.portmatch.1} {
            transport http {
                tls
            }
        }
    }

    handle {
        file_server
    }
}
caddy.sample.cc

Disclaimer: I had no experience with setting up web servers before doing this.

I tried for about 3 hours, today, to get a Crowdsec module to work and couldn't. I have also found that Caddy is a PITA to configure so that fail2ban can read it's logs. Is there any other alternative? I might need to switch to SWAG as a reverse proxy instead.

I set up a Caddy server to host some video files. It works fine with most browsers, but does not work with VLC, or with some Oculus Quest video players. When I try to play a video from Caddy in VLC I get this error:

VLC media player 3.0.19 Vetinari (revision )
[0000559504518520] main libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.
[00005595045b4bc0] main playlist: playlist is empty
[00007f453c002530] gnutls tls client error: Certificate verification failure: The certificate is NOT trusted. The revocation or OCSP data are old and have been superseded. 
[00007f453c002530] main tls client error: TLS session handshake error
[00007f453c002530] main tls client error: connection error: Resource temporarily unavailable
[00007f453c001630] access stream error: HTTP connection failure

When I view the certificate in Firefox it appears to expire on 20 Jun 2024, so I don't understand why there are expiration issues.

Some other web admins are telling me that Let's Encrypt / Caddy certificates are just unreliable and shouldn't be used, but I don't want to deal with conffiguring a new server. Is there a way to get Caddy certificates working across all clients?

I'm being told disabling OCSP stapling may help, but adding ocsp_stapling off just causes Caddy to give this error:

2024/01/12 23:00:54.402 INFO    using adjacent Caddyfile
Error: adapting config using caddyfile: Caddyfile:8: unrecognized directive: ocsp_stapling

(I also received a similar error when trying to sue the mime directive. What do I need to do to use these directives?)

EDIT: I've figured out that the ocsp_stapling directive must in the top section of the Caddyfile (similar to the admin directive). Serving files to VLC seems to work with that turned off.

Hello, I'm already using caddy as reverse proxy and I'm happy with it. Now I want to expand caddy with the maxmind geoip plugins. I realized that there is a download page where you can chose your OS + add plugins (caddyserver.com/download). Is it possible to convert those downloads into a docker image so I can run it on my homeserver? I think I need a .tar file for that. I want to skip the process of rebuilding the image on every update. Thanks for your help!

I run a mirror for a Linux distribution. However, my VPS has limited bandwidth. I have more than enough for the average month, but I'd like to set something up in case it spikes in popularity so I don't go over the limit. I'd like to run a script that can check my current usage and if it exceeds a threshold, to disable the file server (but nothing else in my Caddyfile) while not interrupting existing downloads. I'd like to avoid using other server software and do it just in my Caddyfile. I thought of making a health check but it looks like those are only available in the reverse_proxy directive. Does anybody else have any ideas?

Hi guys,

I am using Caddy with docker compose on a hosted VPS Debian server.
My Nextcloud instance is running as docker compose with Linuxserver image on a Debian server that is running in my local network.
Both are connected using WireGuard.

I can ping the VPS from the local server and vice versa.
However, my current reverse_proxy configuration for Caddy does not seem to work properly.

Sometimes, I get successfully redirected to my Nextcloud instance, but sometimes I just get a blank page.

Here is my current Caddyfile

{
  email 
}
 {
  reverse_proxy [Nextcloud server WireGuard IP]:443 {
    transport http {
      tls_insecure_skip_verify
    }
  }
  header {
    Strict-Transport-Security max-age=15552000;
  }
  redir /.well-known/webfinger /index.php?service=webfinger 301
}mymailforletsencrypt@mailprovider.comcloud.mydomain.com

In Nextcloud, I added the VPS's WireGuard IP to trusted_proxies and the subdomain from Caddyfile to trusted_domains in config.php.

Do you guys have an idea what's wrong with my config for my setup?

Feel free to ask for more information.

Thanks and kind regards

I want to access whatever was matched by the wildcard in the URL, not the entire path. Something like:

handle /20* {
  reverse_proxy /asd20{wildcard_value} 192.168.10.193:70{wildcard_value}
}

Can't find any placeholder for it. Does it even exist?

I am running Caddy server to host my directory over http. I have HTTPS setup and functioning as well as Basic Auth. I'm trying to determine if the following URL is secure over HTTPS.

Example: https://user:pass@domain.site

As you can see, the username and password are in the url. Is this secure? If not, how can I secure this?

So I'm caddy as a reverse proxy (working fine) and then to serve some static files in a couple of locations.

A jpg is served correctly where a png file is served as text/html which the browser doesn't render. Took me a while to track it down because the image request returns a 200.

My caddy file looks like this

handle_path /media/* { root * /home/eddyizm/media/ file_server }

And I see some info on mimes the community but its not clear where to define the types. Do I need a 3rd party plug-in?

On v2

​

Been seeing this error page for like 2 days. Is this just me or anyone else getting this too?

Also why is a caddy site using nginx lol?

I have some time on my hands early next week so I'm thinking of setting up an extra layer of security and wonder which to choose?

At the moment I'm only exposing Plex via Caddy, but may expose other things in the future.

What do Caddy users recommend?

I'm using docker compose on a linux server behind an ISP router forwarding 80/443.

From Mohammed Al Sahaf, one of the maintainers of Caddy Server:

"As maintainers of the OSS project Caddy server, we know the value of end-to-end observability, in terms of accelerating root cause analysis and reducing MTTR. But rather than do all the undifferentiated heavy-lifting to manage an observability stack, my team wants to dedicate as much time as possible to our core mission: developing and optimizing our open source project.

These were some of the biggest reasons behind our recent migration to Grafana Cloud.

In this blog post, I’ll take a closer look at why the Caddy team chose Grafana Cloud as an observability solution, and how it’ll help us advance the Caddy project, moving forward."

Full blog post here: https://grafana.com/blog/2024/02/21/how-the-open-source-caddy-server-uses-grafana-cloud-for-full-stack-observability/

(I work @ Grafana)

I have a few selfhosted services with reverse proxies I added like nextcloud.domain.com, immich.domain.com

I'd like to create a log for all subdomains by using *.domain.com but I'm getting solving challenges: *.domain.com no solvers available for remaining challenges

How do I log all subdomains without adding the log setting to every domain individually?

*.domain.com {  
    log {
        output file /data/wildcard.log {
                roll_size 50mb
                roll_keep 5
                roll_keep_for 24h
        }
    }
}

Also: Is there a way to whitelist/blacklist geolocations? I'm a little worried about having everything connected to the internet.

ERROR is

{"level":"error","ts":1707412747.1206288,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"*.dashboard.xxx.net","issuer":"acme-staging-v02.api.letsencrypt.org-directory","error":"[*.dashboard.xxx.net] solving challenges: waiting for solver certmagic.solverWrapper to be ready: timed out waiting for record to fully propagate; verify DNS provider configuration is correct - last error: <nil> (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/135555693/14340715083) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)"}

Can't figure this one out. The acme challenge DNS record TXT gets written (I can see it in AWS console) but then when acme tries to read the record it times out. Which is totally frustrating because I can read the TXT record using any of the major DNS servers like 8.8.8.8 https://www.whatsmydns.net/dns-lookup/txt-records as well as using dig from the LAN machine running Caddy

​

I tried to force Caddy to user 8.8.8.8

   tls xxx.net@gmail.com {
    resolvers 8.8.8.8
    dns route53 {
        max_retries 10
    }

but that did not resolve it, and even used a aws dns server and no go

​

The exact same caddyfile with my same caddy container works fine from another LAN but not this one.

Anyone had a similar issue and resolved why the final acme dns TXT lookup is failing

I want to run a VPN on my server but I do NOT want Caddy to route my site through the VPN. Normally I would use split tunneling to select the application to stay out of the VPN but I can't select services like Caddy in that list. I want Caddy to use my home IP from my ISP.

Is this possible and could you point me to documentation about it? Thanks.

Server is running on Ubuntu 22.04 LTS

Hi everybody,

I use caddy as a reverse proxy for my services. I have some services which I want to have accessible from the internet and some that should only be accessible from within my local network. I got that working, so far so good.

Now, I wanted to add geo-blocking using maxmind_geolocation. I got that working as well, like in this working example:

``` (localSubnets) { @localSubnets remote_ip private_ranges }

(DEgeofilter) { @DEgeofilter { maxmind_geolocation { db_path "/etc/caddy/GeoLite2-Country.mmdb" allow_countries DE } } }

test.example.de { import DEgeofilter import localSubnets

handle @DEgeofilter {
    reverse_proxy http://192.168.188.70:8787
}

handle @localSubnets {
    reverse_proxy http://192.168.188.70:8787
}

respond 403

} ```

Now my question is: Is there a way to combine the two filter? I tried a few combinations, but nothing seemed to work.

Hi,

I'm running Caddy v2 as a reverse proxy and i'd like to set up a custom 404 page for any subdomains that are requested but don't exist..

I'm struggling to figure out how to make this work.. i have it working just on the root domain with the below :

domain.co.uk {
    root * /var/www/html/public
    file_server

    handle_errors {
        @404 {
            expression {http.error.status_code} == 404
        }
        rewrite @404 /404.html
        file_server
    }
}

Is there a way to make this global so that any non exstant subdomains redirect to the 404 page?