Caddy seems to good to be true? I just set it up and it works perfect, straight out of the box reddit / selfhosted ---------------------------------------------------------------------- Zestyclose_Car1088 · 2023-11-13 21:49 This seems too straightforward, what's the catch? Like how secure is it? Should I be turning it off (and disabling the port forwarding) when not using it? Do I need any additional security? Thanks ---------------------------------------------------------------------- madroots2 · 2023-11-13 22:03 Idk but I love it. Set it and forget it. I only use caddy now I realized. Lol. ---------------------------------------------------------------------- flaming_m0e · 2023-11-13 22:03 >This seems too straightforward, what's the catch? There isn't one. It's simple and it works great. >Like how secure is it? As secure as any other reverse proxy? >Should I be turning it off (and disabling the port forwarding) when not using it? Why? >Do I need any additional security? I would use Fail2Ban in addition...but always run a firewall and log the data. ---------------------------------------------------------------------- wtfblubby · 2023-11-13 22:09 It just runs... Two years straight. Some more services since start of caddy... No worries. Recently added auth with authelia... Still straight forward. Easy setup, always online. That's it. Period. ---------------------------------------------------------------------- autogyrophilia · 2023-11-13 22:14 The documentation it's surprisingly bad at explaining common patterns of use. It is also a bit thicker compared to nginx or HAproxy. ---------------------------------------------------------------------- thekrautboy · 2023-11-13 22:23 Caddy is very basic, and thats why it works so easily. There is nothing wrong with it. However it lacks some features that other reverse proxies offer. But if you dont need any of those, use Caddy. Additional security? Not directly. But fail2ban and CrowdSec are easily set up too. And Caddy also combines very well with Authelia for authentication. ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-13 22:27 Their localhost management API isn't that cool in terms of security. Thinking about possible SSRF attacks, or in multi-user/multi-tenant environments. Pretty sure they changed that quite recently though. ---------------------------------------------------------------------- adamshand · 2023-11-13 23:06 I switched from Traefik to Caddy a few years ago and have no ragrets. The only complaints I have about Caddy: - It doesn't support configuring virtual hosts automatically via docker labelsl (like Traefik). - Many features (like DNS auth for certs) require compiling Caddy. Which is easy but annoying. ---------------------------------------------------------------------- dazchad · 2023-11-13 23:25 > The documentation it's surprisingly bad at explaining common patterns of use. For real! Specially so with the combination of matchers and directives. ---------------------------------------------------------------------- dudeskeeroo · 2023-11-13 23:37 I went the other way! The docker labels feature is great. Caddy was fantastic, but I like the dynamic, outside -in configuration traefik gives you. ---------------------------------------------------------------------- EagerDevourer · 2023-11-14 01:02 Really? My experience was the opposite. I found everything I needed intheir docs rather quickly. I guess it's true they don't have as many basic examples as nginx, but I'd take their lack of example over the mess an nginx config can become any day. ---------------------------------------------------------------------- EagerDevourer · 2023-11-14 01:07 I'm wondering what those features are? What are the top 2 features you use most that are missing in Caddy? I used to go to nginx by default, but I switched to Caddy recently and I'm wondering what hurdles I'm setting up for myself. ---------------------------------------------------------------------- macka654 · 2023-11-14 01:13 What is it? Is it an alternative to unraid? ---------------------------------------------------------------------- 12_nick_12 · 2023-11-14 01:25 It's no different than NGiNX, put in your config and it just works. ---------------------------------------------------------------------- Hot_Nectarine_5816 · 2023-11-14 01:33 I started with caddy because it seemed to have the least complex config file even though the documentation lacks examples which I found really annoying when troubleshooting or trying any less basic stuff. I also found certificate related issues really hard to fix. Now I run nignx-proxymanager as a docker-container which unifies nearly all services into portainer for updating therefore making it easier to keep my stuff up to date. nginx-proxymanager is also much easier imo on the certificate side of things. I create wildcard certificates for a few domains and select the right one depending on the proxy I add. I also use forwards for a few of my shelly-devices which don't seem to work with proxies and make it easier for me to access them via a domain instead of memorizing a growing number of IPs. ---------------------------------------------------------------------- UnfetteredThoughts · 2023-11-14 01:56 https://caddyserver.com/ ---------------------------------------------------------------------- mrcaptncrunch · 2023-11-14 01:56 No, it’s a web server and reverse proxy. It automatically adds HTTPS using let’s encrypt certificates. ---------------------------------------------------------------------- FierceDeity_ · 2023-11-14 02:00 > As secure as any other reverse proxy? Just say you don't know, not everyone is a security researcher... ---------------------------------------------------------------------- brody5895 · 2023-11-14 02:05 Maybe just cause I'm still learning this stuff but I found the docs fairly challenging to comprehend too. Now that I get the basics though, it's pretty easy looking back ---------------------------------------------------------------------- allocx · 2023-11-14 02:20 I moved over in the past year from traefik and it was well worth it. Traefik is over-abstracted and I found it to break randomly and unpredictably when using docker labels. Debugging was a PITA too with the best solution being turning it off and on again (i.e. restarting it, or the service it was proxying). Caddy on the other hand just works. ---------------------------------------------------------------------- ForeheadMeetScope · 2023-11-14 02:20 Agreed, I had to build Caddy for the PowerDNS integration for LetsEncrypt certs, but it wasn't hard, just mildly annoying ---------------------------------------------------------------------- Anomalous11 · 2023-11-14 02:31 I recently discovered [Caddy-Docker- Proxy](https://github.com/lucaslorentz/caddy-docker-proxy) and it brought Caddy to a whole new level. If you're a fan of containers, check this out. A bit of a learning curve but so worth it once you've got the basics. I used to manually write Nginx configs for my homelab, and then I moved over to using NginxProxyManager, and now I'm on Caddy--and it has been an excellent progression. ---------------------------------------------------------------------- frex4 · 2023-11-14 02:39 Scrolling to find this. Reading caddy documentation sucks, even now I somewhat understand the concepts from caddy, I still get confused sometimes. ---------------------------------------------------------------------- clarksonswimmer · 2023-11-14 02:44 >It doesn't support configuring virtual hosts automatically via docker labels (like Traefik). What feature makes it worth losing this? ---------------------------------------------------------------------- Anomalous11 · 2023-11-14 02:51 Check out Caddy-Docker-Proxy. :) ---------------------------------------------------------------------- chaplin2 · 2023-11-14 02:52 How do you compare Caddy with nginx proxy manager? ---------------------------------------------------------------------- madrascafe · 2023-11-14 02:53 You mean using dns providers like cloud flare? It’s very easy just don’t this `caddy add-package github.com/caddy-dns/cloudflare ` ---------------------------------------------------------------------- madrascafe · 2023-11-14 02:54 It’s very easy just don’t this after you install caddy `caddy add-package github.com/caddy-dns/powerdns ` That’s it ---------------------------------------------------------------------- 510Threaded · 2023-11-14 03:01 Most people run caddy in a docker container ---------------------------------------------------------------------- shahmeers · 2023-11-14 03:31 > It doesn't support configuring virtual hosts automatically via docker labelsl (like Traefik). Here you go: https://github.com/lucaslorentz/caddy-docker-proxy. No more extra Caddy configuration file. ---------------------------------------------------------------------- G1zm0e · 2023-11-14 03:32 Same! Also with the full plugin setup and not needing to recompile is great. I have it setup for docker and kubernetes with external-dns ---------------------------------------------------------------------- CWagner · 2023-11-14 03:34 Caddy is great, been using it for a long time and made the switch from v1 to v2. The biggest negative, IMO, is that examples are usually for NGINX. This is fine if all you have to do is to translate the nginx 5-liner into a Caddy 1-liner, but for nextcloud, the code was a bit more complicated and required some googling (as people had that issue before and their forums are helpful). LLMs can also be useful for translating nginx directives to caddy. ---------------------------------------------------------------------- ribbit43 · 2023-11-14 03:45 there are some trade offs, mostly performance ---------------------------------------------------------------------- adamshand · 2023-11-14 03:48 Traefik has amazing features, but I've never hated using an app as much as I hated using Traefik. 🤣 ---------------------------------------------------------------------- dudeskeeroo · 2023-11-14 03:53 Preach! Once I had a solid labels section, I cut and pasted it for every new service. ---------------------------------------------------------------------- adamshand · 2023-11-14 03:54 I had two main complaints with Traefik. 1. Trying to anything complicated was impossible to figure out from the docs. The only way I could get things to work was to find a working config somebody had shared and then tweak that. 2. I loved the idea of label based config, but in practice I found that often subtle things went wrong and I spent more time debugging it then it took me to just open Caddyfile and add whatever needed changing. ---------------------------------------------------------------------- adamshand · 2023-11-14 03:54 I know about this, but honestly it's so easy to configure Caddy that I've never bothered to set it up. :-) ---------------------------------------------------------------------- adamshand · 2023-11-14 03:55 haha! ---------------------------------------------------------------------- adamshand · 2023-11-14 03:57 It's a little more complicated when running it inside a Docker container, but yes, it's pretty easy. But still an annoying extra step. ---------------------------------------------------------------------- darklord3_ · 2023-11-14 04:02 How do you manage traefik for stuff on multiple machines not running in kubernetes? I always wanted to try it but some of my services r split across multiple machines ---------------------------------------------------------------------- Veloder · 2023-11-14 04:10 If you are using Docker, check out this repository for Caddy builds with different plugins https://github.com/serfriz/caddy-custom-builds ---------------------------------------------------------------------- sixstringnerd · 2023-11-14 04:10 Can somebody explain in plain English what it is used for? ---------------------------------------------------------------------- dudeskeeroo · 2023-11-14 04:11 Haven't tried it, but from memory, traefik needs access to the docker socket so it can listen to events like containers coming up and down. I'm not sure how that would be propagated, even using a swarm network. I've had services running on separate machines and I just ran an instance of traefik on each. They did not talk to each other. Hopefully an expert will chime in. ---------------------------------------------------------------------- dinosaurdynasty · 2023-11-14 04:13 I would not directly expose Jellyfin to the Internet (including reverse proxy) because of security issues they've had. And no, a reverse proxy (like Caddy) doesn't usually add much insecurity _or_ security^. The thing I currently do is use forward_auth w/ Authelia (from anywhere, you could also use basic_auth though the UX sucks) but bypass it for the app in private IP ranges (aka at home or in VPN): ``` jellyfin.example { @notapp { not { header User-Agent *Jellyfin* client_ip private_ranges } } forward_auth @notapp localhost:8080 { uri /api/verify?rd=https://authelia.example/ } reverse_proxy 192.168.1.44:8080 } ``` Apps get to continue working, and I can access it from my phone without a VPN setup (because it's annoying and I only look at metadata on my phone anyway). You can also do a simpler config (which I used to do) where you just give an HTTP Unauthorized for anything outside of private ranges (this lets you do the HTTP challenge for a certificate while still not exposing Jellyfin to the general internet). ^You can configure more security by doing authentication in the reverse proxy so that anyone trying to attack services behind it _must_ first authenticate with the reverse proxy, but this is not the default. Security-wise this ends up similar to forcing all access through a VPN first, if a little harder to setup. ---------------------------------------------------------------------- sevlonbhoi1 · 2023-11-14 04:15 been running my reverse proxy on caddy from last 4-5 years. No issues at all. No maintenance needed. Setup and forget. Just needs a simple config file. Auto certificate generation. ---------------------------------------------------------------------- Cybasura · 2023-11-14 04:21 Sure hope this guy doesnt become management and force people to turn off the servers at night when not in use lmao ---------------------------------------------------------------------- xkcd__386 · 2023-11-14 04:25 Totally agree. The main problem is it's all written as a _reference_ -- for people who already _understand_ what/how, who need to just refresh their memory of the actual syntax. There's very little explanatory stuff for people who need more than that. I had to read the same stuff multiple times, traversing many (or often, the same!) links, make notes, and then form a mental picture of what is going on. ---------------------------------------------------------------------- xkcd__386 · 2023-11-14 04:26 Does nginx now do automatic lets-encrypt certs? Have been wanting to try it out but this is what was stopping me (I admit I have not checked recently) ---------------------------------------------------------------------- 12_nick_12 · 2023-11-14 04:28 No, but with acme.sh there's no need for it to. ---------------------------------------------------------------------- dcw3 · 2023-11-14 04:31 I thought that too initially. And I still think each time I have to trawl forums etc to get the answer to what seems like basic proxy config. ---------------------------------------------------------------------- -eschguy- · 2023-11-14 04:36 Been using it for a few years now, and yeah, it's just that simple. I have 443 open and pointing at my Caddy instance, it handles everything else. ---------------------------------------------------------------------- inrego · 2023-11-14 04:49 I just found a container with the plugin i needed pre-compiled ---------------------------------------------------------------------- bemasher · 2023-11-14 05:01 Caddy is an http server, often used as a reverse proxy. It’s particularly useful for TLS termination and automatic TLS certificate management. ---------------------------------------------------------------------- ithilelda · 2023-11-14 05:06 It is a simple layer 7 proxy and nothing more. It is the simplest so it works. As a comparison, almost all other reverse proxies can handle layer 4 traffic. and I don't miss the label feature of traefik at all. centralized config for an entrance gateway is so much easier to maintain and find security flaws. I think labeling would be useful only in production clusters with thousands of microservices that you absolutely need the reverse of control to get away from dependency hell. Otherwise, I advice against using such feature, not even with a caddy plugin. (I mean if you really need it, why not just use traefik...) ---------------------------------------------------------------------- MaxGhost · 2023-11-14 05:23 Caddy maintainer here, if you could point to specific sections you find confusing, that would help. We rarely receive actionable feedback about the docs, so it's hard for us to make improvements. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 05:24 Caddy maintainer here, if you could elaborate on that, it would help us improve the docs. What are you confused about, specifically? ---------------------------------------------------------------------- MaxGhost · 2023-11-14 05:25 Caddy maintainer here, which patterns are you confused about? ---------------------------------------------------------------------- MaxGhost · 2023-11-14 05:26 And that's trivial as well, just a 4 line Dockerfile gives you a custom build. ---------------------------------------------------------------------- brando56894 · 2023-11-14 05:35 After using Nginx for almost a decade, Caddy is pretty damn awesome regarding how simple it is. I don't need 8-10 lines of code to setup an SSL secured reverse proxy, I need three. ---------------------------------------------------------------------- ObviousAphid · 2023-11-14 05:38 For the first one, you could use: https://github.com/lucaslorentz/caddy-docker-proxy ---------------------------------------------------------------------- tsujiku · 2023-11-14 05:38 Yes, and then when the upstream caddy container changes you... Have to manually rebuild again. So just set up an automated job to check if the upstream container has been updated and then automatically rebuild and publish it to your local container registry, and check there for updates. Yes, each of the steps aren't a lot on their own, but it's certainly a lot easier to have a single container that can do everything and you update it whenever it's updated, rather than having to set up your own CI/CD pipeline because you had to add one plugin to the base image. I like a lot of things about Caddy, but this is definitely not one of them. ---------------------------------------------------------------------- brando56894 · 2023-11-14 05:39 Whoa, just when I thought I had completed my setup haha ---------------------------------------------------------------------- shahmeers · 2023-11-14 05:42 It's the same level of configuration, just within your compose file instead of in another file. ---------------------------------------------------------------------- 510Threaded · 2023-11-14 05:49 Wish it took advantage of linuxserver's dockermods ---------------------------------------------------------------------- Exist4 · 2023-11-14 05:56 Random question from a noobie…. Why do you use something like Traefik versus something like Cloudflare Zero Access? (Again sorry if question is dumb). I’m just a new guy to this learning as I go and after getting up zero access with a $8 domain and now being able to securely access everything via subdomains it seems confusing why apps like Traefik are still so popular? I know I’m missing something there but hoping someone points it out. ---------------------------------------------------------------------- long-money · 2023-11-14 06:42 you can make it so that adding a vhost for a container is a single line in your caddyfile. it's not a big deal ---------------------------------------------------------------------- adamshand · 2023-11-14 06:45 Nice! ---------------------------------------------------------------------- Whitestrake · 2023-11-14 06:47 (I help out on their forums sometimes) If you've got a quick sec - are there any parts you find to cause confusion in particular more than others? Maybe point me to something that you found pretty good vs. something you found to be pretty poor? We wanna improve those docs - any feedback you have the time to give could be really helpful ---------------------------------------------------------------------- adamshand · 2023-11-14 06:48 Because this is r/selfhosted. :-) ---------------------------------------------------------------------- TheoSunny · 2023-11-14 07:05 Not OP but I feel like the docs just need some more verbosity. Some directive explanations are just one liners that don't convey their full function until you try it out trial-and-error style yourself. Which might be the intent, in which case there's no need to change that ig xD As an example, I've been trying to figure out how to get the DNS01 challenge working with a custom caddy build with cloudflare and just can't get it to work (I've followed the community posts and the wiki but no dice). Maybe listing some common pitfalls or limitations to the approach on the wiki post could help. (Common reasons for SSL errors, certificate errors etc). ---------------------------------------------------------------------- eagle101 · 2023-11-14 07:06 Id say npm is 10x better than caddy ---------------------------------------------------------------------- autogyrophilia · 2023-11-14 07:10 It lacks common usage patterns with examples. Not a big deal, there are examples everywhere , but It can be confusing. It also carries the Go runtime with it so it has a small overhead over the likes of nginx in terms of memory consumption when Idle. Just something to be aware when dealing with containers or somesuch. ---------------------------------------------------------------------- Whitestrake · 2023-11-14 07:12 > Maybe listing some common pitfalls or limitations to the approach on the wiki post could help. (Common reasons for SSL errors, certificate errors etc). That seems like a pretty good suggestion! I'd also love if you could point out some of the more problematic directive docs specifically - if you've got time to spare to do that. I could also try give you a hand getting that DNS issue resolved here if you like. What was the actual error you got? ---------------------------------------------------------------------- TheoSunny · 2023-11-14 07:15 For sure. What's a good way to do this for you? Maybe DMs, or discord? ---------------------------------------------------------------------- Whitestrake · 2023-11-14 07:20 Right here works, to be honest, if you're not keen on the Caddy forums? One of the things that's super important for those of us who volunteer to help people with Caddy is that maybe one day someone will Google the error, find themselves here, and might be helped by this exchange, too. ---------------------------------------------------------------------- xkcd__386 · 2023-11-14 07:20 at the moment my caddy setup is stable, I am recounting from memory. If I ever have to update it for something I _may_ be able to point out something specific. It may be useful to consider what I said in a broader perspective -- i.e., what you have is an excellent *reference* but it does not help discovery of task-oriented solutions. Sorry I am unable to express the problem better than that. Will keep an eye out in future if I can get more concrete and open an issue or something. ---------------------------------------------------------------------- Do_TheEvolution · 2023-11-14 07:30 Something I encountered last week. * Wanted to turn off automatic https. * Googled and came up with github discussion that lead to [auto_https off](https://caddyserver.com/docs/caddyfile/options#auto-https) documentation that I read. * It did not work, http still did not work * Googled more and landed on forum page that [explained](https://caddy.community/t/making-sense-of-auto-https-and- why-disabling-it-still-serves-https-instead-of-http/9761) why auto_https is not working and that it needs explicitly stated `http:\\` or port `:80` in the address. Otherwise caddy will listen by default for only https. It was no biggie, that forum post is literally second google results and does good job, but its something... ---------------------------------------------------------------------- p3nn0rbi4tch · 2023-11-14 07:30 You could spin up a traefik instance on every machine, assign the necessary labels to every container you want exposed via traegik and use something like Consul as a key value store to store and load your config and certificates from. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 07:31 > It lacks common usage patterns with examples. Not a big deal, there are examples everywhere , but It can be confusing. _For what_ though? What usage patterns? What do you want to see in the docs? I can't improve the docs if I'm not told specifically what's missing. I can't read user's minds!! > It also carries the Go runtime with it so it has a small overhead over the likes of nginx in terms of memory consumption when Idle. Just something to be aware when dealing with containers or somesuch. You're self-hosting. Why are you concerned with that tiny amount of overhead? It's not even a drop in the bucket. ---------------------------------------------------------------------- ybizeul · 2023-11-14 07:32 Do you mean traefik is running in kubernetes but you are using it for kubernetes services as well as external services ? You can do that by declaring Endpoint resources, that basically replaces the pod that traefik would normally connect to. And you still have a Service resource pointing to that Endpoint ---------------------------------------------------------------------- sarkyscouser · 2023-11-14 07:34 I use Caddy and agree with your last point in the context of Crowdsec ---------------------------------------------------------------------- Do_TheEvolution · 2023-11-14 07:37 npm is nice for people who want easy web gui to configure stuff caddy makes me feel more in control, its easier to backup too, since its all in one easy and readable config, and probably has more features as you go with your needs There is also not that layer of which developer fucked up that you get when projects are projects of projects... ---------------------------------------------------------------------- MaxGhost · 2023-11-14 07:37 😬 Well, that's not helpful. Without specific feedback, there's nothing we can do to improve the docs. It's exhausting to read vague complaints about the docs, because it's 90% of the feedback we get. But yes, please do reach out (open a GitHub issue, comment on the forums etc) if you do notice something that doesn't meet your expectations in the docs. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 07:46 Thanks, that's helpful. Yeah the docs for `auto_https` should explain up-front that this only affects the feature called "Automatic HTTPS" and does not change the default port/procotol of Caddy, which is always HTTPS unless otherwise specified (i.e. by using `http://` as a site address prefix, or `:80` as a suffix). ---------------------------------------------------------------------- autogyrophilia · 2023-11-14 08:04 How do I host a basic PHP site?, How do I reverse proxy? How do I handle different paths? How do I make it accept a self signed cert? How do I make it so it's HA? Neither of those are hard and there are plenty of examples out there. The overhead doesn't matter to me. I could see why it would matter for container orchestration however. ---------------------------------------------------------------------- TheoSunny · 2023-11-14 08:08 Ah cool. Don't wanna be that guy hijacking a thread for my own specific issue isall haha. I'm trying to reverse proxy Vaultwarden over HTTPS. I don't want to expose it through any ports and only want to access it locally (LAN) or through tailscale. In any case exposing ports was never an option as my ISP seems to want to run services exclusively over CGNAT. I built Caddy with Cloudflare DNS provider module, and set up my caddyfile like so (domain and email details anonymised but match the structure of the original) - https://subdomain.example.com:443 { reverse_proxy vaultwarden:80 { tls email@gmail.com { dns cloudflare {env.CLOUDFLARE_API_TOKEN} resolvers 1.0.0.3 1.1.1.3 } } ] I used an .env file so I could set up everything through docker compose [(The docker compose file)](https://pastebin.com/embed_js/zS1pSz4j). I'm sure the variables are being exported as my vaultwarden is picking them up, and the errors caddy throws seem to be unrelated. Speaking of, the errors it threw the first time - ERR ts=1699354501.7057388 logger=tls.obtain msg=will retry error=[subdomain.example.com] Obtain: [subdomain.example.com] solving challenges: presenting for challenge: adding temporary record for zone "example.com.": got error status: HTTP 400: [{Code:6003 Message:Invalid request headers}] (order=https://acme.zerossl.com/v2/DV90/order/YMzv8lwZm6-VciLvSVejLw) (ca=https://acme.zerossl.com/v2/DV90) attempt=2 retrying_in=120 elapsed=72.305519507 max_duration=2592000 To me at the time it seemed like I maybe typo'd a letter somewhere with my Cloudflare token (Permissions set to Zone.Zone, Zone.DNS) so I made a new one and basically carefully pasted it directly into the caddyfile. This time it seemed to have worked as I got an email from cloudflare that a certificate had been issued. But when trying to access the IP from the same machine or the local network, I now got the Chrome browser error - `ERR_SSL_PROTOCOL_ERROR` Which is where I've been stuck. Some potential ideas I had from browsing the caddy forums were - 1. I need to replace the [subdomain.example.com](https://subdomain.example.com) with the local IP of the machine docker and vaultwarden are running on. 2. I need to set up a split DNS/local resolver to redirect local machine queries on [subdomain.example.com](https://subdomain.example.com) to my machine's local IP. Hindsight's making me feel like I should've just put this on the caddy forums itself, I'd be happy to move over there if that's the better way to do this heh. Apologies if the solution to this is just super trivial, I'm not a developer by profession so I unfortunately don't know what I don't know. ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-14 08:09 I agree with you. There's a lot of specifics. No one can know it all. If someone would ask me how I should deal with HTTP desync in caddy vs. traefik I wouldn't have a clue. Is it even specific to proxies, or more about request routing within a hosted application? I don't know. This is why we have rubber ducks and helpful friends. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 08:14 > How do I host a basic PHP site?, How do I reverse proxy? How do I handle different paths? All those are covered here: https://caddyserver.com/docs/caddyfile/patterns > How do I make it accept a self signed cert? Use `tls internal` https://caddyserver.com/docs/caddyfile/directives/tls. Keep in mind this is not exactly "self-signed" because it's better than that; Caddy sets up its own CA which it uses to issue certs. That's different than self-signing which is having a single certificate which signed itself; it means that you can add Caddy's root CA cert to your system's trust store, and let Caddy use continually reissue certs with short lifetimes. > How do I make it so it's HA? That's a very broad question and entirely depends on your needs. But the most basic answer is you can simply specify more than one upstream to `reverse_proxy` to randomly choose between multiple upstreams. See https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#load- balancing, and the examples which show how to use it https://caddyserv er.com/docs/caddyfile/directives/reverse_proxy#examples > The overhead doesn't matter to me. I could see why it would matter for container orchestration however. I disagree, it doesn't matter. You realize Docker and K8s are themselves written in Go? ---------------------------------------------------------------------- TheoSunny · 2023-11-14 08:55 >I'd also love if you could point out some of the more problematic directive docs specifically Two things I can currently think of (again prefacing this with not being a dev so this may just end up being nooby ramblings, apologies if so) 1. [https://caddyserver.com/docs/caddyfile/directives/tls#resolvers](h ttps://caddyserver.com/docs/caddyfile/directives/tls#resolvers) could use an example for the solution to [this help topic](https://caddy.community/t/forcing-certmagic-to-use-system- resolvers-for-propagation-checks/15690/12). While I realise the solution parameters are added just above, providing an example usage would remove any ambiguity. This was just a rabbit hole I went down, where I really only wanted to know if caddy uses the system's resolvers by default. Again, might help to be stated in the *resolvers* paragraph directly. 2. [https://caddyserver.com/docs/automatic- https#errors](https://caddyserver.com/docs/automatic-https#errors) while I really appreciate the plain english explanation of caddy's workings under the hood, maybe adding a link to a list of errors thrown by caddy in the logs would also further help. If I receive an error in the log and google it, I'd land on this section or a link to this section, and that'd clear up any confusion I might still have after reading said error. I'd again be happy to put these up in a more relevant forum, plus any additional documentation suggestions I can think of, if these make sense and are useful! ---------------------------------------------------------------------- FierceDeity_ · 2023-11-14 09:10 I actually didnt mean to reply to you but to the one next up. Yeah. Thats what I mean. People here are a bit stuck in their ways of hosting everything they can find, quickly downvoting "contrarian" opinions that dont keep the illusion that everything IS this easy alive. I would love to know why exactly one reverse proxy should be exactly as secure as any other. I think answering a question about security with a question like that isnt a good way to really show what you are talking about... ---------------------------------------------------------------------- soupdiver23 · 2023-11-14 09:32 that's the way :D ---------------------------------------------------------------------- Douppikauppa · 2023-11-14 09:45 I would argue against fail2ban and even against logging. The reasoning is that unauthenticated traffic should have no effect on your systems. Tuning your firewall based on traffic that is likely malicious is a bad idea. It allows DoS attacks against your server if someone can get the legitimate user fail2banned. Never lock an account due to incorrect password attempts (especially if the ban is not restricted to specific IP that failed to login). My unpopular opinion is that one should simply tolerate the random noise coming off Internet crawlers because it has no effect on your system. Most of the time they don't even know the correct username, and won't be able to guess any decent password. Log only actions made by authenticated users, not by someone trying to log in. Too much useless noise for admin to pay attention to. Prevent brute forcing of passwords by (1) switching to PassKeys, and (2) by requiring JS-based proof of work from client before logging in - Argon2 password hashing on client side is one option to consider that will 100% prevent any brute forcing ---------------------------------------------------------------------- Douppikauppa · 2023-11-14 10:03 I found the practical use cases helpful, probably should expand that cookbook. E.g. I've found this sort of construct helpful (not sure how safe using {host} here is though): ```Caddyfile app.example.com, another.example { reverse_proxy unix//srv/backend/{host}/server.socket } ``` It is hard to understand the whole thinking behind the config system, with directives, matchers, placeholders, invisible reordering of rules, and all the other concepts. And to add to the complication, Caddyfile and API are completely distinct systems and it is not very clearly explained [that one really ought to be using Caddyfile and ignoring the API for most use cases]. And that distros do ship Caddyfile-based systemd service now (some also API-based, and perhaps with root-only control socket to add to the confusion). I did dig into it to really understand how it works but that took a couple of weeks to digest, which is a lot for someone who only needs a simple server/proxy. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 10:06 Good point re `tls` `resolvers`. I've pushed an update to add an example, take a look! For Auto-HTTPS errors, that's tricky. The problem is most errors come from external systems (ACME issuers, DNS providers; not Caddy itself) and it's unreasonable to try to document all those in Caddy's docs. ---------------------------------------------------------------------- lucaprinaorg · 2023-11-14 10:14 it is what you mean...no less no more...Caddy rocks... ---------------------------------------------------------------------- TheoSunny · 2023-11-14 10:15 Wow that was quick! Looks good. I understand the point about Auto-HTTPS. Guess I'll have to work through it by process of elimination. I've just been spoiled by people's pre-made configs and compose files that work first try lol. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 10:18 Are you using Cloudflare as a proxy, or only as a DNS provider? If only for DNS, then what IP address is it resolving to? Is it your WAN IP or your LAN IP? If WAN, since your ISP is CGNAT that probably wouldn't work anyway? I think there's some missing details here. You should use `curl -v` when testing connectivity instead of browsers, it's more predictable and will show you log output that you can paste in forums for help etc. Re 1. you could do that but then you'd no longer be using a publicly trusted cert, and clients would complain unless you install Caddy's CA cert on those devices. Re 2. yes you may need to run a local DNS server if your domain is resolving to your WAN IP, if your router doesn't support NAT hairpinning (it's uncommon for consumer-grade routers to support it unfortunately). ---------------------------------------------------------------------- MaxGhost · 2023-11-14 10:26 FWIW as a Caddy maintainer, I generally agree with this. Crawlers/bots are harmless noise 99.999% of the time and don't cause enough traffic to matter. ---------------------------------------------------------------------- Whitestrake · 2023-11-14 10:46 > again prefacing this with not being a dev so this may just end up being nooby ramblings By the way, not to worry on this front. You're our target audience for our documentation just as much as developers are. As for the link to a list of errors - rather than the official documentation of Caddy itself (as mentioned in a different comment those are _usually_ from the ACME providers themselves instead of Caddy), I think a wiki post would be perfectly suited for that kind of info. ---------------------------------------------------------------------- RandomName01 · 2023-11-14 11:16 What I think they meant is more “how to achieve X or Y” focused documentation, rather than just explaining how features A or B work. The former approach explains what you should use and how to do it, the latter only documents what each variable does. To use an analogy: I could probably build a bicycle from the individual parts based on a tutorial with that goal in mind, but not based on the individual technical descriptions of each part. /u/xkdc__386 is that what you meant? ---------------------------------------------------------------------- MaxGhost · 2023-11-14 11:24 > I found the practical use cases helpful, probably should expand that cookbook. I agree. Finding common enough usecases worth mentioning on that page is tricky though. We want to avoid too much redundancy/duplication/overlap, otherwise the page can get unwieldy. > E.g. I've found this sort of construct helpful (not sure how safe using {host} here is though): I think that's pretty niche tbh, not many people will be proxying to an app running at a unix socket. More common might be a similar idea but serving a file server with root directories matching the hostname. > (not sure how safe using {host} here is though): It's fine because your site address is a host matcher, so it's already "whitelisted" to only those two domains. > It is hard to understand the whole thinking behind the config system, with directives, matchers, placeholders, invisible reordering of rules, and all the other concepts. Yeah 🤷 this page https://caddyserver.com/docs/caddyfile/concepts tries to summarize each of those concepts. That's the page every new user to the Caddyfile should read to get their bearings. > And to add to the complication, Caddyfile and API are completely distinct systems and it is not very clearly explained [that one really ought to be using Caddyfile and ignoring the API for most use cases]. We've struggled a lot with this one. The problem is that we need to announce up-front that "yes, Caddy can be configured via the API" because otherwise users won't know what they don't know. Ultimately, by design, the Caddyfile just produces JSON config which is what Caddy actually runs with, which greatly simplifies the internals and multiplied Caddy's flexibility when we made that design choice for Caddy v2. In fact when you use the Caddyfile you still are using the API because commands like `caddy reload` and such actually push the updated config via the API. So it's a necessary concept to be aware of if you need anything more than the basics. > And that distros do ship Caddyfile-based systemd service now (some also API-based, and perhaps with root-only control socket to add to the confusion). The https://caddyserver.com/docs/install page covers this for the most part. ---------------------------------------------------------------------- Zestyclose_Car1088 · 2023-11-14 11:25 What are the performance concerns? ---------------------------------------------------------------------- Zestyclose_Car1088 · 2023-11-14 11:28 Interesting so what does this do? Do you have to sign in via Authelia before getting access then? How does that work on TV clients etc.? What is the setup like on the Authelia side? ---------------------------------------------------------------------- Zestyclose_Car1088 · 2023-11-14 11:29 Anything specific need to be setup in Fail2Ban? What exactly would you add for the firewall? ---------------------------------------------------------------------- MaxGhost · 2023-11-14 11:31 I understand what they meant, but it's broad/vague, and not specific/actionable. We _do_ have a tutorials section in the docs, and we have the https://caddyserver.com/docs/caddyfile/patterns page which are that. Our question is _how are those lacking_? Just saying "more please" doesn't help because we don't know what the need is. We can't imagine every single possible usecase, because it's actually infinite. Help us by telling us what specifically what usecase is important to you. We don't have telemetry, we need users to tell us. ---------------------------------------------------------------------- Zestyclose_Car1088 · 2023-11-14 11:32 Does Caddy have security recommendations when running a reverse proxy? Is there a need for Fail2Ban? What is the correct procedure for Authelia integration/setup? ---------------------------------------------------------------------- MaxGhost · 2023-11-14 11:34 IMO no need for Fail2ban. Authelia setup is easy with https://caddyserver.com/docs/caddyfile/directives/forward_auth. And see Authelia's docs for integrating with Caddy, which are also excellent (linked to from the above link). ---------------------------------------------------------------------- DMenace83 · 2023-11-14 11:47 Nginx-proxy-manager might be what you're looking for. It's nginx under the hood, has a nice UI, and supports auto updating LetsEncrypt certs. ---------------------------------------------------------------------- Zestyclose_Car1088 · 2023-11-14 11:48 Is there any extra configuration needed for Jellyfin specifically? There's a sense of unease coming from how easy it was to setup. Some of the suggestions here are: 1. Fail2Ban 2. Authelia 3. Firewall 4. IP regional filtering ---------------------------------------------------------------------- DMenace83 · 2023-11-14 11:53 I too find nginx-proxy-manager to be better. Things like caddy and traefik seems to abstract out too many settings. It's great for basic users, but if I need to fine tune something, it's impossible to do. ---------------------------------------------------------------------- RandomName01 · 2023-11-14 12:02 Right, gotcha. I can’t help you there since I don’t use Caddy. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 12:12 Nope. I run Jellyfin on my home server and it's really just a 3-line config (site address & opening brace, proxy, closing brace) ---------------------------------------------------------------------- MaxGhost · 2023-11-14 12:18 Not really, `Dockerfile`: FROM caddy:2.7.5-builder AS builder RUN xcaddy build --with github.com/caddy-dns/cloudflare FROM caddy:2.7.5 COPY --from=builder /usr/bin/caddy /usr/bin/caddy ---------------------------------------------------------------------- lighthawk16 · 2023-11-14 12:23 Used Caddy for years and after a week of Nginx Proxy Manager I never went back to Caddy. ---------------------------------------------------------------------- xkcd__386 · 2023-11-14 12:50 that's probably it; thank you! Added to my list for next time I start fiddling with this setup :) ---------------------------------------------------------------------- xkcd__386 · 2023-11-14 12:53 Spot on. Of course from their point of view that's "not helpful". Maybe I'll spend some time looking at it to come up with something, if I have time. ---------------------------------------------------------------------- xkcd__386 · 2023-11-14 13:11 The tutorials section is very basic; I am not talking at that level. The patterns page is closer to the level of complexity that one needs help with, and it does cover several items, but you have 30-40 directives, many with several options, global options, and so on, so there're bound to be gaps. In the other comment you said this is "90% of the feedback we get", and I can certainly understand the frustration -- people want documentation to magically solve their specific problem _quickly_, which is impossible. As I said before, I'll keep it in mind next time I need to do something if I can't find it _easily_ in the docs I'll at least highlight the effort it took, what I searched/read/found, etc., so you have something concrete. ---------------------------------------------------------------------- Zestyclose_Car1088 · 2023-11-14 13:22 It just seems too good to be true! Thanks ---------------------------------------------------------------------- osuhickeys · 2023-11-14 13:24 Take a look at caddy-docker-proxy. You can add virtual hosts with docker labels with this addon. ---------------------------------------------------------------------- TheoSunny · 2023-11-14 14:09 >Are you using Cloudflare as a proxy, or only as a DNS provider? DNS only, as I do not want to expose vaultwarden to the internet at all. >Is it your WAN IP or your LAN IP? WAN IP, unsure if I should be the LAN IP. I'll use `curl -v` from now on, after reading up on it a bit xD. Yep my router is an ISP provided one, haven't been able to locate any split-DNS/NAT hairpinning features on it. However my ultimate goal is only to access vaultwarden locally, behind reverse proxy as I will not be able to use the web vault if I connect via http. After researching this some more, I'm starting to feel like I'll have to make do with self-signed/locally generated certs and just ignore chrome and firefox's complaints. I've paused work on this for now, but when I resume I'll post on the caddy forums if I get any caddy-specific errors. Also would just like to say that ya'll have been really quick to address these points, so major props! I'm a UX designer so I completely get the frustration of getting vague and/or inactionable feedback, tried to do my best to buck that trend heh. ---------------------------------------------------------------------- z3roTO60 · 2023-11-14 14:17 Same! ---------------------------------------------------------------------- frex4 · 2023-11-14 14:41 I find that the lack of examples with Caddyfile is quite harsh with beginners. In the quick start, this is the first link I will click on if I'm the beginner: https://caddyserver.com/docs/quick-starts/caddyfile Just one example with a non-localhost will make it a lot easier to understand for the most common use case: blog.example.com { reverse_proxy wordpress:8080 } Even after reading the next link for reverse proxy, I still can't find the right example for my use case: https://caddyserver.com/docs/quick- starts/reverse-proxy For an example, I have never used Traefik before, but their quick start is quite good, after reading it a bit I know how to make use of it, even if I have never touched it before: https://doc.traefik.io/traefik/getting-started/quick-start/ ---------------------------------------------------------------------- Whitestrake · 2023-11-14 14:49 On the Caddyfile Quick-start page, there's a link to Common Caddyfile Patterns: https://caddyserver.com/docs/caddyfile/patterns All the examples there are with a valid example domain name and include the form you mentioned, do you think those examples work well? Do you think we could emphasize those links better somehow? I don't think we want to use anything other than `localhost` for the base level quick start, because we don't want people to copy what we put in and have Caddy start trying to get a valid certificate that will probably fail. The link for the reverse proxy quick start could definitely have an example with a valid domain name, though! ---------------------------------------------------------------------- ghoarder · 2023-11-14 14:53 I wrote something that can setup caddy automatically from docker labels. It's not well documented as I mostly wrote it for myself. https://hub.docker.com/r/mheys1/docker-dynamic-caddy https://github.com/mattheys/ddc It basically acts like a DNS server serving up SRV records that caddy can use for dynamic configuration, I added in an on\_demand\_tls endpoint as well so that you don't get spammed for non existent TLS records. ---------------------------------------------------------------------- clarksonswimmer · 2023-11-14 15:05 I think having to maintain another config file is a big deal ---------------------------------------------------------------------- frex4 · 2023-11-14 15:12 I understand your concern and I really like the link you posted. However as a beginner/selfhosting guy, I look at the structure of the docs page, I look at Tutorial > Caddyfile and I cannot find my use case. I'm not sure if I can speak for selfhosting people but the main selling point of Caddy is the ease of use, especially with Docker. Maybe consider having a separate page of Quick Start just for Docker users? Docker users should have their own domain and some basics already, they just need to go fast. A sample docker compose and/or docker command will be a big help. ---------------------------------------------------------------------- Skylantech · 2023-11-14 15:40 I personally use Caddy alongside Cloudflare. Caddy for SSL, Cloudflare for geoblocking & analytics. ---------------------------------------------------------------------- thekrautboy · 2023-11-14 15:47 As example because Caddy is so slim and lightweight it does not have builtin support for most DNS provider APIs to use the dns01-challenge for Lets Encrypt certificates. In order to use those you need to build Caddy with a plugin for example for Cloudflarey or Porkbun etc. This is of course possible but plenty of people dont want to bother with that. Traefik for example has support for a lot of those providers builtin. Another example is that Caddy cannot read configurations from Docker container labels. Again, a plugin exists for that, but building a custom Caddy is not to everyones taste. There are more differences but those are two i can think of right now. This doesnt mean in anyway that Caddy is inferior, its simply made to be very basic and easy and lightweight, and thats great. ---------------------------------------------------------------------- dazchad · 2023-11-14 15:56 I don't remember from the top of my head, but as others have mentioned, quite a few pages list an example or two, and usually they are simple--good for the simple case, but not as helpful if you divert from the common path. I remember I struggled with snippets. I have a reverse proxy with a single subdomain and paths for all my services, like: ``` home.domain.tld { @deny not remote_ip 192.168.1.0/24 redir /service1 /service1/ handle /service1/* { abort @deny reverse_proxy http://... } redir /service2 /service2/ handle /service2/* { abort @deny reverse_proxy http://.. } // a dozen or so more... } ``` Since there's a clear pattern, I tried to write a snippet where I could do something like ``` // don't mind the $var syntax, I don't remember the actual syntax (internal_service) { redir /$path /$path/ handle /$path/* { abort @deny reverse_proxy $host } } home.example.tld { import internal_service service1 http://192.168.1.10:1234 import internal_service service2 http://192.168.1.10:1235 ...so on } ``` Again, I don't quite remember what went wrong, but I think it was related to not being able to define path handlers dynamically? Or using the `{args}` placeholder with directives/matchers? I might be wrong here. But the point is, the docs are rather slim. Another example. I was trying to use a image resizing service (imgproxy), but I wanted to use my own URL format and then rewrite that to imgproxy's path format since I will probably find something else in the future. The documentation for `query` literally contains a single example: `query sort=asc`. It doesn't show where to put that, how to use the expression variant, how the use the wildcards, or how to use querystring values into the configuration (later I found out how to do that with placeholders, but feels glaring to not have a mention in the `query` matcher page). I feel most of this is mostly due to the fact of Caddy being so new compared to other players like nginx. I have a better chance of finding a blog post or SO question about a particular usage of nginx than with Caddy, and that might be a reason the documentation is perceived as a common pain point for users. ---------------------------------------------------------------------- d-cent · 2023-11-14 16:02 I would like to jump over to it. I have been struggling with Nginx and Apache and I am afraid I have made a mess of things. I am installing on an old Mac Mini with Mac OS so I don't really have a way to isolate and remove Nginx and Apache and I have a feeling if I try Caddy I will get some interferences. ---------------------------------------------------------------------- Do_TheEvolution · 2023-11-14 16:13 It sits in charge of your ports 80/443 and decides to which webserver it sends traffic. If to your jellyfin, or your nextcloud, or your uptimekuma, or your vaultwarden or your mealie or your dashboard... unlike others it automaticly do https certificate for you and its config is really clean and readable which is nice. [Heres](https://github.com/DoTheEvo/selfhosted-apps- docker/tree/master/caddy_v2) how to set it up if you wanna try. ---------------------------------------------------------------------- Do_TheEvolution · 2023-11-14 16:18 Strange, I never quite got why ever would i want to swtich to NPM, tried it and never liked it... I ssh in and edit my caddyfile faster than I go to npm web interface and click through menus. I actually can just copy paste caddyfile config and have backup of it, while I am not even sure if npm has any backup solution by now, or you just suppose to backup on docker level. And it is kinda in the way, a gui layer if you wanna do something more.. ---------------------------------------------------------------------- Do_TheEvolution · 2023-11-14 16:21 Try it, [heres](https://github.com/DoTheEvo/selfhosted-apps- docker/tree/master/caddy_v2) a decent guide with lot of examples. ---------------------------------------------------------------------- _unbanned_datum · 2023-11-14 16:33 Anyone know if Caddy would be a good pick for a reverse proxy on a public subnet to distribute traffic to a bunch of subdomains in low traffic settings? I figure it could be a single source for all HTTPS stuff in my stack. ---------------------------------------------------------------------- d-cent · 2023-11-14 16:33 The problem is I have a lot of stuff running on the MacOS already and can't really dump it all to start from scratch with a linux based OS. That really limits me because my system is too small for having docker on top of the MacOS with how it virtualizes it. I am also worried about the already half installed web servers conflicting with Caddy installed straight on the MacOS. I already had issues because both Apache and Nginx use the same port. It's going to be some time before I can afford a new server that I can start fresh from so I have to find a way to remove the residuals first before I install Caddy. ---------------------------------------------------------------------- _unbanned_datum · 2023-11-14 16:42 100%. I’m not a security researcher and I don’t know too much about how reverse proxy’s work- I’ll look into building one from scratch now thanks for the idea lol. When I read that original statement, my first impression was that the reverse proxy’s implementation much be SO straightforward that security isn’t really needed at that layer. Maybe they’re meaning to say security should be implemented either before, after, of entirely around the reverse proxy. I don’t know. I can see though, that’s probably a bad assumption to make. Thanks for speaking up on your thoughts :) ---------------------------------------------------------------------- jax7778 · 2023-11-14 16:52 Caddy is a great, easy web server. It honestly has some pretty good performance too. If you want to see some good tests against nginx, take a look at this: [https://blog.tjll.net/reverse-proxy-hot-dog-eating-contest-caddy-vs- nginx/](https://blog.tjll.net/reverse-proxy-hot-dog-eating-contest- caddy-vs-nginx/) tldr: Optimized nginx does outperform caddy in some areas in under heavy load, and they have a completely different strategies to handle failure. Under very heavy load Nginx just starts dropping and refusing connections to keep itself fast, while caddy will dramatically slow down response times in order to keep failures from happening. ---------------------------------------------------------------------- FierceDeity_ · 2023-11-14 16:58 A reverse proxy is definitely a little less complex than other things, but you still have to have a whole http stack which can absolutely go wrong in many ways, only some of which are related to using a language like c++. I cant enumerate all the issues arising from broken browsers, even.. ---------------------------------------------------------------------- Sohex · 2023-11-14 16:59 It’s really not hard to have a nightly CI job run, check the latest commit hash, then rebuild or not. Then either push the new image or have something like watchtower pull it. Good practice for containers in general really since then you can do your own security testing and whatnot when building your nightlies too. ---------------------------------------------------------------------- aksdb · 2023-11-14 17:09 "very basic" is quite an exaggeration, IMO. nginx doesn't have any auto-tls at all, you need an external tool for that. Same if you want to use it as an ingress for k8s or docker; there are essentially nginx-config-generators. Caddy has far more batteries included than nginx or apache (which also lives mostly from a module system). ---------------------------------------------------------------------- MaxGhost · 2023-11-14 17:11 > WAN IP, unsure if it should be the LAN IP. If you're using the DNS challenge and you don't want to expose your server publicly, then yes use your LAN IP. Your WAN IP won't be useful anyway because of CGNAT, so nothing will ever route directly to your server with that IP. But using your LAN IP would make your devices in your LAN be able to connect directly to your server. ---------------------------------------------------------------------- sixstringnerd · 2023-11-14 17:12 Cool! Thanks! ---------------------------------------------------------------------- thekrautboy · 2023-11-14 17:26 > "very basic" is quite an exaggeration, IMO. I dont think so. > Caddy has far more batteries included than nginx or apache That is true. But for a huge part of the people around here the typical comparison for a reverse proxy isnt nginx or apache, but instead Traefik or Nginx Prox Manager for example. And in that comparison Caddy is quite barebones (which is not a bad thing). ---------------------------------------------------------------------- ribbit43 · 2023-11-14 17:37 Compared to something like haproxy, caddy's performance is not close. https://github.com/NickMRamirez/Proxy-Benchmarks That being said... for the vast majority of use cases in this subreddit, it's fine. ---------------------------------------------------------------------- Do_TheEvolution · 2023-11-14 17:45 I think docker works pretty well on macos, though not sure... and running caddy in docker is equivalent of opening calculator app... its nothing. Only issue you have is dealing with what currently is using port 80/443 on that machine.. or generally learning docker compose. ---------------------------------------------------------------------- Bestwave · 2023-11-14 17:54 Ssss999 ---------------------------------------------------------------------- rodude123 · 2023-11-14 17:56 Don't hate me but I use Apache2, why would use caddy? ---------------------------------------------------------------------- MaxGhost · 2023-11-14 17:56 > Again, I don't quite remember what went wrong, but I think it was related to not being able to define path handlers dynamically? Or using the `{args}` placeholder with directives/matchers? I might be wrong here. But the point is, the docs are rather slim. I think https://caddyserver.com/docs/caddyfile/directives/import explains pretty well the args syntax, i.e. `{args[0]}` and `{args[1]}` in your case for the first and second args respectively. Your config should work fine as-is by replacing `$path` and `$host` with those. It would certainly help if you can elaborate if you still think the docs are unclear. > The documentation for query literally contains a single example: `query sort=asc`. It doesn't show where to put that, how to use the expression variant, how the use the wildcards You're right we can add more examples to the `query` matcher. I couldn't come up with anything useful off the top of my head though, because in practice it's not that useful of a matcher most of the time. If you have ideas for useful examples, that would help. With all matchers, you're meant to have read https://caddyserver.com/docs/caddyfile/matchers#syntax first (at the top of the page). That explains what you need to know to use matchers. > or how to use querystring values into the configuration (later I found out how to do that with placeholders, but feels glaring to not have a mention in the query matcher page). That doesn't have anything to do with matchers though. Placeholders and matchers are totally separate concepts, the only relationship is they happen to use the same words because they both refer to parts of an HTTP request. I'm not sure how we could work that into the matcher docs without it be needlessly noisy. > I feel most of this is mostly due to the fact of Caddy being so new compared to other players like nginx. Caddy isn't new at all. It's 8 years old at this point. It's older than Kubernetes. > I have a better chance of finding a blog post or SO question about a particular usage of nginx than with Caddy, and that might be a reason the documentation is perceived as a common pain point for users. I'm not sure how blog posts relate to the docs. I do agree that there is a general lack of articles about Caddy, but I'd argue that Caddy needs that less, because the config is so much simpler that it doesn't need explainers the same way nginx does. The other problem is that half or more of blogs about Caddy I run into have factual errors or use word-of-mouth-repeated config mistakes, or they just rapidly fall out of date for a variety of reasons. We don't really have the energy to chase these down to correct them, especially for blogspam type articles from inexperienced users. That's why we recommend always looking at the docs first before looking for blogs, because it'll always stay current and correct. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 18:00 To be clear, that feature isn't missing, because https://github.com/lucaslorentz/caddy-docker-proxy provides it. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 18:01 Yes, it excels at that usecase. Caddy will automatically set up and manage certificates for each subdomain. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 18:03 Automatic HTTPS (no need for separate tooling to get TLS certs), much simpler config (`.htaccess` is a mess), better performance in some cases (but do your own benchmarking; 99% of the time performance doesn't matter for self hosting, your webserver is never the bottleneck), has modern and secure defaults without needing to do anything special. ---------------------------------------------------------------------- clarksonswimmer · 2023-11-14 18:27 To be clear, that's an add-on, right? ---------------------------------------------------------------------- dazchad · 2023-11-14 18:28 > Your config should work fine as-is by replacing $path and $host with those I just tried again and it did work, but I also have updated to the latest version of Caddy. So perhaps was an issue before. It worked with `{args[0]}`, however it didn't work with this syntax: (internal_service) { vars path {args[0]} vars host {args[1]} handle /{vars.path}/* { reverse_proxy {vars.host} } } Didn't give me an error. Just didn't proxied the request. `caddy run` didn't show any error message either. And I think when I tried this in the past it complained about redefining variables or couldn't find the `@deny` matcher, but I might be mistaken. Sorry for the fuzzy memory. It was over an year ago. > I'm not sure how blog posts relate to the docs. I do agree that there is a general lack of articles about Caddy, but I'd argue that Caddy needs that less, because the config is so much simpler that it doesn't need explainers the same way nginx does. I mention blogs because it's hard to put all edge cases on the docs, and so if somebody stumble on a particular configuration problem, they show the solution they found. > because the config is so much simpler that it doesn't need explainers the same way nginx does. If that was the case, people wouldn't complain about lack of documentation, or for it being confusing. I say this not as a snark, but as a constructive criticism. As a programmer myself I understand it's frustrating to not have specific, factual pointers on what to change. If I find something something else I can ping you :) ---------------------------------------------------------------------- MaxGhost · 2023-11-14 18:31 I promise we will have a quick start/tutorial for Docker soon; Matt Holt (Caddy's author) doesn't use Docker himself so he didn't write anything about that. But we're working on reworking that part of the docs soon, and I'll make sure that's covered. ---------------------------------------------------------------------- bbaulenas · 2023-11-14 18:32 I have not tested it, but someone did auto discovery for caddy https://github.com/lucaslorentz/caddy-docker-proxy ---------------------------------------------------------------------- scmmishra · 2023-11-14 18:36 Lack of docker labels is a downer, but it’s the best reverse proxy I have used. Recently started a project to run containers with caddy https://github.com/scmmishra/slick-deploy ---------------------------------------------------------------------- MaxGhost · 2023-11-14 19:10 Yes, but it ships as a Docker image which has it included already. It doesn't need to be built into Caddy. ---------------------------------------------------------------------- adamshand · 2023-11-14 19:10 I used Apache for many years. It’s great! But Caddy is simpler, easier and lighter weight. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 19:19 > however it didn't work with this syntax Yeah, `vars` are set and replaced at runtime, not at config-adapt time. It's semantically very different. The problem is that your upstream address includes a scheme `http://` which is not valid when using placeholders. Schemes can only be used when you _don't_ use a placeholder, because it's only used as a shortcut for configuring proxy transport options. See https://caddyser ver.com/docs/caddyfile/directives/reverse_proxy#upstream-addresses which explains in more detail. I recommending avoiding placeholders for proxy upstreams. ---------------------------------------------------------------------- tsujiku · 2023-11-14 20:05 > It’s really not hard to have a nightly CI job run, check the latest commit hash, then rebuild or not. Yeah, just an hour or two of research to figure out what you need to do, a minute to write the few lines of yaml you need to define the right cron action, then an hour or two of trying to debug why it's not working only to find out that your [self-hosted devops platform](https://about.gitea.com/) of choice, despite now having support for CI/CD, still didn't actually have support for any kind of scheduled actions, so you say, okay, fine, I'll just manually trigger it until they add support for scheduled actions, so you spend more time researching how to do that until you find out that that's not supported either and then you give up and manually rebuild the container yourself. This is definitely just an example, and not exactly the situation I found myself in when I tried to do this myself. /s It looks like Gitea finally merged support for cron actions, so maybe I can go back and see if I can get that working, but I would have had at least a full night's worth of my life back if I never had to try to do it in the first place. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 20:13 > it does not have builtin support for most DNS provider APIs to use the dns01-challenge This was a decision based on supply chain security. All the `caddy- dns` plugins are community maintained, and we can't reasonably vet all of them on every release, and bundling them would mean they couldn't be updated out of step with Caddy releases, which can be important to get out quickly if there's a serious bug in the plugin, or some urgent API change due to the DNS provider changing something, etc. > Another example is that Caddy cannot read configurations from Docker container labels. Again, a plugin exists for that, but building a custom Caddy is not to everyones taste. You don't need to build anything to use it, it's already shipped as a ready-to-use Docker image. See https://github.com/lucaslorentz/caddy- docker-proxy ---------------------------------------------------------------------- MaxGhost · 2023-11-14 20:16 IMO Caddy has much more functionality than Traefik, because Caddy is a general purpose webserver (can serve static files, PHP-FPM, static responses, etc) whereas Traefik is only a proxy. I think calling that "very basic" is misleading and untrue. ---------------------------------------------------------------------- thekrautboy · 2023-11-14 20:18 But we are talking about reverse proxies. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 20:24 Caddy is a single static binary. You don't need to install anything to use it. You just download it and run it. And it works on all OSes. Yes, you can run it in Docker (and Docker on Mac), but it's not necessary. ---------------------------------------------------------------------- thekrautboy · 2023-11-14 20:29 You dont need to defend Caddy to me, i was not attacking it I know that image by lorentz. But probably a large part of users around here would also want to use a dns plugin together with that, and that would mean either to built a custom image (which "scares" some users) or to use a prebuilt image by someone else and trust them. I am not saying thats a terrible thing and that Caddy sucks because of that. But it is a difference to Traefik for example. And i was asked what the major missing features of Caddy in my opinion are. ---------------------------------------------------------------------- adamshand · 2023-11-14 20:40 Either run them as independent servers (each with their own Traefik instance) or use Docker Swarm. ---------------------------------------------------------------------- adamshand · 2023-11-14 20:54 I've been doing the same thing for years, no problems. I did hookup LLDAP because I got annoyed with creating accounts for family in multiple places, but that doesn't help with security. There is a reasonable argument that complicated applications like Jellyfin are more likely to have bugs and there is value in putting a simpler, hopefully better audited, authentication layer in front of them. This means that the general public can't pound on your Jellyfin instance. I would definitely do this in a professional context, but don't bother at home. ---------------------------------------------------------------------- long-money · 2023-11-14 20:58 Not for most users. It’s not like most people are setting up and removing services all the time that it’s a major consideration ---------------------------------------------------------------------- adamshand · 2023-11-14 21:12 One thing that threw me in the beginning was that the docs didn't show examples in context. As an example, if you look at the [basicauth](ht tps://caddyserver.com/docs/caddyfile/directives/basicauth ) docs it shows: ``` basicauth /secret/* { Bob $2a$14$Zkx19XLiW6VYouLHR5NmfOFU0z2GTNmpkT/5qqR7hx4IjWJPDhjvG }... } ``` Where can I use this? Globally? In the top-level of the virtualhost definition? If I'm reverse proxying, do I put it inside the reverse_proxy stanza? I used Apache for years and the docs always stated what context directives could be used in, eg. https://httpd.apache.org/docs/2.4/mod/core.html#acceptpathinfo ---------------------------------------------------------------------- viseradius · 2023-11-14 21:29 This is the way ---------------------------------------------------------------------- MaxGhost · 2023-11-14 22:16 Nobody made that exact distinction. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 22:20 > You dont need to defend Caddy to me, i was not attacking it No worries, but I'm clarifying misinformation. > And i was asked what the major missing features of Caddy in my opinion are. And I disagree that they're "missing", because they're available as plugins. They're "missing on purpose", because plugins are a _benefit_ and an _advantage_. ---------------------------------------------------------------------- thekrautboy · 2023-11-14 22:21 I did in my original comment. Not exactly sure what your problem is? Do you feel personally attacked because i simply said "Caddy is very basic" but i also said "that is not a bad thing"? ---------------------------------------------------------------------- thekrautboy · 2023-11-14 22:22 > No worries, but I'm clarifying misinformation. Nothing i said was false imo. > And I disagree that they're "missing", because they're available as plugins. They're "missing on purpose", because plugins are a benefit and an advantage. The reason why they are missing doesnt change the fact that they are missing... smh Have a good night :) ---------------------------------------------------------------------- MaxGhost · 2023-11-14 22:30 For Jellyfin in particular, I think it can be more harmful than good because then it breaks the usecase of using it with apps or chromecast which won't be able to perform that first layer of auth. But it can make sense for fully browser based apps, even moreso if those apps have insufficient auth capabilities. But I think Jellyfin's auth and user management is good enough for my needs as well. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 22:32 You're meant to read https://caddyserver.com/docs/caddyfile/concepts#structure first, which explains that directives always go within a site block, and can sometimes be nested within other special directives like `handle` and `route`. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 22:41 Not at all, you're taking this too seriously, no ill intent. I'm just clarifying for the audience. You're not the only person reading my answers. ---------------------------------------------------------------------- MaxGhost · 2023-11-14 22:42 > Nothing i said was false imo. You said "Caddy cannot read configurations from Docker container labels" which is not true, because the https://github.com/lucaslorentz/caddy-docker-proxy plugin exists. Implying it's not possible at all is misinformation. ---------------------------------------------------------------------- adamshand · 2023-11-14 23:11 I don't use chromecast so didn't know about that, but good point! ---------------------------------------------------------------------- clarksonswimmer · 2023-11-14 23:13 I'm still not seeing why someone would switch from Traefik to Caddy ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-14 23:16 I know you did, I saw the quote. I just wanted to put my perspective in addition to it. ---------------------------------------------------------------------- adamshand · 2023-11-14 23:16 Given that lots of people don't read documentation from top to bottom ( I of course always do 😳) ... I suspect many people would find examples with more context helpful. Show examples in all (or at least a couple) of the situations they can be used. Anyway, just trying to answer your question about how specifically the documentation could have been more helpful when I was starting out. ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-11-14 23:18 Or TLS and SNI based routing for that matter. I believe people are trying to put in as many bells and whistles as possible and still refer to it as a reverse proxy :) ---------------------------------------------------------------------- long-money · 2023-11-15 00:26 👍 ---------------------------------------------------------------------- thekrautboy · 2023-11-15 00:38 ffs... Caddy cannot do it. Caddy can do it if you use a plugin. Thats not the same as Caddy can do it, is it? It would be almost if using a plugin would be flipping a switch or copying a file somewhere, things almost every use would manage. But to rebuild the docker image, or trust someone else to build it, thats too far stretched to claim "Caddy can do it". With that logic i could also claim Traefik can do X, Y and C even tho those only exist as plugins. I compare Caddy vs Traefik, not Caddy plus some plugins vs Traefik. If you disagree with that logic, fine with me. > Implying it's not possible at all is misinformation. I never implied that in anyway, read the entire comment chain. I even mention plugins myself before you even showed up here haha. ---------------------------------------------------------------------- thekrautboy · 2023-11-15 00:40 > Not at all, you're taking this too seriously, no ill intent. I'm just clarifying for the audience. You're not the only person reading my answers. Clarify whatever you want, but youre replying to my comment and addressing me. If you care so much then please do reply to OP himself and explain how Caddy can do everything (but with some plugins in the tiny fineprint). Have a good night. ---------------------------------------------------------------------- FierceDeity_ · 2023-11-15 01:30 Sure, thanks. I only saw I answered to the wrong comment then, heh ---------------------------------------------------------------------- MaxGhost · 2023-11-15 01:46 You're taking what I'm saying personally. Don't. I'm only clarifying for other readers what's possible. I don't really care if your opinion is that plugins aren't relevant. I'm explaining that to the maintainers (and a large part of the userbase), they are relevant. > I never implied that in anyway You did, in your first comment. And often that's all a lot of users will read. Which is why I was correcting it. ---------------------------------------------------------------------- thekrautboy · 2023-11-15 01:50 > Caddy is very basic, and thats why it works so easily. There is nothing wrong with it. > However it lacks some features that other reverse proxies offer. But if you dont need any of those, use Caddy. > Additional security? Not directly. But fail2ban and CrowdSec are easily set up too. And Caddy also combines very well with Authelia for authentication. Nothing false or misleading. Again, i am saying Caddy is lacking those features, which it does. You consider plugins part of Caddy, i dont. This is going in circles now. Bye. ---------------------------------------------------------------------- MaxGhost · 2023-11-15 01:51 I hope you're aware of https://github.com/lucaslorentz/caddy-docker- proxy ? ---------------------------------------------------------------------- snk4ever · 2023-11-15 06:46 I'm thinking of moving to caddy. At the moment I use Apache with certbot for setting up HTTPS. I serve static pages, two dokuwikis, Ampache. My other web services are running in dockers with their own web servers and only accessible on my LAN each on different TCP ports. From outside of my house I use wireguard to access the non-443 services. Would Caddy be a good fit for me ? Can it run my dokuwikis ? I would move Ampache to a docker I think. ---------------------------------------------------------------------- aksdb · 2023-11-15 08:07 I also missed this distinction. If you had said "Caddy has only basic reverse proxy features" I would have concurred. But saying "Caddy is very basic" sounds too generic to be true for a full featured web server with one of the most batteries included features currently around (at least from the opensource and still maintained ones). ---------------------------------------------------------------------- thekrautboy · 2023-11-15 08:12 > the most batteries **included** features But they arent included thats the whole point here ffs. ---------------------------------------------------------------------- aksdb · 2023-11-15 08:20 But it includes more features than nginx and apache. I didn't say "that include all possible features you can achieve with plugins". ---------------------------------------------------------------------- thekrautboy · 2023-11-15 08:28 Okay, but i would also call nginx very basic as a reverse proxy. Apache2 i honestly havent touched or looked at in many years, no clue. ---------------------------------------------------------------------- Zestyclose_Car1088 · 2023-11-15 09:47 That would be handy, and best practice for media server setup! 👍 ---------------------------------------------------------------------- MaxGhost · 2023-11-15 10:10 > and best practice for media server setup That's not really relevant to the Caddy docs tbh. This entirely depends on your needs, and every self hoster has different want/needs. Caddy isn't the only piece to your media server, it's just part of it. ---------------------------------------------------------------------- Zestyclose_Car1088 · 2023-11-15 10:30 Fair enough ---------------------------------------------------------------------- Silencer306 · 2023-11-15 10:31 What firewall do you use? ---------------------------------------------------------------------- TheoSunny · 2023-11-15 11:02 >If you're using the DNS challenge and you don't want to expose your server publicly, then yes use your LAN IP. Back here just to say that it worked! What you said was the last missing piece. (I let out a lil sob-chuckle cause this issue had been driving me mad for weeks) The steps I took, if anyone from the future ever reads this far - 1. Added an "A" record for [subdomain.example.com](https://subdomain.example.com) pointing to LAN IP on cloudflare. 2. Replaced `{env.CLOUDFLARE_API_TOKEN}` with `{$CLOUDFLARE_API_TOKEN}` (and all other variables in my Caddyfile) following variable formats in Caddy docs. 3. Brought up the containers and used `curl -v` [`subdomain.example.com`](https://subdomain.example.com)`.` Got a successful connection as certificate details were displayed. Of course accessing via the local machine's browser still throws `ERR_SSL_PROTOCOL_ERROR` which means I'll have to setup a local DNS server. Planning to do so with coreDNS. Greateful for the quick tips and patience u/MaxGhost & u/Whitestrake, ya'll rock! ---------------------------------------------------------------------- MaxGhost · 2023-11-15 11:11 Great! Glad it worked. > Replaced {env.CLOUDFLARE_API_TOKEN} with {$CLOUDFLARE_API_TOKEN} (and all other variables in my Caddyfile) following variable formats in Caddy docs. I don't think that's necessary in this case FWIW. It's slightly more correct to use the `{env.*}` form for secrets because it's replaced at runtime instead of at config adapt time, which leaks secrets to the `autosave.json` file (very minor issue, but it can matter in certain contexts). ---------------------------------------------------------------------- flaming_m0e · 2023-11-15 13:06 I just use UFW on the VPS running my caddy. Every port except 80/443 is blocked, and I have Wireguard and Tailscale setup for me to have remote access. ---------------------------------------------------------------------- powerfulparadox · 2023-11-16 07:10 Traefik's docs are written for experts, not mere mortals. Find an option you (might) need because someone insists that their software needs to handle TLS, not the reverse proxy (correct in some cases, but not all, and no option to change the behavior), and the setting is documented in 3 different places in different ways with bare-bones config file examples that don't specify which config file it goes into (and barely where in said file it should go). There are a couple helpful people on the forums, but that isn't a guarantee of success. ---------------------------------------------------------------------- adamshand · 2023-11-16 07:53 (Despite evidence to the contrary), I am officially an expert in this shit and I still found it infuriating. ---------------------------------------------------------------------- Douppikauppa · 2023-11-17 09:46 FWIW, all major web backends (Node, FastAPI, Rocket etc) and thus most services support listening on UNIX socket just fine, and not having to keep track of which port number one assigns to which service is a big advantage even without the "dynamic" {host} trickery above. TCP ports get messy to maintain with many services on the same box, and they are also vulnerable to proxy bypass, lacking the permission control that UNIX sockets have. ---------------------------------------------------------------------- MaxGhost · 2023-11-17 10:30 Don't get me wrong, I agree there's a lot of advantages to unix sockets, I'm just saying that it's not really a particularly common thing to use. Especially since Caddy is cross-platform, it's more useful to show examples that work everywhere (yes Windows does have AF_UNIX support now but nobody really uses it). ---------------------------------------------------------------------- Douppikauppa · 2023-11-17 13:38 Absolutely, and I think you are right, the unix sockets are skipped in most guides and tutorials-- Because others overlook them too? (and Windows indeed may be an issue too) 🤔 ---------------------------------------------------------------------- gelizaga123 · 2023-11-26 18:13 also setting up local tls is 2 lines. i love caddy ---------------------------------------------------------------------- scmmishra · 2023-12-01 20:37 Yeah, just felt adventurous and tried to build something fun ---------------------------------------------------------------------- n1c0_ds · 2023-12-24 13:22 I'm trying to replicate a very simple nginx setup, and after a few hours of reading useless documentation plus 2-3 of the same forum posts, I give up and ditch Caddy altogether. This is the second time it happens this week. On both accounts, figuring out nginx' stupid syntax was easier than making Caddy's poorly documented directives work. Simply put, for anything but the most basic projects, the lack of documentation makes Caddy deeply unpleasant to use. Simple things like "how to implement a caching proxy" or "how do I redirect 401 errors to the login page?" are not explained at all. A lot of the directives have no meaningful examples. I'm replying to you because I spent the last 3 hours trying to get my Django-based auth page to work like before. Pardon my frustration; I'm not a very patient computer user and that's not your fault at all. ---------------------------------------------------------------------- MaxGhost · 2023-12-25 03:25 For caching you need to install this plugin: https://github.com/caddyserver/cache-handler For error handling, see https://caddyserver.com/docs/caddyfile/directives/handle_errors. Yes, there's examples. But it depends how you're emitting auth errors. Without context, I'm not sure exactly what you're trying to do. What you should do if you're having trouble is open a topic on the forums, and make sure to fill out the help topic template. ---------------------------------------------------------------------- n1c0_ds · 2023-12-25 10:24 I will find a solution in the end. I'm just expressing my frustration that the documentation never seems to address the most basic cases with complete, working, in-context examples.