Trying to host Caddy behind Cloudflare Tunnel on a subdomain reddit / selfhosted ---------------------------------------------------------------------- LeVraiRoiDHyrule · 2023-12-23 19:31 Hi, Thanks to all the recommendations here, I choosed Cloudflare Tunnel with Cloudflared to host my self hosted services. I tried a simple setup first and it worked great with Home Assistant directly connected to Cloudflared. Now, I am trying something more complicated : having Caddy between Cloudflared and my apps. This will allow me to integrate Authentik for authentication for my app access. I know Cloudflare can integrate something similar but I am already an Authentik user so I prefer to do it that way. The problem is that I am trying to make my tunnel point to a subdomain, [server2.mydomain.com](https://server2.mydomain.com) , because I already have a server running without tunnel on [mydomain.com](https://mydomain.com) . I then want to have services like [homeassistant.mydomain.com](https://homeassistant.mydomain.com) working on [server2.mydomain.com](https://server2.mydomain.com) and not [mydomain.com](https://mydomain.com). I first set up a CNAME [homeassistant.mydomain.com](https://homeassistant.mydomain.com) redirecting to [server2.mydomain.com](https://server2.mydomain.com) I have set up my Cloudflare Tunnel so it connects to [server2.mydomain.com](https://server2.mydomain.com) and redirects locally to [https://caddy:443](https://caddy:443) . I am running everything in docker so it is the DNS name on the docker network. It seems caddy has issues succeeding ACME challenges to get its certificates. I tried following [https://caddy.community/t/caddy-with- cloudflare-tunnel/18569](https://caddy.community/t/caddy-with- cloudflare-tunnel/18569) , following the Internal HTTPS section but it doesn't seem to work. I have set [server2.mydomain.com](https://server2.mydomain.com) in Origin Server Name and HTTP Host Header settings. What should I do so Caddy can get its certificates and work with full HTTPS ? Thanks in advance and have a great day ---------------------------------------------------------------------- clintkev251 · 2023-12-23 21:35 You can't run HTTP acme challenges through a Cloudflare tunnel which is likely why you're failing to get certificates. I'm not a Caddy expert, but this is how most proxies operate by default. You should use a DNS challenge instead as this won't be dependent on the tunnel ---------------------------------------------------------------------- LeVraiRoiDHyrule · 2023-12-23 21:53 Do you know how I should set this up? ---------------------------------------------------------------------- clintkev251 · 2023-12-23 21:58 I don't use Caddy, but it seems like you use a module. https://caddy.community/t/how-to-use-dns-provider-modules-in- caddy-2/8148 ---------------------------------------------------------------------- LeVraiRoiDHyrule · 2023-12-24 01:18 Suceeded to install the module and it seems like Caddy is able to get its SSL certs after creating an API access. It should be ok but I can't access any of the services I try to expose. There is no error in Caddy logs so it looks like Caddy is not receiving anything. So I think the problem comes from Cloudflare settings. Is there anything more I need to set up with Cloudflare ? It could be because I'm doing my tunnel on a subdomain and not the main domaine. In my tunnel settings, should I set the Origin Server Name and HTTP Host Header to the subdomain or the main domain ? ---------------------------------------------------------------------- clintkev251 · 2023-12-24 01:46 Origin server name should match whatever your certificate is valid for, HTTP Host header should just be able to be left blank. And the actual service address should be however your caddy server is reachible from the context of Cloudflared ---------------------------------------------------------------------- LeVraiRoiDHyrule · 2023-12-24 10:56 I've also been told to left HTTP Host Header blank but when I do, I can't host anything on my tunnel. If I set it to the subdomain of my tunnel, I can host on this subdomain. But I can't host anything on another CNAME subdomain pointing to the tunnel subdomain. According to https://developers.cloudflare.com/cloudflare-one/connections/connect- networks/routing-to-tunnel/dns/, it should be working but it's not and I can't find why. ---------------------------------------------------------------------- clintkev251 · 2023-12-24 13:35 Something else with your config is screwy then. You shouldn't need to override the host header, as by default this will be set to whatever the host is for the URL that you're calling. So if you use the url [https://mysubdomain.mydomain.com](https://mysubdomain.mydomain.com), the host header will be set to [mysubdomain.mydomain.com](https://mysubdomain.mydomain.com) which should be what your caddy server is expecting and can use to route the traffic to the correct service. ---------------------------------------------------------------------- LeVraiRoiDHyrule · 2023-12-24 14:04 You were right. At first I wanted to have only one public hostname in my tunnel settings, then make CNAME pointing to it. Apparently it should work but it wasn't, so I created multiple public hostname in the tunnel for my subdomains instead. I left HTTP Host Header empty, and matched the TLS Origin Server Name with the subdomain. And it works ! I don't know if a way is better than the other but it works as expected for now. I still have a lot to learn about Cloudflare configurations, I hope I didn't make too risky configurations. Anyway it works at last, thanks a lot !