Reverse Proxy using Caddy (with optional automatic TLS)

[Dave-g08]

Thanks for your help. I re-added the hostname in my router and restarted and it now works. So far I've only got transmission to work. I'll try the rest tomorrow.

 

[Dave-g08]

So I've managed to get tautulli and sonarr working too. Radarr returns a Bad Request error which I've read can be due to the user it is run under. Also when I try to add a subdomain to the caddyfile, all stop working. Can you advise on the code needed when adding a new subdomain? For example

Code:

example.com {
tls {
        dns cloudflare
}
gzip
root /usr/local/www/html/
proxy /transmission http://local IP:9091 {
        transparent

}
unifi.example.com {
gzip
proxy / local IP:8443 {
        header_upstream -Authorization
        insecure_skip_verify
        websocket
        transparent
}

 

[danb35]

I think you're missing closing braces on both of those host blocks.

 

[andrewzah]

-snip-

This is why the "simple" syntax caddy shows by default is bad. I don't understand why Caddy accepts this sort of syntax or shows examples for it.

You are indeed missing two ending braces, so the file should look like the following:

Code:

example.com {
  tls {
    dns cloudflare
  }

  gzip
  root /usr/local/www/html/
  proxy /transmission http://local IP:9091 {
    transparent
  }
}

unifi.example.com {
  gzip

  proxy / localIP:8443 {
    header_upstream -Authorization
    insecure_skip_verify
    websocket
    transparent
  }
}

Much easier to read with indentation.

 

[Dave-g08]

Thank you @danb35 and @andrewzah

Unifi controller and Unifi Video both work as above. They don't work as domain.com/app

 

[andrewzah]

Thank you @danb35 and @andrewzah

Unifi controller and Unifi Video both work as above. They don't work as domain.com/app

Is that an issue with unifi controller/video, or caddy?

Something like this ought to work:

Code:

example.com {
  tls {
    dns cloudflare
  }
  gzip
  root /usr/local/www/html/

  proxy /transmission http://localhost:9091/ {
    transparent
  }

  proxy /unifi http://localhost:8443/ {
    header_upstream -Authorization
    insecure_skip_verify
    websocket
    transparent
  }
}

with localhost being replaced if the services are on a different ip.

 

[Dave-g08]

s that an issue with unifi controller/video, or caddy?

I believe it's due to the unifi controller, but I'm not sure why.

Something like this ought to work:

I tried that plus variations but couldn't get it to work.

Also unifi controller and unifi video require 'https://ipaddress: port/'

 

[rmblr]

The link to the resource docs is 404ing, I think it should point to

https://www.ixsystems.com/community...-using-caddy-with-optional-automatic-tls.114/

 

[KevDog]

How does this proxy handle wss/ws (web socket connections)? I'm trying to use Nextcloud with the Collabora plugin however this Collabora makes use of web sockets.

 

[danb35]

Caddy does handle web socket connections, but the directives are different--check the Caddy docs. Start here: https://caddyserver.com/docs/proxy

 

[KevDog]

@danb35

This probably is kind of out of the scope of this forum however with the websocket thing -- if I had this proxy sitting in front of another Apache reverse proxy which then forwarded to websocket host -- I'm not sure how I would configure things. Clearing the reverse proxy is looking for the connection/upgrade headers contained within the request and then upgrading the connection to ws/wss and then passing the request to the ws/wss server. This is very similar to how Apache's proxy_wstunnel works. In this circumstance however, I really don't want the request to be processed but just passed to the next reverse proxy in the chain. Just proxying the request to the next reverse proxy as http/https however doesn't work since I think for whatever reason the document headers are re-written. This is all a guess on my part since I don't have any great tool or method to examine the headers -- pre and post proxy traversal.

 

[gt2416]

Hey danb, I finally got around to setting this up. It works much better than I thought with handling certs and stuff so thats pretty cool.
However I could not get nextcloud to work. I used your nextcloud guide to set it up manually (before you had the script) and was wondering if you knew how to get caddy to work with it. I have a seperate dns that I use only for nextcloud so getting it to work with dns.com or dns.com/nextcloud doesnt matter, I just want it to work with caddy so that my other apps can renew their certs without me manually port forwarding every 3 months to renew them.

 

[danb35]

I used your nextcloud guide to set it up manually (before you had the script)

The script (which has been using Caddy as the webserver for a while now) is the only guide I've done, so it would have been another user's guide. But that shouldn't make a difference. I haven't run Nextcloud behind a reverse proxy before, but this may give you some ideas of things to put in your Caddyfile:
https://github.com/caddyserver/exam...ud/caddy-reverseproxy-nginx-backend-nextcloud

 

[gt2416]

I realized I did use someone else's guide not yours sorry.
Edit : Fixed

 

[sheenegarmi]

danb35 submitted a new resource:

Reverse Proxy using Caddy (with optional automatic TLS) - Install Caddy Server to use as a reverse proxy for web applications in your FreeNAS jails



Read more about this resource...

I try to open a link but I get
Oops! We ran into some problems.
You do not have permission to view this page or perform this action.

what i did wrong

 

[danb35]

Looks like iX have broken something else on the forums. There's another copy here: https://forum.freenas-community.org/t/reverse-proxy-using-caddy-with-optional-automatic-tls/27

Edit: Or just click "Overview" toward the top of the page:

 

[ecomstock]

I've followed the guide here:
https://www.ixsystems.com/community...-using-caddy-with-optional-automatic-tls.114/

and additionally installed a version of caddy with a Namecheap TLS DNS plugin by running:
curl https://getcaddy.com | bash -s personal tls.dns.namecheap

Everything is working fine when running unsecured. However, when I attempt to secure my sites using TLS by
adding the following lines to a site in my Caddyfile:

Code:

tls {
    dns namecheap
}

I can then run service caddy start, but the service stops immediately with the following message in the caddy.log file:

Error during parsing: Setting up DNS provider 'namecheap': namecheap: some credentials information are missing: NAMECHEAP_API_USER,NAMECHEAP_API_KEY

I've added the NAMECHEAP_API_USER and NAMECHEAP_API_KEY to the login.config file for the jail, and if I run the "env" command as root I see the proper environment variables and values:

Code:

TERM=xterm-256color
NAMECHEAP_API_KEY=**************************
NAMECHEAP_API_USER=*******************
BLOCKSIZE=K

It seems like when running the "service caddy start" command that caddy is being run as a user other than root.

Can anyone offer any advice as to what may be happening? Is there another place that I can configure the environment variables needed by the TLS DNS Plugin?

Thanks!
Everett

 

[danb35]

Is there another place that I can configure the environment variables needed by the TLS DNS Plugin?

Yes, in the rc.conf file. I cover this in the resource, though the example is for Cloudflare:

Finally, set the API credentials for your DNS provider: sysrc caddy_env="CLOUDFLARE_EMAIL=(cloudflare_account_email) CLOUDFLARE_API_KEY=(global_api_key)".

For your credentials, it'd be sysrc caddy_env="NAMECHEAP_API_KEY=************************** NAMECHEAP_API_USER=*******************".

 

[ecomstock]

danb, thanks for the quick reply. Considering how many times I read the resource I'm not sure how I missed that, but I did. Caddy is now starting with TLS! Thanks again!

 

[blueether]

Hi @danb35
I have used you guide as a starting point for setting up caddy in a debian lxc on proxmox to handle a wordpress site (also a proxmox lxc) and nextcloud under freenas (installed via you script)

HTTPS is working great for the wordpress site that I've set up for the wife, but for the nextcloud I'm getting 502 Bad Gateway. I'm assuming this is because there is caddy and https already setup on the nextcloud jail.

Before I break tne nextcloud jail is there any thing that you would suggest?

Code:

village*****.org.nz {
   gzip
   proxy / 10.1.1.56/ {
        transparent
   }
}

www.village*****.org.nz {
   gzip
   proxy / 10.1.1.56/ {
        transparent
   }
}

cloud.******.net:443 {
   gzip
   proxy / https://10.1.1.55/ {
        transparent
   }
}