caddy¶

Configuration for the Caddy reverse proxy, the single entry point of the server: every other service is published through one of its sites, with a certificate obtained automatically.

Caddy runs rootless but listens on the privileged ports 80 and 443 thanks to two mechanisms: the host lowers net.ipv4.ip_unprivileged_port_start to 80, and the sockets are opened by systemd (caddy.socket) and passed to the container, which also lets the unit start on the first connection.

caddy.image¶

The image of the Caddy server to deploy.

• Type: String
• Example: docker.io/library/caddy:2.10

caddy.http_port¶

Port to listen for HTTP requests. TCP connections are forwarded to Caddy via a UNIX socket for improved performance. Every HTTP request is permanently redirected to HTTPS.

• Type: Integer
• Example: 80

caddy.https_port¶

Port to listen for HTTPS requests. TCP (and UDP for QUIC/HTTP-3) connections are forwarded to Caddy via UNIX sockets.

• Type: Integer
• Example: 443

caddy.lan_subnets¶

The address ranges of the local network, in CIDR notation, from which private sites answer and protected sites answer without a login. Caddy matches them against the address of the client connection itself, which a client cannot fake with a header: the sockets are opened by systemd on the host, so Caddy sees the real client address. Caddy's private_ranges shortcut is accepted as an item and stands for every private IPv4 and IPv6 range plus the loopback.

• Optional, required as soon as there are private or protected sites
• Type: List of CIDR ranges
• Example: [192.168.0.0/24]

caddy.authelia¶

The Authelia service that checks the logins of protected sites.

• Optional, required as soon as there are protected sites

caddy.authelia.port¶

The http_port of the Authelia service. Caddy reaches it on the host through host.containers.internal.

• Type: Integer
• Example: 3023

caddy.public_sites¶

List of sites served over HTTPS to any client, one per host name. A site is either a reverse proxy to a service of the server, a redirect to another address, or a block of Caddy directives written by hand. Caddy automatically requests a certificate from Let's Encrypt for each host name, for private sites too.

Exactly one of port, redirect_to or directives must be set per site.

• Optional
• Type: List

caddy.public_sites[].hostname¶

Host name of the site, which must resolve to the server.

• Type: Fully qualified domain name
• Example: jellyfin.mydomain.com

caddy.public_sites[].port¶

The http_port of the service to proxy the site to. Caddy reaches it on the host through host.containers.internal. For a service on another machine, give directives with reverse_proxy <address>:<port> instead.

• Type: Integer
• Example: 3002

caddy.public_sites[].redirect_to¶

Target of a permanent HTTP redirect for the site, instead of a reverse proxy. Caddy placeholders such as {uri} are allowed.

• Type: String
• Example: https://home.mydomain.com{uri}

caddy.public_sites[].directives¶

Caddy directives inserted verbatim into the site block, for anything port and redirect_to cannot express. Remember that Caddy orders directives itself (redir and handle run before respond, which runs before reverse_proxy), so a respond meant to stop some requests must be scoped with a matcher and must not sit next to handle blocks. To keep a whole site on the LAN, make it a private site instead.

• Type: Multi-line string

• Example: keep one path on the LAN

  - hostname: vault.mydomain.com
    directives: |
      @admin_outside {
          path /admin*
          not remote_ip 192.168.0.0/24
      }
      respond @admin_outside 403
      reverse_proxy host.containers.internal:3019
  

caddy.private_sites¶

List of sites served over HTTPS to the clients of lan_subnets only; every other client gets a 403 Forbidden. Use it for web interfaces without authentication, or not meant to be exposed to the internet. The entries take the same keys as those of public_sites.

The restriction applies to whatever the site does, directives included: the template nests the body of the site in a handle block reserved to the LAN, so directives that are only valid at the top of a site block (tls, log, bind) cannot be used in a private site.

• Optional
• Type: List

• Example:

  private_sites:
    - hostname: prometheus.mydomain.com
      port: 3013
  

caddy.protected_sites¶

List of sites served over HTTPS to the clients of lan_subnets as they are, and to every other client after a login on the Authelia portal. Use it for web interfaces without authentication of their own that must be reachable from outside. The entries take the same keys as those of public_sites.

Caddy checks each request from outside with Authelia before running the body of the site: a browser without a session is redirected to the portal and brought back once logged in, and the application then receives the Remote-User, Remote-Email, Remote-Name and Remote-Groups headers of the user. Those headers are first removed from every request, so that no client can set them itself; LAN clients reach the application without them. As for private sites, the body is nested in a handle block, so tls, log and bind cannot be used in directives.

• Optional
• Type: List

• Example:

  protected_sites:
    - hostname: zigbee.mydomain.com
      port: 3021