setting up a caddy reverse proxy without losing a weekend
three gotchas that ate my saturday, in the order they'll eat yours
Never miss an update
This list changes over time — get a short email when it does.
At most one short email a week — unfollow in one click.
1
domain, then reverse_proxy, then the port you're proxying to. that's it for step one
2
point dns at the server first
ymmv on how long propagation takes, but that's what a 'failed' cert issuance almost always means, not caddy being broken
3
open ports 80 and 443, both
80 isn't optional tbh, even if you never serve plain http the acme challenge needs it
4
use caddy reload, not caddy restart
keeps existing connections alive while it swaps the config in place
5
backend on a self-signed cert? set transport https + insecure_skip_verify
otherwise caddy refuses to trust it and you'll stare at a handshake error way longer than you should
6
caddy derives the tls sni from the host header
rewrote the host header for a multi-tenant backend and broke tls entirely until i found the right override. cost me a saturday
7
after caddy trust for local certs, restart the whole browser
not just the tab. chrome caches trust state harder than you'd think
8
log level info while you're setting this up, dial it back after
9
final check: hit the site from outside your network
localhost lied to me about dns resolving correctly. always test from a phone on data
Or start a list of your own — free, it takes a minute.