setting up a caddy reverse proxy without losing a weekend

three gotchas that ate my saturday, in the order they'll eat yours

domain, then reverse_proxy, then the port you're proxying to. that's it for step one

point dns at the server first

ymmv on how long propagation takes, but that's what a 'failed' cert issuance almost always means, not caddy being broken

open ports 80 and 443, both

80 isn't optional tbh, even if you never serve plain http the acme challenge needs it

use caddy reload, not caddy restart

keeps existing connections alive while it swaps the config in place

backend on a self-signed cert? set transport https + insecure_skip_verify

otherwise caddy refuses to trust it and you'll stare at a handshake error way longer than you should

caddy derives the tls sni from the host header

rewrote the host header for a multi-tenant backend and broke tls entirely until i found the right override. cost me a saturday

after caddy trust for local certs, restart the whole browser

not just the tab. chrome caches trust state harder than you'd think

log level info while you're setting this up, dial it back after

final check: hit the site from outside your network

localhost lied to me about dns resolving correctly. always test from a phone on data

Related lists