Yannick Lyn Fatt writes that new updates to the `serversideup/php` Docker images allow FrankenPHP containers to serve real HTTPS via Let's Encrypt using only an IP address. By utilizing the `shortlived` ACME profile, users can obtain valid certificates without requiring a DNS entry, which is particularly beneficial for self-hosting, staging environments, or internal APIs reachable by IP.
- Requires pinning the Docker image to v4.6.0-beta1 or later.
- The short-lived certificate profile issues credentials valid for 160 hours.
- Configuration requires setting a `default_sni` via `CADDY_GLOBAL_OPTIONS` because IP connections lack SNI metadata.
- Certificates and ACME state must be persisted in `/config` and `/data` volumes to avoid Let's Encrypt rate limits during redeploys.
- Requires pinning the Docker image to v4.6.0-beta1 or later.
- The short-lived certificate profile issues credentials valid for 160 hours.
- Configuration requires setting a `default_sni` via `CADDY_GLOBAL_OPTIONS` because IP connections lack SNI metadata.
- Certificates and ACME state must be persisted in `/config` and `/data` volumes to avoid Let's Encrypt rate limits during redeploys.
This article discusses the author's experience setting up reverse proxies for self-hosted services, finding the process surprisingly straightforward despite extensive and often overwhelming documentation. It compares several popular options like Nginx, Traefik, Caddy, Envoy, SWAG, and HAProxy, ultimately recommending Caddy for its simplicity and features. It also touches on the relative ease of reverse proxy setup compared to configuring the services they front.
