Joe Rice-Jones writes about replacing Nginx Proxy Manager with Caddy as a reverse proxy in his Proxmox home lab. The entire config lives in a single Caddyfile, making it readable and diffable. He uses DNS-01 challenges via Cloudflare to get Let's Encrypt certificates behind CGNAT without opening any ports, and opts for a single wildcard certificate rather than per-service certs to avoid broadcasting his setup in Certificate Transparency logs.
- Eero mesh router hijacked all DNS packets on port 53, blocking Caddy's DNS-01 lookups; fixed with `propagation_timeout -1` and a fixed `propagation_delay 30s`
- Technitium (his authoritative DNS) interfered with Caddy's zone discovery, requiring a public resolver for that lookup
- Caddy's internal CA (`tls internal`) works for quick local testing but mobile apps often reject user-installed certificates
- New Caddy package updates overwrite `/usr/bin/caddy`, so `dpkg-divert` is needed to protect custom builds
- Eero mesh router hijacked all DNS packets on port 53, blocking Caddy's DNS-01 lookups; fixed with `propagation_timeout -1` and a fixed `propagation_delay 30s`
- Technitium (his authoritative DNS) interfered with Caddy's zone discovery, requiring a public resolver for that lookup
- Caddy's internal CA (`tls internal`) works for quick local testing but mobile apps often reject user-installed certificates
- New Caddy package updates overwrite `/usr/bin/caddy`, so `dpkg-divert` is needed to protect custom builds
