Joe Rice-Jones writes about replacing Nginx Proxy Manager with Caddy as a reverse proxy in his Proxmox home lab. The entire config lives in a single Caddyfile, making it readable and diffable. He uses DNS-01 challenges via Cloudflare to get Let's Encrypt certificates behind CGNAT without opening any ports, and opts for a single wildcard certificate rather than per-service certs to avoid broadcasting his setup in Certificate Transparency logs.
- Eero mesh router hijacked all DNS packets on port 53, blocking Caddy's DNS-01 lookups; fixed with `propagation_timeout -1` and a fixed `propagation_delay 30s`
- Technitium (his authoritative DNS) interfered with Caddy's zone discovery, requiring a public resolver for that lookup
- Caddy's internal CA (`tls internal`) works for quick local testing but mobile apps often reject user-installed certificates
- New Caddy package updates overwrite `/usr/bin/caddy`, so `dpkg-divert` is needed to protect custom builds
- Eero mesh router hijacked all DNS packets on port 53, blocking Caddy's DNS-01 lookups; fixed with `propagation_timeout -1` and a fixed `propagation_delay 30s`
- Technitium (his authoritative DNS) interfered with Caddy's zone discovery, requiring a public resolver for that lookup
- Caddy's internal CA (`tls internal`) works for quick local testing but mobile apps often reject user-installed certificates
- New Caddy package updates overwrite `/usr/bin/caddy`, so `dpkg-divert` is needed to protect custom builds
Yannick Lyn Fatt writes that new updates to the `serversideup/php` Docker images allow FrankenPHP containers to serve real HTTPS via Let's Encrypt using only an IP address. By utilizing the `shortlived` ACME profile, users can obtain valid certificates without requiring a DNS entry, which is particularly beneficial for self-hosting, staging environments, or internal APIs reachable by IP.
- Requires pinning the Docker image to v4.6.0-beta1 or later.
- The short-lived certificate profile issues credentials valid for 160 hours.
- Configuration requires setting a `default_sni` via `CADDY_GLOBAL_OPTIONS` because IP connections lack SNI metadata.
- Certificates and ACME state must be persisted in `/config` and `/data` volumes to avoid Let's Encrypt rate limits during redeploys.
- Requires pinning the Docker image to v4.6.0-beta1 or later.
- The short-lived certificate profile issues credentials valid for 160 hours.
- Configuration requires setting a `default_sni` via `CADDY_GLOBAL_OPTIONS` because IP connections lack SNI metadata.
- Certificates and ACME state must be persisted in `/config` and `/data` volumes to avoid Let's Encrypt rate limits during redeploys.
This article discusses the author's experience setting up reverse proxies for self-hosted services, finding the process surprisingly straightforward despite extensive and often overwhelming documentation. It compares several popular options like Nginx, Traefik, Caddy, Envoy, SWAG, and HAProxy, ultimately recommending Caddy for its simplicity and features. It also touches on the relative ease of reverse proxy setup compared to configuring the services they front.
