Joe Rice-Jones writes about replacing Nginx Proxy Manager with Caddy as a reverse proxy in his Proxmox home lab. The entire config lives in a single Caddyfile, making it readable and diffable. He uses DNS-01 challenges via Cloudflare to get Let's Encrypt certificates behind CGNAT without opening any ports, and opts for a single wildcard certificate rather than per-service certs to avoid broadcasting his setup in Certificate Transparency logs.
- Eero mesh router hijacked all DNS packets on port 53, blocking Caddy's DNS-01 lookups; fixed with `propagation_timeout -1` and a fixed `propagation_delay 30s`
- Technitium (his authoritative DNS) interfered with Caddy's zone discovery, requiring a public resolver for that lookup
- Caddy's internal CA (`tls internal`) works for quick local testing but mobile apps often reject user-installed certificates
- New Caddy package updates overwrite `/usr/bin/caddy`, so `dpkg-divert` is needed to protect custom builds
- Eero mesh router hijacked all DNS packets on port 53, blocking Caddy's DNS-01 lookups; fixed with `propagation_timeout -1` and a fixed `propagation_delay 30s`
- Technitium (his authoritative DNS) interfered with Caddy's zone discovery, requiring a public resolver for that lookup
- Caddy's internal CA (`tls internal`) works for quick local testing but mobile apps often reject user-installed certificates
- New Caddy package updates overwrite `/usr/bin/caddy`, so `dpkg-divert` is needed to protect custom builds
Yannick Lyn Fatt writes that new updates to the `serversideup/php` Docker images allow FrankenPHP containers to serve real HTTPS via Let's Encrypt using only an IP address. By utilizing the `shortlived` ACME profile, users can obtain valid certificates without requiring a DNS entry, which is particularly beneficial for self-hosting, staging environments, or internal APIs reachable by IP.
- Requires pinning the Docker image to v4.6.0-beta1 or later.
- The short-lived certificate profile issues credentials valid for 160 hours.
- Configuration requires setting a `default_sni` via `CADDY_GLOBAL_OPTIONS` because IP connections lack SNI metadata.
- Certificates and ACME state must be persisted in `/config` and `/data` volumes to avoid Let's Encrypt rate limits during redeploys.
- Requires pinning the Docker image to v4.6.0-beta1 or later.
- The short-lived certificate profile issues credentials valid for 160 hours.
- Configuration requires setting a `default_sni` via `CADDY_GLOBAL_OPTIONS` because IP connections lack SNI metadata.
- Certificates and ACME state must be persisted in `/config` and `/data` volumes to avoid Let's Encrypt rate limits during redeploys.
