diff --git a/caddy_v2/readme.md b/caddy_v2/readme.md index c35c09b..5e2971f 100644 --- a/caddy_v2/readme.md +++ b/caddy_v2/readme.md @@ -61,8 +61,7 @@ and will route traffic to other containers, or machines on the network. `docker network create caddy_net` -All the future containers and Caddy must be on this new network. - +All the future containers and Caddy must be on this new network.
Can be named whatever you want, but it must be a new custom named network. Otherwise [dns resolution would not work](https://docs.docker.com/network/drivers/bridge/) and containers would not be able to target each other just by the hostname. @@ -590,15 +589,13 @@ In the monitoring section theres more use of logging and visualizing it in grafa # Caddy DNS challenge -This setup only works for Cloudflare. - DNS challenge authenticates ownership of the domain by requesting that the owner puts a specific TXT record in to the domains DNS zone.
Benefit of using DNS challenge is that there is no need for your server -to be reachable by the letsencrypt servers. Cant open ports or want to exclude -entire world except your own country from being able to reach your server? -DNS challange is what you want to use for https then.
-It also allows for issuance of wildcard certificates.
+to be reachable by the letsencrypt. Cant open ports or want to **geoblock** +the entire world except your own country from being able to reach your server? +DNS challange is what you need to use for https then.
+It also allows for issuance of **wildcard certificates**.
The drawback is a potential security issue, since you are creating a token that allows full control over your domain's DNS. You store this token somewhere, you are giving it to some application from dockerhub... @@ -640,19 +637,20 @@ Inside create a file named `Dockerfile`. `Dockerfile` ```Dockerfile -FROM caddy:2.8.4-builder AS builder +FROM caddy:2.10.0-builder AS builder RUN xcaddy build \ --with github.com/caddy-dns/cloudflare -FROM caddy:2.8.4 +FROM caddy:2.10.0 COPY --from=builder /usr/bin/caddy /usr/bin/caddy ``` -of note - if making changes in the Dockerfile after running, +*of note* - if making changes in the Dockerfile after running, use command `docker compose down --rmi local` -to remove localy built containers and force rebuild on the next compose up. +to remove localy built containers and force rebuild on the next compose up.
+That's how you update. ### - Edit docker-compose.yml @@ -711,45 +709,91 @@ b.{$MY_DOMAIN} { ### - Wildcard certificate -A one certificate to rule all subdomains. But not apex/naked domain, thats separate.
-As shown in [the documentation](https://caddyserver.com/docs/caddyfile/patterns#wildcard-certificates), -the subdomains must be moved under the wildcard site block and make use -of host matching and handles. +One certificate to rule all subdomains.
+Well, not really, the apex/naked domain would use separate one. +But it is nice to have just a single cert for all the subdomains. +Plus you are not [announcing to the world](https://dnsdumpster.com/) +each and every subdomain you have in use. +`auto_https prefer_wildcard` - is the global directive that makes it happen, +it will make caddy ignore automation policies for non-wildcard domains when +theres already a wild card certificate that applies to them. + +This prefer_wildcard is [releatively new](https://github.com/caddyserver/caddy/pull/6146), +previously the config was bit [messier](https://caddyserver.com/docs/caddyfile/patterns#wildcard-certificates), +more nested. `Caddyfile` -``` +```php { acme_dns cloudflare {$CLOUDFLARE_API_TOKEN} -} - -{$MY_DOMAIN} { - reverse_proxy homer:8080 + auto_https prefer_wildcard } *.{$MY_DOMAIN} { - @a host a.{$MY_DOMAIN} - handle @a { - reverse_proxy whoami:80 - } +} - @b host b.{$MY_DOMAIN} - handle @b { - reverse_proxy nginx:80 - } +cook.{$MY_DOMAIN} { + reverse_proxy mealie:80 +} - handle { - abort - } +photo.{$MY_DOMAIN} { + reverse_proxy immich:2283 } ``` -[Here's](https://github.com/caddyserver/caddy/issues/3200) some discussion -on this and a simple, elegant way we could have had, without the need to -dick with the Caddyfile this much. Just one global line declaration. -But the effort went sideways.
-So I myself do not even bother with wildcard when the config ends up looking -complex and ugly. + +
+

Manual DNS challange

 + +If it's problematic to switch nameservers to cloudflare...
+Manually ever 80 days adding TXT record and deleting it, +according to docker log instructions. + +Still need to build ourselves as all DNS stuff is packages. + +`Dockerfile` +```php +FROM caddy:2.10.0-builder AS builder + +RUN xcaddy build \ + --with github.com/nakamorg/caddy-dns-manual + +FROM caddy:2.10.0 + +COPY --from=builder /usr/bin/caddy /usr/bin/caddy +``` + +`Caddyfile` +```php +{ + acme_dns manual_dns + auto_https prefer_wildcard +} + +*.{$MY_DOMAIN} { +} + +cook.{$MY_DOMAIN} { + reverse_proxy mealie:80 +} + +pic.{$MY_DOMAIN} { + reverse_proxy immich:2283 +} +``` + +--- +--- + +
+ + +# mTLS + +Maybe one day I will bother to test? + +[Meanwhile](https://www.reddit.com/r/selfhosted/comments/1foxrlb/guide_setting_up_mtls_with_caddy_for_multiple/) # Monitoring @@ -764,7 +808,9 @@ Complete guide how to get it up for Caddie is part of of: * [Prometheus + Grafana + Loki guide-by-example](https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/prometheus_grafana_loki#caddy-reverse-proxy-monitoring) -# Other guides +# Other guides and useful stuff * [gurucomputing caddy guide](https://blog.gurucomputing.com.au/reverse-proxies-with-caddy/) -* +* [Caddy WAF](https://github.com/fabriziosalmi/caddy-waf) +* [caddy generator](https://www.reddit.com/r/selfhosted/comments/1hvtst0/i_made_a_caddyfile_generator/) +* [caddy defender](https://www.reddit.com/r/selfhosted/comments/1i8f9a2/introducing_caddydefender_a_redditinspired_caddy/)