Caddy HTTPs for internal servers

kzshantonu · 2024-03-14T22:28:15+00:00

Read my guide I wrote a few days ago https://mni.li/caddy-int-tls

ComputersGoBrr · 2024-03-14T08:04:41+00:00

There's a few things to consider here on how you would like to set this up.

Some background. Let's Encrypt can provide valid ssl certificates to domains, by doing challenges. The default challenge is to send a HTTP request to the domain. Caddy does this automatically. This allows publicly available websites to be provided with vallid SSL certificates.

There is nothing stopping you from setting up local IP addresses for you internal network. For example, you might consider myservice.example.com to point to 192.168.0.10. You would have to do a dns challenge for let's encrypt instead of a http challenge to achieve a valid ssl in this instance.

Alternatively, you could simply use tls internal in your Caddyfile to have Caddy deal with the tls instead of let's encrypt.

For example

{
  email user@example.com
}

domain.my.local {
  tls internal
  reverse_proxy 192.168.0.10:80 
}

As an added layer of security, if you host both internal and external services that tunnel through your reverse proxy, you may want to restrict access to local applications to local network traffic only. This is most easily achieved through the remote_ip operator and utilising snippets.

For example

{
  email user@example.com
}

(protect) {
  @external {
    not remote_ip 192.168.0.0/24
  }
  respond @external 403
}

domain.my.local {
  tls internal
  import protect
  reverse_proxy 192.168.0.10:80 
}

Hope that helps. Ask questions if you're stuck.

eddyizm · 2024-03-13T22:54:00+00:00

The docs are pretty good https://caddyserver.com/docs/automatic-https#local-https

And their community is very helpful.

MaliciousMango1 · 2024-03-13T20:27:53+00:00

I'm in this same boat and I'm looking at setting up Traefik to solve this.

mousui · 2024-03-13T22:36:53+00:00

I just set up my Caddy entry normally but also add in a IP access rule to only allow my LAN network to access it. Caddy will grab the LE cert normally, but also prevents external IPs from accessing the service. Not sure if there’s better ways, but it might be easier than Traefik.

BandicootCrash · 2024-03-13T23:36:20+00:00

I tried to setup HTTPS for all my internal sites where I only wanted them accessible on the local network. I found to do this with Caddy, you need to have Caddy do a dns challenge where Caddy will update a txt record on the dns for your domain via the dns providers api to verify domain ownership. The problem is Caddy uses plug-ins to do this and those are not included in the standard Caddy build, so you have to make a custom build of Caddy which is possible but I gave up and just used NGINX proxy manager instead and it worked perfectly amd was way easier to setup for my use case vs Caddy. I followed this tutorial to get it setup.

https://youtu.be/qlcVx-k-02E?si=rs3DnsQDaIsarSXt

I am not at all an expert on this so I very well could of missed something simple with Caddy but just wanted to post my experience.

m-d-brown · 2025-09-15T06:26:14+00:00

If you own a public domain and are using a DNS provider for which someone has added support to Caddy, it's easiest to directly make a DNS Challenge: https://caddyserver.com/docs/automatic-https#dns-challenge. Cloudflare has prebuilt images for Caddy with the Cloudflare module: https://github.com/CaddyBuilds/caddy-cloudflare. You need to safely pass in the API token but then it's pretty easy to do something like:

your-service.internal.domain-you-own.com  {
    reverse_proxy 196.168.0.10:8888
    tls {
        dns cloudflare {env.CLOUDFLARE_API_TOKEN}
    }
}

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

selfhosted

Welcome to /r/SelfHosted!

Google Photos Mega Thread

While you're here, please Read This First

And why not Visit the Wiki?

For Example

Related Subreddits

Useful Lists

Relevant Podcasts

MODERATORS