Allow direct access to server only by Hostname not by IP

[francislavoie]

@winoffrg

I want to block the access to site by direct IP Address. For example if somone enter’s by IP Address I just shouldn’t resolve the request and simply block it with error code 444. And allow only by hostname. I also don’t want if someone opens postman and manually set Host header and get’s the response.

I’m not sure where you got the idea of error code 444, that’s a non-standard HTTP status code, only used by nginx.

Caddy’s default behaviour when you configure it with a domain is to not match requests that don’t have that domain in the Host header.

It’s not possible to “block someone manually setting the Host header”, because that is what the browser does when you put the domain in the URL.

Browsers also set the TLS-SNI field in the TLS handshake so that the server can determine which certificate to use to complete the handshake (because the Host header is part of the request payload which is encrypted, otherwise the server would have no way to know which certificate to use for which request).

@winoffrg

and in brower the response is ERR_SSL_PROTOCOL_ERROR;

That’s normal, that means the TLS handshake failed because the browser either couldn’t trust the certificate it was sent from the server, or it didn’t match the hostname it sent in the request (if you made a request with an IP address but the server responds with a certificate for a particular domain and not that IP address, then it fails).

@winoffrg

"msg":"dial tcp: lookup portainer on 127.0.0.11:53: server misbehaving"

This means that Caddy wasn’t able to resolve the name portainer with Docker’s built-in DNS server to an IP address. I’m not sure why that would happen, but that’s not a problem with Caddy, it’s a problem with your Docker setup.