Autostart Caddy with the netcup plugin

Help
1

1. The problem I’m having:

I would like to have ./caddy_linux_amd64_custom start run after booting my server.

Would the best way to set up a cron job with @reboot?

3. Caddy version:

root@paperless-ngx:~# ./caddy_linux_amd64_custom --version
v2.7.5 h1:HoysvZkLcN2xJExEepaFHK92Qgs7xAiCFydN5x5Hs6Q=

4. How I installed and ran Caddy:

Its downloaded from here: Download Caddy

a. System environment:

root@paperless-ngx:~# cat /etc/os-release 
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

b. Command:

./caddy_linux_amd64_custom start

My config:

{
        acme_ca https://acme-v02.api.letsencrypt.org/directory
        email mail@peterge.de
}

paperless.peterge.de {
        tls {
                dns netcup {
                        customer_number number
                        api_key key
                        api_password pw
                }
        }
        reverse_proxy http://localhost:8000
}
2

You don’t need a cronjob to do that, just enable caddy as a systemd service. It’s explained in the docs:

3

I downloaded the binary and installed it, see 4. in my post.
Thats why its not set up with systemctl:

root@paperless-ngx:~# systemctl enable --now caddy    
Failed to enable unit: Unit file caddy.service does not exist.
root@paperless-ngx:~# systemctl status caddy
Unit caddy.service could not be found.
4

How you downloaded it is not really relevant, if you want a binary to automatically be executed on host restar you need some kind of service.

If you install caddy with a package manager the service will be created automatically for you, if you install Caddy manually, as you did, you need to set up your service manually.

Systemd is a popular option and you have the instructions on how to do it step by step in the link I sent before

5

I set up the unit file like described on the page.

root@paperless-ngx:~# cat /etc/systemd/system/caddy.service
[Service]
ExecStart=
ExecStart=/usr/bin/caddy run --environ --config /root/Caddyfile
ExecReload=
ExecReload=/usr/bin/caddy reload --config /root/Caddyfile

But how do I enable caddy?

root@paperless-ngx:~# systemctl enable caddy.service 
The unit files have no installation config (WantedBy=, RequiredBy=, Also=,
Alias= settings in the [Install] section, and DefaultInstance= for template
units). This means they are not meant to be enabled using systemctl.
 
Possible reasons for having this kind of units are:
* A unit may be statically enabled by being symlinked from another unit's
  .wants/ or .requires/ directory.
* A unit's purpose may be to act as a helper for some other unit which has
  a requirement dependency on it.
* A unit may be started when needed via activation (socket, path, timer,
  D-Bus, udev, scripted systemctl call, ...).
* In case of template units, the unit is meant to be enabled with some
  instance name specified.
6

No, you only copied lines from the Overrides section, you didn’t use the unit file (which is linked to at the top of that page).

I strongly recommend you install Caddy using these instructions, and then follow these instructions to replace the Caddy binary from the package with your custom one.

That way, you won’t need to touch systemd config yourself, it’ll be managed by the apt package.

7

I set it up like described on Keep Caddy Running — Caddy Documentation.

But its not working yet, it did work before when I was executing it with the root user and the config in /root/Caddyfile. Now after creating the caddy user & group like described in the docs and moving the config to /etc/caddy/Caddyfile, I am unable to solve the challenge. I did no changes to my network/DNS stuff. Do you have any idea why it isnt wokring anymore?

root@paperless-ngx:~# systemctl status caddy.service 
* caddy.service - Caddy
     Loaded: loaded (/etc/systemd/system/caddy.service; enabled; preset: enabled)
     Active: active (running) since Wed 2023-12-06 11:57:23 CET; 4min 58s ago
       Docs: https://caddyserver.com/docs/
   Main PID: 212441 (caddy)
      Tasks: 9 (limit: 18941)
     Memory: 11.7M
        CPU: 347ms
     CGroup: /system.slice/caddy.service
             `-212441 /usr/bin/caddy run --environ --config /etc/caddy/Caddyfile

Dec 06 12:00:03 paperless-ngx caddy[212441]: {"level":"info","ts":1701860403.9204547,"logger":"tls.issuance.zerossl","msg":"done waiting on internal rate limiter","identifiers":["paperless.peterge.de"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":"mail@peterge.de"}
Dec 06 12:00:04 paperless-ngx caddy[212441]: {"level":"info","ts":1701860404.723109,"logger":"tls.issuance.zerossl.acme_client","msg":"trying to solve challenge","identifier":"paperless.peterge.de","challenge_type":"dns-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}
Dec 06 12:00:25 paperless-ngx caddy[212441]: {"level":"error","ts":1701860425.0205178,"logger":"tls.issuance.zerossl.acme_client","msg":"cleaning up solver","identifier":"paperless.peterge.de","challenge_type":"dns-01","error":"no memory of presenting a DNS record for \"_acme-challenge.paperless.peterge.de\" (usually OK if presenting also failed)"}
Dec 06 12:00:25 paperless-ngx caddy[212441]: {"level":"error","ts":1701860425.1876392,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"paperless.peterge.de","issuer":"acme-v02.api.letsencrypt.org-directory","error":"[paperless.peterge.de] solving challenges: presenting for challenge: adding temporary record for zone \"peterge.de.\": Post \"https://ccp.netcup.net/run/webservice/servers/endpoint.php?JSON\": dial tcp: lookup ccp.netcup.net on 9.9.9.9:53: read udp 10.0.4.104:59848->9.9.9.9:53: i/o timeout (order=https://acme-v02.api.letsencrypt.org/acme/order/1450990096/227258608366) (ca=https://acme-v02.api.letsencrypt.org/directory)"}
Dec 06 12:00:25 paperless-ngx caddy[212441]: {"level":"error","ts":1701860425.187714,"logger":"tls.obtain","msg":"will retry","error":"[paperless.peterge.de] Obtain: [paperless.peterge.de] solving challenges: presenting for challenge: adding temporary record for zone \"peterge.de.\": Post \"https://ccp.netcup.net/run/webservice/servers/endpoint.php?JSON\": dial tcp: lookup ccp.netcup.net on 9.9.9.9:53: read udp 10.0.4.104:59848->9.9.9.9:53: i/o timeout (order=https://acme-v02.api.letsencrypt.org/acme/order/1450990096/227258608366) (ca=https://acme-v02.api.letsencrypt.org/directory)","attempt":1,"retrying_in":60,"elapsed":182.04181498,"max_duration":2592000}
Dec 06 12:01:25 paperless-ngx caddy[212441]: {"level":"info","ts":1701860485.189629,"logger":"tls.obtain","msg":"obtaining certificate","identifier":"paperless.peterge.de"}
Dec 06 12:01:31 paperless-ngx caddy[212441]: {"level":"info","ts":1701860491.1433957,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"paperless.peterge.de","challenge_type":"dns-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
Dec 06 12:01:41 paperless-ngx caddy[212441]: {"level":"error","ts":1701860501.1465476,"logger":"tls.issuance.acme.acme_client","msg":"cleaning up solver","identifier":"paperless.peterge.de","challenge_type":"dns-01","error":"no memory of presenting a DNS record for \"_acme-challenge.paperless.peterge.de\" (usually OK if presenting also failed)"}
Dec 06 12:01:41 paperless-ngx caddy[212441]: {"level":"error","ts":1701860501.3033261,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"paperless.peterge.de","issuer":"acme-v02.api.letsencrypt.org-directory","error":"[paperless.peterge.de] solving challenges: presenting for challenge: adding temporary record for zone \"peterge.de.\": Post \"https://ccp.netcup.net/run/webservice/servers/endpoint.php?JSON\": dial tcp [2a03:4000::e01d]:443: connect: network is unreachable (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/127975814/12785990474) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)"}
Dec 06 12:01:47 paperless-ngx caddy[212441]: {"level":"info","ts":1701860507.1175063,"logger":"tls.issuance.zerossl.acme_client","msg":"trying to solve challenge","identifier":"paperless.peterge.de","challenge_type":"dns-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}

It is working fine when I coppy the config back to /root/Caddyfile, change the permissions and run caddy start…

8

I guess I might need to look for a new domain provider. Now I am facing

2023/12/06 11:40:14.532	ERROR	tls.issuance.acme.acme_client	cleaning up solver	{"identifier": "paperless.peterge.de", "challenge_type": "dns-01", "error": "deleting temporary record for name \"_acme-challenge.paperless.peterge.de\" in zone \"peterge.de.\": [netcup] Api session id in invalid format: The session id is not in a valid format."}
9

This reads more like your system was misconfigured and couldn’t make connections to the outside world.

:man_shrugging:

10

Ping heise.de worked flawlessly…

11

Just a small update, this fixed my problem with netcup:

propagation_timeout 900s
propagation_delay 600s
resolvers 1.1.1.1

See Please set the default --dns-netcup-propagation-seconds >= 630 · Issue #28 · coldfix/certbot-dns-netcup · GitHub

1 Like
12

Makes sense. The netcup plugin’s README should probably mention that. If you could open an issue or PR with the plugin’s repo, that would help future users.

13
1 Like
14
1 Like
15

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.