Hello!
I wonder if other Caddy users are dealing with multiple SSL sites on a single server/IP-address, isolating each different “tenant”.
My use case is replacing an aging Cpanel+apache “multiple reseller” self hosting solution with a more modern, secure and TLS1.2+HTTP/2, dockerized approach.
Right now I have a working setup with several personal sites I am serving with HTTPS just fine with one Caddy instance on a internet-exposed container acting as frontend server for all domains. This instance is doing all Let’s Encrypt magic for all domains, then proxying each one to internal Caddy instances, one per tenant with its own container, Caddyfile and isolated / filesystem.
So far, that works like a charm. They are personal low-traffic sites, but I do not foresee any scalability issues.
But I am running into trouble when enabling some advances features on the internal sites, like a http.git hook, as the remote cannot reach into the internal server (the frontend rejects the POST from bitbucket with a 402, as it does not know anything about the git webhook from the internal site)
Am I over-complicating this? Is there another way to handle multi-domain, multi-tenant setups?
Not planning to start a huge hosting business, just migrate from 15-year old server into the new cloud+infra-as-code+devops concept.
This is the Caddfile for proxy:
www.tenantone.com, tenantone.com {
tls webmaster@tenantone.com
log stdout
errors stdout
proxy / web-tenantone:8000
}
www.tenanttwo.org, tenanttwo.org {
tls webmaster@tenanttwo.org
log stdout
errors stdout
proxy / web-tenanttwo:8001
}
And this is a typical Caddyfile for a tenant:
:8000 {
tls off
log stdout
errors stdout
root /data/content
ext .html
rewrite / /old/index.html
rewrite {
to {uri} /old/{uri}
}
rewrite {
to {uri} /new/{uri}
}
}
Thanks in advance for any insight!
///Pablo
