Caddy as "acme forward proxy"?

[resmo (René Moser)]

I wonder if it is (already) possible to get a TLS cert from letsencrypt for a private network not accessable for the public by having a caddy in a DMZ to act as a “acme forward proxy” (using GitHub - caddyserver/forwardproxy: Forward proxy plugin for the Caddy web server ?) for the caddies in the LAN.

The public DNS would resolve to the DMZ caddy by a wildcard record.The LAN network would use split DNS and resolve the LAN caddies as local network IP (RFC 1918).

Of course it would be necessary to restrict the proxy for the network/caddies.

I will try to create such a setup but I would be interested if you see already any issues, which would not allow me to get it working with the current state of caddy and forward proxy.

[matt (Matt Holt)]

I would use the DNS challenge so that you do not need to worry about an ACME server trying to reach your server:

How to use DNS provider modules in Caddy 2

Caddy 2 uses a new and improved DNS provider interface for solving the ACME DNS challenge. All you have to do is plug the service provider(s) you need into your build, then add the DNS challenge to your configuration! Getting a DNS provider plugin How you choose to get a custom Caddy build is up to you; we’ll describe two common methods here. Method 1: Go to the Caddy download page. Find your DNS provider in the list of modules (dns.providers.*) and select it. Download your custom Caddy …

Much simpler.

[Whitestrake (Matthew Fay)]

Another option is to share storage (e.g. via NFS) between the three and then the public facing one can solve challenges initiated by the other two automatically.