Caddy can get certificates for my duckdns ip address if I run it from cli, but can't, when I lauch it as a systemd service

[timelordx]

@legokol

when I run CLI, I use sudo and caddy runs from root user (I guess), and in case of systemd it runs with caddy user and group. Might that be an issue?

It could indeed be the issue.

I am not very familiar with Debian, but you do have ProtectSystem=full in your service file.

Take a look at this, it was kind of a similar problem.

Changing log location

You haven’t shared your systemd unit file for caddy, I’m guessing you have a very restrictive ProtectSystem setting, which is OK, but you haven’t adjusted ReadWritePaths to include your new log directory. Check your systemd settings for Caddy: systemctl show caddy | grep -E 'Protect|ReadWritePaths'

You may need to adjust ReadWritePaths accordingly and add the folders Caddy uses to store its data and logs.

Refer to the following:

Conventions - Caddy Documentation

or check your Caddy debug log to see where it is trying to store data.

Also, make sure caddy has read/write access to those folders.