1. The problem I’m having:
When I connect to Caddy using my public ip address it works only when I type http://mypublicip:80 when I do http://mypublicip:443 I get Client sent an “HTTP request to an HTTPS server.” and when I do https://mypublicip:443 says secure connection failed and SSL_ERROR_INTERNAL_ERROR_ALERT
2. Error messages and/or full log output:
log
{"level":"info","ts":1735931016.4684925,"msg":"using config from file","file":"/etc/caddy/Caddyfile"}
{"level":"info","ts":1735931016.4697332,"msg":"adapted config to JSON","adapter":"caddyfile"}
{"level":"warn","ts":1735931016.4697464,"msg":"Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies","adapter":"caddyfile","file":"/etc/caddy/Caddyfile","line":2}
{"level":"info","ts":1735931016.4707115,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
{"level":"info","ts":1735931016.470922,"logger":"http.auto_https","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv0","https_port":443}
{"level":"info","ts":1735931016.4709387,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
{"level":"info","ts":1735931016.4709764,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc000523580"}
{"level":"info","ts":1735931016.4713411,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
{"level":"info","ts":1735931016.471422,"msg":"failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details."}
{"level":"info","ts":1735931016.4715652,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
{"level":"info","ts":1735931016.4716215,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]}
{"level":"info","ts":1735931016.4716637,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["ford.work","jellyfin.ford.work"]}
{"level":"info","ts":1735931016.4732473,"msg":"autosaved config (load with --resume flag)","file":"/config/caddy/autosave.json"}
{"level":"info","ts":1735931016.4732754,"msg":"serving initial configuration"}
{"level":"info","ts":1735931016.4841115,"logger":"tls","msg":"storage cleaning happened too recently; skipping for now","storage":"FileStorage:/data/caddy","instance":"f77bea6e-fbbf-4a5b-be8f-a2e7350fe217","try_again":1736017416.484107,"try_again_in":86399.999999254}
{"level":"info","ts":1735931016.4842725,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"error","ts":1735931020.5647044,"logger":"http.log.error","msg":"dial tcp [::1]:8096: connect: connection refused","request":{"remote_ip":"162.158.10.229","remote_port":"10490","client_ip":"162.158.10.229","proto":"HTTP/2.0","method":"GET","host":"jellyfin.ford.work","uri":"/","headers":{"X-Forwarded-For":["100.40.98.148"],"X-Forwarded-Proto":["https"],"Upgrade-Insecure-Requests":["1"],"Accept-Language":["en-US,en;q=0.5"],"Cf-Connecting-Ip":["100.40.98.148"],"Cf-Ray":["8fc5400e3c008fcc-BOS"],"User-Agent":["Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"],"Sec-Fetch-Site":["none"],"Cf-Ipcountry":["US"],"Sec-Fetch-Mode":["navigate"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"Sec-Fetch-User":["?1"],"Cdn-Loop":["cloudflare; loops=1"],"Accept-Encoding":["gzip, br"],"Sec-Fetch-Dest":["document"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"Priority":["u=0, i"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"jellyfin.ford.work"}},"duration":0.000716851,"status":502,"err_id":"7mw7huyi0","err_trace":"reverseproxy.statusError (reverseproxy.go:1269)"}
{"level":"error","ts":1735931020.842992,"logger":"http.log.error","msg":"dial tcp [::1]:8096: connect: connection refused","request":{"remote_ip":"162.158.10.249","remote_port":"9840","client_ip":"162.158.10.249","proto":"HTTP/2.0","method":"GET","host":"jellyfin.ford.work","uri":"/favicon.ico","headers":{"X-Forwarded-Proto":["https"],"Accept-Encoding":["gzip, br"],"Cf-Ray":["8fc540101f2e8fcc-BOS"],"Sec-Fetch-Dest":["image"],"Cdn-Loop":["cloudflare; loops=1"],"Accept-Language":["en-US,en;q=0.5"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"User-Agent":["Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"],"Referer":["https://jellyfin.ford.work/"],"Sec-Fetch-Mode":["no-cors"],"Sec-Fetch-Site":["same-origin"],"Priority":["u=6"],"Cf-Ipcountry":["US"],"X-Forwarded-For":["100.40.98.148"],"Cf-Connecting-Ip":["100.40.98.148"],"Accept":["image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"jellyfin.ford.work"}},"duration":0.000774329,"status":502,"err_id":"ks2dh5m7t","err_trace":"reverseproxy.statusError (reverseproxy.go:1269)"}
3. Caddy version:
caddy:latest
4. How I installed and ran Caddy:
docker compose up -d
a. System environment:
Linux Ubuntu docker compose
b. Command:
docker compose up -d
c. Service/unit/compose file:
networks:
caddy:
services:
portainer:
image: portainer/portainer-ce:latest
networks:
- caddy
ports:
- 9443:9443
volumes:
- data:/data
- /var/run/docker.sock:/var/run/docker.sock
restart: unless-stopped
caddy:
build:
context: .
dockerfile: Dockerfile # Use the custom Dockerfile to build Caddy with t>
restart: unless-stopped
networks:
- caddy
ports:
- "80:80"
- "443:443"
- "443:443/udp"
environment:
- CLOUDFLARE_EMAIL=${CLOUDFLARE_EMAIL}
- CLOUDFLARE_API_KEY=${CLOUDFLARE_API_KEY}
- DOMAIN=${DOMAIN}
- CADDY_DNS_PROVIDER=cloudflare
volumes:
- ./Caddyfile:/etc/caddy/ # Correct path for Caddyfile
- ./site:/srv
- caddy_data:/data
- caddy_config:/config
volumes:
caddy_data:
caddy_config:
data:
d. My complete Caddy config:
my Dockerfile
# Use the official Caddy builder image
FROM caddy:builder AS builder
# Add the Cloudflare DNS module
RUN xcaddy build \
--with github.com/caddy-dns/cloudflare
# Use the official Caddy runtime image
FROM caddy:latest
# Copy the custom-built Caddy binary
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
my Caddyfile
https://ford.work {
tls {
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
}
reverse_proxy portainer:9443
}
https://jellyfin.ford.work {
tls {
dns cloudflare {env.CLOUDFLARE_API_TOKEN}
}
reverse_proxy localhost:8096
}
that did fix jellyfin so now that works and I did end up needing to use tls_insecure_skip_verify. I’m connected to my site using https and it says it’s encrypted still? does that mean its fine or am I misunderstand that command?