1. Caddy version (caddy version):2.3.0
2. How I run Caddy:
from the CL: sudo systemctl start caddy
a. System environment:
RPi 4, RP-OS
PRETTY_NAME=“Raspbian GNU/Linux 10 (buster)”
NAME=“Raspbian GNU/Linux”
VERSION_ID=“10”
VERSION=“10 (buster)”
b. Command:
sudo systemctl start caddy
c. Service/unit/compose file:
n/a
d. My complete Caddyfile or JSON config:
The Caddyfile is an easy way to configure your Caddy web server.
#
# Unless the file starts with a global options block, the first
# uncommented line is always the address of your site.
#
# To use your own domain name (with automatic HTTPS), first make
# sure your domain's A/AAAA DNS records are properly pointed to
# this machine's public IP, then replace the line below with your
# domain name.
#:80
#mediaserver.stufftoread.com
jellyfin.DOMAIN.TLD {
encode gzip
reverse_proxy mediaserver.stufftoread.com:8096
}
# Set this path to your site's directory.
root * /usr/share/caddy
# Enable the static file server.
file_server
# Another common task is to set up a reverse proxy:
# reverse_proxy localhost:8080
reverse_proxy 127.0.0.1:8096
#{
# email email@domain.tld
#}
#jellyfin.DOMAIN.TLD {
# encode gzip
# reverse_proxy mediaserver.stufftoread.com:8096
#}
# Or serve a PHP site through php-fpm:
# php_fastcgi localhost:9000
# Refer to the Caddy docs for more information:
# https://caddyserver.com/docs/caddyfile
3. The problem I’m having:
I am running Jellyfin media system. I want to use Caddy to implement a reverse proxy and support https connections to jellyfin
- I do not know how to test that that reverse proxy is working.
- when I connect to jellyfin from the web or my LAN using any web browser, it states that the connection is ‘not secured’
When I http://localhost, I get the ‘Caddy success’ page.
I am not sure what commands to use and in what order to:
a)shut Caddy down and kill any zombie or suspended instances
b) how to correctly restart it, without or with a new Caddyfile
4. Error messages and/or full log output:
I issue: sudo systemctl start caddy
I then issue: journalctl -u caddy --no-pager | less
This is the last portion of the log file:
pr 14 20:07:01 raspberrypi systemd[1]: Started Caddy.
Apr 14 20:07:02 raspberrypi caddy[16417]: caddy.HomeDir=/var/lib/caddy
Apr 14 20:07:02 raspberrypi caddy[16417]: caddy.AppDataDir=/var/lib/caddy/.local/share/caddy
Apr 14 20:07:02 raspberrypi caddy[16417]: caddy.AppConfigDir=/var/lib/caddy/.config/caddy
Apr 14 20:07:02 raspberrypi caddy[16417]: caddy.ConfigAutosavePath=/var/lib/caddy/.config/caddy/autosave.json
Apr 14 20:07:02 raspberrypi caddy[16417]: caddy.Version=v2.3.0
Apr 14 20:07:02 raspberrypi caddy[16417]: runtime.GOOS=linux
Apr 14 20:07:02 raspberrypi caddy[16417]: runtime.GOARCH=arm
Apr 14 20:07:02 raspberrypi caddy[16417]: runtime.Compiler=gc
Apr 14 20:07:02 raspberrypi caddy[16417]: runtime.NumCPU=4
Apr 14 20:07:02 raspberrypi caddy[16417]: runtime.GOMAXPROCS=4
Apr 14 20:07:02 raspberrypi caddy[16417]: runtime.Version=go1.15.6
Apr 14 20:07:02 raspberrypi caddy[16417]: os.Getwd=/
Apr 14 20:07:02 raspberrypi caddy[16417]: LANG=en_US.UTF-8
Apr 14 20:07:02 raspberrypi caddy[16417]: LANGUAGE=en_US.UTF-8
Apr 14 20:07:02 raspberrypi caddy[16417]: PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
Apr 14 20:07:02 raspberrypi caddy[16417]: HOME=/var/lib/caddy
Apr 14 20:07:02 raspberrypi caddy[16417]: LOGNAME=caddy
Apr 14 20:07:02 raspberrypi caddy[16417]: USER=caddy
Apr 14 20:07:02 raspberrypi caddy[16417]: INVOCATION_ID=b99a3b666a2648a0a22d9f35a75b0e69
Apr 14 20:07:02 raspberrypi caddy[16417]: JOURNAL_STREAM=8:967252
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.0433996,"msg":"using provided configuration","config_file":"/etc/caddy/Caddyfile","config_adapter":""}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.0489562,"logger":"admin","msg":"admin endpoint started","address":"tcp/localhost:2019","enforce_origin":false,"origins":["localhost:2019","[::1]:2019","127.0.0.1
:2019"]}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.0499094,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0x38a3f40"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.0582778,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"warn","ts":1618445222.1815743,"logger":"pki.ca.local","msg":"installing root certificate (you might be prompted for password)","path":"storage:pki/authorities/local/root.crt"}
Apr 14 20:07:02 raspberrypi caddy[16417]: 2021/04/14 20:07:02 Warning: "certutil" is not available, install "certutil" with "apt install libnss3-tools" or "yum install nss-tools" and try again
Apr 14 20:07:02 raspberrypi caddy[16417]: 2021/04/14 20:07:02 define JAVA_HOME environment variable to use the Java trust
Apr 14 20:07:02 raspberrypi sudo[16426]: pam_unix(sudo:auth): conversation failed
Apr 14 20:07:02 raspberrypi sudo[16426]: pam_unix(sudo:auth): auth could not identify password for [caddy]
Apr 14 20:07:02 raspberrypi sudo[16426]: caddy : user NOT in sudoers ; TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/bin/tee /usr/local/share/ca-certificates/Caddy_Local_Authority_-_2021_ECC_Root_63340393426586678000127088344461378
8.crt
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"error","ts":1618445222.2062793,"logger":"pki.ca.local","msg":"failed to install root certificate","error":"failed to execute sudo: exit status 1","certificate_file":"storage:pki/authorities/local/root.crt"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.2088716,"logger":"tls.obtain","msg":"acquiring lock","identifier":"root"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.209651,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["jellyfin.domain.tld","root"]}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.210895,"logger":"tls.obtain","msg":"acquiring lock","identifier":"*"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.2113645,"logger":"tls.obtain","msg":"lock acquired","identifier":"*"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.210333,"logger":"tls.obtain","msg":"lock acquired","identifier":"root"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.2130425,"msg":"autosaved config","file":"/var/lib/caddy/.config/caddy/autosave.json"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.2222428,"msg":"serving initial configuration"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.2154403,"logger":"tls","msg":"cleaned up storage units"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.2239392,"logger":"tls.obtain","msg":"acquiring lock","identifier":"jellyfin.domain.tld"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.224881,"logger":"tls.obtain","msg":"acquiring lock","identifier":"root"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.225707,"logger":"tls.obtain","msg":"lock acquired","identifier":"jellyfin.domain.tld"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.2311223,"logger":"tls.obtain","msg":"certificate obtained successfully","identifier":"root"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.2311835,"logger":"tls.obtain","msg":"releasing lock","identifier":"root"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"warn","ts":1618445222.2347302,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [root]: no OCSP server specified in certificate"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.234884,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["jellyfin.domain.tld"]}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.2349503,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["jellyfin.domain.tld"]}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.239381,"logger":"tls.obtain","msg":"certificate obtained successfully","identifier":"*"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.2394261,"logger":"tls.obtain","msg":"releasing lock","identifier":"*"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"warn","ts":1618445222.242,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [*]: no OCSP server specified in certificate"}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.7109668,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["jellyfin.domain.tld"]}
Apr 14 20:07:02 raspberrypi caddy[16417]: {"level":"info","ts":1618445222.7116823,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["jellyfin.domain.tld"]}
Apr 14 20:07:03 raspberrypi caddy[16417]: {"level":"error","ts":1618445223.1016335,"logger":"tls.obtain","msg":"will retry","error":"[jellyfin.domain.tld] Obtain: [jellyfin.domain.tld] creating new order: request to https://acme.zerossl.com/v2/DV90/newOrder failed after 1 attempts: HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid DNS identifier [jellyfin.domain.tld] (ca=https://acme.zerossl.com/v2/DV90)","attempt":1,"retrying_in":60,"elapsed":0.875859077,"max_duration":2592000}
Apr 14 20:07:03 raspberrypi caddy[16417]: {"level":"info","ts":1618445223.2260509,"logger":"tls.obtain","msg":"lock acquired","identifier":"root"}
Apr 14 20:07:03 raspberrypi caddy[16417]: {"level":"info","ts":1618445223.226719,"logger":"tls.obtain","msg":"certificate already exists in storage","identifier":"root"}
Apr 14 20:07:03 raspberrypi caddy[16417]: {"level":"info","ts":1618445223.2267785,"logger":"tls.obtain","msg":"releasing lock","identifier":"root"}
Apr 14 20:07:03 raspberrypi caddy[16417]: {"level":"warn","ts":1618445223.2324445,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [root]: no OCSP server specified in certificate"}
Apr 14 20:08:03 raspberrypi caddy[16417]: {"level":"error","ts":1618445283.980844,"logger":"tls.obtain","msg":"will retry","error":"[jellyfin.domain.tld] Obtain: [jellyfin.domain.tld] creating new order: request to https://acme.zerossl.com/v2/DV90/newOrder failed after 1 attempts: HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid DNS identifier [jellyfin.domain.tld] (ca=https://acme.zerossl.com/v2/DV90)","attempt":2,"retrying_in":120,"elapsed":61.755069736,"max_duration":2592000}
Apr 14 20:10:04 raspberrypi caddy[16417]: {"level":"error","ts":1618445404.7653296,"logger":"tls.obtain","msg":"will retry","error":"[jellyfin.domain.tld] Obtain: [jellyfin.domain.tld] creating new order: request to https://acme.zerossl.com/v2/DV90/newOrder failed after 1 attempts: HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid DNS identifier [jellyfin.domain.tld] (ca=https://acme.zerossl.com/v2/DV90)","attempt":3,"retrying_in":120,"elapsed":182.539554229,"max_duration":2592000}
Apr 14 20:12:05 raspberrypi caddy[16417]: {"level":"error","ts":1618445525.5073993,"logger":"tls.obtain","msg":"will retry","error":"[jellyfin.domain.tld] Obtain: [jellyfin.domain.tld] creating new order: request to https://acme.zerossl.com/v2/DV90/newOrder failed after 1 attempts: HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid DNS identifier [jellyfin.domain.tld] (ca=https://acme.zerossl.com/v2/DV90)","attempt":4,"retrying_in":300,"elapsed":303.281624582,"max_duration":2592000}
Apr 14 20:17:06 raspberrypi caddy[16417]: {"level":"error","ts":1618445826.2060003,"logger":"tls.obtain","msg":"will retry","error":"[jellyfin.domain.tld] Obtain: [jellyfin.domain.tld] creating new order: request to https://acme.zerossl.com/v2/DV90/newOrder failed after 1 attempts: HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid DNS identifier [jellyfin.domain.tld] (ca=https://acme.zerossl.com/v2/DV90)","attempt":5,"retrying_in":600,"elapsed":603.98022583,"max_duration":2592000}
Apr 14 20:27:07 raspberrypi caddy[16417]: {"level":"error","ts":1618446427.0961154,"logger":"tls.obtain","msg":"will retry","error":"[jellyfin.domain.tld] Obtain: [jellyfin.domain.tld] creating new order: request to https://acme.zerossl.com/v2/DV90/newOrder failed after 1 attempts: HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid DNS identifier [jellyfin.domain.tld] (ca=https://acme.zerossl.com/v2/DV90)","attempt":6,"retrying_in":1200,"elapsed":1204.870341586,"max_duration":2592000}
Apr 14 20:47:07 raspberrypi caddy[16417]: {"level":"error","ts":1618447627.8803048,"logger":"tls.obtain","msg":"will retry","error":"[jellyfin.domain.tld] Obtain: [jellyfin.domain.tld] creating new order: request to https://acme.zerossl.com/v2/DV90/newOrder failed after 1 attempts: HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid DNS identifier [jellyfin.domain.tld] (ca=https://acme.zerossl.com/v2/DV90)","attempt":7,"retrying_in":1200,"elapsed":2405.65453113,"max_duration":2592000}
Apr 14 21:07:08 raspberrypi caddy[16417]: {"level":"error","ts":1618448828.570637,"logger":"tls.obtain","msg":"will retry","error":"[jellyfin.domain.tld] Obtain: [jellyfin.domain.tld] creating new order: request to https://acme.zerossl.com/v2/DV90/newOrder failed after 1 attempts: HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid DNS identifier [jellyfin.domain.tld] (ca=https://acme.zerossl.com/v2/DV90)","attempt":8,"retrying_in":1800,"elapsed":3606.344863526,"max_duration":2592000}
Apr 14 21:37:09 raspberrypi caddy[16417]: {"level":"error","ts":1618450629.7044632,"logger":"tls.obtain","msg":"will retry","error":"[jellyfin.domain.tld] Obtain: [jellyfin.domain.tld] creating new order: request to https://acme.zerossl.com/v2/DV90/newOrder failed after 1 attempts: HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid DNS identifier [jellyfin.domain.tld] (ca=https://acme.zerossl.com/v2/DV90)","attempt":9,"retrying_in":1800,"elapsed":5407.478689038,"max_duration":2592000}
(END)
### 5. What I already tried:
<!-- Show us what effort you've put in to solving the problem. Be specific -- people are volunteering their time to help you! Low effort posts are not likely to get good answers! -->
I've used various combinations of caddy stop/start/run and revised my Caddyfile to what I think is the minimum to connect to jellyfin securely.
### 6. Links to relevant resources:
https://jellyfin.org/docs/general/quick-start.html
see the link 'reverse proxies' in the text.