1. The problem I’m having:
Summary
First time setup. Caddy Container is exiting after throwing multiple errors. It seems to me like it is not consuming my caddyfile at all.
Goals:
- Cloudflare DNS-01
- wildcard certs only
- Do not try to capture port 443 and 80 on the host, as it is statically assigned to nginx on Synology.
- reverse proxy for containers running on the same host.
2. Error messages and/or full log output:
The main issues seem to be that caddy insists on wanting to bind to port 443 & 2019
It also appears something in my caddyfile is incorrectly formatted, I am wondering what that can be (see above for caddyfile).
Docker logs:
caddy | {"level":"warn","ts":1737886889.542978,"msg":"failed to set GOMAXPROCS","error":"open /sys/fs/cgroup/cpu/cpu.cfs_quota_us: no such file or directory"}
caddy | {"level":"info","ts":1737886889.543482,"msg":"using config from file","file":"/etc/caddy/Caddyfile"}
caddy | {"level":"info","ts":1737886889.546961,"msg":"adapted config to JSON","adapter":"caddyfile"}
caddy | {"level":"warn","ts":1737886889.5470042,"msg":"Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies","adapter":"caddyfile","file":"/etc/caddy/Caddyfile","line":2}
caddy | {"level":"info","ts":1737886889.548721,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
caddy | {"level":"info","ts":1737886889.549162,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc000192200"}
caddy | {"level":"info","ts":1737886889.5492225,"logger":"http.auto_https","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv0","https_port":443}
caddy | {"level":"info","ts":1737886889.5492504,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
caddy | Error: loading initial config: loading new config: http app module: start: listening on :443: listen tcp :443: bind: address already in use
3. Caddy version:
Can’t even run it to check, but I just pulled the docker image today.
4. How I installed and ran Caddy:
a. System environment:
- DSM 7.2
- Docker 20.10.2 (I know…)
- Docker Compose 2.9.0
b. Command:
Building caddy with the acm-dns plugin is successful using this command:
docker build -t caddy:latest /volume1/docker/caddy/dockerfile-caddy
Dockerfile
FROM caddy:builder AS builder
RUN xcaddy build \
--with github.com/caddy-dns/cloudflare
FROM caddy:latest
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
c. Compose file:
docker compose yaml
services:
caddy:
build:
context: ${DOCKER_FOLDER}/caddy/dockerfile-caddy
dockerfile: Dockerfile
image: caddy:latest
container_name: caddy
hostname: caddy
restart: unless-stopped
env_file: .env
ports:
- 4382:4382
volumes:
- ${DOCKER_FOLDER}/caddy/Caddyfile:/etc/caddy/Caddyfile
- ${DOCKER_FOLDER}/caddy/caddy_config:/config
- ${DOCKER_FOLDER}/caddy/caddy_data:/data
networks:
default:
name: $DOCKER_MY_NETWORK
external: true
.env
TZ=Europe/Berlin
DOCKER_FOLDER=/volume1/docker
PUBLIC_DOMAIN=cd.domain1.com
PRIVATE_DOMAIN=cd.domain2.com
CLOUDFLARE_API_TOKEN=<mytoken>
DOCKER_MY_NETWORK=default_container_network_IPv4_only
(yes, I have redacted the domains, as the container isn’t even starting, so I assume domains are irrelevant here. At least for now.)
d. My complete Caddy config:
Logs say format is wrong on line 2 already (the one with acme_dns), which makes me think it isn’t even able to read the real caddyfile. But I might be wrong, open to advice.
Caddyfile
{
acme_dns cloudflare {$CLOUDFLARE_API_TOKEN}
}
*.{$PUBLIC_DOMAIN}:4382 {
tls {
dns cloudflare {$CLOUDFLARE_API_TOKEN}
}
@a host nc.{$PUBLIC_DOMAIN}:4382
handle @a {
reverse_proxy localhost:4380
}
handle {
abort
}
}
*.{$PRIVATE_DOMAIN}:4382 {
tls {
dns cloudflare {$CLOUDFLARE_API_TOKEN}
}
@a host nc.{$PRIVATE_DOMAIN}:4382
handle @a {
reverse_proxy localhost:4380
}
handle {
abort
}
}