Caddy & Tailscale & Cloudflare (Certificate issue)

Help
1

Hello, new here but thanks for your help in advance

1. The problem I’m having:

I’m trying to setup caddy as a reverse proxy, via tailscale network with cloudflare CNAME redirection. But I’m having problems getting Caddy to accept my token to generate SSL certificate.

Following the steps at https://www.youtube.com/watch?v=Vt4PDUXB_fg,

2. Error messages and/or full log output:

Redacted part of the Cloudflare token. In the video the token did not have the cftu_ prefix. But this is what cloudflare is giving now, and full token was validate with curl for Zones and DNS

caddy      | {"level":"info","ts":1774076881.271653,"msg":"maxprocs: Leaving GOMAXPROCS=2: CPU quota undefined"}
caddy      | {"level":"info","ts":1774076881.271817,"msg":"GOMEMLIMIT is updated","package":"github.com/KimMachineGun/automemlimit/memlimit","GOMEMLIMIT":30076316467,"previous":9223372036854775807}
caddy      | {"level":"info","ts":1774076881.2726083,"msg":"using config from file","file":"/etc/caddy/Caddyfile"}
caddy      | {"level":"info","ts":1774076881.2738512,"msg":"adapted config to JSON","adapter":"caddyfile"}
caddy      | {"level":"warn","ts":1774076881.2739635,"msg":"Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies","adapter":"caddyfile","file":"/etc/caddy/Caddyfile","line":1}
caddy      | {"level":"info","ts":1774076881.2749794,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
caddy      | {"level":"info","ts":1774076881.2753055,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc000015300"}
caddy      | {"level":"info","ts":1774076881.275449,"logger":"tls.cache.maintenance","msg":"stopped background certificate maintenance","cache":"0xc000015300"}
caddy      | {"level":"info","ts":1774076881.2755399,"logger":"http","msg":"servers shutting down with eternal grace period"}
caddy      | {"level":"info","ts":1774076881.2756388,"msg":"maxprocs: No GOMAXPROCS change to reset"}
caddy      | Error: loading initial config: loading new config: loading http app module: provision http: getting tls app: loading tls app module: provision tls: provisioning automation policy 0: loading TLS automation management module: position 0: loading module 'acme': provision tls.issuance.acme: loading DNS provider module: loading module 'cloudflare': provision dns.providers.cloudflare: API token 'cfut_1bgW...0c' appears invalid; ensure it's correctly entered and not wrapped in braces nor quotes

3. Caddy version:

can’t get the version as the container closes out because of invalid token message

4. How I installed and ran Caddy:

dockerfile:

FROM caddy:builder AS builder

–mount=type=cache,target=/go/pkg/mod #    --mount=type=cache,target=/root/.cache/go-build \RUN xcaddy build \    --with     --with  #    --with github.com/hairyhenderson/caddy-teapot-module@v0.0.3-0

FROM caddy:latestCOPY --from=builder /usr/bin/caddy /usr/bin/caddy

a. System environment:

Docker with Tailscale and Caddy

b. Command/Dockercompose:

services:
  tailscale:
    image: tailscale/tailscale:latest
    container_name: tailscale
    hostname: caddy-node
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    volumes:
      - tailscale_state:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_PERMIT_CERT_UID=0
    network_mode: host
  caddy:
    image: ghcr.io/caddy-dns/cloudflare:latest
    container_name: caddy
    cap_add:
      - NET_ADMIN
    ports:
      - 80:80
      - 443:443
    volumes:
      - /mnt/homelab/dockercompose/caddy/Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
      - /var/run/tailscale:/var/run/tailscale:ro
    environment:
      - CF_API_TOKEN=cfut_1bgW....820c
    depends_on:
      - tailscale
    networks:
      - proxy
volumes:
  caddy_data: null
  caddy_config: null
  tailscale_state: null
networks:
  proxy:
    driver: bridge

d. My complete Caddy config:

setup works with tls internal (commented out), but fails for cloudflare


(cloudflare) {
  tls {
    dns cloudflare {env.CF_API_TOKEN}
  }
}

# immich
photos.houseofinfinity.net {
  reverse_proxy 192.168.100.40:2283
  import cloudflare
  #tls internal
}

5. Links to relevant resources:

Possibly similar issue to Caddy & Tailscale & Cloudflare, Oh my! (certificate issue)

1 Like