1. The problem I’m having:
I was able to get Caddy working as a reverse proxy for a single local service with Tailscale, but I have multiple service running locally. The video from Tailscale made it look so easy, but I haven’t been able duplicate their success using subdomains to reverse proxy to different services. After spending hours going through support forums in search of answers, I figured it’s finally time to get some direct help on my situation.
Here’s the steps I’ve taken:
- I have a test domain from Namecheap and used Cloudflare to setup a CNAME (tried both *.app and test for names)
- Created API token with Zone:Read and DNS:Edit
- I added
TS_PERMIT_CERT_UID=caddyto /etc/default/tailscaled - HTTPS and MagicDNS are both turned on in Tailscale and it shows the cert for the machine is valid for three months
- Currently using the cloudflare version (module: dns.providers.cloudflare)
If I go to the Tailscale domain for the machine and include the port it works but it doesn’t work if I try and use test.app.lunaticmallard.com.
As you can probably tell, I’m still very new to this so please let me know if there is any additional information I can provide to help diagnose the issue.
2. Error messages and/or full log output:
Aug 31 18:12:24 lin caddy[147677]: {"level":"debug","ts":1725142344.3353295,"logger":"tls.handshake","msg":"no certificate matching TLS ClientHello","remote_ip":"100.87.73.93","remote_port":"59336","server_name":"lin.tail2cd30c.ts.net","remote":"100.87.73.93:59336","identifier":"lin.tail2cd30c.ts.net","cipher_suites":[4865,4867,4866,49195,49199,52393,52392,49196,49200,49162,49161,49171,49172,156,157,47,53],"cert_cache_fill":0,"load_or_obtain_if_necessary":true,"on_demand":false}
Aug 31 18:12:24 lin caddy[147677]: {"level":"debug","ts":1725142344.335465,"logger":"http.stdlib","msg":"http: TLS handshake error from 100.87.73.93:59336: no certificate available for 'lin.tail2cd30c.ts.net'"}
Aug 31 18:12:27 lin caddy[147677]: {"level":"debug","ts":1725142347.3394558,"logger":"events","msg":"event","name":"tls_get_certificate","id":"0c18a51f-019a-4c5d-91da-529b3eb1b67a","origin":"tls","data":{"client_hello":{"CipherSuites":[4865,4867,4866,49195,49199,52393,52392,49196,49200,49162,49161,49171,49172,156,157,47,53],"ServerName":"lin.tail2cd30c.ts.net","SupportedCurves":[29,23,24,25,256,257],"SupportedPoints":"AA==","SignatureSchemes":[1027,1283,1539,2052,2053,2054,1025,1281,1537,515,513],"SupportedProtos":["h2","http/1.1"],"SupportedVersions":[772,771],"RemoteAddr":{"IP":"100.87.73.93","Port":59350,"Zone":""},"LocalAddr":{"IP":"100.87.73.93","Port":443,"Zone":""}}}}
Aug 31 18:12:27 lin caddy[147677]: {"level":"debug","ts":1725142347.339474,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"lin.tail2cd30c.ts.net"}
Aug 31 18:12:27 lin caddy[147677]: {"level":"debug","ts":1725142347.3394787,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"*.tail2cd30c.ts.net"}
Aug 31 18:12:27 lin caddy[147677]: {"level":"debug","ts":1725142347.3394816,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"*.*.ts.net"}
Aug 31 18:12:27 lin caddy[147677]: {"level":"debug","ts":1725142347.3394847,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"*.*.*.net"}
Aug 31 18:12:27 lin caddy[147677]: {"level":"debug","ts":1725142347.3394876,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"*.*.*.*"}
Aug 31 18:12:27 lin caddy[147677]: {"level":"debug","ts":1725142347.3394926,"logger":"tls.handshake","msg":"no certificate matching TLS ClientHello","remote_ip":"100.87.73.93","remote_port":"59350","server_name":"lin.tail2cd30c.ts.net","remote":"100.87.73.93:59350","identifier":"lin.tail2cd30c.ts.net","cipher_suites":[4865,4867,4866,49195,49199,52393,52392,49196,49200,49162,49161,49171,49172,156,157,47,53],"cert_cache_fill":0,"load_or_obtain_if_necessary":true,"on_demand":false}
Aug 31 18:12:27 lin caddy[147677]: {"level":"debug","ts":1725142347.3395238,"logger":"http.stdlib","msg":"http: TLS handshake error from 100.87.73.93:59350: no certificate available for 'lin.tail2cd30c.ts.net'"}
3. Caddy version:
v2.8.4
4. How I installed and ran Caddy:
Honestly, I can’t remember but I’m pretty sure it was xcaddy because I needed to install Go so I could get the cloudflare module.
a. System environment:
Linux 24.04. As a test I’ve been running a docker container with nginx, which is linked to port 8080. I have also tried RStudio server which is run locally with the same results.
b. Command:
sudo systemctl <verb> caddy
c. Service/unit/compose file:
To create the test nginx container
docker run -it --rm -d -p 8080:80 --name web nginx
d. My complete Caddy config:
{
debug
}
cloudflare {
tls {
dns cloudflare <api token>
}
}
#nginx test
test.app.lunaticmallard.com {
reverse_proxy localhost:8080
}
5. Links to relevant resources:
