1. The problem I’m having:
I have two servers running in my home. Since I can only forward port 443 to one of the machines, I want it to reverse-proxy to the other server
Currently, port 443 is forwarded to yeda-server
Within that server’s Caddyfile, any hostname under a deanayalon.com is reverse-proxied to dean-linux (I’d have used a wildcard domain, but I can’t do the DNS-01 challenge)
I believe that the configuration is generally correct for yeda-server. If I spin up a container on dean-linux:443, the hostnames under deanayalon.com get there and I can use the service
But if I try to create a Caddy container on dean-linux, it tries issuing certificates, which is not possible, seeing as :80 arrives at yeda-server, which itself issues certificate requests.
Is there a way to have those two Caddy servers communicate so that the inner one uses the external one’s certificates, and does not try to issue them itself?
2. Error messages and/or full log output:
{
"level": "error",
"ts": 1726527929.4295866,
"logger": "tls.issuance.acme.acme_client",
"msg": "validating authorization",
"identifier": "filemaker.deanayalon.com",
"problem": {
"type": "urn:ietf:params:acme:error:tls",
"title": "",
"detail": "62.0.120.246: remote error: tls: internal error",
"instance": "",
"subproblems": []
},
"order": "https://acme-v02.api.letsencrypt.org/acme/order/1950502556/305757599826",
"attempt": 1,
"max_attempts": 3
}
{
"level": "error",
"ts": 1726527930.6718748,
"logger": "tls.obtain",
"msg": "could not get certificate from issuer",
"identifier": "filemaker.deanayalon.com",
"issuer": "acme-v02.api.letsencrypt.org-directory",
"error": "HTTP 429 urn:ietf:params:acme:error:rateLimited - Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/failed-validation-limit/"
}
{
"level": "error",
"ts": 1726527932.7435188,
"logger": "tls.issuance.acme.acme_client",
"msg": "validating authorization",
"identifier": "onedev.deanayalon.com",
"problem": {
"type": "urn:ietf:params:acme:error:unauthorized",
"title": "",
"detail": "62.0.120.246: Invalid response from https://onedev.deanayalon.com/.well-known/acme-challenge/tLat3xbKaZ3QIe6wAW6YtRwwa3tGUPg6xYsUQ9ile8g: 502",
"instance": "",
"subproblems": []
},
"order": "https://acme-v02.api.letsencrypt.org/acme/order/1950502556/305757609216",
"attempt": 2,
"max_attempts": 3
}
{
"level": "error",
"ts": 1726527932.743571,
"logger": "tls.obtain",
"msg": "could not get certificate from issuer",
"identifier": "onedev.deanayalon.com",
"issuer": "acme-v02.api.letsencrypt.org-directory",
"error": "HTTP 403 urn:ietf:params:acme:error:unauthorized - 62.0.120.246: Invalid response from https://onedev.deanayalon.com/.well-known/acme-challenge/tLat3xbKaZ3QIe6wAW6YtRwwa3tGUPg6xYsUQ9ile8g: 502"
}
3. Caddy version:
v2.8.4 h1:q3pe0wpBj1OcHFZ3n/1nl4V4bxBrYoSoab7rL9BMYNk=
4. How I installed and ran Caddy:
Using the caddy image for Docker
a. System environment:
Yeda-Server:
MacOS Sonoma 14.6.1 (M1 Max chip)
Docker Desktop 4.33.0 (Engine 27.1.1)
Dean-Linux:
Manjaro Linux 24.0.8 Wynsdey (AMD64)
Docker Engine 27.1.2
b. Command
docker compose up -d
c. Service/unit/compose file:
compose.yml (Identical in both servers)
services:
caddy:
image: caddy
container_name: caddy
hostname: caddy
restart: unless-stopped
ports:
- 80:80
- 443:443
- 443:443/udp
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile:ro
- ./site:/srv:ro
- ./log:/var/log
- data:/data/caddy
- config:/config/caddy
env_file:
- .env
volumes:
data:
name: caddy-data
config:
name: caddy-config
d. My complete Caddy config:
Yeda-server’s Caddyfile:
{
email {$EMAIL}
}
(tls-insecure) {
reverse_proxy {args[0]}:443 {
transport http {
tls
tls_insecure_skip_verify
}
}
}
(log) {
log {
output file /var/log/{args[0]}.log
format json
}
}
filemaker.yeda-water.com:443 {
import log filemaker
import tls-insecure fms
}
(dean) {
{args[0]}.deanayalon.com:443 {
import log dean/{args[0]}
import tls-insecure {$DEAN_IP}
}
}
import dean filemaker
import dean onedev
dean-linux’s Caddyfile:
{
email {$EMAIL}
}
(tls-insecure) {
reverse_proxy {args[0]} {
transport http {
tls
tls_insecure_skip_verify
}
}
}
(log) {
log {
output file /var/log/{args[0]}.log
format json
}
}
filemaker.deanayalon.com:443 {
import log filemaker
import tls-insecure fms:443
}
onedev.deanayalon.com:443 {
import log onedev
reverse_proxy onedev:6610 {
transport http {
tls
}
}
}
5. Links to relevant resources:
Unfortunately, though I remember reading mention of multiple Caddy server management, I could not find any documentation or forum threads about configuring that, my apologies if I missed something
