1. The problem I’m having:
I use Caddy to great effect with most of my self-hosted apps, but I’m having trouble with Immich, which used to work but stopped recently. Certificates are issued via the Cloudflare integration and work fine on my other 10+ services. Immich is accessible through its local IP addresses but I get this SSL error when trying to access it via the caddy proxied domain:
502 Bad Gateway
Please note that my domain resolves to a Tailscale IP address so it will not work for you unless you are on my Tailnet:
2. Error messages and/or full log output:
curl -vL for https://photos.queasy.cc
headband@bubba:~/shared/docker/immich$ curl -vL https://photos.queasy.cc
* Trying 100.74.12.67:443...
* Connected to photos.queasy.cc (100.74.12.67) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_CHACHA20_POLY1305_SHA256
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=photos.queasy.cc
* start date: Jun 14 06:05:31 2026 GMT
* expire date: Sep 12 06:05:30 2026 GMT
* subjectAltName: host "photos.queasy.cc" matched cert's "photos.queasy.cc"
* issuer: C=US; O=Let's Encrypt; CN=YE2
* SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* Using Stream ID: 1 (easy handle 0x563edd92ea40)
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET / HTTP/2
> Host: photos.queasy.cc
> user-agent: curl/7.81.0
> accept: */*
>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
< HTTP/2 502
< alt-svc: h3=":443"; ma=2592000
< server: Caddy
< content-length: 0
< date: Sat, 04 Jul 2026 18:30:09 GMT
<
* Connection #0 to host photos.queasy.cc left intact
3. Caddy version:
2.10.2
(fyi there is an error in your template here for the command it suggests you run to get the version, instead of docker-compose exec caddy caddy version it should be docker exec caddy caddy version)
4. How I installed and ran Caddy:
Installed via docker-compose
a. System environment:
Docker on UbuntuServer
b. Command:
docker-compose
c. Service/unit/compose file:
services:
caddy:
image: ghcr.io/caddybuilds/caddy-cloudflare:latest
restart: unless-stopped
cap_add:
- NET_ADMIN
ports:
- "80:80"
- "443:443"
- "443:443/udp"
volumes:
- /home/headband/Config/caddy/Caddyfile:/etc/caddy/Caddyfile
- /home/headband/Config/caddy/site:/srv
- /home/headband/Config/caddy/caddy_data:/data
- /home/headband/Config/caddy/caddy_config:/config
environment:
- CLOUDFLARE_API_TOKEN=[MyCloudflareKey]
volumes:
caddy_data:
external: true
caddy_config:
d. My complete Caddy config:
(cloudflare) {
tls {
dns cloudflare [MyCloudflareKey]
}
}
queasy.cc {
reverse_proxy 192.168.0.4:3001
import cloudflare
}
www.queasy.cc {
redir https://queasy.cc{uri}
import cloudflare
}
photos.queasy.cc {
reverse_proxy 192.168.0.229:2283
import cloudflare
}
Thank you for the help!