CFSSL behind caddy reverse proxy with subpath rewrite

[francislavoie]

@unb0rn

header_up Host {host}

You don’t need this line, it’s redundant. Caddy passes through the Host header automatically by default.

@unb0rn

It looks like there is no way to switch web root for cfssl, hence this handle_path statement is used.

handle_path isn’t fool-proof. The problem is that if the upstream app uses paths relative to the root in the HTML (for JS/CSS) then there’s not much that can be done to fix it reliably.

This article explains in depth:

The "subfolder problem", OR, "why can't I reverse proxy my app into a subfolder?"

Have you ever tried to reverse proxy an app into its own little subfolder of your domain name? Makes things neat, doesn’t it? Using example.com/foo/ for one app, example.com/bar/ for another. If you’re coming here from one of the selfhosted communities, you might be thinking along the lines of example.com/sonarr/, example.com/radarr/ etc. Chances are, you’ve tried some configuration along these lines: example.com { redir /sonarr /sonarr/ handle_path /sonarr/* { reverse_proxy localhost…

I strongly recommend using a subdomain for that service, like pki-ecc.gateway.unb0rnet.tk for example.