1. Output of caddy version:
2.5.2
2. How I run Caddy:
DOCKER COMPOSE
a. System environment:
UBUNTU SERVER/DOCKER
b. Command:
docker-compose up -d
Paste command here.
c. Service/unit/compose file:
version: "3"
services:
caddy:
container_name: caddy
image: caddy:2-alpine
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- /docker/caddy/Caddyfile:/etc/caddy/Caddyfile
- /docker/caddy/data:/data
- /docker/caddy/srv:/srv
- /docker/caddy/config:/config
networks:
- t2_proxy
networks:
t2_proxy:
external: true
d. My complete Caddy config:
{
# Global options block. Entirely optional, https is on by default
# Optional email key for lets encrypt
email ryan.naff@gmail.com
# Optional staging lets encrypt for testing. Comment out for production.
# acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
}
port.naff.casa {
reverse_proxy 192.168.1.37:9443
}
www.naff.casa {
reverse_proxy 192.168.1.37:1111
}
sonarr.naff.casa {
reverse_proxy 192.168.1.37:8989
}
plex.naff.casa {
reverse_proxy 192.168.1.37:32400
}
radarr.naff.casa {
reverse_proxy 192.168.1.37:7878
}
ombi.naff.casa {
reverse_proxy 192.168.1.37:3579
}
remote.naff.casa {
reverse_proxy 192.168.1.37:6969
}
bw.naff.casa {
reverse_proxy 192.168.1.37:8711
}
cloud.naff.casa {
reverse_proxy 192.168.1.37:8814 {
transport http {
tls_insecure_skip_verify
}
}
header {
Strict-Transport-Security max-age=31536000;
}
redir /.well-known/webfinger /public.php?service=webfinger 301
}
cctv.naff.casa {
reverse_proxy 192.168.1.39:8123
}
jellyfin.naff.casa {
reverse_proxy 192.168.1.37:8096
}
naff.casa {
root * /srv/www
encode gzip
file_server
}
3. The problem I’m having:
Cannot connect to static webpage – just trying to host a simple index.html for learning purposes on home lab.
4. Error messages and/or full log output:
{"level":"info","ts":1661287835.7232783,"msg":"using provided configuration","config_file":"/etc/caddy/Caddyfile","config_adapter":"caddyfile"}
{"level":"warn","ts":1661287835.7273011,"msg":"Caddyfile input is not formatted; run the 'caddy fmt' command to fix inconsistencies","adapter":"caddyfile","file":"/etc/caddy/Caddyfile","line":2}
{"level":"info","ts":1661287835.7297251,"logger":"admin","msg":"admin endpoint started","address":"tcp/localhost:2019","enforce_origin":false,"origins":["//[::1]:2019","//127.0.0.1:2019","//localhost:2019"]}
{"level":"info","ts":1661287835.732739,"logger":"http","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv0","https_port":443}
{"level":"info","ts":1661287835.7329063,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
{"level":"info","ts":1661287835.7331548,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc000868380"}
{"level":"info","ts":1661287835.7353787,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["port.naff.casa","remote.naff.casa","ombi.naff.casa","bw.naff.casa","jellyfin.naff.casa","radarr.naff.casa","plex.naff.casa","cctv.naff.casa","www.naff.casa","sonarr.naff.casa","cloud.naff.casa"]}
{"level":"info","ts":1661287835.7355058,"logger":"tls","msg":"cleaning storage unit","description":"FileStorage:/data/caddy"}
{"level":"info","ts":1661287835.744143,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"info","ts":1661287835.746029,"msg":"autosaved config (load with --resume flag)","file":"/config/caddy/autosave.json"}
{"level":"info","ts":1661287835.7460988,"msg":"serving initial configuration"}
{"level":"info","ts":1661287957.8709655,"msg":"shutting down apps, then terminating","signal":"SIGTERM"}
{"level":"warn","ts":1661287957.8710673,"msg":"exiting; byeee!! đź‘‹","signal":"SIGTERM"}
{"level":"info","ts":1661287969.096957,"msg":"using provided configuration","config_file":"/etc/caddy/Caddyfile","config_adapter":"caddyfile"}
{"level":"warn","ts":1661287969.101679,"msg":"Caddyfile input is not formatted; run the 'caddy fmt' command to fix inconsistencies","adapter":"caddyfile","file":"/etc/caddy/Caddyfile","line":2}
{"level":"info","ts":1661287969.1041563,"logger":"admin","msg":"admin endpoint started","address":"tcp/localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
{"level":"info","ts":1661287969.1049354,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc000926070"}
{"level":"info","ts":1661287969.1050003,"logger":"http","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv0","https_port":443}
{"level":"info","ts":1661287969.1051006,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
{"level":"info","ts":1661287969.1076643,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["www.naff.casa","bw.naff.casa","naff.casa","cloud.naff.casa","remote.naff.casa","plex.naff.casa","jellyfin.naff.casa","radarr.naff.casa","port.naff.casa","ombi.naff.casa","cctv.naff.casa","sonarr.naff.casa"]}
{"level":"info","ts":1661287969.108425,"logger":"tls","msg":"cleaning storage unit","description":"FileStorage:/data/caddy"}
{"level":"info","ts":1661287969.114429,"logger":"tls.obtain","msg":"acquiring lock","identifier":"naff.casa"}
{"level":"info","ts":1661287969.115026,"msg":"[INFO][FileStorage:/data/caddy] Lock for 'issue_cert_naff.casa' is stale (created: 2022-08-23 18:57:40.137677826 +0000 UTC, last update: 2022-08-23 19:48:40.450926145 +0000 UTC); removing then retrying: /data/caddy/locks/issue_cert_naff.casa.lock"}
{"level":"info","ts":1661287969.117956,"logger":"tls.obtain","msg":"lock acquired","identifier":"naff.casa"}
{"level":"info","ts":1661287969.1188917,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"info","ts":1661287969.1197028,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["naff.casa"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":"ryan.naff@gmail.com"}
{"level":"info","ts":1661287969.119793,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["naff.casa"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":"ryan.naff@gmail.com"}
{"level":"info","ts":1661287969.121443,"msg":"autosaved config (load with --resume flag)","file":"/config/caddy/autosave.json"}
{"level":"info","ts":1661287969.12149,"msg":"serving initial configuration"}
{"level":"info","ts":1661287969.88405,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"naff.casa","challenge_type":"tls-alpn-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1661287970.2386084,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"naff.casa","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1661287970.238734,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"naff.casa","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/127013746/118935071467","attempt":1,"max_attempts":3}
{"level":"info","ts":1661287971.385481,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"naff.casa","challenge_type":"http-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1661287971.730858,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"naff.casa","challenge_type":"http-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"2606:4700:3037::ac43:c4f7: Invalid response from http://naff.casa/.well-known/acme-challenge/XhM01SCqWc6hjHZeS0CGDVlt_Av1COpN8VIxDa4EIE4: 403","instance":"","subproblems":[]}}
{"level":"error","ts":1661287971.7310746,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"naff.casa","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"2606:4700:3037::ac43:c4f7: Invalid response from http://naff.casa/.well-known/acme-challenge/XhM01SCqWc6hjHZeS0CGDVlt_Av1COpN8VIxDa4EIE4: 403","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/127013746/118935074497","attempt":2,"max_attempts":3}
{"level":"error","ts":1661287971.7311814,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"naff.casa","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - 2606:4700:3037::ac43:c4f7: Invalid response from http://naff.casa/.well-known/acme-challenge/XhM01SCqWc6hjHZeS0CGDVlt_Av1COpN8VIxDa4EIE4: 403"}
{"level":"info","ts":1661287971.7319148,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["naff.casa"],"ca":"https://acme.zerossl.com/v2/DV90","account":"ryan.naff@gmail.com"}
{"level":"info","ts":1661287971.7320268,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["naff.casa"],"ca":"https://acme.zerossl.com/v2/DV90","account":"ryan.naff@gmail.com"}
{"level":"info","ts":1661287993.6329064,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"naff.casa","challenge_type":"http-01","ca":"https://acme.zerossl.com/v2/DV90"}
{"level":"error","ts":1661288186.4946084,"logger":"http.log.error","msg":"dial tcp 192.168.1.37:1111: connect: connection refused","request":{"remote_ip":"192.168.1.1","remote_port":"9040","proto":"HTTP/2.0","method":"GET","host":"www.naff.casa","uri":"/","headers":{"Sec-Ch-Ua":["\"Chromium\";v=\"104\", \" Not A;Brand\";v=\"99\", \"Google Chrome\";v=\"104\""],"Sec-Ch-Ua-Platform":["\"Windows\""],"Upgrade-Insecure-Requests":["1"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"],"Purpose":["prefetch"],"Sec-Fetch-Site":["none"],"Sec-Fetch-User":["?1"],"Sec-Ch-Ua-Mobile":["?0"],"Sec-Fetch-Mode":["navigate"],"Sec-Fetch-Dest":["document"],"Accept-Encoding":["gzip, deflate, br"],"Accept-Language":["en-US,en;q=0.9"]},"tls":{"resumed":false,"version":772,"cipher_suite":4867,"proto":"h2","server_name":"www.naff.casa"}},"duration":0.001010169,"status":502,"err_id":"phdgu96fz","err_trace":"reverseproxy.statusError (reverseproxy.go:1184)"}
{"level":"error","ts":1661288301.0419633,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"naff.casa","issuer":"acme.zerossl.com-v2-DV90","error":"[naff.casa] solving challenges: [naff.casa] authorization took too long (order=https://acme.zerossl.com/v2/DV90/order/P-rUVs0YSNv8gXMjGfi-zw) (ca=https://acme.zerossl.com/v2/DV90)"}
{"level":"error","ts":1661288301.0420623,"logger":"tls.obtain","msg":"will retry","error":"[naff.casa] Obtain: [naff.casa] solving challenges: [naff.casa] authorization took too long (order=https://acme.zerossl.com/v2/DV90/order/P-rUVs0YSNv8gXMjGfi-zw) (ca=https://acme.zerossl.com/v2/DV90)","attempt":1,"retrying_in":60,"elapsed":331.924072782,"max_duration":2592000}
{"level":"info","ts":1661288361.3881571,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"naff.casa","challenge_type":"http-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1661288361.7337716,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"naff.casa","challenge_type":"http-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"2606:4700:3037::ac43:c4f7: Invalid response from http://naff.casa/.well-known/acme-challenge/jOaUzvigXMdQjXxg4rUlxwHb1bsxcbxc9S765mde_Gg: 403","instance":"","subproblems":[]}}
{"level":"error","ts":1661288361.7339041,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"naff.casa","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"2606:4700:3037::ac43:c4f7: Invalid response from http://naff.casa/.well-known/acme-challenge/jOaUzvigXMdQjXxg4rUlxwHb1bsxcbxc9S765mde_Gg: 403","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/19892834/3771805784","attempt":1,"max_attempts":3}
{"level":"info","ts":1661288362.8436286,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"naff.casa","challenge_type":"tls-alpn-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1661288363.190342,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"naff.casa","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1661288363.1904476,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"naff.casa","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/19892834/3771805994","attempt":2,"max_attempts":3}
{"level":"error","ts":1661288363.1905048,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"naff.casa","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
{"level":"info","ts":1661288374.401656,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"naff.casa","challenge_type":"http-01","ca":"https://acme.zerossl.com/v2/DV90"}
{"level":"error","ts":1661288687.6170526,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"naff.casa","issuer":"acme.zerossl.com-v2-DV90","error":"[naff.casa] solving challenges: [naff.casa] authorization took too long (order=https://acme.zerossl.com/v2/DV90/order/SU3o1lhcdQUI2RgxuUiWkQ) (ca=https://acme.zerossl.com/v2/DV90)"}
{"level":"error","ts":1661288687.6171775,"logger":"tls.obtain","msg":"will retry","error":"[naff.casa] Obtain: [naff.casa] solving challenges: [naff.casa] authorization took too long (order=https://acme.zerossl.com/v2/DV90/order/SU3o1lhcdQUI2RgxuUiWkQ) (ca=https://acme.zerossl.com/v2/DV90)","attempt":2,"retrying_in":120,"elapsed":718.499187566,"max_duration":2592000}
{"level":"info","ts":1661288808.12972,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"naff.casa","challenge_type":"http-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1661288808.7734842,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"naff.casa","challenge_type":"http-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"2606:4700:3033::6815:2227: Invalid response from http://naff.casa/.well-known/acme-challenge/To9MUzw0enVT291Lok_JxJ6XSgiVXqXwto2ylas_NJw: 403","instance":"","subproblems":[]}}
{"level":"error","ts":1661288808.7736177,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"naff.casa","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"2606:4700:3033::6815:2227: Invalid response from http://naff.casa/.well-known/acme-challenge/To9MUzw0enVT291Lok_JxJ6XSgiVXqXwto2ylas_NJw: 403","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/19892834/3771868374","attempt":1,"max_attempts":3}
{"level":"info","ts":1661288809.8901477,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"naff.casa","challenge_type":"tls-alpn-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1661288811.709706,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"naff.casa","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}
{"level":"error","ts":1661288811.7098074,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"naff.casa","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/19892834/3771868574","attempt":2,"max_attempts":3}
{"level":"error","ts":1661288811.7098873,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"naff.casa","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}
{"level":"info","ts":1661288841.2099123,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"naff.casa","challenge_type":"http-01","ca":"https://acme.zerossl.com/v2/DV90"}
5. What I already tried:
spent most of the day trying to figure this out on my own.
I tried hosting apache container and pointing to it via Caddyfile (like my other containers which work fine) but i wasn’t able to get that going either.
). No skin in the game, I just like to help.