Hello,
First of all, I just want to say that I like Caddy Server a lot. My intent is to use for a reverse proxy. I’m coming from NGINX Proxy Manager, which is very buggy, to Caddy and I like how it works, how fast it is, reliable and how it’s configured. Also, I tried every wiki and tutorial possible, either here, reddit or other sources, but they don’t seem to apply to my case or configuration. See below for further explanation.
1. The problem I’m having:
When I use the cloudflare tunnel to connect to my Caddy reverse proxy, I’m getting “host error”, which does not happen when I point the cloudflare tunnel to the NGINX Proxy Manager instance that I have running.
Note that locally, all works fine and well with Caddy. The problem is only when it is going through the cloudflare tunnel. An important thing is that I use a wildcard certificate. Also, some services I run with a mTLS certificate. Other services, I don’t. Further down, my Caddyfile will show how I set this up.
My cloudflare tunnel config.yml:
tunnel: <tunnel_UUID>
credentials-file: /etc/cloudflared/<tunnel_UUID>.json
ingress:
- hostname: '*.mydomain.net'
service: https://<caddy_lxc_ip>:443
originRequest:
noTLSverify: true
originServerName: '*.mydomain.net'
httpHostHeader: '*.mydomain.net'
- service: http_status:404
Note that I tried all sorts of combinations with the options on the originRequest in the configuration, but to no avail.
2. Error messages and/or full log output:
{"level":"info","ts":1738949007.8934052,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
{"level":"info","ts":1738949007.8949847,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc0005c6480"}
{"level":"info","ts":1738949007.8952591,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
{"level":"warn","ts":1738949007.8952835,"logger":"http","msg":"enabling strict SNI-Host enforcement because TLS client auth is configured","server_id":"srv0"}
{"level":"info","ts":1738949007.8966854,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
{"level":"info","ts":1738949007.8973846,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
{"level":"warn","ts":1738949007.897432,"logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
{"level":"warn","ts":1738949007.897441,"logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
{"level":"info","ts":1738949007.8974454,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]}
{"level":"info","ts":1738949007.8974502,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["*.mydomain.net"]}
{"level":"info","ts":1738949007.8979354,"msg":"autosaved config (load with --resume flag)","file":"/root/.config/caddy/autosave.json"}
{"level":"info","ts":1738949007.897953,"msg":"serving initial configuration"}
{"level":"info","ts":1738949007.9025705,"logger":"tls","msg":"storage cleaning happened too recently; skipping for now","storage":"FileStorage:/root/.local/share/caddy","instance":"7ee4f97f-d64d-434a-8010-2d645bd326b9","try_again":1739035407.9025645,"try_again_in":86399.999998044}
{"level":"info","ts":1738949007.902646,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"info","ts":1738956807.9011948,"logger":"tls.cache.maintenance","msg":"reloaded ARI with newer one in storage","identifiers":["*.mydomain.net"],"cert_hash":"6cbd7b39debde2e888762f509c65fe9b307c6bff8651e250bf94ae455855b216","ari_unique_id":"kydGmAOpUWiOmNbEQkjbI79YlNI.AxedazOBd_uPcaTvcY0wAyn3","cert_expiry":1746164729,"next_refresh":1738978194.3478506,"renewal_time":1743637188}
{"level":"info","ts":1738965571.6347935,"logger":"admin.api","msg":"received request","method":"POST","host":"localhost:2019","uri":"/stop","remote_ip":"127.0.0.1","remote_port":"48060","headers":{"Accept-Encoding":["gzip"],"Content-Length":["0"],"Origin":["http://localhost:2019"],"User-Agent":["Go-http-client/1.1"]}}
{"level":"warn","ts":1738965571.634828,"logger":"admin.api","msg":"exiting; byeee!! 👋"}
{"level":"info","ts":1738965571.6348436,"logger":"http","msg":"servers shutting down with eternal grace period"}
{"level":"info","ts":1738965571.6362305,"logger":"admin","msg":"stopped previous server","address":"localhost:2019"}
{"level":"info","ts":1738965571.63625,"logger":"admin.api","msg":"shutdown complete","exit_code":0}
{"level":"info","ts":1738965578.3277547,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
{"level":"info","ts":1738965578.3284423,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc0008ae880"}
{"level":"info","ts":1738965578.3288624,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
{"level":"warn","ts":1738965578.3288896,"logger":"http","msg":"enabling strict SNI-Host enforcement because TLS client auth is configured","server_id":"srv0"}
{"level":"info","ts":1738965578.3302643,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
{"level":"info","ts":1738965578.3304112,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
{"level":"warn","ts":1738965578.3304396,"logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
{"level":"warn","ts":1738965578.3304534,"logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
{"level":"info","ts":1738965578.330458,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]}
{"level":"info","ts":1738965578.3304622,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["*.mydomain.net"]}
{"level":"info","ts":1738965578.3309326,"msg":"autosaved config (load with --resume flag)","file":"/root/.config/caddy/autosave.json"}
{"level":"info","ts":1738965578.3309417,"msg":"serving initial configuration"}
{"level":"info","ts":1738965578.336066,"logger":"tls","msg":"cleaning storage unit","storage":"FileStorage:/root/.local/share/caddy"}
{"level":"info","ts":1738965578.3395813,"logger":"tls","msg":"finished cleaning storage units"}
3. Caddy version:
v2.9.1 h1:OEYiZ7DbCzAWVb6TNEkjRcSCRGHVoZsJinoDR/n9oaY=
4. How I installed and ran Caddy:
a. System environment:
I have a Proxmox server where I have one LXC for the Cloudflare Tunnel (cloudflared) and another LXC with Caddy. Both LXC’s were generated based on the nice people at helper-scripts.com
The Caddy LXC is Debian 12.
b. Command:
sudo caddy fmt --overwrite
sudo caddy adapt
sudo caddy run
c. Service/unit/compose file:
N/A
d. My complete Caddy config:
{
auto_https prefer_wildcard
log {
output file /var/log/access.log
}
}
(localonly) {
@denied not remote_ip private_ranges
abort @denied
}
(mtls) {
tls {
client_auth {
mode require_and_verify
trust_pool file <file_directory>/ca.pem
}
}
}
*.mydomain.net {
tls {
dns cloudflare {env.CLOUDFLARE_API_KEY}
}
}
service1.mydomain.net {
reverse_proxy <service1_ip>:<service1_port>
}
service2.mydomain.net {
import localonly
import mtls
reserve_proxy <service2_ip>:<service2_port>
}
When I run the service1 from the cloudflare tunnel, I get the host error as mentioned.
