Context & Infrastructure Setup
I am setting up a web application reverse proxy using Caddy on a Linux VPS instance provided by VPSTTT (Ubuntu 22.04 LTS, 2 vCPU, 4GB RAM). The objective is to leverage Caddy’s automatic HTTPS to terminate TLS and forward traffic to an internal web service listening on port 8080.
Caddy Version
v2.7.6 h1:w0N32vDRFZ9lwMc40L3P0+SgL2/S1m0/
Environment
- Host OS: Ubuntu 22.04 LTS (VPSTTT VPS)
- Kernel: 5.15.0-88-generic x86_64
- Network: Direct static public IPv4, UFW enabled with ports 80 and 443 allowed
Caddyfile
example.com {
reverse_proxy 127.0.0.1:8080
}
Expected Result
Caddy successfully completes the ACME HTTP-01 challenge, provisions a Let’s Encrypt TLS certificate for example.com, and proxies requests to 127.0.0.1:8080.
Actual Result
The TLS challenge fails during startup because the ACME validation request times out when attempting to hit port 80.
Logs
2023/10/25 10:15:00.123 INFO tls.obtain acquiring lock {"identifier": "example.com"}
2023/10/25 10:15:02.456 ERROR tls.obtain challenge failed {"domain": "example.com", "provider": "http", "error": "ACME server unable to reach http://example.com/.well-known/acme-challenge/..."}
Focused Question
When running Caddy on virtual private server infrastructure with external edge firewalls, are there specific network interface binding options or MTU configurations required to ensure the HTTP-01 challenge packets reach Caddy properly?
Disclosure: This post was prepared with AI assistance.