Configuring reverse proxy to portainer

1. Caddy version (caddy version):

v2.4.6

2. How I run Caddy:

a. System environment:

Ubuntu 20.04.4 LTS

b. Command:

docker-compose up -d 

c. Service/unit/compose file:

version: "3.7"

services:

  plex:
    container_name: plex
    networks:
      - internal
    environment:
      - PUID=1000
      - PGID=1000
      - VERSION=docker
    volumes:
      - plex_data:/config
      - /mnt/unionfs:/media
    restart: always
    image: linuxserver/plex:latest

  portainer:
    container_name: portainer
    image: portainer/portainer-ce:latest
    command: -H unix:///var/run/docker.sock
    restart: always
    environment:
      - VIRTUAL_HOST=portainer.24-7tv.com
      - VIRTUAL_PORT=9443
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    networks:
      - internal

  caddy:
    container_name: caddy
    image: jmricker/caddy-cloudflare:latest
    restart: unless-stopped
    environment:
      ACME_AGREE: 'true'
      CLOUDFLARE_EMAIL: 'my@email'
      CLOUDFLARE_API_TOKEN: '1M7UxRa1KDGdqqxk8yw65x2xJ2JMsYEr4i'
      DOMAIN: '24-7tv.com'
   ports:
      - "80:80"
      - "443:443"
    volumes:
      - /opt/appdata/superplex/caddy/Caddyfile:/etc/caddy/Caddyfile
      - /opt/appdata/superplex/caddy/data:/data
      - /opt/appdata/superplex/caddy/config:/config
    networks:
      - web
      - internal

networks:
  web:
    external: true
  internal:
    external: false
    driver: bridge

volumes:
  portainer_data:
    name: portainer_data
  plex_data:
    name: plex_data

d. My complete Caddyfile or JSON config:

{    
    email my@email
}

portainer.24-7tv.com {
   reverse_proxy portainer:9443
   #reverse_proxy portainer:9000

   tls {
          dns cloudflare 1M7UxRa1KDGdqqxk8yw65x2xJ2JMsYEr4i
   }
}

plex.24-7tv.com {
   reverse_proxy plex:32400

   tls {
          dns cloudflare 1M7UxRa1KDGdqqxk8yw65x2xJ2JMsYEr4i
   }
}

3. The problem I’m having:

I’ve been able to get Caddy setup on my remote server as a reverse proxy. I’m using docker to manage all of my containers with a Portainer frontend. I’ve got this mostly working but had an issue and a few questions that I couldn’t quite find a resolution on.

The first issue to do with Portainer. Port 9443 is the current port for use by Portainer. However with my setup, I get this message “Client sent an HTTP request to an HTTPS server.” From what I can see from the wget, it changes to the request to HTTPS so I’m not sure what client is making the HTTP request. As a fix, what I can do is change the port to 9000 (reverse_proxy portainer:9000). As far as I know that technically works the problem is that the 9000 port is deprecated and I imagine will eventually go away so I would like to get this pointed to the correct port.

Second question is on 404, or error pages. So if I there is a invalid subdomain, such as test.24-7tv.com, right now the site gives back a 525 error message, SSL Handshake Failed. Is there a good way create a catch all to reroute this to a 404 page?

Thanks!

$ wget -v portainer.24-7tv.com

URL transformed to HTTPS due to an HSTS policy
--2022-03-28 20:23:38--  https://portainer.24-7tv.com/
Resolving portainer.24-7tv.com (portainer.24-7tv.com)... 2606:4700:3034::ac43:b4b8, 2606:4700:3037::6815:1fe5, 172.67.180.184, ...
Connecting to portainer.24-7tv.com (portainer.24-7tv.com)|2606:4700:3034::ac43:b4b8|:443... connected.
HTTP request sent, awaiting response... 400 Bad Request
2022-03-28 20:23:39 ERROR 400: Bad Request.

4. Error messages and/or full log output:

5. What I already tried:

6. Links to relevant resources:

Client sent an HTTP request to an HTTPS server.

You will have to create a wildcard host entry and use route handler.

Caddy expects you to be explicit about your subdomains as a good practice

There’s an example in the docs for this:

Also, I really hope you didn’t just paste your actual cloudflare key on the forums

:grimacing:

You’ll need to revoke that key and get a new one.

2 Likes

Hah! No its not. Actually its a fake bitcoin address generated by Mockaroo. I guess it looks a bit too much like a real key doesn’t it? Maybe someone will get a kick from trying to use it.

4 Likes

Aww, that foils my $1 unlimited CF DNS updates business plans :frowning:

This topic was automatically closed after 30 days. New replies are no longer allowed.