1. The problem I’m having:
I’m trying to set up Encrypted Client Hello (ECH) on my Caddy instance and I’m running into an issue where Caddy skips publishing the HTTPS records for my subdomains.
I am using OVH for DNS with the Caddy OVH DNS plugin. In my OVH dashboard, I have a wildcard A record (*.moes.ovh) and the apex moes.ovh pointing to my server IP. I’m using moes.ovh as my outer SNI.
When Caddy starts, it successfully publishes the ECH config for the domains, but throws warnings saying it’s skipping the subdomains because they don’t have existing records (see logs).
Because I’m using a wildcard A record in my DNS zone, the individual subdomains (like wiki.moes.ovh, auth.moes.ovh) don’t actually exist as explicit records in OVH. It seems Caddy checks for the explicit record, doesn’t find it (because of the wildcard), and skips publishing the HTTPS record for that subdomain.
I can see that no HTTPS records were published. Running curl 8.22.0 confirms this:
./curl -vL --ech hard --doh-url https://1.1.1.1/dns-query https://wiki.moes.ovh
Note: Using embedded CA bundle (188900 bytes)
Note: Using embedded CA bundle, for proxies (188900 bytes)
* Trying 81.206.9.114:443...
* HTTPS-RR wiki.moes.ovh:443: -
* Host wiki.moes.ovh:443 was resolved.
* IPv6: (none)
* IPv4: 81.206.9.114
* ECH: requested but no ECHConfig available
* closing connection #0
curl: (35) SSL connect error
Is there a way to make this setup work without having to manually go into OVH and create explicit A records for every single one of my 30+ subdomains? I would like to keep the wildcard functionality if possible. Am I doing something wrong, or is explicitly defining the subdomains in the DNS zone a hard requirement for Caddy’s current ECH implementation?
2. Error messages and/or full log output:
Caddy.log:
{"level":"info","ts":1790598442.6004016,"msg":"maxprocs: Leaving GOMAXPROCS=24: CPU quota undefined"}
{"level":"info","ts":1790598442.6004016,"msg":"GOMEMLIMIT is updated","GOMEMLIMIT":61634138112,"previous":9223372036854775807}
{"level":"info","ts":1790598442.6004016,"msg":"using adjacent Caddyfile"}
{"level":"info","ts":1790598442.6004016,"msg":"adapted config to JSON","adapter":"caddyfile"}
{"level":"info","ts":1790598442.6004016,"msg":"redirected default logger","from":"stderr","to":"D:\\Documents\\Caddy\\caddy.log"}
{"level":"info","ts":1790598442.608878,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
{"level":"info","ts":1790598442.608878,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xd59ba914000"}
{"level":"debug","ts":1790598442.6157815,"logger":"tls.ech","msg":"generated new ECH config","public_name":"moes.ovh","id":195}
{"level":"info","ts":1790598442.6157815,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
{"level":"warn","ts":1790598442.6157815,"logger":"http.auto_https","msg":"server is listening only on the HTTP port, so no automatic HTTPS will be applied to this server","server_name":"srv1","http_port":80}
{"level":"debug","ts":1790598442.6231582,"logger":"http","msg":"starting server loop","address":"[::]:443","tls":true,"http3":false}
{"level":"info","ts":1790598442.6231582,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
{"level":"info","ts":1790598442.6231582,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
{"level":"debug","ts":1790598442.624139,"logger":"http","msg":"starting server loop","address":"[::]:80","tls":false,"http3":false}
{"level":"warn","ts":1790598442.624139,"logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
{"level":"warn","ts":1790598442.624139,"logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
{"level":"info","ts":1790598442.624139,"logger":"http.log","msg":"server running","name":"srv1","protocols":["h1","h2","h3"]}
{"level":"info","ts":1790598442.624139,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["youtube.moes.ovh","pw.moes.ovh","headscale.moes.ovh","immich.moes.ovh","dc.moes.ovh","plan.moes.ovh","proj.moes.ovh","bm.moes.ovh","ms.moes.ovh","ig.moes.ovh","discord.moes.ovh","auth.moes.ovh","wiki.moes.ovh","pws.moes.ovh","instagram.moes.ovh","syncthing.moes.ovh","filicivtaresort.moes.ovh","jackett.moes.ovh","monica.moes.ovh","ma.moes.ovh","ist.moes.ovh","yt.moes.ovh","home.moes.ovh","merch.moes.ovh","test.moes.ovh","ipt.moes.ovh"]}
{"level":"debug","ts":1790598442.624139,"logger":"events","msg":"event","name":"started","id":"34535215-e16e-4722-a27b-75ef0729ff0d","origin":"","data":null}
{"level":"info","ts":1790598442.624139,"msg":"autosaved config (load with --resume flag)","file":"C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Caddy\\autosave.json"}
{"level":"info","ts":1790598442.624139,"msg":"serving initial configuration"}
{"level":"debug","ts":1790598442.6251154,"logger":"tls","msg":"loading managed certificate","domain":"*.moes.ovh","expiration":1798235225,"issuer_key":"acme-v02.api.letsencrypt.org-directory","storage":"FileStorage:C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Caddy"}
{"level":"debug","ts":1790598442.6251154,"logger":"tls","msg":"loading managed certificate","domain":"moes.ovh","expiration":1798235226,"issuer_key":"acme-v02.api.letsencrypt.org-directory","storage":"FileStorage:C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Caddy"}
{"level":"debug","ts":1790598442.6251154,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [moes.ovh]: no OCSP server specified in certificate","identifiers":["moes.ovh"]}
{"level":"debug","ts":1790598442.6251154,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [*.moes.ovh]: no OCSP server specified in certificate","identifiers":["*.moes.ovh"]}
{"level":"debug","ts":1790598442.6251154,"logger":"tls.cache","msg":"added certificate to cache","subjects":["*.moes.ovh"],"expiration":1798235225,"managed":true,"issuer_key":"acme-v02.api.letsencrypt.org-directory","hash":"fa63cc3ea605ce59493010a095a8beab6e4430e601189ed83c0995cd5fbc8fee","cache_size":1,"cache_capacity":10000}
{"level":"debug","ts":1790598442.6251154,"logger":"tls.cache","msg":"added certificate to cache","subjects":["moes.ovh"],"expiration":1798235226,"managed":true,"issuer_key":"acme-v02.api.letsencrypt.org-directory","hash":"1dd36e9c727f9e9196a7737bc381305a6debbf85cf74c56fc43027b9ac4b0064","cache_size":2,"cache_capacity":10000}
{"level":"debug","ts":1790598442.6251154,"logger":"events","msg":"event","name":"cached_managed_cert","id":"3f6aa81b-d46c-49e3-8622-1c58e7969249","origin":"tls","data":{"sans":["*.moes.ovh"]}}
{"level":"debug","ts":1790598442.6251154,"logger":"events","msg":"event","name":"cached_managed_cert","id":"a8d0c91a-8a2a-4f00-b76b-8dd833621a51","origin":"tls","data":{"sans":["moes.ovh"]}}
{"level":"debug","ts":1790598442.6251154,"logger":"tls.ech","msg":"publishing ECH config list","publisher":"dns.providers.ovh","domains":["home.moes.ovh","discord.moes.ovh","instagram.moes.ovh","syncthing.moes.ovh","youtube.moes.ovh","filicivtaresort.moes.ovh","immich.moes.ovh","ipt.moes.ovh","wiki.moes.ovh","ms.moes.ovh","yt.moes.ovh","ig.moes.ovh","proj.moes.ovh","test.moes.ovh","auth.moes.ovh","bm.moes.ovh","merch.moes.ovh","headscale.moes.ovh","jackett.moes.ovh","pws.moes.ovh","plan.moes.ovh","dc.moes.ovh","ma.moes.ovh","pw.moes.ovh","monica.moes.ovh","ist.moes.ovh"],"config_ids":[195]}
{"level":"info","ts":1790598442.6260934,"logger":"tls","msg":"cleaning storage unit","storage":"FileStorage:C:\\WINDOWS\\system32\\config\\systemprofile\\AppData\\Roaming\\Caddy"}
{"level":"info","ts":1790598442.6280441,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"debug","ts":1790598442.6848502,"logger":"events","msg":"event","name":"tls_get_certificate","id":"30389d4b-f142-432b-ac0b-b52168a698be","origin":"tls","data":{"client_hello":{"CipherSuites":[49195,49199,49196,49200,52393,52392,49161,49171,49162,49172,4865,4866,4867],"ServerName":"headscale.moes.ovh","SupportedCurves":[4588,4587,4589,29,23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[2052,1027,2055,2053,2054,1025,1281,1537,1283,1539],"SupportedProtos":null,"SupportedVersions":[772,771],"RemoteAddr":{"IP":"81.206.9.114","Port":65203,"Zone":""},"LocalAddr":{"IP":"192.168.1.23","Port":443,"Zone":""}}}}
{"level":"debug","ts":1790598442.7492936,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 29732\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;home.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598442.790397,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 26533\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3600\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598443.0535707,"logger":"events","msg":"event","name":"tls_get_certificate","id":"0a96fa1d-3244-4b22-bb3a-b194745cbf75","origin":"tls","data":{"client_hello":{"CipherSuites":[4866,4867,4865,49199,49195,49200,49196,158,49191,103,49192,107,163,159,52393,52392,52394,49325,49311,49245,49249,49239,49235,162,49324,49310,49244,49248,49238,49234,49188,106,49187,64,49162,49172,57,56,49161,49171,51,50,157,49309,49233,156,49308,49232,61,60,53,47],"ServerName":"headscale.moes.ovh","SupportedCurves":[4588,29,23,30,24,25,256,257],"SupportedPoints":"AAEC","SignatureSchemes":[2309,2310,2308,1027,1283,1539,2055,2056,2074,2075,2076,2057,2058,2059,2052,2053,2054,1025,1281,1537,771,769,770,1026,1282,1538],"SupportedProtos":["http/1.1","h2"],"SupportedVersions":[772,771],"RemoteAddr":{"IP":"81.206.9.114","Port":65204,"Zone":""},"LocalAddr":{"IP":"192.168.1.23","Port":443,"Zone":""}}}}
{"level":"warn","ts":1790598443.4007726,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"home.moes.ovh","relative_name":"home","zone":"moes.ovh."}
{"level":"debug","ts":1790598443.5273101,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 25149\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;discord.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598443.569807,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 41018\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3600\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598443.9246163,"logger":"events","msg":"event","name":"tls_get_certificate","id":"0aa67e90-176d-40ac-9549-66236c1ee3a3","origin":"tls","data":{"client_hello":{"CipherSuites":[49195,49199,49196,49200,52393,52392,49161,49171,49162,49172,4865,4866,4867],"ServerName":"headscale.moes.ovh","SupportedCurves":[4588,4587,4589,29,23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[2052,1027,2055,2053,2054,1025,1281,1537,1283,1539],"SupportedProtos":null,"SupportedVersions":[772,771],"RemoteAddr":{"IP":"81.206.9.114","Port":58136,"Zone":""},"LocalAddr":{"IP":"192.168.1.23","Port":443,"Zone":""}}}}
{"level":"debug","ts":1790598443.9323645,"logger":"events","msg":"event","name":"tls_get_certificate","id":"e3c7faab-55a3-4783-abcd-1b4b78beec85","origin":"tls","data":{"client_hello":{"CipherSuites":[49195,49199,49196,49200,52393,52392,49161,49171,49162,49172,4865,4866,4867],"ServerName":"headscale.moes.ovh","SupportedCurves":[4588,4587,4589,29,23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[2052,1027,2055,2053,2054,1025,1281,1537,1283,1539],"SupportedProtos":null,"SupportedVersions":[772,771],"RemoteAddr":{"IP":"81.206.9.114","Port":65214,"Zone":""},"LocalAddr":{"IP":"192.168.1.23","Port":443,"Zone":""}}}}
{"level":"debug","ts":1790598443.965653,"logger":"events","msg":"event","name":"tls_get_certificate","id":"a34d4532-76c4-4006-ad77-d3db239d0183","origin":"tls","data":{"client_hello":{"CipherSuites":[49195,49199,49196,49200,52393,52392,49161,49171,49162,49172,4865,4866,4867],"ServerName":"headscale.moes.ovh","SupportedCurves":[4588,4587,4589,29,23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[2052,1027,2055,2053,2054,1025,1281,1537,1283,1539],"SupportedProtos":null,"SupportedVersions":[772,771],"RemoteAddr":{"IP":"81.206.9.114","Port":65216,"Zone":""},"LocalAddr":{"IP":"192.168.1.23","Port":443,"Zone":""}}}}
{"level":"warn","ts":1790598444.0136702,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"discord.moes.ovh","relative_name":"discord","zone":"moes.ovh."}
{"level":"debug","ts":1790598444.1003294,"logger":"events","msg":"event","name":"tls_get_certificate","id":"f8431cd3-2067-48e4-bc70-6b7cdd2fc6bd","origin":"tls","data":{"client_hello":{"CipherSuites":[4866,4867,4865,49199,49195,49200,49196,158,49191,103,49192,107,163,159,52393,52392,52394,49325,49311,49245,49249,49239,49235,162,49324,49310,49244,49248,49238,49234,49188,106,49187,64,49162,49172,57,56,49161,49171,51,50,157,49309,49233,156,49308,49232,61,60,53,47],"ServerName":"headscale.moes.ovh","SupportedCurves":[4588,29,23,30,24,25,256,257],"SupportedPoints":"AAEC","SignatureSchemes":[2309,2310,2308,1027,1283,1539,2055,2056,2074,2075,2076,2057,2058,2059,2052,2053,2054,1025,1281,1537,771,769,770,1026,1282,1538],"SupportedProtos":["http/1.1","h2"],"SupportedVersions":[772,771],"RemoteAddr":{"IP":"81.206.9.114","Port":65199,"Zone":""},"LocalAddr":{"IP":"192.168.1.23","Port":443,"Zone":""}}}}
{"level":"debug","ts":1790598444.1131644,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 36984\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;instagram.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598444.1536372,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 51675\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3600\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598444.6072,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"instagram.moes.ovh","relative_name":"instagram","zone":"moes.ovh."}
{"level":"debug","ts":1790598444.73971,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 609\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;syncthing.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598444.7812116,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 25754\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3600\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598445.1844885,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"syncthing.moes.ovh","relative_name":"syncthing","zone":"moes.ovh."}
{"level":"debug","ts":1790598445.2979646,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 17115\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;youtube.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598445.327881,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 49008\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3600\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598445.779469,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"youtube.moes.ovh","relative_name":"youtube","zone":"moes.ovh."}
{"level":"debug","ts":1790598445.9047573,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 37563\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;filicivtaresort.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598445.912911,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 28959\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3597\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598446.3464286,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"filicivtaresort.moes.ovh","relative_name":"filicivtaresort","zone":"moes.ovh."}
{"level":"debug","ts":1790598446.4389293,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 20399\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;immich.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598446.4490445,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 49686\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3599\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598446.9129643,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"immich.moes.ovh","relative_name":"immich","zone":"moes.ovh."}
{"level":"debug","ts":1790598447.0246038,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 16278\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;ipt.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598447.037407,"logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.1.23:28080","total_upstreams":1}
{"level":"debug","ts":1790598447.0488887,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 2065\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3600\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598447.0675921,"logger":"http.stdlib","msg":"http: TLS handshake error from 81.206.9.114:65188: EOF"}
{"level":"debug","ts":1790598447.4119864,"logger":"http.stdlib","msg":"http: TLS handshake error from 81.206.9.114:65190: EOF"}
{"level":"warn","ts":1790598447.4787343,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"ipt.moes.ovh","relative_name":"ipt","zone":"moes.ovh."}
{"level":"debug","ts":1790598447.5625546,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 23235\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;wiki.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598447.5743997,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 34618\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3599\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598448.0446963,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"wiki.moes.ovh","relative_name":"wiki","zone":"moes.ovh."}
{"level":"debug","ts":1790598448.8528583,"logger":"http.stdlib","msg":"http: TLS handshake error from 81.206.9.114:65192: EOF"}
{"level":"debug","ts":1790598449.1590812,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 34113\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;ms.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598449.202598,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 24725\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3600\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598449.64692,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"ms.moes.ovh","relative_name":"ms","zone":"moes.ovh."}
{"level":"debug","ts":1790598449.7637434,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 64484\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;yt.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598449.7729578,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 25314\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3595\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598450.231687,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"yt.moes.ovh","relative_name":"yt","zone":"moes.ovh."}
{"level":"debug","ts":1790598450.3232756,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 6666\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;ig.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598450.331658,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 49108\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3596\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598450.7648447,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"ig.moes.ovh","relative_name":"ig","zone":"moes.ovh."}
{"level":"debug","ts":1790598450.8537881,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 4230\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;proj.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598450.8623917,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 1353\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3595\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598451.2966661,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"proj.moes.ovh","relative_name":"proj","zone":"moes.ovh."}
{"level":"debug","ts":1790598451.4219182,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 38620\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;test.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598451.4306192,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 13473\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3592\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598451.8834584,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"test.moes.ovh","relative_name":"test","zone":"moes.ovh."}
{"level":"debug","ts":1790598452.0008135,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 29932\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;auth.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598452.0131967,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 60801\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3593\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598452.052968,"logger":"events","msg":"event","name":"tls_get_certificate","id":"631c6b9f-c256-4974-9f90-25005ae1df8f","origin":"tls","data":{"client_hello":{"CipherSuites":[4866,4867,4865,49199,49195,49200,49196,158,49191,103,49192,107,163,159,52393,52392,52394,49325,49311,49245,49249,49239,49235,162,49324,49310,49244,49248,49238,49234,49188,106,49187,64,49162,49172,57,56,49161,49171,51,50,157,49309,49233,156,49308,49232,61,60,53,47],"ServerName":"headscale.moes.ovh","SupportedCurves":[4588,29,23,30,24,25,256,257],"SupportedPoints":"AAEC","SignatureSchemes":[2309,2310,2308,1027,1283,1539,2055,2056,2074,2075,2076,2057,2058,2059,2052,2053,2054,1025,1281,1537,771,769,770,1026,1282,1538],"SupportedProtos":["http/1.1","h2"],"SupportedVersions":[772,771],"RemoteAddr":{"IP":"81.206.9.114","Port":65222,"Zone":""},"LocalAddr":{"IP":"192.168.1.23","Port":443,"Zone":""}}}}
{"level":"warn","ts":1790598452.4556746,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"auth.moes.ovh","relative_name":"auth","zone":"moes.ovh."}
{"level":"debug","ts":1790598452.5134833,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 2287\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;bm.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598452.518081,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 64768\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3592\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598452.9805064,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"bm.moes.ovh","relative_name":"bm","zone":"moes.ovh."}
{"level":"debug","ts":1790598454.056839,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 47730\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;merch.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598454.0652795,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 20441\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3589\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598454.460133,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"merch.moes.ovh","relative_name":"merch","zone":"moes.ovh."}
{"level":"debug","ts":1790598454.5476737,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 63783\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;headscale.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598454.555631,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 31420\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3592\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598455.0797107,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"headscale.moes.ovh","relative_name":"headscale","zone":"moes.ovh."}
{"level":"debug","ts":1790598455.2041473,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 30592\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;jackett.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598455.2136304,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 43102\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3587\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598455.652373,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"jackett.moes.ovh","relative_name":"jackett","zone":"moes.ovh."}
{"level":"debug","ts":1790598456.26521,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 784\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;pws.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598456.2737863,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 11642\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3589\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598456.669451,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"pws.moes.ovh","relative_name":"pws","zone":"moes.ovh."}
{"level":"debug","ts":1790598456.7856145,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 25161\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;plan.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598456.7951064,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 28274\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3590\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598457.2477553,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"plan.moes.ovh","relative_name":"plan","zone":"moes.ovh."}
{"level":"debug","ts":1790598457.3287404,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 65350\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;dc.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598457.3396077,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 41003\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3585\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598457.775996,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"dc.moes.ovh","relative_name":"dc","zone":"moes.ovh."}
{"level":"debug","ts":1790598457.8861232,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 4472\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;ma.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598457.8969617,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 44640\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3588\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598458.3703482,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"ma.moes.ovh","relative_name":"ma","zone":"moes.ovh."}
{"level":"debug","ts":1790598458.4617794,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 26259\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;pw.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598458.4708073,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 11132\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3588\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598458.908902,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"pw.moes.ovh","relative_name":"pw","zone":"moes.ovh."}
{"level":"debug","ts":1790598459.0063503,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 45871\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;monica.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598459.053301,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 40335\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3600\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"warn","ts":1790598459.4667418,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"monica.moes.ovh","relative_name":"monica","zone":"moes.ovh."}
{"level":"debug","ts":1790598459.5717669,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 35898\n;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 1232\n\n;; QUESTION SECTION:\n;ist.moes.ovh.\tIN\t SOA\n\n;; AUTHORITY SECTION:\nmoes.ovh.\t60\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598459.5800743,"logger":"tls.ech.soa_lookup","msg":"fetched SOA","msg":";; opcode: QUERY, status: NOERROR, id: 49393\n;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version 0; flags:; udp: 512\n\n;; QUESTION SECTION:\n;moes.ovh.\tIN\t SOA\n\n;; ANSWER SECTION:\nmoes.ovh.\t3587\tIN\tSOA\tdns101.ovh.net. tech.ovh.net. 2090591650 86400 3600 3600000 60\n"}
{"level":"debug","ts":1790598459.596566,"logger":"events","msg":"event","name":"tls_get_certificate","id":"ca965054-07bb-4365-90e1-720319afad29","origin":"tls","data":{"client_hello":{"CipherSuites":[4866,4867,4865,49196,49200,49195,49199,52393,52392,49188,49192,49187,49191,159,158,107,103],"ServerName":"immich.moes.ovh","SupportedCurves":[4588,29,23,30,24,25,256,257],"SupportedPoints":"AAEC","SignatureSchemes":[2309,2310,2308,1027,1283,1539,2055,2056,2074,2075,2076,2057,2058,2059,2052,2053,2054,1025,1281,1537,771,769,770,1026,1282,1538],"SupportedProtos":["http/1.1"],"SupportedVersions":[772,771],"RemoteAddr":{"IP":"81.206.9.114","Port":53410,"Zone":""},"LocalAddr":{"IP":"192.168.1.23","Port":443,"Zone":""}}}}
{"level":"warn","ts":1790598460.0859137,"logger":"tls.ech","msg":"domain does not have any existing records, so skipping publication of HTTPS record","domain":"ist.moes.ovh","relative_name":"ist","zone":"moes.ovh."}
{"level":"info","ts":1790598460.0859137,"logger":"tls.ech","msg":"successfully published ECH configuration list for all domains","publisher":"dns.providers.ovh","domains":["home.moes.ovh","discord.moes.ovh","instagram.moes.ovh","syncthing.moes.ovh","youtube.moes.ovh","filicivtaresort.moes.ovh","immich.moes.ovh","ipt.moes.ovh","wiki.moes.ovh","ms.moes.ovh","yt.moes.ovh","ig.moes.ovh","proj.moes.ovh","test.moes.ovh","auth.moes.ovh","bm.moes.ovh","merch.moes.ovh","headscale.moes.ovh","jackett.moes.ovh","pws.moes.ovh","plan.moes.ovh","dc.moes.ovh","ma.moes.ovh","pw.moes.ovh","monica.moes.ovh","ist.moes.ovh"],"config_ids":[195]}
3. Caddy version:
PS C:\Users\evanp> .\caddy.exe version
v2.11.4 h1:XKxkMTgNSizEvKG6QHue6cAsFOteU2qA61w2tKkCWi0=
4. How I installed and ran Caddy:
Built using xcaddy with the OVH dns provider plugin: .\xcaddy.exe build --with github.com/caddy-dns/ovh then ran as a service (details below).
a. System environment:
Windows (running natively, based on paths in logs). x86_64
Module versions:
dns.providers.ovh v1.1.0
b. Command:
Caddy is ran as a service with the following command (see below):
C:\Users\evanp\caddy.exe run
c. Service/unit/compose file:
A Windows service with the ‘path to executable’ set to C:\Users\evanp\caddy.exe run, ‘startup type’ set to ‘Automatic’, running as the local system account.
d. My complete Caddy config:
{
debug
email evan.pacini@gmail.com
default_sni moes.ovh
dns ovh {
endpoint ovh-eu
application_key REDACTED
application_secret REDACTED
consumer_key REDACTED
}
ech moes.ovh
log {
output file D:\Documents\Caddy\caddy.log {
roll_size 10mb
roll_keep 5
roll_keep_for 720h
}
}
order respond before redir
order abort before respond
}
###################################################################################
######### Snippets
###################################################################################
(privacy) {
header {
X-Robots-Tag none
X-Content-Type-Options nosniff
X-Frame-Options DENY
Content-Security-Policy upgrade-insecure-requests; frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
}
respond /robots.txt "User-agent: *
Disallow: /"
}
(whitelist) {
import privacy
@b not remote_ip private_ranges 81.206.9.114 82.75.45.230
abort @b
}
(blacklist) {
import privacy
@b remote_ip 185.252.220.0/24 152.70.58.0/24 193.123.61.0/24 112.168.75.0/24 172.69.223.0/24 172.70.243.0/24 172.70.47.0/24 5.181.190.0/24 205.210.31.0/24 34.48.10.0/24
abort @b
}
(authentik) {
import blacklist
route {
reverse_proxy /outpost.goauthentik.io/* http://192.168.1.23:9000
forward_auth http://192.168.1.23:9000 {
uri /outpost.goauthentik.io/auth/caddy
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version
trusted_proxies 192.168.1.23
}
{args[:]}
}
}
(redir_b) {
import blacklist
redir {args[:]}
}
(proxy_b) {
import blacklist
reverse_proxy {args[:]}
}
###################################################################################
######### Sites & Reverse proxies
###################################################################################
auth.moes.ovh {
import proxy_b http://192.168.1.23:9000
}
bm.moes.ovh {
import authentik reverse_proxy http://192.168.1.23:3333
}
http://headscale.moes.ovh {
import blacklist
respond /generate_204 204
redir https://{host}{uri}
}
headscale.moes.ovh {
import blacklist
@headplane path /admin /admin/*
handle @headplane {
reverse_proxy http://192.168.1.23:3005
}
handle {
reverse_proxy http://192.168.1.23:28080 {
header_up True-Client-IP {remote_host}
header_up X-Real-IP {remote_host}
}
}
}
home.moes.ovh {
import proxy_b http://192.168.1.22:8123
}
ist.moes.ovh {
import authentik reverse_proxy http://192.168.1.23:5000
}
ipt.moes.ovh {
import authentik reverse_proxy http://192.168.1.23:8001
}
immich.moes.ovh {
import proxy_b http://192.168.1.23:2283
}
jackett.moes.ovh {
import whitelist
reverse_proxy http://192.168.1.23:9117
}
ma.moes.ovh {
import authentik reverse_proxy http://192.168.1.23:42010
}
monica.moes.ovh {
import whitelist
reverse_proxy http://192.168.1.23:8080
}
ms.moes.ovh {
import authentik reverse_proxy http://192.168.1.23:9078
}
plan.moes.ovh {
import authentik reverse_proxy http://192.168.1.23:8804
}
pw.moes.ovh {
import proxy_b http://192.168.1.23:7277
}
syncthing.moes.ovh {
import authentik reverse_proxy http://192.168.1.23:8384
}
test.moes.ovh {
import authentik file_server browse
}
wiki.moes.ovh {
import proxy_b http://192.168.1.23:3000
}
###################################################################################
######### Redirections
###################################################################################
dc.moes.ovh, discord.moes.ovh {
import redir_b https://discord.com/invite/dyAPruPFxV
}
filicivtaresort.moes.ovh {
import redir_b https://filicivtaresort.wordpress.com
}
ig.moes.ovh, instagram.moes.ovh {
import redir_b https://www.instagram.com/greaterisleofmoes
}
merch.moes.ovh {
import redir_b https://evanpacini.redbubble.com
}
proj.moes.ovh {
import redir_b https://github.com/users/LukeKuijpers/projects/1
}
pws.moes.ovh {
import redir_b https://vixra.org/abs/2111.0173
}
youtube.moes.ovh, yt.moes.ovh {
import redir_b https://www.youtube.com/@greaterisleofmoes
}
###################################################
# Default
###################################################
:80, :443, *.moes.ovh, moes.ovh {
import redir_b https://www.youtube.com/watch?v=dQw4w9WgXcQ
}