1. The problem I’m having:
I’ve been successfully running my service on Caddy for a few years now. After updating packages on my FreeBSD server Caddy fails to start by not being able to bind to port 443. I use the exact portacl setup recommended here: ThomasHurst/Caddy - FreeBSD Wiki
2. Error messages and/or full log output:
{"level":"info","ts":1739561001.0517418,"msg":"using config from file","file":"/usr/local/etc/caddy/Caddyfile"}
{"level":"info","ts":1739561001.0528932,"msg":"adapted config to JSON","adapter":"caddyfile"}
{"level":"warn","ts":1739561001.0529566,"msg":"Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies","adapter":"caddyfile","file":"/usr/local/etc/caddy/Caddyfile","line":2}
{"level":"info","ts":1739561001.053941,"logger":"admin","msg":"admin endpoint started","address":"unix//var/run/caddy/caddy.sock","enforce_origin":false,"origins":["","//127.0.0.1","//::1"]}
{"level":"info","ts":1739561001.0540845,"logger":"http.auto_https","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv0","https_port"
:443}
{"level":"info","ts":1739561001.0541418,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
Error: loading initial config: loading new config: http app module: start: listening on :443: listen tcp :443: bind: operation not permitted
Error: caddy process exited with error: exit status 1
3. Caddy version:
v2.9.0
4. How I installed and ran Caddy:
I installed Caddy using pkg and use the recommended portacl setup. Here’s my /etc/rc.conf:
hostname="freebsd14"
keymap="fi.kbd"
ifconfig_vtnet0="DHCP"
ifconfig_vtnet0_ipv6="inet6 accept_rtadv"
sshd_enable="YES"
ntpdate_enable="YES"
# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
dumpdev="AUTO"
zfs_enable="YES"
duiker_enable="YES"
portacl_users+=www
portacl_user_www_tcp="http https"
portacl_user_www_udp="https"
portacl_enable="YES"
caddy_user="www"
caddy_group="www"
caddy_enable="YES"
a. System environment:
FreeBSD 14.2-RELEASE-p1
b. Command:
N/A
c. Service/unit/compose file:
#!/bin/sh
# PROVIDE: caddy
# REQUIRE: LOGIN DAEMON NETWORKING
# KEYWORD: shutdown
# To enable caddy:
#
# - Edit /usr/local/etc/caddy/Caddyfile
# See https://caddyserver.com/docs/
# - Run 'service caddy enable'
#
# Note while Caddy currently defaults to running as root:wheel, it is strongly
# recommended to run the server as an unprivileged user, such as www:www.
#
# - Use security/portacl-rc to enable privileged port binding:
#
# # pkg install security/portacl-rc
# # sysrc portacl_users+=www
# # sysrc portacl_user_www_tcp="http https"
# # sysrc portacl_user_www_udp="https"
# # service portacl enable
# # service portacl start
#
# - Configure caddy to run as www:www
#
# # sysrc caddy_user=www caddy_group=www
#
# - Note if Caddy has been started as root previously, files in
# /var/log/caddy, /var/db/caddy, and /var/run/caddy may require their ownership
# changing manually.
# Optional settings:
# caddy_command (string): Full path to the caddy binary
# caddy_config (string): Full path to caddy config file
# (/usr/local/etc/caddy/Caddyfile)
# caddy_adapter (string): Config adapter type (caddyfile) 21:47:25 [112/24978]
# caddy_admin (string): Default administration endpoint
# (unix//var/run/caddy/caddy.sock)
# caddy_directory (string): Root for caddy storage (ACME certs, etc.)
# (/var/db/caddy)
# caddy_extra_flags (string): Extra flags passed to caddy start
# caddy_logdir (string): Where caddy logs are stored
# (/var/log/caddy)
# caddy_logfile (string): Location of process log (${caddy_logdir}/caddy.log)
# This is for startup/shutdown/error messages.
# To create an access log, see:
# https://caddyserver.com/docs/caddyfile/directives/log
# caddy_user (user): User to run caddy (root)
# caddy_group (group): Group to run caddy (wheel)
#
# This script will honor XDG_CONFIG_HOME/XDG_DATA_HOME. Caddy will create a
# .../caddy subdir in each of those. By default, they are subdirs of /var/db/caddy.
# See https://caddyserver.com/docs/conventions#data-directory
. /etc/rc.subr 21:47:25 [93/24978]
name=caddy
rcvar=caddy_enable
desc="Powerful, enterprise-ready, open source web server with automatic HTTPS written in Go"
load_rc_config $name
# Defaults
: ${caddy_enable:=NO}
: ${caddy_adapter:=caddyfile}
: ${caddy_config:="/usr/local/etc/caddy/Caddyfile"}
: ${caddy_admin:="unix//var/run/${name}/${name}.sock"}
: ${caddy_command:="/usr/local/bin/${name}"}
: ${caddy_directory:=/var/db/caddy}
: ${caddy_extra_flags:=""}
: ${caddy_logdir:="/var/log/${name}"}
: ${caddy_logfile:="${caddy_logdir}/${name}.log"}
: ${caddy_user:="root"}
: ${caddy_group:="wheel"} 21:47:25 [74/24978]
# Config and base directories
: ${XDG_CONFIG_HOME:="${caddy_directory}/config"}
: ${XDG_DATA_HOME:="${caddy_directory}/data"}
export XDG_CONFIG_HOME XDG_DATA_HOME
# Default admin interface
export CADDY_ADMIN="${caddy_admin}"
command="${caddy_command}"
pidfile="/var/run/${name}/${name}.pid"
required_files="${caddy_config} ${caddy_command}"
start_precmd="caddy_precmd"
start_cmd="caddy_start"
stop_precmd="caddy_prestop"
# JSON is the native format, so there is no "adapter" for it 21:47:25 [55/24978]
if [ "${caddy_adapter}" = "json" ]; then
caddy_flags="--config ${caddy_config}"
else
caddy_flags="--config ${caddy_config} --adapter ${caddy_adapter}"
fi
# Extra Commands
extra_commands="configtest reload reloadssl"
configtest_cmd="caddy_execute validate ${caddy_flags}"
reload_cmd="caddy_execute reload ${caddy_flags}"
reloadssl_cmd="caddy_execute reload --force ${caddy_flags}"
caddy_execute()
{
/usr/bin/su -m "${caddy_user}" -c "${caddy_command} $*"
}
caddy_precmd()
{ 21:47:25 [36/24978]
# Create required directories and set permissions
/usr/bin/install -d -m 755 -o "${caddy_user}" -g "${caddy_group}" ${caddy_directory}
/usr/bin/install -d -m 700 -o "${caddy_user}" -g "${caddy_group}" ${caddy_directory}/config
/usr/bin/install -d -m 700 -o "${caddy_user}" -g "${caddy_group}" ${caddy_directory}/data
/usr/bin/install -d -m 755 -o "${caddy_user}" -g "${caddy_group}" ${caddy_logdir}
/usr/bin/install -d -m 700 -o "${caddy_user}" -g "${caddy_group}" /var/run/caddy
if [ -e ${caddy_logfile} ]; then
/bin/chmod 644 ${caddy_logfile}
/usr/sbin/chown "${caddy_user}:${caddy_group}" ${caddy_logfile}
else
/usr/bin/install -m 644 -o "${caddy_user}" -g "${caddy_group}" /dev/null ${caddy_logfile}
fi
}
caddy_start()
{
echo -n "Starting caddy... "
/usr/bin/su -m ${caddy_user} -c "${caddy_command} start ${caddy_flags} \
${caddy_extra_flags} --pidfile ${pidfile}" >> ${caddy_logfile} 2>&1 21:47:25 [17/24978]
if [ $? -eq 0 ] && ps -ax -o pid | grep -q "$(cat ${pidfile})"; then
echo "done"
echo "Log: ${caddy_logfile}"
else
echo "Error: Caddy failed to start"
echo "Check the caddy log: ${caddy_logfile}"
fi
}
caddy_prestop()
{
local result
echo -n "Stopping caddy... "
result="$(caddy_execute stop ${caddy_flags} 2>&1)"
if [ ${?} -eq 0 ]; then
echo "done"
echo "done"
exit 0
else
if echo "${result}" | grep -q -e "connection refused" \
-e "connect: no such file or directory"; then
echo "admin interface unavailable; using pidfile"
return 0
else
echo "Error: Unable to stop caddy"
echo "Check the caddy log: ${caddy_logfile}"
return 1
fi
fi
}
run_rc_command "$1"
d. My complete Caddy config:
duiker.fi {
redir https://www.{host}{uri}
}
www.duiker.fi {
reverse_proxy 127.0.0.1:9200
header {
-server
}
}
5. Links to relevant resources:
N/A