Okay so now I’m getting below logs
{"level":"info","ts":1700227136.8759327,"msg":"using provided configuration","config_file":"/etc/caddy/Caddyfile","config_adapter":"caddyfile"}
{"level":"warn","ts":1700227136.877691,"msg":"Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies","adapter":"caddyfile","file":"/etc/caddy/Caddyfile","line":2}
{"level":"info","ts":1700227136.8790748,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//127.0.0.1:2019","//localhost:2019","//[::1]:2019"]}
{"level":"info","ts":1700227136.8794892,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
{"level":"info","ts":1700227136.8795319,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc00011da80"}
{"level":"debug","ts":1700227136.8796377,"logger":"http.auto_https","msg":"adjusted config","tls":{"automation":{"policies":[{"on_demand":true}],"on_demand":{"ask":"http://cache-cloud-api.com/check"}}},"http":{"servers":{"remaining_auto_https_redirects":{"listen":[":80"],"routes":[{},{}],"logs":{"default_logger_name":"log0"}},"srv0":{"listen":[":443"],"routes":[{"handle":[{"encodings":{"gzip":{}},"handler":"encode","prefer":["gzip"]},{"handler":"reverse_proxy","upstreams":[{"dial":"ssl.default.svc.cluster.local:3000"}]}]}],"tls_connection_policies":[{}],"automatic_https":{},"logs":{"default_logger_name":"log0"}}}}}
{"level":"info","ts":1700227136.8801842,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
{"level":"info","ts":1700227136.880454,"msg":"failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details."}
{"level":"debug","ts":1700227136.8807192,"logger":"http","msg":"starting server loop","address":"[::]:443","tls":true,"http3":true}
{"level":"info","ts":1700227136.8807418,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
{"level":"debug","ts":1700227136.8808153,"logger":"http","msg":"starting server loop","address":"[::]:80","tls":false,"http3":false}
{"level":"info","ts":1700227136.8808246,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]}
{"level":"info","ts":1700227136.8811884,"msg":"autosaved config (load with --resume flag)","file":"/config/caddy/autosave.json"}
{"level":"info","ts":1700227136.8812008,"msg":"serving initial configuration"}
{"level":"info","ts":1700227136.8814921,"logger":"tls","msg":"cleaning storage unit","description":"FileStorage:/data/caddy"}
{"level":"info","ts":1700227136.8815575,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"debug","ts":1700227476.7405252,"logger":"http.stdlib","msg":"http: TLS handshake error from 10.128.0.6:41020: tls: client offered only unsupported versions: [302 301]"}
{"level":"debug","ts":1700228307.8627481,"logger":"events","msg":"event","name":"tls_get_certificate","id":"7247fb01-ae44-4103-bb0c-bd3fb92c879a","origin":"tls","data":{"client_hello":{"CipherSuites":[49199,49200,49195,49196,52392,52393,49171,49161,49172,49162,156,157,47,53,49170,10],"ServerName":"","SupportedCurves":[29,23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[1025,1027,1281,1283,513,515],"SupportedProtos":null,"SupportedVersions":[771,770,769],"Conn":{}}}}
{"level":"debug","ts":1700228307.8634315,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"10.60.2.135"}
{"level":"error","ts":1700228317.8639276,"logger":"tls","msg":"request to 'ask' endpoint failed","ask_endpoint":"http://cache-cloud-api.com/check","domain":"10.60.2.135","error":"error checking http://cache-cloud-api.com/check to determine if certificate for hostname '10.60.2.135' should be allowed: Get \"http://cache-cloud-api.com/check?domain=10.60.2.135\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)"}
{"level":"debug","ts":1700228317.8641155,"logger":"http.stdlib","msg":"http: TLS handshake error from 10.128.15.241:28339: certificate is not allowed for server name 10.60.2.135: decision func: error checking http://cache-cloud-api.com/check to determine if certificate for hostname '10.60.2.135' should be allowed: Get \"http://cache-cloud-api.com/check?domain=10.60.2.135\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)"}
{"level":"debug","ts":1700228522.9069974,"logger":"http.stdlib","msg":"http: TLS handshake error from 10.60.2.1:3698: tls: client offered only unsupported versions: [302 301]"}
{"level":"info","ts":1700228546.1246722,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.128.15.241","remote_port":"58906","client_ip":"10.128.15.241","proto":"HTTP/1.1","method":"GET","host":"34.136.106.166:80","uri":"/","headers":{"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"],"Accept":["*/*"],"Connection":["keep-alive"]}},"bytes_read":0,"user_id":"","duration":0.000263191,"size":0,"status":308,"resp_headers":{"Connection":["close"],"Location":["https://34.136.106.166/"],"Content-Type":[],"Server":["Caddy"]}}
{"level":"debug","ts":1700228914.9650488,"logger":"http.stdlib","msg":"http: TLS handshake error from 10.128.0.6:1024: read tcp 10.60.2.135:443->10.128.0.6:1024: read: connection reset by peer"}
{"level":"debug","ts":1700228937.3597276,"logger":"events","msg":"event","name":"tls_get_certificate","id":"7cf6a82f-f934-475f-b336-b4f769e9e523","origin":"tls","data":{"client_hello":{"CipherSuites":[49199,49195,49169,49159,49171,49161,49172,49162,5,47,53,49170,10],"ServerName":"","SupportedCurves":[23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[1025,1027,513,515,1025,1281,1537],"SupportedProtos":null,"SupportedVersions":[771,770,769],"Conn":{}}}}
{"level":"debug","ts":1700228937.359907,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"10.60.2.135"}
{"level":"error","ts":1700228947.3602724,"logger":"tls","msg":"request to 'ask' endpoint failed","ask_endpoint":"http://cache-cloud-api.com/check","domain":"10.60.2.135","error":"error checking http://cache-cloud-api.com/check to determine if certificate for hostname '10.60.2.135' should be allowed: Get \"http://cache-cloud-api.com/check?domain=10.60.2.135\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)"}
{"level":"debug","ts":1700228947.3605545,"logger":"http.stdlib","msg":"http: TLS handshake error from 10.128.0.6:5732: certificate is not allowed for server name 10.60.2.135: decision func: error checking http://cache-cloud-api.com/check to determine if certificate for hostname '10.60.2.135' should be allowed: Get \"http://cache-cloud-api.com/check?domain=10.60.2.135\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)"}
{"level":"debug","ts":1700230018.6478019,"logger":"http.stdlib","msg":"http: TLS handshake error from 10.60.2.1:29134: tls: client offered only unsupported versions: [302 301]"}
{"level":"debug","ts":1700230390.9185197,"logger":"http.stdlib","msg":"http: TLS handshake error from 10.60.2.1:42371: tls: first record does not look like a TLS handshake"}
{"level":"info","ts":1700230570.3532252,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.128.0.6","remote_port":"49966","client_ip":"10.128.0.6","proto":"HTTP/1.1","method":"POST","host":"34.136.106.166:80","uri":"/boaform/admin/formLogin","headers":{"Content-Type":["application/x-www-form-urlencoded"],"Content-Length":["29"],"Origin":["http://34.136.106.166:80"],"Accept-Encoding":["gzip, deflate"],"User-Agent":["Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"Accept-Language":["en-GB,en;q=0.5"],"Connection":["keep-alive"],"Referer":["http://34.136.106.166:80/admin/login.asp"],"Upgrade-Insecure-Requests":["1"]}},"bytes_read":0,"user_id":"","duration":0.00006985,"size":0,"status":308,"resp_headers":{"Connection":["close"],"Location":["https://34.136.106.166/boaform/admin/formLogin"],"Content-Type":[],"Server":["Caddy"]}}
{"level":"debug","ts":1700231359.805899,"logger":"http.stdlib","msg":"http: TLS handshake error from 10.128.0.6:18336: tls: client offered only unsupported versions: [302 301]"}
This IP is my frontend container IP 10.60.3.135
But the script is in my backend container 10.60.2.129
So the path Caddy is trying to ask is this
Get "http://cache-cloud-api.com/check?domain=10.60.2.135\"
It seems to be it’s looking for it in Front-End container not in the Back-End container
Do you think I should move that check script into front-end container
FrontEnd Application