1. The problem I’m having:
Hello! I am back looking for some more help understanding things.
For reference, this post has the background:
To recap, I have been trying to setup self-hosted apps locally and remove the need to use IP address in the browser and from configuration files.
The concept in my head was pretty simple, I have a DHCP server (router) that knows all of the devices on the network. I should be able to ask the router for the IP based on hostname.domain (and probably just by hostname) and get to the app without IPs.
Whitesnake was extremely helpful in getting that issue resolved. Full transparency, I did have some continued struggles, but Whitesnake armed me with much needed context and information which allowed me to better understand what I still had wrong.
The challenge of late has been that darn “This connection is not secure” warnings. I can’t find the post, but I did find a comment on a thread that indicated that I needed to get the root and intermediate certificates from the PKI folder of Caddy onto what I understood as my computer. (The one I am using to submit this on). I put them into my Apply Keychain and trusted them. Made no difference.
I attempted to follow this conversation Local valid SSL cert setup - #5 by Rocker8607 but I wasn’t.
Knowing that I do tend to comprehend better from videos, I turned YT and tried to search but nothing caddy specific seemed to touch the issue, at least not in a way that I could translate into my issue.
What I did find was a video by The_Sudo which was not about Caddy but was about the issue: https://www.youtube.com/watch?v=PQh3sDaPJyg
This video made me question whether or not I was doing the right thing with the certificates from Caddy. In the video, he is using Vault and after generating all the certs and keys, at the end he is taking the root and intermediate certs and putting them into his Heimdall site. I started wondering if that was what I was supposed to be doing as well with Caddy’s.
The other thing, I don’t understand the whole 12hr expiration thing and I can’t imagine that the expectation for Caddy users is to go copy certificates every 12 hours and install everywhere needed.
My relevant Caddyfile section looks like this. Note, I am generalizing the hostnames, but again, the issue is about what I am supposed to be doing with the certs and I can’t imagine anyone needs the hostnames to help. Or maybe these are the actual hostnames if that helps! 
# Wildcard certificate for all internal services
*.internal {
tls internal
log {
output file /var/log/caddy/internal-services.log
format json
level DEBUG
}
@a host a.internal
handle @a {
reverse_proxy a.internal:1234
}
@b host b.internal
handle @b {
reverse_proxy b.internal:2345
}
@c host c.internal
handle @c {
reverse_proxy c.internal:3456
}
}
I appreciate any guidance from the community to help me fill in the gaps of my understanding. Visual, as in videos, content is something I will absorb and understand more fully. I am not looking for do this and then that and would prefer an approach similar to Whitesnake in the original thread. I learned from Whitesnake and was able to use that knowledge to get here.
Thanks!
2. Error messages and/or full log output:
[
{
"level": "info",
"ts": 1724540845.3384328,
"logger": "http.log.access.log0",
"msg": "handled request",
"request": {
"remote_ip": "192.168.1.5",
"remote_port": "60014",
"client_ip": "192.168.1.5",
"proto": "HTTP/1.1",
"method": "GET",
"host": "a.internal",
"uri": "/signalr/messages?access_token=a4d3455865204d6786bd75ac83632436&id=FX0I3ZtMq05d-UevqfAO3Q",
"headers": {
"Connection": ["Upgrade"],
"Sec-Fetch-Dest": ["websocket"],
"User-Agent": [
"Mozilla/5.0 (iPhone; CPU iPhone OS 17_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Mobile/15E148 Safari/604.1"
],
"Sec-Websocket-Key": ["SGum0PMRLFX85OahJEicug=="],
"Sec-Websocket-Extensions": ["permessage-deflate"],
"Accept": ["*/*"],
"Origin": ["https://a.internal"],
"Upgrade": ["websocket"],
"Sec-Fetch-Site": ["same-origin"],
"Pragma": ["no-cache"],
"Sec-Websocket-Version": ["13"],
"Cache-Control": ["no-cache"],
"Sec-Fetch-Mode": ["websocket"],
"Accept-Language": ["en-US,en;q=0.9"],
"Accept-Encoding": ["gzip, deflate"]
},
"tls": {
"resumed": false,
"version": 772,
"cipher_suite": 4865,
"proto": "http/1.1",
"server_name": "a.internal"
}
},
"bytes_read": 72,
"user_id": "",
"duration": 39.267173594,
"size": 581,
"status": 101,
"resp_headers": {
"Alt-Svc": ["h3=\":443\"; ma=2592000"],
"Upgrade": ["websocket"],
"Connection": ["Upgrade"],
"Date": ["Sat, 24 Aug 2024 23:06:45 GMT"],
"Cache-Control": ["no-cache, no-store"],
"Server": ["Caddy", "Kestrel"],
"Expires": ["-1"],
"Pragma": ["no-cache"],
"Sec-Websocket-Accept": ["MwgsQ/AeFXeWEkUDx02rbVbML4U="]
}
},
{
"level": "info",
"ts": 1724545179.18059,
"logger": "http.log.access.log0",
"msg": "handled request",
"request": {
"remote_ip": "192.168.1.2",
"remote_port": "55978",
"client_ip": "192.168.1.2",
"proto": "HTTP/2.0",
"method": "GET",
"host": "a.internal",
"uri": "/",
"headers": {
"Accept": [
"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
],
"Sec-Fetch-Site": ["none"],
"Accept-Encoding": ["gzip, deflate, br"],
"Sec-Fetch-Mode": ["navigate"],
"User-Agent": [
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15"
],
"Accept-Language": ["en-US,en;q=0.9"],
"Sec-Fetch-Dest": ["document"]
},
"tls": {
"resumed": false,
"version": 772,
"cipher_suite": 4865,
"proto": "h2",
"server_name": "a.internal"
}
},
"bytes_read": 0,
"user_id": "",
"duration": 0.002500461,
"size": 1952,
"status": 200,
"resp_headers": {
"Date": ["Sun, 25 Aug 2024 00:19:38 GMT"],
"Server": ["Caddy", "Kestrel"],
"Alt-Svc": ["h3=\":443\"; ma=2592000"],
"Cache-Control": ["no-cache, no-store"],
"Expires": ["-1"],
"Pragma": ["no-cache"],
"Content-Length": ["1952"],
"Content-Type": ["text/html"]
}
}
]
3. Caddy version:
caddy --version
v2.8.4 h1:q3pe0wpBj1OcHFZ3n/1nl4V4bxBrYoSoab7rL9BMYNk=
4. How I installed and ran Caddy:
xbuild caddy
a. System environment:
Caddy is in a Proxmox LXC
b. Command:
systemctl start caddy
c. Service/unit/compose file:
d. My complete Caddy config:
Relevant section, again, this is working for the most part. I am addressing the SSL portion.
# Wildcard certificate for all internal services
*.internal {
tls internal
log {
output file /var/log/caddy/internal-services.log
format json
level DEBUG
}
@a host a.internal
handle @a {
reverse_proxy a.internal:1234
}
@b host b.internal
handle @b {
reverse_proxy b.internal:2345
}
@c host c.internal
handle @c {
reverse_proxy c.internal:3456
}
}
5. Links to relevant resources:
Just continued thanks for the assistance.
