How secure a redirect for only on reverse proxy site

[Dwayne_La_Rose]

1. The problem I’m having:

I have a site that need to secure or block the reverse proxy only part of
https://remote.access.site - allow all access
https://remote.access.site/web - admin site to protect

The issue is that the two URLS are two different ports.
I want to protect the admin site.

From what I can see there is no way to use a matcher or basic auth for just one reverse proxy site under a domain. It seems to be all or None

Caddy is working normally with everything else. The only issue is the need to lock down that admin site. I think I need to pipe this caddy into another caddy instance. so I can lock that site one down . Thx for your input

2. Error messages and/or full log output:

N/A 

3. Caddy version: 2.7.6

4. How I installed and ran Caddy:

I used Docker to create my caddy service

a. System environment:

Docker

b. Command:

sudo docker run -d \
-p 443:443 \
-p 80:80 \
-v /etc/caddy/data:/data \
-v /etc/caddy/Caddyfile:/etc/caddy/Caddyfile \
--restart unless-stopped \
--name caddydec2023 \
caddydec2023

c. Service/unit/compose file:

Dockerfile
FROM caddy:2.7.6-builder-alpine AS builder
RUN xcaddy build \
     --with github.com/greenpau/caddy-security

FROM caddy:2.7.6-alpine
COPY --from=builder /usr/bin/caddy /usr/bin/caddy

d. My complete Caddy config:

https://remote.access.site {

	reverse_proxy /web* https://172.16.15.15:9444 { #admin site that needs to be protected
		transport http {
			tls_insecure_skip_verify
		}
	}
	
    reverse_proxy 172.16.15.15:4444 #allow remote unprotected access 
}

5. Links to relevant resources:

[Mohammed90 (Mohammed Al Sahaf)]

You can wrap whole segments in route or handle with the reverse_proxy inside them. For example,

https://remote.access.site {
     handle /web* {
        basicauth {
            <user> <hashed_pass>
        }

        reverse_proxy /web* https://172.16.15.15:9444 { 
		transport http {
			tls_insecure_skip_verify
		}
	}
    }

    handle {
        reverse_proxy 172.16.15.15:4444 #allow remote unprotected access 
    }
}

What handle does is enforce mutually-exclusive routing to ensure only one of the 2 handler chains is executed, not both, and to enable conditional chain of handlers as in your case.

[Dwayne_La_Rose]

wow I works!
thanks so much! you saved me a bunch of time!