Hi @timelordx, thanks for your help!
I tried, but this don’t allow /heathcheck, I still have an http basic auth 
$ curl -v -k https://localhost/healthcheck
* Host localhost:443 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
* Trying [::1]:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust: peer verification disabled
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519MLKEM768 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
* subject:
* start date: Dec 18 10:03:10 2025 GMT
* expire date: Dec 18 22:03:10 2025 GMT
* issuer: CN=Caddy Local Authority - ECC Intermediate
* Certificate level 0: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
* Certificate level 1: Public key type EC/prime256v1 (256/128 Bits/secBits), signed using ecdsa-with-SHA256
* SSL certificate OpenSSL verify result: unable to get local issuer certificate (20)
* SSL certificate verification failed, continuing anyway!
* Established connection to localhost (::1 port 443) from ::1 port 39568
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://localhost/healthcheck
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: localhost]
* [HTTP/2] [1] [:path: /healthcheck]
* [HTTP/2] [1] [user-agent: curl/8.17.0]
* [HTTP/2] [1] [accept: */*]
> GET /healthcheck HTTP/2
> Host: localhost
> User-Agent: curl/8.17.0
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Request completely sent off
< HTTP/2 401
< alt-svc: h3=":443"; ma=2592000
< server: Caddy
< www-authenticate: Basic realm="restricted"
< content-length: 0
< date: Thu, 18 Dec 2025 10:44:25 GMT
<
* Connection #0 to host localhost:443 left intact
Here is the result of curl “http://localhost:2019/config/” :
{
"apps": {
"frankenphp": {
"workers": [
{
"env": {
"APP_RUNTIME": "Runtime\\FrankenPhpSymfony\\Runtime"
},
"file_name": "./public/index.php",
"watch": [
"./**/*.{php,yaml,yml,twig,env}"
]
}
]
},
"http": {
"metrics": {},
"servers": {
"srv0": {
"listen": [
":443"
],
"logs": {
"logger_names": {
"localhost": [
"log0"
]
}
},
"routes": [
{
"handle": [
{
"handler": "subroute",
"routes": [
{
"handle": [
{
"handler": "vars",
"root": "/app/public"
},
{
"handler": "headers",
"response": {
"require": {
"headers": {
"Permissions-Policy": null
}
},
"set": {
"Permissions-Policy": [
"browsing-topics=()"
]
}
}
}
]
},
{
"group": "group1",
"handle": [
{
"handler": "rewrite",
"uri": "index.php"
}
],
"match": [
{
"not": [
{
"path": [
"/metrics"
]
},
{
"file": {
"try_files": [
"{http.request.uri.path}"
]
}
}
]
}
]
},
{
"handle": [
{
"encodings": {
"br": {},
"gzip": {},
"zstd": {}
},
"handler": "encode",
"prefer": [
"zstd",
"br",
"gzip"
]
}
]
},
{
"handle": [
{
"handler": "subroute",
"routes": [
{
"handle": [
{
"handler": "authentication",
"providers": {
"http_basic": {
"accounts": [
{
"password": "$2a$14$a3L/wRWU9mvnYoO2AOuS4u8GztSKf82tFLqi36VSbBsD3hvsDbJ.G",
"username": "foo"
}
],
"hash": {
"algorithm": "bcrypt"
},
"hash_cache": {}
}
}
}
]
}
]
}
],
"match": [
{
"not": [
{
"path": [
"/healthcheck"
]
}
]
}
]
},
{
"handle": [
{
"handler": "metrics"
}
],
"match": [
{
"path": [
"/metrics"
]
}
]
},
{
"handle": [
{
"handler": "php"
}
],
"match": [
{
"path": [
"index.php"
]
}
]
},
{
"handle": [
{
"handler": "file_server",
"hide": [
"*.php",
"/etc/frankenphp/Caddyfile"
]
}
]
}
]
}
],
"match": [
{
"host": [
"localhost"
]
}
],
"terminal": true
}
]
},
"srv1": {
"listen": [
":80"
],
"logs": {
"logger_names": {
"php": [
"log0"
]
}
},
"routes": [
{
"handle": [
{
"handler": "subroute",
"routes": [
{
"handle": [
{
"handler": "vars",
"root": "/app/public"
},
{
"handler": "headers",
"response": {
"require": {
"headers": {
"Permissions-Policy": null
}
},
"set": {
"Permissions-Policy": [
"browsing-topics=()"
]
}
}
}
]
},
{
"group": "group2",
"handle": [
{
"handler": "rewrite",
"uri": "index.php"
}
],
"match": [
{
"not": [
{
"path": [
"/metrics"
]
},
{
"file": {
"try_files": [
"{http.request.uri.path}"
]
}
}
]
}
]
},
{
"handle": [
{
"encodings": {
"br": {},
"gzip": {},
"zstd": {}
},
"handler": "encode",
"prefer": [
"zstd",
"br",
"gzip"
]
}
]
},
{
"handle": [
{
"handler": "subroute",
"routes": [
{
"handle": [
{
"handler": "authentication",
"providers": {
"http_basic": {
"accounts": [
{
"password": "$2a$14$a3L/wRWU9mvnYoO2AOuS4u8GztSKf82tFLqi36VSbBsD3hvsDbJ.G",
"username": "foo"
}
],
"hash": {
"algorithm": "bcrypt"
},
"hash_cache": {}
}
}
}
]
}
]
}
],
"match": [
{
"not": [
{
"path": [
"/healthcheck"
]
}
]
}
]
},
{
"handle": [
{
"handler": "metrics"
}
],
"match": [
{
"path": [
"/metrics"
]
}
]
},
{
"handle": [
{
"handler": "php"
}
],
"match": [
{
"path": [
"index.php"
]
}
]
},
{
"handle": [
{
"handler": "file_server",
"hide": [
"*.php",
"/etc/frankenphp/Caddyfile"
]
}
]
}
]
}
],
"match": [
{
"host": [
"php"
]
}
],
"terminal": true
}
]
}
}
},
"pki": {
"certificate_authorities": {
"local": {
"install_trust": false
}
}
}
},
"logging": {
"logs": {
"default": {
"exclude": [
"http.log.access.log0"
]
},
"log0": {
"encoder": {
"fields": {
"request>uri": {
"actions": [
{
"parameter": "authorization",
"type": "replace",
"value": "REDACTED"
}
],
"filter": "query"
}
},
"format": "filter"
},
"include": [
"http.log.access.log0"
]
}
}
}
}
Here is my docker entrypoint :
...
# HTTP Basic Auth configuration
if [ -n "$HTTP_BASIC_USER" ] && [ -n "$HTTP_BASIC_PASSWORD" ]; then
HASHED_PASSWORD=$(frankenphp hash-password --plaintext "$HTTP_BASIC_PASSWORD")
unset HTTP_BASIC_PASSWORD
CADDY_SERVER_EXTRA_DIRECTIVES=$(cat <<EOF
@protected {
not path /healthcheck
}
handle @protected {
basic_auth {
${HTTP_BASIC_USER} ${HASHED_PASSWORD}
}
}
${CADDY_SERVER_EXTRA_DIRECTIVES:-}
EOF
)
export CADDY_SERVER_EXTRA_DIRECTIVES
fi
exec docker-php-entrypoint "$@"
(frankenphp = caddy with php)
Any idea of what is wrong?
