How to get dockerised Caddy to use self-signed certs for local dev with php-fpm SPA (VueJs)

[francislavoie]

@geoidesic

        header_up Host                  "localhost"
        header_up X-Real-IP             {remote}
        header_up X-Forwarded-Host      "localhost"
        header_up X-Forwarded-Server    "localhost"
        header_up X-Forwarded-For       {port}
        header_up X-Forwarded-Proto     {scheme}

@geoidesic

        header_up Host                                  {host}
        header_up Origin                                {host}
        header_up X-Real-IP                             {remote}
        header_up X-Forwarded-Host                      {host}
        header_up X-Forwarded-Server                    {host}
        header_up X-Forwarded-Port                      {port}
        header_up X-Forwarded-For                       {remote}
        header_up X-Forwarded-Proto                     {scheme}

Remove all of this. Caddy sets the appropriate headers automatically. See the docs:

reverse_proxy (Caddyfile directive) - Caddy Documentation

@geoidesic

        header_down Access-Control-Allow-Origin         https://frontend.foo.bar
        header_down Access-Control-Allow-Credentials    true

You should use the header directive instead for this. The difference is that the header_down subdirective will only apply for requests that actually get proxied to your PHP app, whereas header will apply for all requests, including ones handled by file_server.

@geoidesic

tls ./certs/_wildcard.foo.bar.pem ./certs/_wildcard.foo.bar-key.pem

I don’t think you need to generate your certs outside of Caddy. You can use Caddy’s tls internal to have it use a local CA, then you can grab the root CA cert from ./caddy/data/caddy/pki/authorities/local/root.crt and install it in your browser/system’s trust store.

@geoidesic

The docker-compose up runs without error… but the virtual hosts yield:
ERR_CONNECTION_REFUSED

How are you making the request? Show us with curl -v what you’re trying and what you get.

@geoidesic

The article shows an /etc/hosts entry – is that relevant to a docker-based environment?

If the domain you’re using doesn’t exist in public DNS, then you need to make your system resolve that domain to some IP address. So yes, possibly. But you could just use something like backend.localhost and frontend.localhost instead, since *.localhost should always resolve to ::1 or 127.0.0.1 on most machines (maybe Macs don’t, idk if they do that or not).