How to make local network browsers accept my test site?

Help
1

Background
I am a web app developer with limited systems knowledge.

1. The problem I’m having:

I’ve managed to get caddy up and running as per advice from @francislavoie :slight_smile: (Error: reading default Caddyfile: open Caddyfile: permission denied).

I would like to make my local system as close to the real world as possible for testing. This means that (temporarily) I would like to persuade browsers on all devices on my local network that they are pointing at my real website, and to accept the https certificate as entirely valid.

In other words, I point my phone browser — which is connected to my local wifi — to example.com and it happily connects to the locally hosted example.com over https and accepts the TLS certificate without any error.

Can I do this just with caddy? If so how?
If not, what to do on a Lubuntu (Ubuntu) 24.04 system…?

Many Thanks.

2. Error messages and/or full log output:

3. Caddy version:

$ caddy version 
2.6.2

4. How I installed and ran Caddy:

a. System environment:

$ uname -a
Linux L24 6.14.0-33-generic #33~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Sep 19 17:02:30 UTC 2 x86_64 x86_64 x86_64 GNU/Linux  

$ systemd --version
systemd 255 (255.4-1ubuntu8.11)
+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified

b. Command:

$ sudo systemctl reload caddy

c. Service/unit/compose file:

$ cat /lib/systemd/system/caddy.service 
# caddy.service
#
# For using Caddy with a config file.
#
# Make sure the ExecStart and ExecReload commands are correct
# for your installation.
#
# See https://caddyserver.com/docs/install for instructions.
#
# WARNING: This service does not use the --resume flag, so if you
# use the API to make changes, they will be overwritten by the
# Caddyfile next time the service is restarted. If you intend to
# use Caddy's API to configure it, add the --resume flag to the
# `caddy run` command or use the caddy-api.service file instead.

[Unit]
Description=Caddy
Documentation=https://caddyserver.com/docs/
After=network.target network-online.target
Requires=network-online.target

[Service]
Type=notify
User=caddy
Group=caddy
ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile
ExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile --force
TimeoutStopSec=5s
LimitNOFILE=1048576
LimitNPROC=512
PrivateTmp=true
ProtectSystem=full
AmbientCapabilities=CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target

d. My complete Caddy config:

$ cat /etc/caddy/Caddyfile
# The Caddyfile is an easy way to configure your Caddy web server.
#
# Unless the file starts with a global options block, the first
# uncommented line is always the address of your site.
#
# To use your own domain name (with automatic HTTPS), first make
# sure your domain's A/AAAA DNS records are properly pointed to
# this machine's public IP, then replace ":80" below with your
# domain name.

localhost {
        # Set this path to your site's directory.
        #root * /usr/share/caddy
        root * /home/alan/DEV

        # Enable the static file server.
        file_server

        # Another common task is to set up a reverse proxy:
        # reverse_proxy localhost:8080

        # Or serve a PHP site through php-fpm:
        # php_fastcgi localhost:9000
}

# Refer to the Caddy docs for more information:
# https://caddyserver.com/docs/caddyfile

5. Links to relevant resources:

2

Add your local machine with its local IP Address to the hosts file (on Unix it is located /etc/hosts) (on Window 10 it is located C:\Windows\System32\drivers\etc\hosts).

1 Like
3

Actually then setup a local name server that mostly caches from the outside world
but also local add your server and its IP address, then have all the clients local use that name server. When you are done remove the temporarily added server and its IP address, or just take down the local name server and remove it from all the local clients so they don’t try to use it.

4

You’re on a very old version. Follow our official installation steps.

You shouldn’t store your files to serve in /home, put them in /srv or /var/www/html. The caddy user that Caddy runs as doesn’t have access to /home.

Typically the way to do this is to run a DNS server in your LAN (software like pihole or adguard are also DNS servers and can serve dual purpose if you want DNS-based ad blocking, or CoreDNS for a pure DNS server). That would make devices on your wifi (phone etc) resolve your domain to your LAN IP while inside your network.

For HTTPS if you’re not using a publicly trusted cert (e.g. tls internal in Caddy) then you have to install Caddy’s root CA cert on each device you plan to use to connect to the server. This is basically a one-time thing cause the root cert lasts like 10 years.

If your server isn’t publicly accessible you could use the DNS challenge to get a publicly trusted cert, then you don’t need to worry about installing certs on devices. But you need to use a custom build of Caddy with the DNS plugin for your DNS provider added in.

2 Likes
5

Thank you again, Francis, very much. I’ve upgraded to 2.10.2, I’ve moved my site to /var/www/html. I’m working on the next bit…