1. The problem I’m having:
Setting up a new server, pointed a subdomain to the public IP and verified using traefik/whoami that port 80 is indeed accessible externally by the URL.
When running caddy, it fails solving the http-01 challenge, saying it has timed out and this may be a firewall error, but seeing as whoami was easily accessible, I tend to think that might not be the case.
curl seems to hang and timeout as well when trying to access via the domain address or the public IP; only when trying to access via the LAN IP does caddy log the attempt.
2. Error messages and/or full log output:
{
"level": "error",
"ts": 1764277431.7495704,
"msg": "challenge failed",
"identifier": "meshi.yeda-water.com",
"challenge_type": "http-01",
"problem": {
"type": "urn:ietf:params:acme:error:connection",
"title": "",
"detail": "62.90.48.190: Fetching http://meshi.yeda-water.com/.well-known/acme-challenge/Ba7EhYw5F47FTzGBi2qD7scCbqa-_toT7rrNRVzmGIU: Timeout during connect (likely firewall problem)",
"instance": "",
"subproblems": null
},
"stacktrace": "github.com/mholt/acmez/v3.(*Client).pollAuthorization\n\tgithub.com/mholt/acmez/v3@v3.1.2/client.go:557\ngithub.com/mholt/acmez/v3.(*Client).solveChallenges\n\tgithub.com/mholt/acmez/v3@v3.1.2/client.go:378\ngithub.com/mholt/acmez/v3.(*Client).ObtainCertificate\n\tgithub.com/mholt/acmez/v3@v3.1.2/client.go:136\ngithub.com/caddyserver/certmagic.(*ACMEIssuer).doIssue\n\tgithub.com/caddyserver/certmagic@v0.24.0/acmeissuer.go:489\ngithub.com/caddyserver/certmagic.(*ACMEIssuer).Issue\n\tgithub.com/caddyserver/certmagic@v0.24.0/acmeissuer.go:382\ngithub.com/caddyserver/caddy/v2/modules/caddytls.(*ACMEIssuer).Issue\n\tgithub.com/caddyserver/caddy/v2@v2.10.2/modules/caddytls/acmeissuer.go:288\ngithub.com/caddyserver/certmagic.(*Config).obtainCert.func2\n\tgithub.com/caddyserver/certmagic@v0.24.0/config.go:626\ngithub.com/caddyserver/certmagic.doWithRetry\n\tgithub.com/caddyserver/certmagic@v0.24.0/async.go:104\ngithub.com/caddyserver/certmagic.(*Config).obtainCert\n\tgithub.com/caddyserver/certmagic@v0.24.0/config.go:700\ngithub.com/caddyserver/certmagic.(*Config).ObtainCertAsync\n\tgithub.com/caddyserver/certmagic@v0.24.0/config.go:505\ngithub.com/caddyserver/certmagic.(*Config).manageOne.func1\n\tgithub.com/caddyserver/certmagic@v0.24.0/config.go:415\ngithub.com/caddyserver/certmagic.(*jobManager).worker\n\tgithub.com/caddyserver/certmagic@v0.24.0/async.go:73"
}
3. Caddy version:
v2.10.2 h1:g/gTYjGMD0dec+UgMw8SnfmJ3I9+M2TdvoRL/Ovu6U8=
4. How I installed and ran Caddy:
I’m using the Caddy Docker container
a. System environment:
Ubuntu Server 24 running Caddy within Docker
b. Command:
docker compose up -d caddy
c. Service/unit/compose file:
services:
caddy:
image: caddy
container_name: caddy
hostname: caddy
restart: unless-stopped
ports:
- 80:80
- 443:443
- 443:443/udp
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile:ro
- ./site:/srv:ro
- ./log:/var/log
- data:/data/caddy
- config:/config/caddy
env_file:
- .env
volumes:
data:
name: caddy-data
config:
name: caddy-config
.env:
EMAIL=dev@deanayalon.com
d. My complete Caddy config:
{
email {$EMAIL}
}
(tls-insecure) {
reverse_proxy {args[0]}:443 {
transport http {
tls
tls_insecure_skip_verify
}
}
}
(log) {
log {
output file /var/log/{args[0]}.log
format json
}
}
meshi.yeda-water.com:443 {
import log filemaker
import tls-insecure fms
}
I know the template abstractions are useless with only one service, this used to have more 
Can be summed up to this:
{
email {$EMAIL}
}
meshi.yeda-water.com:443 {
log {
output file /var/log/filemaker.log
format json
}
reverse_proxy fms:443 {
transport http {
tls
tls_insecure_skip_verify
}
}
}
I should note, this server is going to replace an older one, I already have one running perfectly, set up with almost the exact same configurations, except the subdomain itself.
Any ideas where the problem might lie?
