HTTPS in Backend, Caddy as Proxy ends in Errror 502

[francislavoie]

@ei8ht

Isn’t it stated, that several caddy servers act as one, as long as they use the same storage

Yes that’s true

@ei8ht

That’s also the reason why I need the DNS Challenge.

I don’t see where you configured the DNS challenge in your config, and you haven’t installed a plugin that would allow you to use the DNS challenge.

How to use DNS provider modules in Caddy 2

Caddy 2 uses a new and improved DNS provider interface for solving the ACME DNS challenge. All you have to do is plug the service provider(s) you need into your build, then add the DNS challenge to your configuration! Getting a DNS provider plugin How you choose to get a custom Caddy build is up to you; we’ll describe two common methods here. Method 1: Go to the Caddy download page. Find your DNS provider in the list of modules (dns.providers.*) and select it. Download your custom Caddy …

@ei8ht

However, LEGO can’t handle custom timeouts and CloudNS is to slow actual.

I’m not sure what you mean by this.

@ei8ht

If this isn’t possible, is caddy capable to act as a L4 Loadbalancer with http3 support?

Yeah, the caddy-l4 plugin can do this:

GitHub - mholt/caddy-l4: Layer 4 (TCP/UDP) app for Caddy

@ei8ht

why http2/3 in the front when the rest runs with the old and slow http 1.1?

HTTP 1.1 isn’t actually slow in server to server scenarios like proxying. Connections are kept open and reused, so the overhead is not very high.

@ei8ht

There are customer sites with logins and I don’t want the customers (or the customers customer) credentials in cleartext on my machine. Not even in the backend.

Are you running untrusted code on that machine? Cause if so, it’s already game-over.

Once the first Caddy instance handles the request, the connection is all within the docker network, so the only way something could intercept it is if it’s running as root on the host machine (or as a user with access to the docker network), pretty sure.