Is it possible to use a wildcard certificate with separate Caddyfiles?

[WoJ]

Note: I am using caddy-docker-proxy to automatically update a Caddy configuration from docker labels (à la Traefik). This does not change, I believe, the question because it essentially boils down to using separate Caddyfiles per service.

The documentation shows how to use wildcard certificated, by enveloping entries in an *.example.com block

Common Caddyfile Patterns - Caddy Documentation

I would like to use wildcards but in separate Caddyfiles.

I imagine that I could add a tls load directive for each entry, but this would require the certificate to be maintained (requested, refreshed) without an associated endpoint. In other words, something should periodically download a wildcard certificate and place it in a specific place (and that’s all).

Is this possible?

EDIT ONE: looks like it is via the JSON endoint. Can that be translated back to Caddyfile “code”?

Using Caddy to keep certificates renewed

You can use Caddy as an automated certificate manager to keep certificates renewed without having to run an HTTPS server [1]. This way, the certificates can be used by other programs that need them. Caddy’s tls app can be configured without the need for an HTTP server. It can keep certificates renewed. Without additional configuration, assets (certificates, keys, and metadata) are stored in a data directory on the local file system at a location dependent upon your OS. The simplest form is to …

EDIT TWO: I already asked that question back in 2021… The answer was “it has to be done via the API”

Is it possible to use caddy to retrieve a LE certificate for something else than a web site?

The Caddyfile is for configuring sites to serve. If you don’t want to serve any sites, I think you’ll have to use JSON.

I will have to find a way to manage this in a docker environment (any ideas welcome)

[francislavoie]

No, the only way currently is with that pattern.

In a future version we’ll introduce a new option which would make it possible:

autohttps: Implement `auto_https prefer_wildcard` option

@WoJ

Note: I am using caddy-docker-proxy to automatically update a Caddy configuration from docker labels (à la Traefik). This does not change, I believe, the question because it essentially boils down to using separate Caddyfiles per service.

CDP doesn’t act like separate files, no. It’s one big Caddyfile. It doesn’t use import to bring in other files or w/e.

I’m pretty sure CDP would allow you to merge labels for a site with the same address. If you define *.example.com as your site address in each container, they should get zipped up. Just put the host matcher & handle labels inside of that, on each container.

[WoJ]

@francislavoie

I’m pretty sure CDP would allow you to merge labels for a site with the same address. If you define *.example.com as your site address in each container, they should get zipped up. Just put the host matcher & handle labels inside of that, on each container.

Oh, this is very interesting, I will try it out and see how the final JSON looks like. Thanks!

[WoJ]

@francislavoie

n a future version we’ll introduce a new option which would make it possible:

Woah, this is super cool! Thanks!