1. Caddy version (caddy version):
v2.1.1 h1:X9k1+ehZPYYrSqBvf/ocUgdLSRIuiNiMo7CvyGUQKeA=
2. How I run Caddy:
systemd
and to reload Caddyfile changes:
caddy reload ./Caddyfile
a. System environment:
Ubuntu 18.04
b. Command:
n/a
c. Service/unit/compose file:
n/a
d. My complete Caddyfile or JSON config:
{
# This is pointing to Let's Encrypt Staging environment (for dev)
# https://letsencrypt.org/docs/staging-environment/
# This will allow you to get things right before issuing trusted
# certificates and reduce the chance of your running up against rate limits.
# acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
# causes all certificates to be issued internally by default,
# rather than through a (public) ACME CA such as Let's Encrypt.
# This is useful in development environments.
# local_certs
# configure automatic HTTPS. It can either disable it entirely (off)
# or disable only HTTP-to-HTTPS redirects (disable_redirects).
# auto_https off
}
# Refer to the Caddy docs for more information:
# https://caddyserver.com/docs/caddyfile
(header_options) {
header_up X-Real-IP {remote_host}
header_up X-Forwarded-Proto {scheme}
header_up Access-Control-Allow-Origin *
header_up Access-Control-Allow-Credentials true
header_up Access-Control-Allow-Headers Cache-Control,Content-Type
}
:80, :443 {
# serve photography folder
root /files/* /opt/ivt/photography
# Set this path to your site's directory.
root * /opt/ivt/apps/6.0.0/packages/client/spa
# Enable the static file server.
file_server
route /weather/* {
uri replace /weather /socket.io
reverse_proxy * http://localhost:3010 {
import header_options
}
}
route /ptz/* {
uri replace /ptz /socket.io
reverse_proxy * http://localhost:3006 {
import header_options
}
}
route /liveview/* {
uri replace /liveview /socket.io
reverse_proxy * http://localhost:3004 {
import header_options
}
}
route /archive/* {
uri replace /archive /socket.io
reverse_proxy * http://localhost:3003 {
import header_options
}
}
route /alarms/* {
uri replace /alarms /socket.io
reverse_proxy * http://localhost:3002 {
import header_options
}
}
route /console_socket/* {
uri replace /console_socket /console/socket.io
reverse_proxy * http://localhost:3001 {
import header_options
}
}
route /web_app_socket/* {
uri replace /web_app_socket /web/socket.io
reverse_proxy * http://localhost:3001 {
import header_options
}
}
route /dcam-dev/ivt-hvr-web-app/* {
uri replace /dcam-dev/ivt-hvr-web-app/ /
reverse_proxy * http://10.10.2.241:80 {
import header_options
}
}
route /dcam-dev_socket/* {
uri replace /dcam-dev_socket/socket.io /socket.io
reverse_proxy * http://10.10.2.241:80 {
import header_options
}
}
route /dcam-dev_socket_data/* {
uri replace /dcam-dev_socket_data/socket.io /socket.io
reverse_proxy * http://10.10.2.241:8080 {
import header_options
}
}
route /dcam-dev_files/* {
uri replace /dcam-dev_files/ /
reverse_proxy * http://10.10.2.241:8080 {
import header_options
}
}
route /khalid-sam/* {
reverse_proxy * http://10.10.3.146:80 {
import header_options
}
}
route /hikvision/* {
reverse_proxy * http://10.10.1.70:80 {
import header_options
}
}
route /rainwise/* {
reverse_proxy * http://10.10.2.95:80 {
import header_options
}
}
route /api/* {
reverse_proxy * http://localhost:3001 {
import header_options
}
}
}
3. The problem I’m having:
I see these errors/warnings in the journal and wondering if I can get help to clean them up
4. Error messages and/or full log output:
Aug 18 13:30:48 FLEX-5 caddy[2010]: {"level":"info","ts":1597779048.2883162,"logger":"http","msg":"server is listening only on the HTTP port, so no automatic HTTPS will be applied to this server","server_name":"srv0","http_port":80}
Aug 18 13:30:48 FLEX-5 caddy[2010]: {"level":"info","ts":1597779048.2884388,"logger":"http","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv1","https_port":443}
Aug 18 13:30:48 FLEX-5 caddy[2010]: {"level":"info","ts":1597779048.2884488,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv1"}
Aug 18 13:30:48 FLEX-5 caddy[2010]: {"level":"info","ts":1597779048.2888637,"logger":"tls","msg":"setting internal issuer for automation policy that has only internal subjects but no issuer configured","subjects":["localhost"]}
Aug 18 13:30:48 FLEX-5 caddy[2010]: {"level":"warn","ts":1597779048.2889013,"logger":"http","msg":"user server is listening on same interface as automatic HTTP->HTTPS redirects; user-configured routes might override these redirects","server_name":"srv0","interface":"tcp/:80"}
Aug 18 13:30:48 FLEX-5 caddy[2010]: {"level":"info","ts":1597779048.293308,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["localhost"]}
Aug 18 13:30:48 FLEX-5 caddy[2010]: {"level":"warn","ts":1597779048.2935982,"logger":"pki.ca.local","msg":"installing root certificate (you might be prompted for password)","path":"storage:pki/authorities/local/root.crt"}
Aug 18 13:30:48 FLEX-5 caddy[2010]: 2020/08/18 13:30:48 not NSS security databases found
Aug 18 13:30:48 FLEX-5 caddy[2010]: 2020/08/18 13:30:48 define JAVA_HOME environment variable to use the Java trust
Aug 18 13:30:48 FLEX-5 caddy[2010]: 2020/08/18 13:30:48 [INFO][cache:0xc000249860] Started certificate maintenance routine
Aug 18 13:30:48 FLEX-5 caddy[2010]: 2020/08/18 13:30:48 [INFO][localhost] Obtain certificate; acquiring lock...
Aug 18 13:30:48 FLEX-5 caddy[2010]: 2020/08/18 13:30:48 [INFO][localhost] Obtain: Lock acquired; proceeding...
Aug 18 13:30:48 FLEX-5 caddy[2010]: 2020/08/18 13:30:48 [INFO][localhost] Certificate obtained successfully
Aug 18 13:30:48 FLEX-5 caddy[2010]: 2020/08/18 13:30:48 [INFO][localhost] Obtain: Releasing lock
Aug 18 13:30:48 FLEX-5 caddy[2010]: 2020/08/18 13:30:48 [WARNING] Stapling OCSP: no OCSP stapling for [localhost]: no OCSP server specified in certificate
Aug 18 13:30:48 FLEX-5 sudo[22382]: pam_unix(sudo:auth): conversation failed
Aug 18 13:30:48 FLEX-5 sudo[22382]: pam_unix(sudo:auth): auth could not identify password for [caddy]
Aug 18 13:30:48 FLEX-5 caddy[2010]: {"level":"error","ts":1597779048.3020384,"logger":"pki.ca.local","msg":"failed to install root certificate","error":"failed to execute sudo: exit status 1","certificate_file":"storage:pki/authorities/local/root.crt"}
Aug 18 13:30:48 FLEX-5 caddy[2010]: 2020/08/18 13:30:48 [INFO][cache:0xc000913680] Stopped certificate maintenance routine
5. What I already tried:
I thought it may be a folder missing, tried this:
sudo mkdir /etc/ssl/caddy
sudo chown -R root:caddy /etc/ssl/caddy
sudo chmod 0770 /etc/ssl/caddy
