Multiple apps and dockers on multiple machines - Caddy the solution?

General
1

Hi :waving_hand:

I currently have a Home Assistant instance using their Let’s Encrypt add-on, which I believe is a custom Certbot instance. This has worked well so far, and the add-on places the generated certs in a folder that HA and all it’s add-ons can see, and can be accessed via FTP/Samba etc.

It’s been suggested that I look at Caddy, because I am facing an issue where I have various other machines, some with many docker containers, and I would like to be able to use these certs for those applications eg. media server.

Thus far, it’s been a painful process of copying those certs manually to other machines in order to use them. I looked a while back at having shares for each docker or app and running some sort of scripting to copy to each location but this seems messy and probably not the best approach security-wise.

The end goal here is to be able to access each docker, app etc on multiple machines with the SSL certs with something automating distribution, or (and I guess this is why Caddy was suggested) running everything through Caddy.

It should be worth noting that I do not have any external connections to my network, I just want to use the SSL certs on each app because 1. constant browser nagging annoys me, 2. I have the certs, I want to make more use of them. 3. Why not?

The other thing worth mentioning is that I use Tailscale to access my network, which I am pretty sure means everything is encrypted anyway, but because browsers are unaware of this, I am still left with annoying nags and the “NOT SECURE” warning by the address bar.

What would be the best approach here? That’s even if it’s applicable to my situation. Am I able to run Caddy in a docker and route all applications through it making use of the certs?

Thanks :slight_smile:

2

You can use Caddy with your DNS provider plugin to get certificates via the DNS-01 challenge, which doesn’t require any inbound access to your network.

  1. You can set up a central Caddy instance as a reverse proxy - this becomes your main point of access. You’d connect to Caddy over HTTPS, and it would handle communication with your containers over HTTP.

  2. Or, you can install Caddy on each machine that runs containers. Each instance would act as a reverse proxy for the containers on that machine. If you want, you can also designate one of these instances as the primary reverse proxy for all the others.

You’ve got a few options here, and the best setup depends on what you’re aiming for. If you’re looking for a simple starting point, option 1 is a good way to go.

1 Like
3

Option 1 sounds like exactly what I am after. I’ll get stuck in and come back to the forum if I hit any issues. Thanks for taking the time to read and reply :slight_smile:

1 Like