New to Caddy, got some questions

[francislavoie]

@Konstantinos_V

A. How do i force Caddy to only use port 443 as an entry point and completely ignore requests on port 80? I already map only port 443:443 in my docker compose file but i wonder if i also have to explicitly declare https in front of my domain in my Caddyfile?

If you’re using Docker, not publishing the port is enough.

But keep in mind that you’re also causing the ACME HTTP challenge to not work, which makes your setup slightly more brittle because you’re entirely relying on the ACME TLS-ALPN challenge; if Let’s Encrypt finds a bug with that challenge (which has happened in the past), they may disable that challenge temporarily while they fix it.

Why exactly do you want to turn off HTTP? Caddy sets up HTTP->HTTPS redirects anyway, there’s no harm in leaving it up, in fact it’s a benefit to users because they will get properly redirected if typing the domain in their browser without https://.

@Konstantinos_V

Like this:

https://remote.redacted.pro {

No, specifying https:// makes no difference because HTTPS is the default in Caddy. See Caddyfile Concepts — Caddy Documentation which describes the rules for site addresses.

You can configure the auto_https disable_redirects global option to have skip enabling the redirects (which cause an :80 server to get implicitly created for you).

@Konstantinos_V

B. How to force Caddy to use only the TLS-ALPN challenge and skip any attempts of using the HTTP challenge since i am not mapping port 80 anyways.

Using the tls directive you can turn off a challenge:

tls {
	issuer acme {
		disable_http_challenge
	}
}

But like I said, why do you want to do this?

@Konstantinos_V

C. I am getting a “failed to sufficiently increase receive buffer size” in my Caddy logs.
I suspect that i need

   cap_add:
     - NET_ADMIN

in my docker compose file, but i just want to make sure this is the reason for the warning in the logs.

That might fix it, I forget. But you can probably just follow the instructions on the linked page in that warning, I think the settings on your host machine will affect your Docker containers too.