Permissions of Caddyfile

Whitestrake · August 2, 2019, 12:25am

Hi @jotteerr, welcome to the Caddy community!

If it’s working on the command line with the right permissions, but systemd has decided that it doesn’t like it… Well. I’ve personally done as much as I can to avoid using systemd.

I figure it probably has something to do with this section:

github.com

caddyserver/caddy/blob/0ba427a6f44edb5169e022e3cbc23f7b6de35a81/dist/init/linux-systemd/caddy.service#L31-L41

    
      
          ; Use private /tmp and /var/tmp, which are discarded after caddy stops.
          PrivateTmp=true
          ; Use a minimal /dev (May bring additional security if switched to 'true', but it may not work on Raspberry Pi's or other devices, so it has been disabled in this dist.)
          PrivateDevices=false
          ; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
          ProtectHome=true
          ; Make /usr, /boot, /etc and possibly some more folders read-only.
          ProtectSystem=full
          ; … except /etc/ssl/caddy, because we want Letsencrypt-certificates there.
          ;   This merely retains r/w access rights, it does not add any new. Must still be writable on the host!
          ReadWritePaths=/etc/ssl/caddy

Seems to be focused on restricting access. Could try commenting ProtectSystem, maybe.

Outside of that, and assuming we don’t have any systemd gurus pop in on this thread, you might have better luck on a systemd-specific forum somewhere.