Regex redirect for www to non-www without knowing the domain

[NicoS (Nico)]

1. Caddy version:

v2.6.2 h1:wKoFIxpmOJLGl3QXoo6PNbYvGW4xLEgo32GPBEjWL8o=

2. How I installed, and run Caddy:

a. System environment:

Ubuntu Package on Ubuntu 22.04.1 LTS ARM version

b. Command:

We have added the following packages:

caddy add-package github.com/gamalan/caddy-tlsredis
caddy add-package github.com/caddy-dns/route53

Service edit to inject Environment variables

[Service]
Environment="CADDY_CLUSTERING_REDIS_HOST=${REDIS_HOST}"
Environment="CADDY_CLUSTERING_REDIS_PORT=${REDIS_PORT}"
Environment="CADDY_CLUSTERING_REDIS_DB=${REDIS_DB}"

d. My complete Caddy config:

{	
	admin off
	storage redis
	on_demand_tls {		
		interval "5m"
		burst 100
	}
}

(proxyNode) {
	reverse_proxy 10.0.3.125:3133 {
		header_up +Host "{http.request.host}"
		header_up +X-Real-IP "{http.request.remote}"
		header_up +X-Forwarded-For "{http.request.remote.host}"
		header_up +X-NginX-Proxy "true" # <- Yeah, it sucks but is a backend requirement
	}
	
	header -X-powered-by
}

*.wildcard.staging.bonda.co {
	tls {
		issuer acme {
			dns route53
		}	
	}
	
	handle {
		import proxyNode
	}
}

:443 {
	tls {
		on_demand
	}

	handle {
		import proxyNode
	}
}

3. The problem I’m having:

No problem itself, but I’m having a hard time to find an effective way to remove all the www subdomains from hosts.

We don’t know the hosts, because each client may use:

• One of our subdomains
• Their own domain
• Their own subdomain (like: provider.ourCustomerSite.com.co)

Now, we need to remove the www. preffixes, this is the most common solution that I found in the forum:

@www header_regexp Host ^www\.
redir @www https://{labels.1}{labels.0}{uri}

And thats nice, but it just take care of short TLDs, something like www.site.co.uk will not be handled correctly (Will redirect to co.uk).

Maybe, use something like the http.request.host proxy placeholder may be useful, but i guess that this placeholder may be used just in the reverse_proxy block.

Is there any other way to manipulate the host?

Thanks so much for your hard work team! You rock it

6. Links to relevant resources:

• Dynamic request(Host) conditions for redirect www - #3 by dinesh.developer

[francislavoie]

@NicoS

admin off

Why are you turning off admin? If you do so, you won’t be able to reload Caddy’s config gracefully, meaning you will incur downtime on any config change due to having to restart the server.

@NicoS

		header_up +Host "{http.request.host}"
		header_up +X-Real-IP "{http.request.remote}"
		header_up +X-Forwarded-For "{http.request.remote.host}"

You don’t need these. Caddy sets the Host and XFF headers automatically.

reverse_proxy (Caddyfile directive) - Caddy Documentation

@NicoS

	on_demand_tls {		
		interval "5m"
		burst 100
	}

This is not safe. You’re vulnerable to DDOS by an attacker continually forcing your server to issue certificates for random domains until you run out of storage (or in your case, memory in Redis).

You must use an ask endpoint to validate domains to allow. Your backend should have an endpoint that does a lookup in your database for registered domains for known customers.

@NicoS

Now, we need to remove the www. preffixes, this is the most common solution that I found in the forum:

@www header_regexp Host ^www\.
redir @www https://{labels.1}{labels.0}{uri}

You can use regexp capture groups to keep the remainder of the host:

@www header_regexp host Host ^www\.(.*)
redir @www https://{re.host.1}{uri}

[NicoS (Nico)]

Hi Francis!

Thanks so much for review the entire config file! That’s really appreciated.

@francislavoie

Why are you turning off admin? If you do so, you won’t be able to reload Caddy’s config gracefully, meaning you will incur downtime on any config change due to having to restart the server.

True, sorry, that shouldn’t be there. We are in a staging phase, making some tests before migrate from nginx. That was a test, but finaly we have removed that, thanks for the advice!

@francislavoie

You don’t need these. Caddy sets the Host and XFF headers automatically.

Originally, I’ve started making the JSO, without the Caddyfile, but for a unknown reason, those headers was not added to the request.
Pretty sure that I was setting some property wrong, I’ll remove those now

@francislavoie

You must use an ask endpoint to validate domains to allow. Your backend should have an endpoint that does a lookup in your database for registered domains for known customers.

Thanks a lot again! This endpoint is on developing phase right now

@francislavoie

You can use regexp capture groups to keep the remainder of the host:

That’s perfect! So obvious

Really, thanks so much for your help to the community Francis!

You are awesome!

Regards,