1. The problem I’m having:
I am trying to replace the Server
response header with a custom value. The problem is that with the following configuration the Server
header is being sent twice, once with the value I set in the Caddy
configuration and once with the value set by the upstream service
.
What am I doing wrong, should I use >
to defer writing the header?
Thanks in advance
2. Error messages and/or full log output:
3. Caddy version:
v2.8.4 h1:q3pe0wpBj1OcHFZ3n/1nl4V4bxBrYoSoab7rL9BMYNk=
4. How I installed and ran Caddy:
Using Docker
and Docker Compose
.
a. Service/unit/compose file:
services:
caddy:
build:
context: .
dockerfile: Dockerfile
image: example/caddy
container_name: caddy
hostname: caddy
restart: unless-stopped
environment:
- TLS__EMAIL=${TLS__EMAIL}
- TLS__CLOUDFLARE_API_TOKEN=${TLS__CLOUDFLARE_API_TOKEN}
- DOMAINS__001=${DOMAINS__001}
- TZ=${GLOBAL__TIMEZONE}
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile
- ./site:/srv
- ${GLOBAL__VOLUME_DIR}/data:/data
- ${GLOBAL__VOLUME_DIR}/config:/config
- ${GLOBAL__VOLUME_DIR}/logs:/logs
networks:
- default
- reverse-proxy
ports:
- 80:80
- 443:443
- 443:443/udp
networks:
default:
name: caddy
reverse-proxy:
name: reverse-proxy
external: true
b. My complete Caddy config:
# Global Configuration
## Global options block. Entirely optional, HTTPS is ON by default.
{
### TLS configuration
email {$TLS__EMAIL}
### Enable debug mode
debug
}
# Snippets
## Snippets are reusable configuration blocks that can be included in multiple sites.
(security) {
header {
### Replace Server header
Server "Example Server"
### Disable FLoC tracking
Permissions-Policy "interest-cohort=()"
### Enable HSTS
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
### Upgrade insecure requests to HTTPS
Content-Security-Policy "upgrade-insecure-requests"
### Disable clients from sniffing the media type
X-Content-Type-Options "nosniff"
X-XSS-Protection "1; mode=block"
Referrer-Policy "strict-origin-when-cross-origin"
### Clickjacking protection
?X-Frame-Options "SAMEORIGIN"
}
}
(compression) {
### Enable compression
encode zstd gzip
}
(log) {
log {args[0]} {
hostnames {args[0]}
level INFO
output file /logs/{args[0]}.log {
roll_size 3MiB
roll_keep 5
roll_keep_for 48h
}
format json
}
}
(service) {
import log {args[0]}
@{args[1]} host {args[0]}
handle @{args[1]} {
import security
import compression
reverse_proxy {args[1]}:{args[2]}
}
}
# Sites
## Configuration for defining sites.
*.{$DOMAINS__001}, {$DOMAINS__001} {
tls {$TLS__EMAIL} {
dns cloudflare {$TLS__CLOUDFLARE_API_TOKEN}
resolvers 1.1.1.1 8.8.8.8 8.8.4.4
}
import service wordpress.{$DOMAINS__001} wordpress 80
handle {
abort
}
}