SSH over HTTPS - multiplex-tls-traffic

gyferlim · July 18, 2025, 2:13pm

1. The problem I’m having:

I can’t get SSH over Layer4 at port 443 to work.

2. Error messages and/or full log output:

3. Caddy version:

v2.10.0 h1:fonubSaQKF1YANl8TXqGcn4IbIRUDdfAkpcsfI/vX5U=

4. How I installed and ran Caddy:

a. System environment:

Inside FreeBSD ( TrueNAS Core) Jails

b. Command:

caddy start

c. Service/unit/compose file:

N/A

d. My complete Caddy config:

{
    email myaddress@email.com
    default_sni mysite.biz

    acme_dns cloudflare abcDEfghIjKlmNOpqrsTUVwxyz

    auto_https prefer_wildcard

    storage_clean_interval 7d
    log default {
        output file /config/caddy.log {
            roll_size 1mb
            roll_keep 3
            roll_keep_for 72h
        }
    }

    dynamic_dns {
        provider cloudflare abcDEfghIjKlmNOpqrsTUVwxyz
        domains {
            mysite.biz @  dns *.dns ssh 
        }
        check_interval 5m
        ttl 12h
    }

    layer4 {
        :853 {
            @tlsdns tls sni dns.mysite.biz
            route @tlsdns {
                proxy 192.168.0.53:853 192.168.0.54:853
            }

            @quictraffic quic
            route @quictraffic {
                proxy 192.168.0.53:853 192.168.0.54:853
            }

        }

        :443 {
            @l4ssh http host ssh.mysite.biz
            route @l4ssh {
                subroute {
                    @isssh ssh
                    route @isssh {
                        proxy {
                            upstream 192.168.0.22:22
                        }
                    }
                }
            }

            route {
                subroute {
                    @allhttp http
                    route @allhttp {
                        proxy localhost:80
                    }


                    @allhttps tls
                    route @allhttps {
                        proxy localhost:2019
                    }
                }
            }
        }
    }
}

mysite.biz {
    root * /usr/local/www/temp
    encode zstd gzip

    redir /jellyfin /jellyfin/
    handle_path /jellyfin/* {
       reverse_proxy 192.168.0.35:8096
    }

    redir /localai /localai/
    handle_path /localai/* {
       reverse_proxy http://192.168.0.15:3000
    }

    redir /dns2 /dns2/
    handle_path /dns2/* {
        reverse_proxy adguard.local {
            transport http {
                tls
                tls_insecure_skip_verify
            }
        }
    }

    redir /dns-query/ /dns-query
    handle_path /dns-query {
        reverse_proxy 192.168.0.53 192.168.0.54 {
            lb_policy header X-Upstream {
                fallback first
            }
            transport http {
                tls
                tls_insecure_skip_verify
            }
        }
    }

    handle_path /* {
        reverse_proxy 192.168.0.55 {
            header_up Host linkstack.1.mysite.biz
        }
    }
    respond * 404
}

linkstack.1.mysite.biz  {
    reverse_proxy 192.168.0.55 {
        header_up Host {upstream_hostport}
    }
}

*.dns.mysite.biz  {

    root * /usr/local/www/temp
    encode gzip zstd

    handle_path /dns-query {
        reverse_proxy 192.168.0.53{uri} 192.168.0.54{uri} {
            lb_policy header X-Upstream {
                fallback first
            }
            transport http {
                tls
                tls_insecure_skip_verify
            }
        }
    }
    handle_path /* {
        respond * 200
    }
    respond * 404
}

5. Links to relevant resources:

github.com/mholt/caddy-l4

Example of using http listener_wrappers with l4

opened 06:45AM - 21 Mar 23 UTC

coolaj86

I'm running this right now and it works... with two caveats: - [ ] TLS ALPN can… _only_ be set to "http/1.1" due to https://github.com/caddyserver/caddy/pull/4929 as mentioned in #78 - [x] ~~I don't know how to get this to work with the `http` challenge~~ - [x] ~~Not sure how to get this working with `http` => `https` redirects~~ \ ~~(or I think I could, but I'm afraid it would mess up `http` challenges)~~ - [ ] Needs PROXY protocol for SSH remote ip (and mmproxy) Specifically, this exposes the caddy admin interface behind HTTP Basic Auth and terminates and forwards SSH-over-TLS to port 22. Should be used with `--resume`: ```sh caddy run --resume ``` ```sh curl "http://localhost:2019/load" \ -H "Content-Type: application/json" \ --data-binary @./config.json ``` Changes should be backed up ```sh curl "http://localhost:2019/config/" | jq > "config.$(date -u '+%F_%H.%M.%S').json" ``` `config.json`: ```json { "logging": { "logs": { "default": { "level": "DEBUG" } } }, "apps": { "http": { "servers": { "srv443": { "listen": [":443"], "automatic_https": { "disable": true }, "routes": [ { "match": [ { "host": ["my-caddy.duckdns.org"] } ], "handle": [ { "handler": "subroute", "routes": [ { "handle": [ { "handler": "authentication", "providers": { "http_basic": { "accounts": [ { "password": "{env.CADDY_BCRYPT}", "username": "{env.CADDY_USER}" } ], "hash": { "algorithm": "bcrypt" }, "hash_cache": {} } } }, { "handler": "reverse_proxy", "headers": { "request": { "set": { "Host": ["localhost:2019"] } } }, "upstreams": [ { "dial": "localhost:2019" } ] } ] } ] } ], "terminal": true } ], "listener_wrappers": [ { "wrapper": "layer4", "routes": [ { "match": [ { "tls": {} } ], "handle": [ { "handler": "subroute", "routes": [ { "match": [ { "tls": { "sni": ["my-caddy.duckdns.org"] } } ], "handle": [ { "handler": "tls", "connection_policies": [ { "alpn": ["http/1.1"] } ] }, { "handler": "subroute", "routes": [ { "match": [{ "ssh": {} }], "handle": [ { "handler": "proxy", "upstreams": [ { "dial": ["localhost:22"] } ] } ] }, { "match": [ { "http": [ { "host": ["my-caddy.duckdns.org"] } ] } ] } ] } ] } ] } ] } ] } ] }, "srv80": { "listen": [":80"], "routes": [ { "handle": [ { "handler": "static_response", "headers": { "Location": [ "https://{http.request.host}{http.request.uri}" ] }, "status_code": 302 } ], "terminal": true } ] } } }, "tls": { "certificates": { "automate": ["localhost", "192.168.0.10", "my-caddy.duckdns.org"] }, "automation": { "policies": [ { "subjects": ["localhost", "192.168.0.10"], "issuers": [ { "module": "internal" } ] }, { "subjects": ["my-caddy.duckdns.org"], "issuers": [ { "challenges": { "dns": { "provider": { "api_token": "{env.DUCKDNS_API_TOKEN}", "name": "duckdns" } } }, "module": "acme" }, { "challenges": { "dns": { "provider": { "api_token": "{env.DUCKDNS_API_TOKEN}", "name": "duckdns" } } }, "module": "zerossl" } ] } ] } } } } ```

https://www.reddit.com/r/selfhosted/comments/tqavcj/introducing_caddyssh/