Subdomain of subdomain with local DNS

[vipero]

1. Caddy version (caddy version):

2.4.6

2. How I run Caddy:

a. System environment:

Docker (own derived image with cloudflare DNS ACME module as shown on the Dockerhub page)

b. Command:

docker-compose up -d

c. Service/unit/compose file:

version: "3.8"

services:
    caddy:
        image: registry.gitlab.com/my-name/caddy:latest
        container_name: caddy
        restart: unless-stopped
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - ./Caddyfile:/etc/caddy/Caddyfile
            - ./data:/data
            - ./config:/config
        networks:
            - proxy

d. My complete Caddyfile or JSON config:

(slightly edited as domain name is my personal name, sorry)

Config A

*.mypersonalname.com {
	tls {
        dns cloudflare API_KEY
    }

	@synology host synology.mypersonalname.com
	handle @synology {
		reverse_proxy 10.0.0.10:5001 {
            transport http {
            tls_insecure_skip_verify
            }
        }
	}

	# Fallback for otherwise unhandled domains
	handle {
		abort
	}

    encode zstd gzip
}

*.local.mypersonalname.com {
	tls {
        dns cloudflare API_KEY
    }

	@pihole host pihole.local.mypersonalname.com
	handle @pihole {
		reverse_proxy http://10.0.0.10:81 {
            transport http {
            tls_insecure_skip_verify
            }
        }
	}

	# Fallback for otherwise unhandled domains
	handle {
		abort
	}

    encode zstd gzip
}

Config B

*.mypersonalname.com {
	tls {
        dns cloudflare API_KEY
    }

	@synology host synology.mypersonalname.com
	handle @synology {
		reverse_proxy 10.0.0.10:5001 {
            transport http {
            tls_insecure_skip_verify
            }
        }
	}

    @pihole host pihole.local.mypersonalname.com
	handle @pihole {
		reverse_proxy 10.0.0.10:81 
        }
	}

	# Fallback for otherwise unhandled domains
	handle {
		abort
	}

    encode zstd gzip
}

3. The problem I’m having:

My domain name synology.mypersonalname.com points to my public IP and this all works perfectly from the outside network.
I have an internal pihole system with DNS which redirects this domain to the internal Caddy server IP and this works perfectly as well.

Now I would like to add internal services like the pihole admin dashboard to this configuration without being accessible to the internet. I have set my internal DNS of pihole.local.mypersonalname.com to my Caddy server IP. The internal DNS works, I have verified this with ping and curl.

The configurations above gets me a certificate without a problem but I can not access the service.
I just get a blank page. I have tried both configurations without succes.

I can get all of my services to run on abcd.mypersonalname.com but abcd.local.mypersonalname.com is a problem.

4. Error messages and/or full log output:

Config A:
No response in browser but does show a valid certificate, internal docker log shows a 502 error.

Config B:
browser:

SSL_ERROR_INTERNAL_ERROR_ALERT

Curl:

*   Trying 10.0.0.11...
* TCP_NODELAY set
* Connected to pihole.local.mypersonalname.com (10.0.0.11) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS alert, internal error (592):
* error:14004438:SSL routines:CONNECT_CR_SRVR_HELLO:tlsv1 alert internal error
* Closing connection 0
curl: (35) error:14004438:SSL routines:CONNECT_CR_SRVR_HELLO:tlsv1 alert internal error

5. What I already tried:

A mix of above configurations A and B and various TLS options.

6. Links to relevant resources:

[francislavoie]

Turn on the debug global option in your Caddyfile.

What do you see in Caddy’s logs?

You’re clearly having a TLS handshake issue, which might be because you don’t have a good certificate for that domain for Caddy to use.

@vipero

	@pihole host pihole.local.mypersonalname.com
	handle @pihole {
		reverse_proxy http://10.0.0.10:81 {
            transport http {
            tls_insecure_skip_verify
            }
        }
	}

I think you might have a mistake here, you used http:// but configured tls_insecure_skip_verify. Those are kinda in conflict with eachother. Is it HTTP or is it HTTPS?

[vipero]

Ah yes I’m not sure how I missed that, it was indeed an HTTP endpoint. Config A works fine now, thanks!