Thank you again Whitestrake.
I summarize:
If I have on my caddy.conf file the following block:
http://service.mydomain.com:8963 {
import gzipconf
import addheader
proxy / http://192.168.2.87:8989 {
keepalive 32
transparent
websocket
}
}
I can access the service via browser (both from inside and outside my LAN, in the last case having portforwarded port 80 to 8963) and on curl I get the following:
# curl -iL http://192.168.1.3:8963 -H "Host:service.mydomain.com"
HTTP/1.1 401 Unauthorized
Content-Length: 149
Content-Type: text/html; charset=utf-8
Date: Mon, 09 Jul 2018 08:06:15 GMT
Referrer-Policy: strict-origin-when-cross-origin
Set-Cookie: TWISTED_SESSION=e7fa4a49137b7647168e0a2c0541f0cc; Path=/
Strict-Transport-Security: max-age=31536000;
Www-Authenticate: Basic realm="Service"
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
<html>
<head><title>401 - Unauthorized</title></head>
<body>
<h1>Unauthorized</h1>
<p>401 Authentication required</p>
</body>
</html>
However if I change the caddy.conf file with the following (and I portforward port 8443 to 8963), I get:
https://service.mydomain.com:8963 {
import gzipconf
import addheader
proxy / https://192.168.2.87:9898 {
keepalive 32
transparent
websocket
}
}
in this case, with the browser I can access the service from within the LAN, but I can’t from outside the LAN (i.e. using https://service.mydomain.com:8443).
However I just noticed that as soon as I make the above change in the config, all other reverse proxies which are HTTP (like transmission, etc…) fails to work.
curl: (7) Failed to connect to 192.168.1.3 port 8963: Connection refused
Indeed caddy does not start!
ps aux |grep caddy
7267 admin 956 S grep caddy
It seems that I miss a config in caddy somewhere.
Here is the beginning of the caddy.conf file, in case it is useful:
(gzipconf) {
gzip {
ext *
level 7
min_length 1
}
}
(addheader) {
header / {
Strict-Transport-Security "max-age=31536000;"
X-XSS-Protection "1; mode=block"
X-Content-Type-Options "nosniff"
X-Frame-Options "DENY"
Referrer-Policy "strict-origin-when-cross-origin"
-Server
}
}
Probably I am missing something really stupid here!
Thanks!
