1. The problem I’m having:
Hello! This may be a very niche problem but I am running a Flask application and serving it through Waitress. Caddy is acting as a reverse proxy. This is all within a Docker Container as well that runs Debian 11 and Python 3.6. I hope to run this over https.
There are two problems I am experiencing.
The first is when I try to connect to my server through a web browser using an HTTP connection. After typing the IP address, the page will say “Client sent an HTTP request to an HTTPS server.”
The second is when I try to connect to my server through a web browser using an HTTPS connection.
The page will display this:
I serve the Flask application through Waitress with this code.
from manage import app
from waitress import serve
serve(app, listen='0.0.0.0:5000', threads=4)
2. Error messages and/or full log output:
2024-08-20 13:30:05 Caddy started
2024-08-20 13:30:05 {"level":"info","ts":1724182205.7101378,"msg":"using config from file","file":"/etc/caddy/PW_Caddyfile"}
2024-08-20 13:30:05 {"level":"warn","ts":1724182205.7103899,"logger":"caddyfile","msg":"Unnecessary header_up X-Forwarded-For: the reverse proxy's default behavior is to pass headers to the upstream"}
2024-08-20 13:30:05 {"level":"warn","ts":1724182205.710425,"logger":"caddyfile","msg":"Unnecessary header_up X-Forwarded-Proto: the reverse proxy's default behavior is to pass headers to the upstream"}
2024-08-20 13:30:05 {"level":"info","ts":1724182205.7112877,"msg":"adapted config to JSON","adapter":"caddyfile"}
2024-08-20 13:30:05 {"level":"warn","ts":1724182205.7113397,"msg":"Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies","adapter":"caddyfile","file":"/etc/caddy/PW_Caddyfile","line":2}
2024-08-20 13:30:05 {"level":"info","ts":1724182205.7123103,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//[::1]:2019","//127.0.0.1:2019","//localhost:2019"]}
2024-08-20 13:30:05 {"level":"info","ts":1724182205.7125983,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc000313400"}
2024-08-20 13:30:05 {"level":"debug","ts":1724182205.8491518,"logger":"events","msg":"event","name":"cached_unmanaged_cert","id":"de3e1c94-89eb-4c23-b0cf-7bb767e7bb6c","origin":"tls","data":{"sans":["nanomicro.byu.edu"]}}
2024-08-20 13:30:05 {"level":"debug","ts":1724182205.8491938,"logger":"tls.cache","msg":"added certificate to cache","subjects":["nanomicro.byu.edu"],"expiration":1736726400,"managed":false,"issuer_key":"","hash":"c956d63645de91c267e9754f8bcefa59fb1aba1b033e856295244aeae41efc20","cache_size":1,"cache_capacity":10000}
2024-08-20 13:30:05 {"level":"info","ts":1724182205.849241,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
2024-08-20 13:30:05 {"level":"debug","ts":1724182205.8528328,"logger":"http.auto_https","msg":"adjusted config","tls":{"automation":{"policies":[{"subjects":["10.37.145.182"]},{}]}},"http":{"servers":{"remaining_auto_https_redirects":{"listen":[":80"],"routes":[{},{}],"logs":{"logger_names":{"10.37.145.182":["log0"]}}},"srv0":{"listen":[":31415"],"routes":[{"handle":[{"handler":"subroute","routes":[{"handle":[{"handler":"vars","root":"./"},{"handler":"reverse_proxy","headers":{"request":{"set":{"Host":["{http.request.host}"],"X-Forwarded-For":["{http.request.remote.host}"],"X-Forwarded-Proto":["{http.request.scheme}"],"X-Real-Ip":["{http.request.remote.host}"]}}},"upstreams":[{"dial":"127.0.0.1:5000"}]}]}]}],"terminal":true}],"tls_connection_policies":[{"match":{"sni":["10.37.145.182"]},"certificate_selection":{"any_tag":["cert0"]}},{}],"automatic_https":{},"logs":{"logger_names":{"10.37.145.182":["log0"]}}}}}}
2024-08-20 13:30:05 {"level":"warn","ts":1724182205.8531919,"logger":"pki.ca.local","msg":"installing root certificate (you might be prompted for password)","path":"storage:pki/authorities/local/root.crt"}
2024-08-20 13:30:05 {"level":"info","ts":1724182205.8534386,"msg":"warning: \"certutil\" is not available, install \"certutil\" with \"apt install libnss3-tools\" or \"yum install nss-tools\" and try again"}
2024-08-20 13:30:05 {"level":"info","ts":1724182205.8534763,"msg":"define JAVA_HOME environment variable to use the Java trust"}
2024-08-20 13:30:05 {"level":"info","ts":1724182205.8553903,"logger":"tls","msg":"cleaning storage unit","storage":"FileStorage:/root/.local/share/caddy"}
2024-08-20 13:30:05 {"level":"info","ts":1724182205.8558648,"logger":"tls","msg":"finished cleaning storage units"}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.810972,"msg":"certificate installed properly in linux trusts"}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.81116,"logger":"http","msg":"enabling HTTP/3 listener","addr":":31415"}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.8112955,"msg":"failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details."}
2024-08-20 13:30:06 {"level":"debug","ts":1724182206.8114414,"logger":"http","msg":"starting server loop","address":"[::]:31415","tls":true,"http3":true}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.8114772,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
2024-08-20 13:30:06 {"level":"debug","ts":1724182206.8115187,"logger":"http","msg":"starting server loop","address":"[::]:80","tls":false,"http3":false}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.8115263,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.8115313,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["10.37.145.182"]}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.8117585,"msg":"autosaved config (load with --resume flag)","file":"/root/.config/caddy/autosave.json"}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.811792,"msg":"serving initial configuration"}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.812062,"logger":"tls.obtain","msg":"acquiring lock","identifier":"10.37.145.182"}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.8140306,"logger":"tls.obtain","msg":"lock acquired","identifier":"10.37.145.182"}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.8142135,"logger":"tls.obtain","msg":"obtaining certificate","identifier":"10.37.145.182"}
2024-08-20 13:30:06 {"level":"debug","ts":1724182206.8143103,"logger":"events","msg":"event","name":"cert_obtaining","id":"91083013-99c3-4d86-9d75-325e9a98d25e","origin":"tls","data":{"identifier":"10.37.145.182"}}
2024-08-20 13:30:06 {"level":"debug","ts":1724182206.8144894,"logger":"tls.obtain","msg":"trying issuer 1/1","issuer":"local"}
2024-08-20 13:30:06 {"level":"debug","ts":1724182206.8149123,"logger":"pki.ca.local","msg":"using intermediate signer","serial":"335355397680664560297744683734270447478","not_before":"2024-08-20 19:30:05 +0000 UTC","not_after":"2024-08-27 19:30:05 +0000 UTC"}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.8158832,"logger":"tls.obtain","msg":"certificate obtained successfully","identifier":"10.37.145.182","issuer":"local"}
2024-08-20 13:30:06 {"level":"debug","ts":1724182206.8159795,"logger":"events","msg":"event","name":"cert_obtained","id":"4990088b-e325-4ae4-9623-f219f3498780","origin":"tls","data":{"certificate_path":"certificates/local/10.37.145.182/10.37.145.182.crt","csr_pem":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlIZE1JR0VBZ0VBTUFBd1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFRSjBmNTVlbmR3REd6ZwpFamVORzgrTGt3MjVzVkZPVWd2L1YwdDh5V2pxWmF2dGF3WEt4dEIxTnJabTNONFpTR1ZhYXNDRStkaVZVOW12CktkdGJ4UGE3b0NJd0lBWUpLb1pJaHZjTkFRa09NUk13RVRBUEJnTlZIUkVFQ0RBR2h3UUtKWkcyTUFvR0NDcUcKU000OUJBTUNBMGdBTUVVQ0lDM0dIQ0l3bU9DMmJRUkp5dXRJb3U0bEZQSHNrbW1BODhCajV0SHFDNkNzQWlFQQp0eGN5Z1RpazN3WER5U1dCUk91cUU4bitFS0E2YWpJZ3N5Wm1yQ3RHSktjPQotLS0tLUVORCBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0K","identifier":"10.37.145.182","issuer":"local","metadata_path":"certificates/local/10.37.145.182/10.37.145.182.json","private_key_path":"certificates/local/10.37.145.182/10.37.145.182.key","renewal":false,"storage_path":"certificates/local/10.37.145.182"}}
2024-08-20 13:30:06 {"level":"info","ts":1724182206.8159845,"logger":"tls.obtain","msg":"releasing lock","identifier":"10.37.145.182"}
2024-08-20 13:30:06 {"level":"warn","ts":1724182206.8163075,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [10.37.145.182]: no OCSP server specified in certificate","identifiers":["10.37.145.182"]}
2024-08-20 13:30:06 {"level":"debug","ts":1724182206.8163524,"logger":"tls.cache","msg":"added certificate to cache","subjects":["10.37.145.182"],"expiration":1724225407,"managed":true,"issuer_key":"local","hash":"fb81ec8e09c3dd439c29f7e2617a535b40d2d9f95d262763e4cd5339b148367b","cache_size":2,"cache_capacity":10000}
2024-08-20 13:30:06 {"level":"debug","ts":1724182206.8163702,"logger":"events","msg":"event","name":"cached_managed_cert","id":"9c69ae62-3865-41e1-9257-a121d7c6dc46","origin":"tls","data":{"sans":["10.37.145.182"]}}
2024-08-20 13:33:04 {"level":"debug","ts":1724182384.1544716,"logger":"http.stdlib","msg":"http: TLS handshake error from 192.168.65.1:20294: EOF"}
3. Caddy version: 2.8.4
4. How I installed and ran Caddy:
a. System environment:
Debian 11
Docker Container FROM python:3.6
b. Command:
Installation: app.dockerfile
RUN apt update && apt-get install -y debian-keyring debian-archive-keyring apt-transport-https
RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list
RUN apt update && apt install -y caddy
Run Command: start-app.sh
nohup caddy run --config /etc/caddy/PW_Caddyfile --adapter caddyfile &
c. Service/unit/compose file:
docker-compose.yml
services:
mongo:
build:
context: .
dockerfile: mongo.dockerfile
ports:
- "27017:27017"
volumes:
- /Users/nmserver/DockerProjectWiki/backup/2024.07.01.193119:/data/db/backup
networks:
- pw-network
environment:
MONGO_DATA_DIR: /data/db/backup
project-wiki:
build:
context: .
dockerfile: app.dockerfile
networks:
- pw-network
ports:
- "31415:31415"
- "5000:5000"
depends_on:
- mongo
volumes:
- /Users/nmserver/DockerProjectWiki/uploads:/app/uploads
- /Users/nmserver/Desktop/certificates:/etc/ssl/certs
- /Users/nmserver/DockerProjectWiki/PW_Caddyfile:/etc/caddy/PW_Caddyfile
environment:
MONGO_DATA_DIR: /data/db/backup
DB_SERVICE: mongo
networks:
pw-network:
driver: bridge
d. My complete Caddy config:
10.37.145.182:31415 {
root * ./
reverse_proxy * 127.0.0.1:5000 {
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up X-Forwarded-For {remote_host}
header_up X-Forwarded-Proto {scheme}
}
log {
output file /Project_Wiki_Data/log/caddy.log
}
tls /etc/ssl/certs/nanomicro_byu_edu.pem /etc/ssl/certs/nanomicro_byu_edu_key.pem
}