1. Output of caddy version:
v2.6.2 h1:wKoFIxpmOJLGl3QXoo6PNbYvGW4xLEgo32GPBEjWL8o=
2. How I run Caddy:
Ran though Portainer with command
caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
a. System environment:
Debian Bullseye host
Docker version 20.10.5
Portainer version Community Edition 2.16.2
b. Command:
caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
c. Service/unit/compose file:
Do not know how to retrieve from Portainer/Docker
d. My complete Caddy config:
172.16.20.4:443 {
tls internal
encode gzip
reverse_proxy /notifications/hub 172.16.20.4:3012
reverse_proxy 172.16.20.4:80 {
header_up X-Real-IP {remote_host}
}
}
port.garth.one {
reverse_proxy 172.16.9.1:8006
}
3. The problem I’m having:
When Caddy and the two services (Portainer and Vaultwarden) are all up I am unable to reach the HTTPS version of Vaultwarden (HTTP still works fine) and the port.garth.one does not send me to portainer
I get this from https://172.16.20.4
This site can’t be reached 172.16.9.1 refused to connect.
Try:
Checking the connection
Checking the proxy and the firewall
ERR_CONNECTION_REFUSED
and this from https://port.garth.one
Connection timed out Error code 522
4. Error messages and/or full log output:
INF ts=1671160716.3389893 msg=using provided configuration config_file=/etc/caddy/Caddyfile config_adapter=caddyfile
WRN ts=1671160716.3417804 msg=Caddyfile input is not formatted; run the 'caddy fmt' command to fix inconsistencies adapter=caddyfile file=/etc/caddy/Caddyfile line=6
INF ts=1671160716.3439555 logger=admin msg=admin endpoint started address=localhost:2019 enforce_origin=false origins=["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]
INF ts=1671160716.3443856 logger=http msg=server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS server_name=srv0 https_port=443
INF ts=1671160716.3444228 logger=http msg=enabling automatic HTTP->HTTPS redirects server_name=srv0
INF ts=1671160716.3443775 logger=tls.cache.maintenance msg=started background certificate maintenance cache=0xc00069ca80
INF ts=1671160716.3450954 logger=tls msg=cleaning storage unit description=FileStorage:/data/caddy
INF ts=1671160716.3451052 logger=http msg=enabling HTTP/3 listener addr=:443
INF ts=1671160716.3452008 msg=failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/lucas-clemente/quic-go/wiki/UDP-Receive-Buffer-Size for details.
DBG ts=1671160716.3453057 logger=http msg=starting server loop address=[::]:443 tls=true http3=true
INF ts=1671160716.3453798 logger=http.log msg=server running name=srv0 protocols=["h1","h2","h3"]
DBG ts=1671160716.3454835 logger=http msg=starting server loop address=[::]:80 tls=false http3=false
INF ts=1671160716.345529 logger=http.log msg=server running name=remaining_auto_https_redirects protocols=["h1","h2","h3"]
INF ts=1671160716.3455563 logger=http msg=enabling automatic TLS certificate management domains=["port.garth.one","172.16.20.4"]
INF ts=1671160716.3461924 logger=tls msg=finished cleaning storage units
INF ts=1671160716.3464015 msg=autosaved config (load with --resume flag) file=/config/caddy/autosave.json
INF ts=1671160716.3464792 msg=serving initial configuration
INF ts=1671160716.3465142 logger=tls.obtain msg=acquiring lock identifier=172.16.20.4
INF ts=1671160716.3467722 logger=tls.obtain msg=acquiring lock identifier=port.garth.one
INF ts=1671160716.497243 logger=tls.obtain msg=lock acquired identifier=172.16.20.4
INF ts=1671160716.4972227 logger=tls.obtain msg=lock acquired identifier=port.garth.one
INF ts=1671160716.497526 logger=tls.obtain msg=obtaining certificate identifier=172.16.20.4
INF ts=1671160716.4975977 logger=tls.obtain msg=obtaining certificate identifier=port.garth.one
DBG ts=1671160716.4976492 logger=events msg=event name=cert_obtaining id=abf9f728-db4b-47d7-88a9-fb043ea6eb4b origin=tls data={"identifier":"172.16.20.4"}
DBG ts=1671160716.4977076 logger=events msg=event name=cert_obtaining id=a339bc84-b240-4375-bd20-f85fd6ecc2ea origin=tls data={"identifier":"port.garth.one"}
DBG ts=1671160716.498341 logger=tls.obtain msg=trying issuer 1/2 issuer=acme-v02.api.letsencrypt.org-directory
DBG ts=1671160716.4983613 logger=tls.obtain msg=trying issuer 1/2 issuer=acme-v02.api.letsencrypt.org-directory
DBG ts=1671160716.4983876 logger=tls.obtain msg=trying issuer 2/2 issuer=acme.zerossl.com-v2-DV90
DBG ts=1671160716.4984128 logger=events msg=event name=cert_failed id=81f9dac1-a93e-49b5-92ba-2da64d909e29 origin=tls data={"error":{},"identifier":"172.16.20.4","issuers":["acme-v02.api.letsencrypt.org-directory","acme.zerossl.com-v2-DV90"],"renewal":false}
ERR ts=1671160716.4985318 logger=tls.obtain msg=will retry error=[172.16.20.4] Obtain: subject does not qualify for a public certificate: 172.16.20.4 attempt=1 retrying_in=60 elapsed=0.00123513 max_duration=2592000
WRN ts=1671160716.689143 logger=http.acme_client msg=HTTP request failed; retrying url=https://acme-v02.api.letsencrypt.org/directory error=performing request: Get "https://acme-v02.api.letsencrypt.org/directory": x509: certificate signed by unknown authority
WRN ts=1671160717.0543773 logger=http.acme_client msg=HTTP request failed; retrying url=https://acme-v02.api.letsencrypt.org/directory error=performing request: Get "https://acme-v02.api.letsencrypt.org/directory": x509: certificate signed by unknown authority
WRN ts=1671160717.4184477 logger=http.acme_client msg=HTTP request failed; retrying url=https://acme-v02.api.letsencrypt.org/directory error=performing request: Get "https://acme-v02.api.letsencrypt.org/directory": x509: certificate signed by unknown authority
ERR ts=1671160717.418548 logger=tls.obtain msg=could not get certificate from issuer identifier=port.garth.one issuer=acme-v02.api.letsencrypt.org-directory error=registering account [] with server: provisioning client: performing request: Get "https://acme-v02.api.letsencrypt.org/directory": x509: certificate signed by unknown authority
DBG ts=1671160717.418572 logger=tls.obtain msg=trying issuer 2/2 issuer=acme.zerossl.com-v2-DV90
WRN ts=1671160717.4188077 logger=http msg=missing email address for ZeroSSL; it is strongly recommended to set one for next time
ERR ts=1671160717.622286 logger=tls.obtain msg=could not get certificate from issuer identifier=port.garth.one issuer=acme.zerossl.com-v2-DV90 error=account pre-registration callback: performing EAB credentials request: Post "https://api.zerossl.com/acme/eab-credentials-email": x509: certificate signed by unknown authority
DBG ts=1671160717.6223865 logger=events msg=event name=cert_failed id=f7914102-8aae-4841-b53f-157eb2172308 origin=tls data={"error":{},"identifier":"port.garth.one","issuers":["acme-v02.api.letsencrypt.org-directory","acme.zerossl.com-v2-DV90"],"renewal":false}
ERR ts=1671160717.6224327 logger=tls.obtain msg=will retry error=[port.garth.one] Obtain: account pre-registration callback: performing EAB credentials request: Post "https://api.zerossl.com/acme/eab-credentials-email": x509: certificate signed by unknown authority attempt=1 retrying_in=60 elapsed=1.125058499 max_duration=2592000
5. What I already tried:
I have tried changing the Caddyfile to be both more and less verbose with no changes, I have recently wiped the whole system and reinstalled it with the same outcome, I’ve followed multiple articles with similar issues, but either had issues understanding the solution or after trying the solution provided no extra luck.
Any help would be much appreciated, I do not quite understand the docker networking section other than being able to successfully setup a macvlan to give each container their own IP
6. Links to relevant resources:
Past 4 link limit