More of a (very) basic general question than help request but I’ve used caddy in the past for creating simple HTTP browser accessible versions of local directories for testing small things using the caddy defaults and in the back of my mind wondered if utilizing caddy exposes anything on the local machine to the outside internet.
Searched various times but since I’m not terribly familiar with the mechanics I thought I’d ask. I know caddy runs on port 2015 not the typical internet ports and returns only localhost as the IP but nevertheless wasn’t sure if while running it opens up anything on the system to the internet that otherwise wouldn’t be.
No worries - it’s a fair question, although it has a deceptively complicated answer.
How can you know that you haven’t opened up something to the internet? Well, let me answer in a roundabout way: let me tell you what you’d need in order to actually open something up.
For someone out there to talk to your Caddy, packets from them have to make their way all the way through all the devices between the internet and your device to reach your Caddy, and Caddy has to be able to send packets back.
So to run through it: to be internet-accessible, you must have a public IP address. Whatever device has that IP address (commonly your home router) must accept traffic destined for it and do something with that traffic. Usually it has to forward the traffic to the computer running the service (e.g. Caddy). Then, the computer running Caddy needs to accept this traffic and allow it to reach Caddy.
If any step of that chain isn’t satisfied, Caddy isn’t accessible from the internet!
A Windows firewall, for example, will stop the computer from accepting traffic unless you configure it to allow traffic to Caddy. A common home router will stop any inbound traffic (other than, y’know, traffic specifically requested like webpages etc) from reaching any device inside its local network, unless you manually port forward from it. Lots of things vary from environment to environment and from device to device, but generally you have to jump through hoops to allow outside traffic, and generally Caddy can’t jump those hoops without you in the loop.
You’re even somewhat more protected from accidental access by using localhost as your site name; under normal operation, a browser would never connect to a different computer when someone types localhost in the address bar (although a malicious actor with a bit of knowledge can get around this with relative ease, so… I wouldn’t call it security).