Hi!
1. The problem I’m having:
OPNSense with Adguard/Unbound-Plugin and Caddy-Plugin.
Caddy is used to serve home network domains (eg: nc.example.de points to 192.168.1.60, but only in my homemetwork). Everythink is working fine.
Everythink? No - one service I cant get to run.
It’s the dashboard of venus os (Cerbo GX device from victron, a solar power/battery management system). Via IP (192.168.1.50) everythink works fine:
With venus.example.de, there is a connection error
I think it is a websocket problem. I tought caddy handles websockets automatically. I cant find a websocket option in caddy.
2. Error messages and/or full log output:
Chrome F12:
Caddy Debug log:
"debug","ts":"2024-09-20T04:26:31Z","logger":"http.handlers.reverse_proxy","msg":"streaming error","upstream":"192.168.1.50:80","duration":0.008340873,"request":{"remote_ip":"192.168.1.159","remote_port":"55788","client_ip":"192.168.1.159","proto":"HTTP/1.1","method":"GET","host":"venus.xxx.de","uri":"/websockify","headers":{"Connection":["Upgrade"],"Sec-Websocket-Protocol":["binary, base64"],"Cache-Control":["no-cache"],"X-Forwarded-Host":["venus.xxx.de"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"],"Sec-Websocket-Key":["dMDCSw/tM1pmoQbwxAb0mg=="],"Origin":["https://venus.xxx.de"],"Sec-Websocket-Version":["13"],"Sec-Websocket-Extensions":["permessage-deflate; client_max_window_bits"],"Accept-Language":["de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7"],"Pragma":["no-cache"],"Upgrade":["websocket"],"Accept-Encoding":["gzip, deflate, br, zstd"],"X-Forwarded-For":["192.168.1.159"],"X-Forwarded-Proto":["https"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"http/1.1","server_name":"venus.xxx.de"}}}
3. Caddy version:
OPNSense: 24.7.4_1
Caddy Plugin: 1.7.0_1
4. How I installed and ran Caddy:
OPNSense Plugin
a. System environment:
OPNSense bare metal
b. Command:
c. Service/unit/compose file:
d. My complete Caddy config:
[details="Summary"]
# DO NOT EDIT THIS FILE -- OPNsense auto-generated file
# caddy_user=root
# Global Options
{
log {
output net unixgram//var/run/caddy/log.sock {
}
format json {
time_format rfc3339
}
level DEBUG
}
servers {
trusted_proxies static 192.168.1.0/24 10.10.0.0/24 10.7.0.0/24 10.9.0.0/24 192.168.200.0/24 192.168.90.0/24
listener_wrappers {
layer4 {
import /usr/local/etc/caddy/caddy.d/*.layer4
route
}
tls
}
}
email xx
grace_period 10s
import /usr/local/etc/caddy/caddy.d/*.global
}
# Reverse Proxy Configuration
# Layer4 default HTTP port
:80 {
}
# Layer4 default HTTPS port
:443 {
}
# Reverse Proxy Domain: "38ba0804-7c0a-4dc8-9b95-2c4aca9f85fc"
immich.xxx.de {
log {
output file /var/log/caddy/access/38ba0804-7c0a-4dc8-9b95-2c4aca9f85fc.log {
roll_keep_for 10d
}
}
@9acb4085-666d-4a2c-b32b-b6047fa3f127 {
client_ip 192.168.1.0/24 10.10.0.0/24 10.7.0.0/24 10.9.0.0/24 192.168.200.0/24 192.168.90.0/24
}
handle @9acb4085-666d-4a2c-b32b-b6047fa3f127 {
handle {
reverse_proxy 192.168.1.39:2283 {
}
}
}
abort
}
# Reverse Proxy Domain: "89891edb-f5a3-4f6a-8668-44671e065f19"
whoogle.xxx.de {
log {
output file /var/log/caddy/access/89891edb-f5a3-4f6a-8668-44671e065f19.log {
roll_keep_for 10d
}
}
@9acb4085-666d-4a2c-b32b-b6047fa3f127 {
client_ip 192.168.1.0/24 10.10.0.0/24 10.7.0.0/24 10.9.0.0/24 192.168.200.0/24 192.168.90.0/24
}
handle @9acb4085-666d-4a2c-b32b-b6047fa3f127 {
handle {
reverse_proxy 192.168.1.57:5000 {
}
}
}
abort
}
# Reverse Proxy Domain: "0daafce0-e7da-4061-b839-99069d689781"
omv.xxx.de {
log {
output file /var/log/caddy/access/0daafce0-e7da-4061-b839-99069d689781.log {
roll_keep_for 10d
}
}
@9acb4085-666d-4a2c-b32b-b6047fa3f127 {
client_ip 192.168.1.0/24 10.10.0.0/24 10.7.0.0/24 10.9.0.0/24 192.168.200.0/24 192.168.90.0/24
}
handle @9acb4085-666d-4a2c-b32b-b6047fa3f127 {
handle {
reverse_proxy 192.168.1.58 {
}
}
}
abort
}
# Reverse Proxy Domain: "b89a7d6b-45c8-4ee2-9298-e12dcdbdca22"
dess.xxx.de {
log {
output file /var/log/caddy/access/b89a7d6b-45c8-4ee2-9298-e12dcdbdca22.log {
roll_keep_for 10d
}
}
@9acb4085-666d-4a2c-b32b-b6047fa3f127 {
client_ip 192.168.1.0/24 10.10.0.0/24 10.7.0.0/24 10.9.0.0/24 192.168.200.0/24 192.168.90.0/24
}
handle @9acb4085-666d-4a2c-b32b-b6047fa3f127 {
handle {
reverse_proxy 192.168.1.50:1881 {
transport http {
tls
tls_insecure_skip_verify
}
}
}
}
abort
}
# Reverse Proxy Domain: "7d967257-1b59-44c1-a5dd-481e4482f223"
vaultwarden.xxx.de {
log {
output file /var/log/caddy/access/7d967257-1b59-44c1-a5dd-481e4482f223.log {
roll_keep_for 10d
}
}
@9acb4085-666d-4a2c-b32b-b6047fa3f127 {
client_ip 192.168.1.0/24 10.10.0.0/24 10.7.0.0/24 10.9.0.0/24 192.168.200.0/24 192.168.90.0/24
}
handle @9acb4085-666d-4a2c-b32b-b6047fa3f127 {
handle {
reverse_proxy 192.168.1.59:8000 {
}
}
}
abort
}
# Reverse Proxy Domain: "1d55b940-5ee4-4e48-9527-c48986c5fc36"
gitea.xxx.de {
log {
output file /var/log/caddy/access/1d55b940-5ee4-4e48-9527-c48986c5fc36.log {
roll_keep_for 10d
}
}
@9acb4085-666d-4a2c-b32b-b6047fa3f127 {
client_ip 192.168.1.0/24 10.10.0.0/24 10.7.0.0/24 10.9.0.0/24 192.168.200.0/24 192.168.90.0/24
}
handle @9acb4085-666d-4a2c-b32b-b6047fa3f127 {
handle {
reverse_proxy 192.168.1.34 {
}
}
}
abort
}
# Reverse Proxy Domain: "114a69a8-670a-4f56-af4a-fb5d9bbb959c"
venus.xxx.de {
log {
output file /var/log/caddy/access/114a69a8-670a-4f56-af4a-fb5d9bbb959c.log {
roll_keep_for 10d
}
}
@9acb4085-666d-4a2c-b32b-b6047fa3f127 {
client_ip 192.168.1.0/24 10.10.0.0/24 10.7.0.0/24 10.9.0.0/24 192.168.200.0/24 192.168.90.0/24
}
handle @9acb4085-666d-4a2c-b32b-b6047fa3f127 {
handle {
reverse_proxy 192.168.1.50 {
}
}
}
abort
}
import /usr/local/etc/caddy/caddy.d/*.conf
[/details]
5. Links to relevant resources:
Thank you!
Please fix that.
