Where does the layer4 plugin take the TLS host name from?

[matt (Matt Holt)]

Hey @AndreKR – sorry it took me a few days to get to this.

Also, apologies that documentation for caddy-l4 is not very good (yet). I never quite got around to enhancing it. So I understand your confusion… I think @francislavoie may have understood differently. Let me see if I read this right.

@AndreKR

Now if it wants to terminate TLS it will need a hostname so it can obtain certificates, right?

Correct. Or you can provide a cert, but yes basically Caddy will need a cert.

@AndreKR

Where do I put this hostname? In the "listen": ["blah.com:1234"] part? Or somewhere in the tls matcher or even tls handler?

With JSON config, there are connection policies and automation policies. Automation policies tell Caddy what certificates to automate and how to do that. Connection policies tell Caddy how to serve TLS connections.

Connection policies are typically configured close to the server that is using them, i.e. the layer4 app, in the tis handler.

Automation policies, however, are configured in the tis app module because any/all other apps can reuse the certificates that the tis app is managing:

JSON Config Structure - Caddy Documentation

So the name(s) to have certificates for are specified in the tis app, in an automation policy. Could be very simple, like so:

Using Caddy to keep certificates renewed

You can use Caddy as an automated certificate manager to keep certificates renewed without having to run an HTTPS server [1]. This way, the certificates can be used by other programs that need them. Caddy’s tls app can be configured without the need for an HTTP server. It can keep certificates renewed. Without additional configuration, assets (certificates, keys, and metadata) are stored in a data directory on the local file system at a location dependent upon your OS. The simplest form is to …

@AndreKR

Another question… my TCP-over-TLS can use port 443 or a different port, both is fine for me. But as far as I know layer4 and regular HTTPs cannot share the same port, so it’ll be a different port.

The layer4 app does support multiplexing, so you can share a port. (It has some bugs we’re working out but in the meantime it’s easy to tweak your config to work around them.)

@AndreKR

I also vaguely remember that the challenge still has to be done on port 80 (for HTTP-01) or 443 (for TLS-ALPN-01). Does Caddy know that? Will it use port 80/443 to do the challenge and then use the obtained certificate on the port that layer4 is listening on?

All of Caddy’s TLS listeners are capable of solving the TLS-ALPN challenge automatically. If you are using the layer4 app, the HTTP challenge is not supported automatically because that’d require setting up an HTTP server, which isn’t a given with layer4. However, if you do set up Caddy’s HTTP server on port 80 then it should be able to solve the HTTP challenge as well.

Does that answer your questions?