Goyban
58 lines
1.9 KiB
Markdown
58 lines
1.9 KiB
Markdown
# Reverse proxy with Caddy
|
|
|
|
Every service in this repo publishes a plain HTTP port on the host. Nothing
|
|
in a service's compose file knows or cares about TLS, domains, or
|
|
authentication — that is all handled here, in one place.
|
|
|
|
This is deliberate: it means you can run any stack in this repo standalone,
|
|
and add a proxy later without touching the compose file.
|
|
|
|
## The basic pattern
|
|
|
|
Caddy gets a certificate automatically. For most services, one block is the
|
|
entire configuration:
|
|
|
|
```caddyfile
|
|
app.example.com {
|
|
reverse_proxy <host>:<port>
|
|
}
|
|
```
|
|
|
|
Look up `<port>` in the [service table](../README.md).
|
|
|
|
TODO: note where your Caddyfile lives and whether Caddy runs on the NAS or
|
|
on the VPS.
|
|
|
|
## Services that need more
|
|
|
|
Most apps don't care what's in front of them. A few build absolute URLs or
|
|
make security decisions based on the request, and those need to be told.
|
|
|
|
**Nextcloud** is the main one — it needs all of:
|
|
|
|
- `trusted_domains` — the public hostname, or it refuses the request
|
|
- `overwrite.cli.url` — so generated links use the public URL
|
|
- `overwriteprotocol=https` — or it builds `http://` links behind TLS and
|
|
breaks mixed content
|
|
- `TRUSTED_PROXIES` — the proxy's IP, or every client appears to come from
|
|
the proxy and rate limiting misfires
|
|
|
|
Milder cases:
|
|
|
|
- **Gitea** — `ROOT_URL`, or clone URLs point at the wrong host
|
|
- **Authentik** — knows its own external URL by configuration
|
|
- **Jellyfin** — only if you serve it from a subpath rather than a subdomain
|
|
|
|
TODO: your `header_up` defaults, and whether you set a shared snippet for
|
|
`X-Forwarded-*`.
|
|
|
|
## Large uploads
|
|
|
|
TODO: Caddy's defaults are usually fine, but note any `request_body`
|
|
`max_size` you set for Nextcloud/Immich, plus the matching app-side limit.
|
|
|
|
## Related
|
|
|
|
- [Cloudflare Tunnel](cloudflare-tunnel.md) — when you don't want to open a port
|
|
- [Single sign-on with Authentik](authentik-sso.md)
|