Caddy reverse proxy guide

Optional in-guest Caddy for path routing; prefer multiple platform sites for separate Hosts.

Do I need Caddy?

No, not for HTTPS. Every NairaCloud node already runs a Caddy edge on ports 80/443. It terminates TLS and forwards plain HTTP to each site's origin port. Prefer multiple platform sites (different labels) when apps need separate Hosts. Use Caddy inside the instance only for path routing behind one origin.

Quick start (inside the instance)

Bind Caddy to 8080 inside the instance, then set that as the site origin port in the dashboard. Do not map 80/443 in the container.

bash

1$ docker run -d \
  --name caddy \
  --restart unless-stopped \
  -p 8080:8080 \
  -v /root/Caddyfile:/etc/caddy/Caddyfile:ro \
  -v caddy_data:/data \
  caddy:2

Caddyfile

8080 {
  encode gzip
  file_server
4}

Common patterns

Reverse proxy

text

1:8080 {
2    reverse_proxy backend:3000
3}

Static site with SPA fallback

text

8080 {
  root * /srv
  try_files {path} /index.html
  file_server
5}

Path-based routing

text

8080 {
  handle /api/* {
      reverse_proxy backend:3000
  }
  handle {
      reverse_proxy frontend:3000
  }
8}

WebSocket upgrade

text

1:8080 {
2    reverse_proxy ws:8080
3}

Load balancing

text

8080 {
  reverse_proxy {
      to backend1:3000 backend2:3000
      health_uri /health
      health_interval 5s
  }
7}

TLS and domains

Leave certificates to the platform edge. A custom domain is attached in the dashboard, not in this Caddyfile. If you put your own TLS-terminating proxy in front of the instance, it must speak plain HTTP to the platform edge or use a published TCP port instead.

Troubleshooting

bash

1$ docker logs caddy                     # config or upstream errors
2$ caddy fmt --overwrite Caddyfile      # validate syntax
3$ curl -sI http://127.0.0.1:8080       # test from inside the instance

Practical -- try it now

Caddy is serving your containers

Start Caddy on port 8080 with the Caddyfile above.
In Sites, set the web origin to 8080.
Open the HTTPS URL -- the platform edge terminates TLS and Caddy routes internally.

Ask a question...

Ctrl+I