1·
6 days agoYeah, that’s exactly why I didn’t use my own CA. There’s a plethora of devices that you now need to import the CA to and then you need to hope, that every application uses the system cert store and doesn’t roll its own (IIRC e.g. Firefox uses its own cert store and doesn’t use the system cert store. Same for every java based application,…)
It’s fiddly with Caddy, as you need a specific plugin to get it to work with anything else than the default challenge. That means using a custom build via caddy - and with docker, you’re SOL. BUT you can just use certbot and point caddy to the cert file in your file system.
If you like, I can send you an example of the Caddyfiles, that I’m using (I used the import directive to split every service into its own Caddyfiles, you could just copy and paste everything in the same file). It will take a few hours until I get home, though.
But basically you can just put every subdomain and it’s target in a separate block and the add some things globally (e.g. passing the original IP, switching off the admin API of Caddy,…)
Something like this should work:
admin off servers { client_ip_headers X-Forwarded-For X-Real-IP } app.example.com { reverse_proxy 127.0.0.1:8080 } app2.example.com { reverse_proxy 127.0.0.1:8081 } api.example.com { reverse_proxy 127.0.0.1:8082 header { Access-Control-Allow-Methods "GET, OPTIONS" Access-Control-Allow-Origin "*" } }