Table of Contents

How to run a Caddy HTTP/2 TLS 1.3 Reverse Proxy with Let's Encrypt

Never again you will need to worry about HTTPS-enabling your NAS, your local webserver, your fileshare, your mediacenter and whatever else. Caddy will do that for you. Automatically. And Caddy will also make sure the certificates get re-issued automatically. All that you need is working DNS A records for your website(s).

Install Caddy

Execute as root. This should work on any debian-based distro: 

apt install curl
curl https://getcaddy.com | bash -s personal http.nobots,http.minify,http.proxyprotocol
chown root:root /usr/local/bin/caddy
chmod 755 /usr/local/bin/caddy
setcap 'cap_net_bind_service=+eip' /usr/local/bin/caddy
mkdir -p /etc/caddy
chown -R root:www-data /etc/caddy
mkdir -p /etc/ssl/caddy
chown -R www-data:root /etc/ssl/caddy
chmod 770 /etc/ssl/caddy
touch /etc/caddy/Caddyfile
curl -L https://github.com/mholt/caddy/raw/master/dist/init/linux-systemd/caddy.service | sed "s/;CapabilityBoundingSet/CapabilityBoundingSet/" | sed "s/;AmbientCapabilities/AmbientCapabilities/" | sed "s/;NoNewPrivileges/NoNewPrivileges/" | tee /etc/systemd/system/caddy.service
chown root:root /etc/systemd/system/caddy.service
chmod 644 /etc/systemd/system/caddy.service
mkdir /var/log/caddy
chown -R www-data:root /var/log/caddy
chmod 770 /var/log/caddy
systemctl daemon-reload
systemctl enable caddy.service

Should you get an error 500 or similar while running the getcaddy.com script, grab your copy here.
https://gist.github.com/Jamesits/2a1e2677ddba31fae62d022ef8aa54dc
https://github.com/mholt/caddy/raw/master/dist/init/linux-systemd/caddy.service
https://caddyserver.com/download

Edit Caddyfile

Configure the Caddyfile located in /etc/caddy so that Caddy works as a reverse proxy. The first line is most important, it *MUST* be a working hostname and not an IP address for Let's Encrypt to generate certificates. Watch your syslogs. It doesn't matter if you are running an AWS or GCP instance behind a 1:1 NAT, the only thing that matters is that the box is available under the configured hostname and that port 80/443 is reachable. And make sure that the domain you use does not restrict letsencrypt.com by a CAA DNS record. If you want to serve more than one local webserver then just duplicate the following content and make sure the hostnames differ. Otherwise, if you want all your webservers to be reachable by the same hostname but under a different path (e.g. yourhost.example.com/mediacenter) then add more proxy{} sections. It's so simple. 

yourhost.example.com {
log /var/log/caddy/yourhost.example.com.log
 
    proxy / 192.168.0.3:80 {
    transparent
    header_upstream Host {host}
    header_upstream X-Real-IP {remote}
    header_upstream X-Forwarded-For {remote}
    header_upstream X-Forwarded-Port {server_port}
    header_upstream X-Forwarded-Proto {scheme}
    }
}

Note: Certificates will re-generate when you change hostnames in Caddyfile followed by a restart. Now that's convenient.
The Caddyfile syntax

Start Caddy

That's it already. Start Caddy and give it a few seconds to grab the SSL certificates. 

systemctl start caddy

Watch your syslogs to see the magic after you fire it up: 

systemd[1]: Started Caddy HTTP/2 web server.
caddy[16065]: Activating privacy features... 
caddy[16065]: [INFO] [FileStorage:/etc/ssl/caddy] Started certificate maintenance routine
caddy[16065]: [INFO] [yourhost.example.com] acme: Obtaining bundled SAN certificate
caddy[16065]: [INFO] [yourhost.example.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/blah
caddy[16065]: [INFO] [yourhost.example.com] acme: use tls-alpn-01 solver
caddy[16065]: [INFO] [yourhost.example.com] acme: Trying to solve TLS-ALPN-01
caddy[16065]: [INFO] [yourhost.example.com] The server validated our request
caddy[16065]: [INFO] [yourhost.example.com] acme: Validations succeeded; requesting certificates
caddy[16065]: [INFO] [yourhost.example.com] Server responded with a certificate.

Finito. There's your super small HTTPS reverse proxy serving at port 80 and port 443 and it will auto-redirect your visitors to HTTPS. Give it a try and enjoy your shiny new SSL certificates that work everywhere without warnings. 

# ps aux | grep caddy
www-data 17694  0.0  2.2 116948 13088 ?        Ssl  00:38   0:00 /usr/local/bin/caddy <...>
 
# netstat -tulpn | grep caddy
tcp6       0      0 :::80                   :::*                    LISTEN      17694/caddy
tcp6       0      0 :::443                  :::*                    LISTEN      17694/caddy

Even the Qualys results are showing pretty lovely defaults: