Hello Self Hosters! I am new-ish… got Jellyfin working great with tailscale remote access! I love it! I keep getting deeper into this stuff and geeking out… really excited to add my next service: Self-Hosted Nextcloud.
Would someone kindly walk me through setting up reverse proxy to my stuff with Caddy? I really just want HTTPS support, as my media files are one thing, but hosting all my personal info/docs on NextCloud is quite another thing to potentially expose…I want to make sure I harden properly, and HTTPS is clearly a part of that, even if I’m running a tailscale VPN. I have done my best following the docs/tutorial so far, but I’ve hit the wall with this “start” page… Here’s what I’ve got:
- pointed my domain “A” DNS to my website as a sub-domain… so my address in caddyfile is “sub.mydomain.com”
- I’ve installed caddy directly on my unbuntu server, but I admin my Jellyfin (and eventually Nextcloud) with Docker via CasaOS interface… is this a problem? Do I need to run Caddy in docker too?
- I’ve followed the instructions on this start page and I still only get the startpage at “sub.mydomain.com”
- my tailnet server IP address is what I’m using for the reverse proxy… that’s correct, yes?
- So many things/guides just say “reverse-proxy --to …” but when I do that, I get an error saying port 80 is ‘already in use’ I have combed my configs & devices on my router…nothing is using port 80 that I can see. Ports 80 and 443 ARE forwarded/open, before you ask! -My next big step in this journey is piHole, so if this will interfere/interact with that in some important way, I appreciate the heads-up mightily!
Thank you in advance, I appreciate it!
EDIT! - CaddyOS uses 80 as default gateway, turns out! So, switched that… now Caddy is starting properly… STILL can’t get the ‘welcome’ page to go away… still a problem with my caddyfile I suppose.
The difference between having caddy or any other reverse proxy in docker alongside other apps/services, is that instead of having to expose ports for every container to the host, and then linking every service/app as,
localhost:<host-port>to caddy, you can have them on the same docker network and use<container-name>:<container-port>and only expose 80 443 to the host, meaning that the only way to access app/services is through caddy, that way if you disable port 80 after configuring SSL certificates, you can only access services with HTTPS.So, it sounds like you’re staying if I want all my services (jellyfin, nextcloud, etc) behind ONE reverse proxy/https then the easier method is to install Caddy as docker and use the containername:containerport method?.. did I understand correctly? Thanks
Yes, if the only exposed port to the host or outside, is 443 from caddy container, then the only way to access any of those services is HTTPS through caddy.