I have a domain at simply.com with a few services running on a server at home.

Previously I used Caddy with subdomains registered with my hosting provider's DNS panel, and ports 80 and 443 opened to the public internet. Anybody could access my services from the outside.

I've now changed to using WireGuard and a custom build of Caddy with a wildcard certificate for my domain. Pi-hole handles DNS for subdomains, e.g. cloud.example.com for Nextcloud.

I'm using podman system quadlets for Pi-hole and Caddy (both use privileged ports), and podman secrets for sensitive data.

In /etc/containers/systemd/caddy, I have 3 files:

Containerfile
--------------------
FROM docker.io/caddy:builder AS builder

RUN xcaddy build --with github.com/caddy-dns/simplydotcom

FROM docker.io/caddy:latest

COPY --from=builder /usr/bin/caddy /usr/bin/caddy
--------------------

caddy.build
------------------
[Build]
ImageTag=localhost/caddy
SetWorkingDirectory=unit
------------------

caddy.container
-------------------------
[Unit]
Description=Caddy container
After=network-online.target

[Container]
AutoUpdate=registry
ContainerName=caddy
Image=caddy.build
Secret=simply_account_name,type=env,target=SIMPLY_ACCOUNT_NAME
Secret=simply_api_key,type=env,target=SIMPLY_API_KEY
Volume=/srv/containers/caddy/conf:/etc/caddy:Z
Volume=/srv/containers/caddy/data:/data:Z
PublishPort=443:443

[Install]
WantedBy=default.target
-------------------------

The Caddyfile is stored in /srv/containers/caddy/conf/:

Caddyfile
---------------
*.example.com {
tls {
dns simplydotcom {env.SIMPLY_ACCOUNT_NAME} {env.SIMPLY_API_TOKEN}
}

@caddy host caddy.example.com
handle @caddy {
respond "Hello World!"
}
}
---------------

See Caddy documentation for more on wildcard certificates.

https://caddyserver.com/docs/caddyfile/patterns#wildcard-certificates

#selfhosting #homelab #podman #caddy

Hey @homelab ,

has anyone managed to write a working config for running #Caddy with the caddy-security plugin and #OIDC?

I am struggling to make it work. Anyone mind sharing a working config?

(watch out to redact your secrets)

I’ve been playing around with a Rock Pi 4 Plus. Went with the default minimal Debian image, since fighting with U-boot wasn’t something I wanted to tackle yet 😛

Running Caddy on it and hosting https://caddy.ninja for testing purposes.

#sbc #caddy #selfHosting

SearXNG su Linux: motore di ricerca self-hosted privato su VPS

#caddy is getting better journald support 🚀

https://github.com/caddyserver/caddy/pull/7623

#caddyserver #linux