Obsidian/05.02 Networks/Configuring Caddy.md

---

Alias: ["caddy"]
Tag: ["Computer", "Server", "Reverse-Proxy"]
Date: 2021-09-19
DocType: "Personal"
Hierarchy: "NonRoot"
TimeStamp:
location: [51.514678599999996, -0.18378583926867909]
CollapseMetaTable: Yes

---

Parent:: [[Selfhosting]], [[Server Tools]]

---

 

```button
name Save
type command
action Save current file
id Save
```
^button-caddySave

 

# Configuring caddy

 

```ad-abstract
title: Summary
collapse: open
This note runs through [caddy](https://caddyserver.com), a free tool webserver allowing for reverse-proxy and automatic SSL certifications.
```

 

```toc
style: number
```

 

---

 

### Installation

 

#### Program installation

1. **Pull the software signature key & image**

```ad-command
~~~
echo "deb [trusted=yes] https://apt.fury.io/caddy/ /" | sudo tee -a /etc/apt/sources.list.d/caddy-fury.list
~~~
```

3. **Install caddy**

```ad-command
~~~
sudo apt update
sudo apt install caddy
~~~
```

Installing caddy will create a default user 'caddy'.

4. **Test install**

Go to the homepage to see the caddy default page.

 

#### Installing php

PHP needs to be enabled for caddy to work.

```ad-command
~~~
sudo add-apt-repository ppa:ondrej/php
sudo apt install php-cli php-fpm php-mysql
~~~
```

Check if php is installed correctly:

```ad-command
~~~
php --version
~~~
```

 

---

 

### Configuration of caddy

 

Caddy will fetch a **SSL certificate** for all sub-domains and addresses present in the config file automatically, once the declaration is made properly.

 

#### Basic files & directories

1. Create a default website folder

```ad-command
~~~
sudo mkdir -p /var/www/html
~~~
```

2. Create a default log folder

```ad-command
~~~
sudo mkdir /var/log/caddy
sudo chown -R caddy:caddy /var/log/caddy
~~~
```

 

---

 

#### Caddy configuration file

Caddy's configuration file is inder:

```ad-path
~~~
/etc/caddy/Caddyfile
~~~
```

Default configuration is:

```ad-code
~~~
(localhost) {
	root * /var/www/html
	encode gzip zstd
	php_fastcgi unix//run/php/php7.4-fpm.sock
	tls (service email) {
		protocols tls1.2 tls1.3
	}
}
~~~
```

 

---

 

#### PHP configuration file

To update php, edit the following file:

```ad-path
~~~
sudo nano /etc/php/7.4/fpm/pool.d/www.conf
~~~
```

Change all 'www-data' user reference with 'caddy' including:

```ad-code
~~~
listen.owner = caddy
listen.group = caddy
~~~
```

Once this is done, restart php:

```ad-command
~~~
sudo systemctl restart php7.4-fpm
~~~
```

 

---

 

#### Configuring CORS

 

##### Preliminary CORS code snippet

```ad-code
~~~
(cors) {
        @origin{args.0} header Origin {args.0}
        header @origin{args.0} Access-Control-Allow-Origin "{args.0}"
}
~~~
```

 

##### CORS for a sub-domain

```ad-code
~~~
 import cors (http://subdomain.tld)
 header Access-Control-Allow-Methods "POST, GET, OPTIONS, PUT"
 header Access-Control-Allow-Headers "*"
~~~
```

 

---

 

#### Configuration of a sub-domain suffix

Configuration requires to add the following in the sub-domain definition:

```ad-code
~~~
 handle_path /(suffix)* {
	 root * /(path to suffix)
	 file_server
 }
~~~
```

 

---

 

#### Configuration with the docker network

Configuration of a service attached to the docker network is easy:

```ad-code
~~~
(hostname) {
	encode zstd gzip
	reverse_proxy xxx.yyy.zzz.aaa:port
}
~~~
```

 

---

 

#### Configuring login with a cookie

```ad-info
title: Tutorial
[Link](https://josheli.com/knob/2021/02/24/single-sign-on-in-caddy-server-using-only-the-caddyfile-and-basic-authentication/)
```

 

##### Preliminary login code snippets

1. **Creat hashed passwords**

```ad-command
~~~
caddy hash-password
~~~
```

2. **Define the array of users and hashed password**

```ad-code
~~~
(basic-auth) {
	basicauth / {
		user hashed-password
	}
}
~~~
```
 
3. **Define the snippet to test whether the cookie is installed**

```ad-code
~~~
(proxy-auth) {
% if cookie not = some-token-nonsense
	@no-auth {
		not header_regexp mycookie Cookie myid=(regex-to-match-id)
	}

% store current time, page and redirect to auth
	route @no-auth {
		header Set-Cookie "myreferer={scheme}://{host}{uri}; Domain=example.com; Path=/; Max-Age=30; HttpOnly; SameSite=Strict; Secure"
		redir https://auth.example.com
	}
}
~~~
```

 

##### Intermediary authentication page

After setting up a new subdomain/page and appropriate DNS records, define it as follows:

```ad-code
~~~
auth.example.com {
	route / {
% require authentication
		import basic-auth

% upon successful auth, set a client token
		header Set-Cookie "myid=some-long-hopefully-random-string; Domain=example.com; Path=/; Max-Age=3600; HttpOnly; SameSite=Strict; Secure"

% delete the referer cookie
		header +Set-Cookie "myreferer=null; Domain=example.com; Path=/; Expires=Thu, 25 Sep 1971 12:00:00 GMT; HttpOnly; SameSite=Strict; Secure"
     
% redirect back to the original site
		redir {http.request.cookie.myreferer}
	}

% fallback
	respond "Hi."
}
~~~
```

 

##### Adding authentication to a subdomain

Simply add the following at the top of all declarations for sub-domain definitions:

```ad-code
~~~
import proxy-auth
~~~
```

 

---

 

### Utilities

 

#### SSL Certification location

Look for a folder with the following sequence:

```ad-path
~~~
/.local/share/caddy
~~~
```

 

---

 

### Basic commands

A full repository of commands can be found [here](https://caddyserver.com/docs/)

 

#### Start/Stop/Restart

```ad-command
~~~
sudo systemctl start/stop/restart caddy
~~~
```

 

#### Reload config

Once config amended just run:

```ad-command
~~~
sudo systemctl reload caddy
~~~
```