Obsidian/05.02 Networks/Configuring Caddy.md

Alias	Tag	Date	DocType	Hierarchy	TimeStamp	location	CollapseMetaTable
caddy	💻 🖥️ Reverse-Proxy	2021-09-19	Personal	NonRoot		51.514678599999996 -0.18378583926867909	true

Parent:: Selfhosting, Server Tools

---

^Top

 

name Save
type command
action Save current file
id Save

^button-caddySave

 

Configuring caddy

 

title: Summary
collapse: open
This note runs through [caddy](https://caddyserver.com), a free tool webserver allowing for reverse-proxy and automatic SSL certifications.

 

style: number

 

---

 

Installation

#^Top  

Program installation

1. Pull the software signature key & image

~~~bash
echo "deb [trusted=yes] https://apt.fury.io/caddy/ /" | sudo tee -a /etc/apt/sources.list.d/caddy-fury.list
~~~

3. Install caddy

~~~bash
sudo apt update
sudo apt install caddy
~~~

Installing caddy will create a default user 'caddy'.

4. Test install

Go to the homepage to see the caddy default page.

 

Installing php

PHP needs to be enabled for caddy to work.

~~~bash
sudo add-apt-repository ppa:ondrej/php
sudo apt install php-cli php-fpm php-mysql
~~~

Check if php is installed correctly:

~~~bash
php --version
~~~

 

---

 

Configuration of caddy

#^Top  

Caddy will fetch a SSL certificate for all sub-domains and addresses present in the config file automatically, once the declaration is made properly.

 

Basic files & directories

#^Top

1. Create a default website folder

~~~bash
sudo mkdir -p /var/www/html
~~~

2. Create a default log folder

~~~bash
sudo mkdir /var/log/caddy
sudo chown -R caddy:caddy /var/log/caddy
~~~

 

---

 

Caddy configuration file

#^Top Caddy's configuration file is inder:

/etc/caddy/Caddyfile

Default configuration is:

~~~javascript
(localhost) {
	root * /var/www/html
	encode gzip zstd
	php_fastcgi unix//run/php/php7.4-fpm.sock
	tls (service email) {
		protocols tls1.2 tls1.3
	}
}
~~~

 

---

 

PHP configuration file

#^Top To update php, edit the following file:

/etc/php/7.4/fpm/pool.d/www.conf

Change all 'www-data' user reference with 'caddy' including:

~~~yaml
listen.owner = caddy
listen.group = caddy
~~~

Once this is done, restart php:

~~~bash
sudo systemctl restart php7.4-fpm
~~~

 

---

 

Configuring CORS

#^Top  

Preliminary CORS code snippet

~~~javascript
(cors) {
        @origin{args.0} header Origin {args.0}
        header @origin{args.0} Access-Control-Allow-Origin "{args.0}"
}
~~~

 

CORS for a sub-domain

~~~javascript
 import cors (http://subdomain.tld)
 header Access-Control-Allow-Methods "POST, GET, OPTIONS, PUT"
 header Access-Control-Allow-Headers "*"
~~~

 

---

 

Configuration of a sub-domain suffix

#^Top Configuration requires to add the following in the sub-domain definition of the Configuring Caddy#Caddy configuration file:

~~~javascript
 handle_path /(suffix)* {
	 root * /(path to suffix)
	 file_server
 }
~~~

 

---

 

Configuring with the docker network

#^Top Configuration of a service attached to the docker network is easy:

~~~javascript
(hostname) {
	encode zstd gzip
	reverse_proxy xxx.yyy.zzz.aaa:port
}
~~~

 

---

 

Configuring login with a cookie

#^Top

title: Tutorial
[Link](https://josheli.com/knob/2021/02/24/single-sign-on-in-caddy-server-using-only-the-caddyfile-and-basic-authentication/)

 

Preliminary login code snippets

1. Creat hashed passwords

~~~bash
caddy hash-password
~~~

2. Define the array of users and hashed password

In the Configuring Caddy#Caddy configuration file:

~~~javascript
(basic-auth) {
	basicauth / {
		user hashed-password
	}
}
~~~

3. Define the snippet to test whether the cookie is installed

In the Configuring Caddy#Caddy configuration file:

~~~javascript
(proxy-auth) {
% if cookie not = some-token-nonsense
	@no-auth {
		not header_regexp mycookie Cookie myid=(regex-to-match-id)
	}

% store current time, page and redirect to auth
	route @no-auth {
		header Set-Cookie "myreferer={scheme}://{host}{uri}; Domain=example.com; Path=/; Max-Age=30; HttpOnly; SameSite=Strict; Secure"
		redir https://auth.example.com
	}
}
~~~

 

Intermediary authentication page

#^Top After setting up a new subdomain/page and appropriate DNS records, define it as follows in the Configuring Caddy#Caddy configuration file:

~~~javascript
auth.example.com {
	route / {
% require authentication
		import basic-auth

% upon successful auth, set a client token
		header Set-Cookie "myid=some-long-hopefully-random-string; Domain=example.com; Path=/; Max-Age=3600; HttpOnly; SameSite=Strict; Secure"

% delete the referer cookie
		header +Set-Cookie "myreferer=null; Domain=example.com; Path=/; Expires=Thu, 25 Sep 1971 12:00:00 GMT; HttpOnly; SameSite=Strict; Secure"
     
% redirect back to the original site
		redir {http.request.cookie.myreferer}
	}

% fallback
	respond "Hi."
}
~~~

 

Adding authentication to a subdomain

Simply add the following at the top of all declarations for sub-domain definitions:

~~~javascript
import proxy-auth
~~~

 

---

 

Configuring logging for Caddy

1. In the Configuring Caddy#Caddy configuration file, add a logging module:

title: logging script
~~~javascript
(log) {
 
 log {

   output file /var/log/caddy/caddy.log {
    roll_local_time
	# Other parameters can be found on the Caddy website
   }
   format json # (or console)
   level INFO # (or ERROR)
 }
}
~~~

 

2. In the global configuration section, add the import log directive

~~~javascript
{
 import log
}
~~~

2. In each subdomain definition, add the following line

import log

 

---

 

Utilities

#^Top  

SSL Certification location

Look for a folder with the following sequence:

/.local/share/caddy

 

Reading the log file

Caddy does offer a common_log field in their JS log that can be called for consumption by other software:

~~~bash
sudo cat /var/log/caddy/caddy.log | jq -r ' .. | .common_log? | select(. !=null)'
~~~

 

Sending logs to user

In order to consume the logs, it is sent through a cron job to a Configuring Telegram bots.

The script is below:

~~~bash

~~~

 

---

 

Basic commands

#^Top A full repository of commands can be found here

 

Start/Stop/Restart

~~~bash
sudo systemctl start/stop/restart caddy
~~~

 

Reload config

Once config amended just run:

~~~bash
sudo systemctl reload caddy
~~~

#^Top