Obsidian/05.02 Networks/Configuring Caddy.md

---

Alias: ["caddy"]
Tag: ["💻", "🖥️", "Reverse-Proxy"]
Date: 2021-09-19
DocType: "Personal"
Hierarchy: "NonRoot"
TimeStamp:
location: [51.514678599999996, -0.18378583926867909]
CollapseMetaTable: true

---

Parent:: [[Selfhosting]], [[Server Tools]]

---

 ^Top

 

```button
name Save
type command
action Save current file
id Save
```
^button-caddySave

 

# Configuring caddy

 

```ad-abstract
title: Summary
collapse: open
This note runs through [caddy](https://caddyserver.com), a free tool webserver allowing for reverse-proxy and automatic SSL certifications.
```

 

```toc
style: number
```

 

---

 

### Installation
[[#^Top|TOP]]
 

#### Program installation

1. **Pull the software signature key & image**

```ad-command
~~~bash
echo "deb [trusted=yes] https://apt.fury.io/caddy/ /" | sudo tee -a /etc/apt/sources.list.d/caddy-fury.list
~~~
```

3. **Install caddy**

```ad-command
~~~bash
sudo apt update
sudo apt install caddy
~~~
```

Installing caddy will create a default user 'caddy'.

4. **Test install**

Go to the homepage to see the caddy default page.

 

#### Installing php

PHP needs to be enabled for caddy to work.

```ad-command
~~~bash
sudo add-apt-repository ppa:ondrej/php
sudo apt install php-cli php-fpm php-mysql
~~~
```

Check if php is installed correctly:

```ad-command
~~~bash
php --version
~~~
```

 

---

 

### Configuration of caddy
[[#^Top|TOP]]
 

Caddy will fetch a **SSL certificate** for all sub-domains and addresses present in the config file automatically, once the declaration is made properly.

 

#### Basic files & directories
[[#^Top|TOP]]
1. Create a default website folder

```ad-command
~~~bash
sudo mkdir -p /var/www/html
~~~
```

2. Create a default log folder

```ad-command
~~~bash
sudo mkdir /var/log/caddy
sudo chown -R caddy:caddy /var/log/caddy
~~~
```

 

---

 

#### Caddy configuration file
[[#^Top|TOP]]
Caddy's configuration file is inder:

```ad-path
/etc/caddy/Caddyfile
```

Default configuration is:

```ad-code
~~~javascript
(localhost) {
	root * /var/www/html
	encode gzip zstd
	php_fastcgi unix//run/php/php7.4-fpm.sock
	tls (service email) {
		protocols tls1.2 tls1.3
	}
}
~~~
```

 

---

 

#### PHP configuration file
[[#^Top|TOP]]
To update php, edit the following file:

```ad-path
/etc/php/7.4/fpm/pool.d/www.conf
```

Change all 'www-data' user reference with 'caddy' including:

```ad-code
~~~yaml
listen.owner = caddy
listen.group = caddy
~~~
```

Once this is done, restart php:

```ad-command
~~~bash
sudo systemctl restart php7.4-fpm
~~~
```

 

---

 

#### Configuring CORS
[[#^Top|TOP]]
 

##### Preliminary CORS code snippet

```ad-code
~~~javascript
(cors) {
        @origin{args.0} header Origin {args.0}
        header @origin{args.0} Access-Control-Allow-Origin "{args.0}"
}
~~~
```

 

##### CORS for a sub-domain

```ad-code
~~~javascript
 import cors (http://subdomain.tld)
 header Access-Control-Allow-Methods "POST, GET, OPTIONS, PUT"
 header Access-Control-Allow-Headers "*"
~~~
```

 

---

 

#### Configuration of a sub-domain suffix
[[#^Top|TOP]]
Configuration requires to add the following in the sub-domain definition of the [[Configuring Caddy#Caddy configuration file|Caddyfile]]:

```ad-code
~~~javascript
 handle_path /(suffix)* {
	 root * /(path to suffix)
	 file_server
 }
~~~
```

 

---

 

#### Configuring with the docker network
[[#^Top|TOP]]
Configuration of a service attached to the docker network is easy:

```ad-code
~~~javascript
(hostname) {
	encode zstd gzip
	reverse_proxy xxx.yyy.zzz.aaa:port
}
~~~
```

 

---

 

#### Configuring login with a cookie
[[#^Top|TOP]]
```ad-info
title: Tutorial
[Link](https://josheli.com/knob/2021/02/24/single-sign-on-in-caddy-server-using-only-the-caddyfile-and-basic-authentication/)
```

 

##### Preliminary login code snippets

1. **Creat hashed passwords**

```ad-command
~~~bash
caddy hash-password
~~~
```

2. **Define the array of users and hashed password**

In the [[Configuring Caddy#Caddy configuration file|Caddyfile]]:

```ad-code
~~~javascript
(basic-auth) {
	basicauth / {
		user hashed-password
	}
}
~~~
```
 
3. **Define the snippet to test whether the cookie is installed**

In the [[Configuring Caddy#Caddy configuration file|Caddyfile]]:

```ad-code
~~~javascript
(proxy-auth) {
% if cookie not = some-token-nonsense
	@no-auth {
		not header_regexp mycookie Cookie myid=(regex-to-match-id)
	}

% store current time, page and redirect to auth
	route @no-auth {
		header Set-Cookie "myreferer={scheme}://{host}{uri}; Domain=example.com; Path=/; Max-Age=30; HttpOnly; SameSite=Strict; Secure"
		redir https://auth.example.com
	}
}
~~~
```

 

##### Intermediary authentication page
[[#^Top|TOP]]
After setting up a new subdomain/page and appropriate DNS records, define it as follows in the [[Configuring Caddy#Caddy configuration file|Caddyfile]]:

```ad-code
~~~javascript
auth.example.com {
	route / {
% require authentication
		import basic-auth

% upon successful auth, set a client token
		header Set-Cookie "myid=some-long-hopefully-random-string; Domain=example.com; Path=/; Max-Age=3600; HttpOnly; SameSite=Strict; Secure"

% delete the referer cookie
		header +Set-Cookie "myreferer=null; Domain=example.com; Path=/; Expires=Thu, 25 Sep 1971 12:00:00 GMT; HttpOnly; SameSite=Strict; Secure"
     
% redirect back to the original site
		redir {http.request.cookie.myreferer}
	}

% fallback
	respond "Hi."
}
~~~
```

 

##### Adding authentication to a subdomain

Simply add the following at the top of all declarations for sub-domain definitions:

```ad-code
~~~javascript
import proxy-auth
~~~
```

 

---

 

#### Configuring logging for Caddy

1. In the [[Configuring Caddy#Caddy configuration file|Caddyfile]], add a logging module:

```ad-code
title: logging script
~~~javascript
(log) {
 
 log {

   output file /var/log/caddy/caddy.log {
    roll_local_time
	# Other parameters can be found on the Caddy website
   }
   format json # (or console)
   level INFO # (or ERROR)
 }
}
~~~
```

 

2. In the global configuration section, add the `import log` directive

```ad-code
~~~javascript
{
 import log
}
~~~
```

2. In each subdomain definition, add the following line

`import log`

 

---

 

### Utilities
[[#^Top|TOP]]
 

#### SSL Certification location

Look for a folder with the following sequence:

```ad-path
/.local/share/caddy
```

 

#### Reading the log file

Caddy does offer a `common_log` field in their JS log that can be called for consumption by other software:

```ad-command
~~~bash
sudo cat /var/log/caddy/caddy.log | jq -r ' .. | .common_log? | select(. !=null)'
~~~
```

 

#### Sending logs to user

In order to consume the logs, it is sent through a cron job to a [[Configuring Telegram bots|Telegram bot]].

The script is below:

```ad-code
~~~bash

~~~
```

 

---

 

### Basic commands
[[#^Top|TOP]]
A full repository of commands can be found [here](https://caddyserver.com/docs/)

 

#### Start/Stop/Restart

```ad-command
~~~bash
sudo systemctl start/stop/restart caddy
~~~
```

 

#### Reload config

Once config amended just run:

```ad-command
~~~bash
sudo systemctl reload caddy
~~~
```

[[#^Top|TOP]]