How to use caddy as reverse proxy for local domain with https

Question

Is it possible to use caddy for local development where you have https://mysite.loc and use Caddyfile as reverse proxy to your services running on localhost?

My hosts file so I have local mysite.loc domain

127.0.0.1   mysite.loc

mysite.loc {
  reverse_proxy /api localhost:5000
  reverse_proxy /admin localhost:6000
  reverse_proxy /graphql localhost:7000
  reverse_proxy localhost:4000

  tls ???
}

And thats about how far I got. I think I need to somehow point mysite.loc to running caddy daemon so it can intercept the request provide generated certs which I would then trust locally and also act as proxy redirecting to my locally running services. I also think I don't need to generate any certificates myself caddy should do it right? I would also like to avoid having to use any ports for mysite.loc like https://mysite.loc:4000 just https://mysite.loc and then let Caddy handle the rest. I would also like to avoid using docker.

Spaceman

Answer 1

I haven't tested this but my gut reaction is: No, you can't.

My reason is that caddy secures HTTPS via Let's Encrypt (LE), and LE works by authenticating the site via caddy placing a beacon internally on the server and LE then querying the beacon has the correct contents. So LE will fail to query if this site is simply on localhost and not open to WAN. LE needs access. You could try opening your site to WAN, doing the LE auth, then closing it to WAN but I'm not sold that would work.

That being said, if all you want is HTTPS locally for dev, use a self-signed cert. Keep in mind HTTPS is silly for local dev because the whole point of HTTPS is to encrypt in-transit and there is no transit for localhost

Lek

"HTTPS is silly for local dev" Not true theres secure flag for cookies which allows them to be set just via https – Spaceman

Also if you're doing geolocation on the browser. It needs a secure connection (HTTPS). – Citrin

Answer 2

It seems that using .localhost instead of .loc is enough to get https for anyone looking to get started heres one of my recent Caddyfiles

Caution: I was kind of hesitant to post this as an answer because browsers get their updates automatically all the time so what works today might not next time you open your browser.

{
    email [email protected]

    log {
        format console
    }
}

www.{$DOMAIN} {
    redir https://{$DOMAIN}{uri}
}

{$DOMAIN} {
    @websockets {
        header Connection *Upgrade*
        header Upgrade websocket
    }

    reverse_proxy /graphiql {$API_SERVICE}
    reverse_proxy /voyager {$API_SERVICE}
    reverse_proxy /graphql {$API_SERVICE}
    reverse_proxy /f/* {$API_SERVICE}

    reverse_proxy @websockets {$CLIENT_SERVICE}
    reverse_proxy {$CLIENT_SERVICE}
}

Spaceman

Answer 3

Check Caddy Local HTTPS configuration. Also, caddy can issue certificates to ACME clients. Details available on Caddy ACME Server.

Sabec

Answer 4

It's possible to get SSL locally however the auto-ssl feature in Caddy will not work since that utilizes Let's Encrypt.

I suggest trying mkcert, after you have successfully installed mkcert run mkcert mysite.loc to generate a certificate and it should return something like:

Created a new certificate valid for the following names 📜
 - "mysite.loc"

The certificate is at "./mysite.loc.pem" and the key at "./mysite.loc-key.pem" ✅

It will expire on 6 March 2025

And then inside your Caddyfile add the tls directive

mysite.loc {
  reverse_proxy /api localhost:5000
  reverse_proxy /admin localhost:6000
  reverse_proxy /graphql localhost:7000
  reverse_proxy localhost:4000

  tls mysite.loc.pem mysite.loc-key.pem
}

then run it and it should just work!

Getty

Caddy advertises itself to have local https by default but then I need to make cert manually and use it. That's not the experience I am looking for. Been using Laravel valet and quite interested in Caddy, Valet has a command to proxy local domains by default, it's not automatic but I would rather do it than make the cert and configure config. I'm not really sold into Caddy but maybe I could give it a few more times before I go back to Valet. – Devin

Okay...? It does have Local HTTPS now with their own CA, you just need to add it so it's trusted. – Getty