← Back to Homelab
services

Caddy Reverse Proxy

Identity

ServiceCaddy Reverse Proxy
Container Typelxc
VMID101
IP:Port10.1.10.101:443

Host

HostJack

Network

VLANVLAN 10 — Production

Resources

vCPU1
RAM512 MB
Disk6 GB
OSDebian 13 (trixie)
Domain*.hake.rodeo

Depends On

None

Depended On By

None

Overview

Caddy is the HTTPS reverse proxy for all internal services on the homelab. Every *.hake.rodeo subdomain routes through Caddy, which handles TLS termination using Let's Encrypt certificates obtained via Cloudflare DNS-01 challenges.

This means no service needs to manage its own TLS — Caddy sits in front of everything and provides valid certificates automatically. Because it uses DNS challenges instead of HTTP challenges, nothing needs to be exposed to the internet.

How It Works

  1. DNS resolution: Pi-hole has local DNS A records mapping each service.hake.rodeo subdomain to Caddy's IP (10.1.10.101)
  2. TLS termination: Caddy presents a valid Let's Encrypt certificate to the client
  3. Reverse proxy: Caddy forwards the request to the backend service over HTTP (or HTTPS with certificate verification skipped for self-signed backends like Proxmox)

Service Details

FieldValue
ContainerLXC (unprivileged)
VMID101
IP10.1.10.101
VLAN10 (Production)
OSDebian 13 (trixie)
Resources1 vCPU, 512 MB RAM, 6 GB disk
Caddyv2.11.1 (custom build via xcaddy)
TLSLet's Encrypt via Cloudflare DNS-01
Domain*.hake.rodeo

Current Routes

SubdomainBackendDescription
pihole.hake.rodeoPi-hole admin UIDNS management dashboard
jack.hake.rodeoProxmox VE web UIHypervisor management
ipmi.hake.rodeoSuperMicro BMCOut-of-band hardware management

New services are added by creating a Caddyfile entry and a Pi-hole local DNS record — Caddy picks up the change on reload with zero downtime.

Architecture

Caddy uses a custom binary built with xcaddy that includes the caddy-dns/cloudflare module. This module allows Caddy to create DNS TXT records in Cloudflare to prove domain ownership for the ACME DNS-01 challenge — no inbound ports required.

The Cloudflare API token is scoped to DNS edit permissions on the hake.rodeo zone only, limiting the blast radius if the token were ever compromised.

Services with self-signed HTTPS backends (Proxmox UI, IPMI BMC) use tls_insecure_skip_verify on the transport — Caddy trusts the backend connection since it's on the local network, while still presenting a valid Let's Encrypt cert to the client.