blog/source/_posts/caddy-upgrade-v2-proxy.md at 4f26c5e813e713f5fef29ce775534dcd4836b3b1

7.2 KiB

Raw Blame History

title

excerpt

date

updated

proxy to reverse_proxy

proxy directive is updated to reverse_proxy.

Reverse proxy the whole website:

proxy / https://backend.com

In v2, the matcher needs *:

reverse_proxy /* https://backend.com

If no matcher is specified, it defaults to /* which match every path:

reverse_proxy https://backend.com

Custom path

Reverse proxy a certain path, like /api:

reverse_proxy /api/* https://backend.com

Requests to https://example.com/api/foo/bar/ is redirected to https://backend.com/api/foo/bar/.

To remove the path prefix:

proxy /api https://backend.com {
  without /api
}

Requests to https://example.com/api/foo/bar/ is redirected to https://backend.com/foo/bar/.

v2 doesn't have without directive, instead you need to use route the request and remove the prefix using uri strip_prefix:

route /api/* {
	uri strip_prefix /api
	reverse_proxy https://backend.com
}

v2.1 adds handle_path directive which integrates prefix stripping:

handle_path /api/* {
	reverse_proxy https://backend.com
}

Backend with custom path

Reverse proxy with custom path:

proxy /img https://backend.com/img/blog {
  without /img
}

v2 doesn't support custom path, instead you need to use rewrite to prepend the path:

route /img/* {
  uri strip_prefix /img

  rewrite * /img/blog{path}

  reverse_proxy https://backend.com
}

handle_path /img/* {
  rewrite * /img/blog{path}
  reverse_proxy https://backend.com
}

header_upstream to header_up

proxy / https://backend.com {
  header_upstream Host backend.com
}

reverse_proxy https://backend.com {
  header_up Host backend.com
}

header_downstream to header_down

proxy / https://backend.com {
  header_downstream -server
}

reverse_proxy https://backend.com {
  header_up -server
}

HTTP only (disable HTTPS/TLS)

example.com:8080 {
  tls off
}

In v2, tls doesn't have off option, instead you can specify http:// to listen on HTTP only:

http://example.com:8080 {

}

Redirect www subdomain

Remove www. subdomain with HTTP 301 Permanent redirect:

example.com www.example.com {
  redir 301 {
    if {label1} is www
    / https://example.com{uri}
  }
}

example.com www.example.com {
  @www {
    host www.example.com
  }
  redir @www https://example.com{uri} permanent
}

v2.1 supports single-line matcher:

example.com www.example.com {
  @www host www.example.com
  redir @www https://example.com{uri} permanent
}

Add www. subdomain:

example.com www.example.com {
  redir 301 {
    if {label1} is example
    / https://www.example.com{uri}
  }
}

example.com www.example.com {
  @www {
    host example.com
  }
  redir @www https://www.example.com{uri} permanent
}

example.com www.example.com {
  @www host example.com
  redir @www https://www.example.com{uri} permanent
}

header and reverse_proxy

header directive still keeps similar syntax, but operates a bit different. In v2, when used alongside with reverse_proxy, Caddy modifies the header before receiving header response from the backend. This behaviour is apparent when you want to replace existing header(s); instead of replacing, Caddy adds the header and results in duplicate headers. To avoid this issue, you should use defer:

  header {
    -server
    Referrer-Policy "no-referrer"
    defer
  }

Disable HTTP -> HTTPS redirects

In v2, Caddy automatically listens on HTTP (port 80) and redirects to HTTPS, whereas in v1, you need add a separate redir 301. This is handy is most use cases, but doesn't apply to my {% post_link caddy-nixos-part-3 'use case' %}--listens on HTTPS only.

In v2.0, this can only be disabled in JSON.

v2.1 supports configuring Automatic HTTPS in Caddyfile using auto_https global option:

{
  auto_https disable_redirects
}

TLS client authentication

Client authentication adds another step to TLS connection process whereby a client needs to present a certificate (that has been signed by a CA certificate) to the server (which has the CA certificate) when it attempts to establish a TLS connection. Once the client is authenticated, the process is reversed and client authenticates the server instead. The padlock icon next to the web address indicates that the website's certificate is valid. Client authentication is only used in private web server to restrict access to authorised clients only. In my case, I restrict my origin server to Cloudflare CDN only; mdleom.com is only accessible via Cloudflare, direct connection to the origin server will be dropped.