How is everything set up? Do you have a quick diagram or anything you can share? I’d like to understand how you have proxmox with a cert but not the rest, or what you mean by your own certs - like from LE? Where is your wildcard cert coming from?

I had some success using nginx reverse proxy with let’s encrypt.

There should be a couple of guides online that will tell you how to do that.

I was running Nginx through Portainer on Proxmox, and the Let’s Encrypt certificate was set to my local IP address for nginx.

IME Caddy will not do wildcard domains “by default” if you just configure sub.domain.com {} for everything. It will try to create a unique cert for each. You have to specifically configure it to use a wildcard cert.

Yeah it will, if you have even a single reference to a wildcard, preferably as one of your first entries in your caddyfile.

https://caddyserver.com/docs/automatic-https

You can literally get a wildcard cert by putting in the following entry, before any other routing logic:

*.domain.tld {
  respond "Wildcard Bitch!"
}

Firstly, wildcards are convenient but they break your functionality of authenticating the server to which you are connecting which is half of what TLS does. That may or may not be important to you.

Does it work without TLS? Start there, making sure dns and reverse proxy works, works, then add the certificate/TLS termination.

Its good practice to handle https on a reverse proxy. Also who actually does cert pinning?

I am neither stating TLS termination is wrong, nor providing instructions to cert pinning.

Firstly, wildcards are convenient but they break your functionality of to which you are connecting which is half of what TLS does. That may or may not be important to you.

You are implying that https is supposed to be done by the individual server and not reverse proxy. Since otherwise you could not “authenticating the server”

Short answer, it should work as you describe, everything local, no need to expose anything.

More information is needed to help.

Its either the caddy setup, maybe proxmox internal networking? Or most likely DNS, its almost always DNS.

Satan could help you little boy. Do you want working acme dns certs for everything? No more port 80 for anything if you just make a small arrangement with the devil.

The devil btw is AI, probably even self hostable. The new qwen model pretty solid if you have some hardware to run it on.

or ones proxmox could make

In proxmox, ACME is a service for the root CA of the cluster. It does use letsencrypt, but it does not provide certs for clients.

Sounds like you are probably conflating DNS and PKI certificates.

Yes, I probably did. I am familiar with computers, but know next to nothing about networking. So I was trying a bunch of various things I could find to try to get it to work. the proxmox ACME did not get me certs for my server or for a vm of proxmox so I abandoned that method and tried caddy and GoDoxy but never got them to get certs for services after various attempts. So I reached out here since there are many more people smarter than me here.

Caddy does certs by responding to ACME challenges on port 80 and 443. You need to forward those ports from the public internet back to Caddy, have you done that?

Edit: it seems like you’re doing DNS challenges. Did you compile Caddy yourself with the right plugins? Have you tested the API token work? Any Caddy logs?

Or do it like traefik can and do TLS challenge by proofing you can add TXT entries on your domain.

My setup: My domain-> vps <-wireguard->home ubuntu server behind 4G modem. My home server runs letsencrypt certbot for .mydomain.com My ubuntu server at home runs adguard home as DNS/DHCP/Android Private VPN. I have rules for adguard to forward any client coming from home lan 192.168.1. accessing mydomain.com to go directly to my home server local ip.

That way I run same certs and can access my local services via same urls - immich.mydomain.com runs from outside and inside my network, with ultra fast local uploads without using my modem data, etc.

Two things that I think are tripping you up:

1. DNS. Your router only maps proxmox.DOMAIN.com to 192.168.10.22. The other services (in LXCs, with their own container IPs) resolve to nothing, so the browser can’t reach Caddy for them at all - that’s why Proxmox works and the rest don’t. Either add a record per service name pointing at the right IP, or forward those service ports into Caddy.

2. Certs. If you want to stay fully local (nothing needs the internet), skip DNS challenges entirely: Caddy has a built-in CA (tls internal in the site block). It auto-issues self-signed certs for whatever hostname you hit, no challenge, no DNS. You do need to export that CA and install it as a trusted root on the machines you browse from, but after that every service works with zero DNS configuration.

Wildcard aside: DNS-01 + wildcard only covers issuance, it doesn’t fix the resolution gap in point 1.

If you’re open to egress, a quick tunnel (cloudflared) removes cert management completely - Cloudflare terminates TLS on a random public URL. That’s how I expose a small self-hosted API of mine; the trade-off is the URL changes on every tunnel restart.

+1 for cloudflare tunnels. But if you want to host locally, nginx proxy manager has a very intuitive gui you’ll be able to host your sites on.

Example:

Docker container exposes port 8989 for sonarr. Nginx proxy manager entry will be: Sonarr.mydomain.com > 192.168.0.50:8888 There’s a setting to allow ssl for your domain.

In your domain registrar, just put the a record for sonarr.mydomain.com to the local IP of nginx proxy manager, in this case let’s assume it’s the same IP as sonarr.

So now in your house your computer calls the domain, your dns server responds with 192.168.0.50. That’s the IP of your proxy.

Your proxy gets your request. Sees you’re trying to access sonarr, and passes your query along to it.

But like I said, cloudflare tunnels removes ALL of this and even supports google / azure SSO to keep you secure and keep logins convenient.

Came here to say this. Cloudflare tunnels ar3 amazing

Once youbuave cloudflared installed on a host, it created an inbound tunnel to whatever IP you configure. This server, and a bunch of other servers i have running, are running across a single clodludflare tunnel. It allows me to keep everything separate and automatically fixes when my public ip changes.

It also masks your public IP from prying eyes.

This is for traefik but might help to understand the process and change it for caddy (youtu.be/liV3c9m_OX8)

You should have

Service.local.domain.com

For local only services (Vaultwarden) and

Service.domain.com

For external things (immich)

I’m your router / Pihole locally, you setup the above URLs to point to the IP of caddy

I’m your router / Pihole locally, you setup the above URLs to point to the IP of caddy This is what I must be doing wrong. I have my router point to the url for the lxc services. So it is supposed to point to caddy. Thank you for the tip. I will try it out!

If you are doing a dns challenge then You need to give caddy access to your domain to perform the dns challenge. Depending on domain provider that is easy or hard. It will briefly change some records that tells let’s encrypt you own the domain and then issue the cert

Or you can do http challenge, this requires you to manually configure your domain to point to a publicly accessible caddy endpoint which is probably not what you want, maybe there is a way to make it work through a cloud flare tunnel

Who is your domain provider?

I use porkbun and I do the DNS challenge. I know it succeeds because proxmox gets https perfectly fine. But none of my lxc containers get https after doing DNS challenges for them. Not sure what I am doing wrong since I clearly did it right at least once :/

Nice, ok hmm… sounds like you are using the router for internal DNS, did you set all the services to point at caddy?

Eg you could try a quick hack in hosts (assuming the caddy ip is 192.168.10.10)

192.168.10.10 grafana.domain.example
192.168.10.10 prometheus.domain.example
192.168.10.10 jellyfin.domain.example

And then navigate to one of the services over https

Main thing is all your internal DNS records need to point at caddy, and then it forwards to the real container IP

Not strictly required but could be worthwhile to get a dedicated internal dns server up… I use technitium, or there’s pi hole or a few other options …

like you are using the router for internal DNS, did you set all the services to point at caddy?

That was the answer! I had it pointed to the services, but once I set them to point at Caddy, it all worked. I cannot believe it was such a simple fix and also that I never picked up on that in all the guides/tutorials/videos I watched about this. Thank you!

Nice :)