mheys1/docker-dynamic-caddy repository overview

⁠Dynamic reverse proxy to your home lab with Caddy

This is a docker container that monitors your other docker containers to reverse proxy them, it looks for labels that start with caddy.dynamic.docker to automatically configure Caddy, there is a web interface where you can see what it has setup and you can also add manual proxies. It keeps a list in memory and when a request comes in Caddy will check to see if it's allowed to get a certificate for that domain using the on_demand_tls endpoint, after which it will then use the built in DNS server in DDC to determine where to proxy a request to. I've not tried this extensively but I think you can load balance services by pointing a single DNS entry to multiple endpoints.

This example gives a simple overview of how it works and dynamically configures it's own web interface to caddy.{DOMAIN_NAME}. It is recommended to use something like Authelia as a forward auth for Caddy to keep your homelab secure, Authelia can then put a forms based login with 2FA in front of all your apps, or can be configured to allow some to bypass. Authelia is out of scope for this and we have just used basic auth to keep you from proxying all your apps to the internet with no security at all.

Once the container is up and running you can look at the configuration file to see how to connect other docker hosts other than the standard one using either unix, npipe or tcp pipes.

Finally if you try and reverse proxy to an external port mapped on the same host to another container, this won't work, this is a limitation called a hairpin NAT, I'm not sure if this is an OS or Docker limitation but it doesn't work without some IPTABLES reconfiguration, so use the internal network and set the container names so they can be resolved internally with Caddy, this is a security benefit as it means no one can access your containers without using the security you have configured in Caddy.

This is all very early stages so I apologise if there are any mistakes or bad information, when I finally get this up on GitHub you will be able to open issues, in the mean time it's being hosted on my own private Gitea instance.

⁠Docker Compose

version: '3.5'

networks:
  internal:
    name: internal
    driver: bridge

services:
  caddy:
    image: caddy
    container_name: caddy
    restart: always
    ports:
      - 80:80
      - 443:443
    environment:
      - DOMAIN_NAME=${DOMAIN_NAME}
      - BASIC_USER=${BASIC_USER}
      - BASIC_PASSWORD=${BASIC_PASSWORD}
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile
      - ./caddy/data:/data
    depends_on:
      - docker-dynamic-caddy
    networks:
      - internal

  docker-dynamic-caddy:
    container_name: docker-dynamic-caddy
    image: mheys1/docker-dynamic-caddy
    restart: always
    labels:
      - caddy.dynamic.docker.dns=caddy.${DOMAIN_NAME}
      - caddy.dynamic.docker.target=docker-dynamic-caddy:5000
    volumes:
      - ./docker-dynamic-caddy/data:/app/data
      - ./docker-dynamic-caddy/logs:/app/logs
      - ./docker-dynamic-caddy/config:/app/config
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - internal

⁠Caddyfile

{
  log {
    output stdout
  }
  on_demand_tls {
    ask http://docker-dynamic-caddy:5000/ask
  }
}

*.{$DOMAIN_NAME} {
  basicauth {
    {$BASIC_USER} {$BASIC_PASSWORD}
  }
  reverse_proxy {
    dynamic srv "srv-{http.request.host}" {
      resolvers docker-dynamic-caddy:53
    }
  }
  tls {
    on_demand
  }
}