victimofareload/caddylogs repository overview

⁠Caddy Log Interface

A self-hosted dashboard for Caddy⁠'s access logs, and a web editor for your Caddyfile — in one container that runs next to Caddy.

• Statistics that outlive your logs — hits, status codes, top URLs and addresses, bandwidth, latency, a visitor-country map, networks, browsers and referrers, per domain. History is kept in its own database, so rotating or deleting logs loses nothing.
• Drill into anything — every number resolves to the individual requests behind it; search with host: status: ua: ip: terms; watch a live stream.
• Manage Caddy — add, change, disable and remove sites from forms with help for almost every option, or edit the Caddyfile directly. Every change is shown as a diff, validated by Caddy and applied with a zero-downtime reload, with a history you can restore from.
• Built for a server that faces the internet — non-root, read-only filesystem, hashed sessions, CSRF protection, login throttling, strict CSP. No Docker socket and no network-exposed admin port.

Source, full documentation and issues: https://github.com/nickolsen8390/caddylogs⁠

⁠Quick start: Caddy and the interface together

The compose file from the repository runs Caddy and this image side by side.

mkdir caddylogs && cd caddylogs
base=https://raw.githubusercontent.com/nickolsen8390/caddylogs/main
curl -fsSLO "$base/docker-compose.yml"
curl -fsSL "$base/.env.example" -o .env
mkdir -p data geoip caddy/conf caddy/run caddy/logs caddy/data caddy/config
curl -fsSL "$base/Caddyfile.example" -o caddy/conf/Caddyfile
sudo chown -R 1000:1000 data caddy/conf caddy/run && sudo chmod 700 caddy/run

The container runs as UID 1000 (PUID/PGID in .env); it only has to own those three directories, and does not need to exist as a host account.

Set who may sign in, in .env:

AUTH_USERS=admin:<a long, unique password>

In caddy/conf/Caddyfile, replace logs.example.com with your host name and the example addresses on the @notlocal line with the networks allowed to reach the interface (everyone else gets 403). Then:

docker compose up -d

The interface listens on port 8899; the example Caddyfile serves it over HTTPS on your host name. For visitor countries, add the free MaxMind GeoLite2-Country.mmdb to geoip/.

Already running Caddy? The README explains how to move its certificates, Caddyfile and logs into this stack: https://github.com/nickolsen8390/caddylogs#moving-an-existing-caddy-into-this-stack⁠

⁠Dashboard only, next to an existing Caddy

Without the Caddy management mounts, set CADDY_MANAGE=false:

docker run -d --name caddylogs --restart unless-stopped \
  --user 1000:1000 --read-only --tmpfs /tmp -p 8899:8899 \
  -e AUTH_USERS='admin:<password>' -e CADDY_MANAGE=false \
  -v "$PWD/data:/data" -v /var/log/caddy:/logs:ro \
  victimofareload/caddylogs:1

Caddy must write JSON access logs (format json) into the mounted directory, readable by the container user (mode 0644 on the log output). ./data must be owned by the --user you run as. Over plain HTTP, also set COOKIE_SECURE=false.

⁠Mounts

⁠Main settings

Every setting is documented in .env.example⁠.

⁠Tags

Images are built for linux/amd64 and linux/arm64 by GitHub Actions from tagged releases, with provenance and SBOM attestations. Changelog⁠

⁠Security and license

Report vulnerabilities privately — see SECURITY.md⁠. MIT licensed.