Bonjour,
Je rencontre quelque problème avec la configuration de CADDY en tant que reverse proxy.
j'ai un domaine interne, qui n'est pas géré par nous : "test.local"
Tout les éléments du sous-domaine pointe vers note passerelle opnsense, nous voulions dont effectuer des redirections vers les différents server qui sont derrière la passerelle opnsense (par exemple serveur JENKINS, GITLAB, etc). Nous avons donc configuré CADDY ainsi :
Caddyfile:
# DO NOT EDIT THIS FILE -- OPNsense auto-generated file
# caddy_user=root
# Global Options
{
log {
output net unixgram//var/run/caddy/log.sock {
}
format json {
time_format rfc3339
}
level DEBUG
}
servers {
protocols h1 h2 h3
log_credentials
}
email cicd@test.local
auto_https off
grace_period 10s
import /usr/local/etc/caddy/caddy.d/*.global
}
# Reverse Proxy Configuration
# Reverse Proxy Domain: "e544817d-abf6-4892-bce7-30865d5ba536"
proxy.test.local:443 {
tls /var/db/caddy/data/caddy/certificates/temp/67470493de394.pem /var/db/caddy/data/caddy/certificates/temp/67470493de394.key
handle {
reverse_proxy 172.117.100.254:8443 {
transport http {
tls_insecure_skip_verify
tls_trust_pool file /var/db/caddy/data/caddy/certificates/temp/6747033d03974.pem
}
}
}
}
# Reverse Proxy Domain: "a976d706-fcde-42ec-b0c4-32781942f63f"
proxmox-4.test.local:443 {
tls /var/db/caddy/data/caddy/certificates/temp/67470493de394.pem /var/db/caddy/data/caddy/certificates/temp/67470493de394.key
handle {
reverse_proxy 172.117.100.4:8006 {
}
}
}
import /usr/local/etc/caddy/caddy.d/*.conf
/usr/local/etc/caddy/caddy.d/01-tuned.conf:
ocsp_stappling off
Mais lorsque nous testons cette configuration nous et essayons d'atteindre un des deux noms FQDn que nous avons paramétré, nous avons une page blanche. Voici un extrait des logs :
2024-12-01T15:40:29 Debug caddy "debug","ts":"2024-12-01T15:40:29Z","logger":"http.auto_https","msg":"adjusted config","tls":{"automation":{"policies":[{"subjects":["ocsp_stapling","off","proxmox-4.test.local","proxy.test.local"]},{}]}},"http":{"grace_period":10000000000,"servers":{"srv0":{"listen":[":443"],"routes":[{"handle":[{"handler":"subroute","routes":[{"handle":[{"handler":"subroute","routes":[{"handle":[{"handler":"reverse_proxy","upstreams":[{"dial":"172.117.100.4:8006"}]}]}]}]}]}],"terminal":true},{"handle":[{"handler":"subroute","routes":[{"handle":[{"handler":"subroute","routes":[{"handle":[{"handler":"reverse_proxy","transport":{"protocol":"http","tls":{"ca":{"pem_files":["/var/db/caddy/data/caddy/certificates/temp/6747033d03974.pem"],"provider":"file"},"insecure_skip_verify":true}},"upstreams":[{"dial":"172.117.100.254:8443"}]}]}]}]}]}],"terminal":true},{"terminal":true}],"tls_connection_policies":[{"match":{"sni":["proxmox-4.test.local"]},"certificate_selection":{"any_tag":["cert0"]}},{"match":{"sni":["proxy.test.local"]},"certificate_selection":{"any_tag":["cert0"]}},{}],"automatic_https":{"disable":true},"logs":{"should_log_credentials":true},"protocols":["h1","h2","h3"]}}}}
2024-12-01T15:40:29 Informational caddy "info","ts":"2024-12-01T15:40:29Z","logger":"http.auto_https","msg":"automatic HTTPS is completely disabled for server","server_name":"srv0"}
2024-12-01T15:40:29 Debug caddy "debug","ts":"2024-12-01T15:40:29Z","logger":"tls.cache","msg":"added certificate to cache","subjects":["test.local","*.test.local"],"expiration":"2025-06-09T15:08:24Z","managed":false,"issuer_key":"","hash":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","cache_size":1,"cache_capacity":10000}
2024-12-01T15:40:29 Debug caddy "debug","ts":"2024-12-01T15:40:29Z","logger":"events","msg":"event","name":"cached_unmanaged_cert","id":"7ebd454a-b7bb-45f7-8034-fe782ee1aece","origin":"tls","data":{"sans":["test.local","*.test.local"]}}
2024-12-01T15:40:29 Error caddy "warn","ts":"2024-12-01T15:40:29Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [test.local *.test.local]: making OCSP request: Post \"http://ocsp.pki.test.local/ocsp\": dial tcp XX.XXX.XXX.XX:80: i/o timeout"}
2024-12-01T15:39:59 Informational caddy "info","ts":"2024-12-01T15:39:59Z","logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0x870473a00"}
2024-12-01T15:39:48 Informational caddy "info","ts":"2024-12-01T15:39:48Z","logger":"http.log.access","msg":"NOP","request":{"remote_ip":"XX.XXX.XXX.XX","remote_port":"59262","client_ip":"XX.XXX.XXX.XX","proto":"HTTP/2.0","method":"GET","host":"proxy.test.local","uri":"/favicon.ico","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0"],"Sec-Fetch-Mode":["no-cors"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Cookie":["PHPSESSID=041ca8540ea5877502724dcd63c89a73"],"Sec-Ch-Ua":["\"Chromium\";v=\"130\", \"Microsoft Edge\";v=\"130\", \"Not?A_Brand\";v=\"99\""],"Sec-Fetch-Site":["same-origin"],"Referer":["https://proxy.test.local/"],"Accept-Language":["fr,fr-FR;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6"],"Priority":["u=1, i"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Dnt":["1"],"Sec-Ch-Ua-Mobile":["?0"],"Accept":["image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8"],"Sec-Fetch-Dest":["image"]},"tls":{"resumed":false,"version":772,"cipher_suite":4867,"proto":"h2","server_name":"proxy.test.local"}},"bytes_read":0,"user_id":"","duration":0.000005539,"size":0,"status":0,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"]}}
Est-ce quelqu'un pourrait m'aiguiller et/ou m'aider ? D'avance merci.
Hello,
I'm having some trouble configuring CADDY as a reverse proxy.
I have an internal domain, which is not managed by us: "test.local".
All the elements of the sub-domain point to our opnsense gateway, so we wanted to redirect to the different servers behind the opnsense gateway (e.g. JENKINS server, GITLAB, etc). This is how we configured CADDY:
Caddyfile:
# DO NOT EDIT THIS FILE -- OPNsense auto-generated file
# caddy_user=root
# Global Options
{
log {
output net unixgram//var/run/caddy/log.sock {
}
format json {
time_format rfc3339
}
level DEBUG
}
servers {
protocols h1 h2 h3
log_credentials
}
email cicd@test.local
auto_https off
grace_period 10s
import /usr/local/etc/caddy/caddy.d/*.global
}
# Reverse Proxy Configuration
# Reverse Proxy Domain: "e544817d-abf6-4892-bce7-30865d5ba536"
proxy.test.local:443 {
tls /var/db/caddy/data/caddy/certificates/temp/67470493de394.pem /var/db/caddy/data/caddy/certificates/temp/67470493de394.key
handle {
reverse_proxy 172.117.100.254:8443 {
transport http {
tls_insecure_skip_verify
tls_trust_pool file /var/db/caddy/data/caddy/certificates/temp/6747033d03974.pem
}
}
}
}
# Reverse Proxy Domain: "a976d706-fcde-42ec-b0c4-32781942f63f"
proxmox-4.test.local:443 {
tls /var/db/caddy/data/caddy/certificates/temp/67470493de394.pem /var/db/caddy/data/caddy/certificates/temp/67470493de394.key
handle {
reverse_proxy 172.117.100.4:8006 {
}
}
}
import /usr/local/etc/caddy/caddy.d/*.conf
/usr/local/etc/caddy/caddy.d/01-tuned.conf:
ocsp_stappling off
But when we test this configuration and try to reach one of the two FQDn names we've set up, we get a blank page. Here's an extract from the logs:
2024-12-01T15:40:29 Debug caddy "debug","ts":"2024-12-01T15:40:29Z","logger":"http.auto_https","msg":"adjusted config","tls":{"automation":{"policies":[{"subjects":["ocsp_stapling","off","proxmox-4.test.local","proxy.test.local"]},{}]}},"http":{"grace_period":10000000000,"servers":{"srv0":{"listen":[":443"],"routes":[{"handle":[{"handler":"subroute","routes":[{"handle":[{"handler":"subroute","routes":[{"handle":[{"handler":"reverse_proxy","upstreams":[{"dial":"172.117.100.4:8006"}]}]}]}]}]}],"terminal":true},{"handle":[{"handler":"subroute","routes":[{"handle":[{"handler":"subroute","routes":[{"handle":[{"handler":"reverse_proxy","transport":{"protocol":"http","tls":{"ca":{"pem_files":["/var/db/caddy/data/caddy/certificates/temp/6747033d03974.pem"],"provider":"file"},"insecure_skip_verify":true}},"upstreams":[{"dial":"172.117.100.254:8443"}]}]}]}]}]}],"terminal":true},{"terminal":true}],"tls_connection_policies":[{"match":{"sni":["proxmox-4.test.local"]},"certificate_selection":{"any_tag":["cert0"]}},{"match":{"sni":["proxy.test.local"]},"certificate_selection":{"any_tag":["cert0"]}},{}],"automatic_https":{"disable":true},"logs":{"should_log_credentials":true},"protocols":["h1","h2","h3"]}}}}
2024-12-01T15:40:29 Informational caddy "info","ts":"2024-12-01T15:40:29Z","logger":"http.auto_https","msg":"automatic HTTPS is completely disabled for server","server_name":"srv0"}
2024-12-01T15:40:29 Debug caddy "debug","ts":"2024-12-01T15:40:29Z","logger":"tls.cache","msg":"added certificate to cache","subjects":["test.local","*.test.local"],"expiration":"2025-06-09T15:08:24Z","managed":false,"issuer_key":"","hash":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx","cache_size":1,"cache_capacity":10000}
2024-12-01T15:40:29 Debug caddy "debug","ts":"2024-12-01T15:40:29Z","logger":"events","msg":"event","name":"cached_unmanaged_cert","id":"7ebd454a-b7bb-45f7-8034-fe782ee1aece","origin":"tls","data":{"sans":["test.local","*.test.local"]}}
2024-12-01T15:40:29 Error caddy "warn","ts":"2024-12-01T15:40:29Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [test.local *.test.local]: making OCSP request: Post \"http://ocsp.pki.test.local/ocsp\": dial tcp XX.XXX.XXX.XX:80: i/o timeout"}
2024-12-01T15:39:59 Informational caddy "info","ts":"2024-12-01T15:39:59Z","logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0x870473a00"}
2024-12-01T15:39:48 Informational caddy "info","ts":"2024-12-01T15:39:48Z","logger":"http.log.access","msg":"NOP","request":{"remote_ip":"XX.XXX.XXX.XX","remote_port":"59262","client_ip":"XX.XXX.XXX.XX","proto":"HTTP/2.0","method":"GET","host":"proxy.test.local","uri":"/favicon.ico","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0"],"Sec-Fetch-Mode":["no-cors"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Cookie":["PHPSESSID=041ca8540ea5877502724dcd63c89a73"],"Sec-Ch-Ua":["\"Chromium\";v=\"130\", \"Microsoft Edge\";v=\"130\", \"Not?A_Brand\";v=\"99\""],"Sec-Fetch-Site":["same-origin"],"Referer":["https://proxy.test.local/"],"Accept-Language":["fr,fr-FR;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6"],"Priority":["u=1, i"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Dnt":["1"],"Sec-Ch-Ua-Mobile":["?0"],"Accept":["image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8"],"Sec-Fetch-Dest":["image"]},"tls":{"resumed":false,"version":772,"cipher_suite":4867,"proto":"h2","server_name":"proxy.test.local"}},"bytes_read":0,"user_id":"","duration":0.000005539,"size":0,"status":0,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"]}}
Can anyone help me? Thanks.
Blank page means caddy can not connect to the upstream.
https://docs.opnsense.org/manual/how-tos/caddy.html#caddy-troubleshooting
proxy.test.local:443 {
tls /var/db/caddy/data/caddy/certificates/temp/67470493de394.pem /var/db/caddy/data/caddy/certificates/temp/67470493de394.key
handle {
reverse_proxy 172.117.100.254:8443 {
transport http {
tls_insecure_skip_verify
tls_trust_pool file /var/db/caddy/data/caddy/certificates/temp/6747033d03974.pem
}
}
}
}
It's himself, and works. Trys with host inside network :
[xxxxx@localhost ~]$ wget --no-check-certificate https://172.117.100.254:8443
--2024-12-02 11:05:34-- https://172.117.100.254:8443/
Connexion à 172.117.100.254:8443... connecté.
Avertissement : le certificat de « 172.117.100.254 » n'est pas de confiance.
Avertissement : le certificat de « 172.117.100.254 » n'est pas d'un émetteur connu.
Le propriétaire du certificat ne correspond pas au nom d'hôte « 172.117.100.254 »
requête HTTP transmise, en attente de la réponse... 200 OK
Taille : 2804 (2,7K) [text/html]
Sauvegarde en : « index.html »
index.html 100%[=================================================================================================================>] 2,74K --.-KB/s ds 0s
2024-12-02 11:05:34 (103 MB/s) — « index.html » sauvegardé [2804/2804]
I check Firewall, not block found
All log during sequence from outside :
<15>1 2024-12-02T13:11:20+00:00 proxy.interco.ppis.local caddy - - [meta sequenceId="25"] "debug","ts":"2024-12-02T13:11:20Z","logger":"events","msg":"event","name":"tls_get_certificate","id":"db0a0029-024f-4066-895a-1e922064d06a","origin":"tls","data":{"client_hello":{"CipherSuites":[27242,4865,4866,4867,49195,49199,49196,49200,52393,52392,49171,49172,156,157,47,53],"ServerName":"proxy.test.local","SupportedCurves":[14906,25497,29,23,24],"SupportedPoints":"AA==","SignatureSchemes":[1027,2052,1025,1283,2053,1281,2054,1537],"SupportedProtos":["h2","http/1.1"],"SupportedVersions":[56026,772,771],"RemoteAddr":{"IP":"xx.XXX.XXX.xx","Port":60220,"Zone":""},"LocalAddr":{"IP":"172.117.100.254","Port":443,"Zone":""}}}}
<15>1 2024-12-02T13:11:20+00:00 proxy.interco.ppis.local caddy - - [meta sequenceId="26"] "debug","ts":"2024-12-02T13:11:20Z","logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"proxy.test.local"}
<15>1 2024-12-02T13:11:20+00:00 proxy.interco.ppis.local caddy - - [meta sequenceId="27"] "debug","ts":"2024-12-02T13:11:20Z","logger":"tls.handshake","msg":"choosing certificate","identifier":"*.test.local","num_choices":1}
<15>1 2024-12-02T13:11:20+00:00 proxy.interco.ppis.local caddy - - [meta sequenceId="28"] "debug","ts":"2024-12-02T13:11:20Z","logger":"tls.handshake","msg":"default certificate selection results","identifier":"*.test.local","subjects":["test.local","*.test.local"],"managed":false,"issuer_key":"","hash":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}
<15>1 2024-12-02T13:11:20+00:00 proxy.interco.ppis.local caddy - - [meta sequenceId="29"] "debug","ts":"2024-12-02T13:11:20Z","logger":"tls.handshake","msg":"matched certificate in cache","remote_ip":"xx.XXX.XXX.xx","remote_port":"60220","subjects":["test.local","*.test.local"],"managed":false,"expiration":"2025-06-09T15:08:24Z","hash":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}
<14>1 2024-12-02T13:11:20+00:00 proxy.interco.ppis.local caddy - - [meta sequenceId="30"] "info","ts":"2024-12-02T13:11:20Z","logger":"http.log.access","msg":"NOP","request":{"remote_ip":"xx.XXX.XXX.xx","remote_port":"60220","client_ip":"xx.XXX.XXX.xx","proto":"HTTP/2.0","method":"GET","host":"proxy.test.local","uri":"/","headers":{"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"],"Sec-Fetch-Site":["none"],"Accept-Language":["fr,fr-FR;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Dnt":["1"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0"],"Sec-Fetch-User":["?1"],"Sec-Fetch-Dest":["document"],"Cache-Control":["max-age=0"],"Upgrade-Insecure-Requests":["1"],"Cookie":["PHPSESSID=32f6a02cad9b11a12f70f6738099a03b"],"Priority":["u=0, i"],"Sec-Ch-Ua":["\"Chromium\";v=\"130\", \"Microsoft Edge\";v=\"130\", \"Not?A_Brand\";v=\"99\""],"Sec-Ch-Ua-Mobile":["?0"],"Sec-Fetch-Mode":["navigate"],"Accept-Encoding":["gzip, deflate, br, zstd"]},"tls":{"resumed":false,"version":772,"cipher_suite":4867,"proto":"h2","server_name":"proxy.test.local"}},"bytes_read":0,"user_id":"","duration":0.000004447,"size":0,"status":0,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"]}}
<14>1 2024-12-02T13:11:20+00:00 proxy.interco.ppis.local caddy - - [meta sequenceId="31"] "info","ts":"2024-12-02T13:11:20Z","logger":"http.log.access","msg":"NOP","request":{"remote_ip":"xx.XXX.XXX.xx","remote_port":"60220","client_ip":"xx.XXX.XXX.xx","proto":"HTTP/2.0","method":"GET","host":"proxy.test.local","uri":"/favicon.ico","headers":{"Dnt":["1"],"Sec-Fetch-Site":["same-origin"],"Cookie":["PHPSESSID=32f6a02cad9b11a12f70f6738099a03b"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Sec-Fetch-Mode":["no-cors"],"Sec-Fetch-Dest":["image"],"Referer":["https://proxy.test.local/"],"Sec-Ch-Ua":["\"Chromium\";v=\"130\", \"Microsoft Edge\";v=\"130\", \"Not?A_Brand\";v=\"99\""],"Sec-Ch-Ua-Mobile":["?0"],"Accept":["image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Accept-Language":["fr,fr-FR;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6"],"Priority":["u=1, i"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0"]},"tls":{"resumed":false,"version":772,"cipher_suite":4867,"proto":"h2","server_name":"proxy.test.local"}},"bytes_read":0,"user_id":"","duration":0.000003265,"size":0,"status":0,"resp_headers":{"Alt-Svc":["h3=\":443\"; ma=2592000"],"Server":["Caddy"]}}
But i found something strange, when WAN it's down and change CADDY conf, save take 1 seconde but when WAN it's UP save take more than 30 secondes
Logs 'caddy.log' when restart :[/u]
{"level":"info","ts":1733136775.7909224,"msg":"using config from file","file":"/usr/local/etc/caddy/Caddyfile"}
{"level":"warn","ts":1733136775.791252,"msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
{"level":"info","ts":1733136775.7934656,"msg":"adapted config to JSON","adapter":"caddyfile"}
{"level":"info","ts":1733136775.7940602,"msg":"redirected default logger","from":"stderr","to":"unixgram//var/run/caddy/log.sock"}
Error: caddy process exited with error: signal: killed
{"level":"info","ts":1733136797.754398,"msg":"using config from file","file":"/usr/local/etc/caddy/Caddyfile"}
{"level":"warn","ts":1733136797.754707,"msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
{"level":"info","ts":1733136797.7570026,"msg":"adapted config to JSON","adapter":"caddyfile"}
{"level":"info","ts":1733136797.7575955,"msg":"redirected default logger","from":"stderr","to":"unixgram//var/run/caddy/log.sock"}
Successfully started Caddy (pid=28308) - Caddy is running in the background
Before someone say, i have fixed error with "Custom Configuration Files".
Rename "/usr/local/etc/caddy/caddy.d/01-tuned.conf" into "/usr/local/etc/caddy/caddy.d/01-tuned.global"
And it seem solve the problem with long save time (think because now Caddy not try to solve OCSP)
Bon nous avons décider d'utiliser un autre plugin (Nginx) avec lesquels nous avons réussi à fonctionner comme
attendue.
So we decided to use another plugin (Nginx) which worked as expected.