[Solved] Problem Reverse Proxy Caddy and Login Synology DSM with Yubikey

[Patrick M. Hausen]

Your backend did not provide a complete response - check the log files of your backend.

[Ronny1978]

Hello Patrick.

Thank you for helping me. May be this?

Code Select Expand

[2026-04-16 14:03:34.284 +00:00] [INF] Sending ForceKeepAlive message to 1 inactive WebSockets.
[2026-04-16 14:03:46.284 +00:00] [INF] Lost 1 WebSockets.
[2026-04-16 14:30:56.131 +00:00] [WRN] WS "10.0.80.1" error receiving data: "The remote party closed the WebSocket connection without completing the close handshake."
[2026-04-16 14:30:56.142 +00:00] [INF] WS "10.0.80.1" closed
[2026-04-16 15:04:41.396 +00:00] [INF] WS "10.0.80.1" request

[Patrick M. Hausen]

You configured the host header as linked by me and activated that host header in your handler configuration under "Transport"?

[viragomann]

Do you use 2 Reverse Proxys? Caddy AND HAProxy?

Not on the same OPNsense instance.
I use Caddy at home and HAproxy at the company.

I have seen in the protocoll of caddy another error. I'm not sure, what the error message means.

Code Select Expand

"warn","ts":"2026-04-16T15:06:23Z","logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","upstream":"10.0.80.9:8096","duration":0.043666007,"request":{"remote_ip":"xxx.xxx.xx.xx","remote_port":"64698","client_ip":"xxx.xxx.xx.xx","proto":"HTTP/2.0","method":"GET","host":"jellyfin-nas01.xxxxxx","uri":"/Videos/d98dd6bf-5112-6253-69c2-3e678e867234/stream?container=mkv&static=true&tag=0fee8bb2a7d611d87a8b8fd6a2daf47f&mediaSourceId=d98dd6bf5112625369c23e678e867234&streamOptions=%7B%7D&enableAudioVbrEncoding=true","headers":{"X-Forwarded-For":["xxx.xxx.xx.xx"],"X-Forwarded-Proto":["https"],"Accept-Encoding":["identity"],"User-Agent":["okhttp/4.12.0"],"Icy-Metadata":["1"],"X-Forwarded-Host":["jellyfin-nas01.xxxxxx"],"Via":["2.0 Caddy"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"jellyfin-nas01.xxxxxx","ech":false}},"error":"writing: http2: stream closed"}

Seems that the logs show different things.
The Caddy log shows access to the backend using http, while the backend shows a websocket connection. I don't think, that Caddy upgrades the connection to ws.

Also this error might be specific to Jellyfin. So if you have trouble with streaming, maybe you have more luck to find a solution in Jellyfin forum.

[Patrick M. Hausen]

The Caddy log shows access to the backend using http, while the backend shows a websocket connection. I don't think, that Caddy upgrades the connection to ws.

But Caddy does that. That's the beauty of the OPNsense plugin. Here in my network e.g. Apache Guacamole - which definitely needs WS.

[viragomann]

Automatically, without any specific setting?
I'm excited!

However, none of my services at home actually need ws.

[Patrick M. Hausen]

Automatically, without any specific setting?

Yes! That's the point. Caddy comes with very reasonable defaults.

[Ronny1978]

You configured the host header as linked by me and activated that host header in your handler configuration under "Transport"?

Yes, I have.

Caddy kommt mit sehr vernünftigen Standardeinstellungen.

This is, why Caddy will be recommend very often.

Thanks Patrick. At the moment it is only an error in the log. The streams of Jellyfin works fine. But I want to understand the error message and want to try to fix it. It is my personal target. 😁

Have a nice weekend.