this post was submitted on 08 Sep 2026
28 points (96.7% liked)

Selfhosted

62325 readers
1148 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
28
SOLVED Issues with https certs locally (slrpnk.net)
submitted 2 weeks ago* (last edited 2 weeks ago) by Spiffyman@slrpnk.net to c/selfhosted@lemmy.world
20 comments fedilink hide all child comments
 

I have a minipc with proxmox on it. I have tried caddy in a lxc to set up DNS challenges to my owned domain and I set the url in my router to point to the IP (for example, proxmox.DOMAIN.com could be 192.168.10.22). The hope was to have everything local within my house and nothing needs the internet to be accessed. Some services I can host in proxmox NEED https to use, which I could not get working with my own certs or ones proxmox could make, thus Caddy. However, I get proxmox with a proper cert, but i cannot get any of the other services from proxmox working. If I were doing it all manually, I would expect DNS issues with the domain, but from what I understand, Caddy by default does wildcard domains which should mean that my services should work. but they do not. Networking is new to me so perhaps I am missing something obvious. Any guidance would be appreciated.

EDIT: You guys helped me find my issue! Turns out that I did everything right except for 1 simple step. Once I have everything set up, I have my router point the urls to the CADDY address, not the services address. For example, I had bookmarks.DOMAIN.com set in my router to point at the readeck lxc ip and it didn't work. Changing that to the Caddy ip fixed it. So all my services would point to the same ip (caddy). I do not know how I never saw this in any of the tutorials/videos/guides I checked, but THANK YOU for pointing it out to me.
Now the only odd thing is why does the proxmox ip work fine without pointing to caddy? I will leave it as is, but its the odd one out :/

all 21 comments
sorted by: hot top controversial new old
[–] valar@lemmy.ca 6 points 2 weeks ago (1 children)

IME Caddy will not do wildcard domains "by default" if you just configure sub.domain.com {} for everything. It will try to create a unique cert for each. You have to specifically configure it to use a wildcard cert.

[–] DarkSirrush@piefed.ca 5 points 2 weeks ago* (last edited 2 weeks ago)

Yeah it will, if you have even a single reference to a wildcard, preferably as one of your first entries in your caddyfile.

https://caddyserver.com/docs/automatic-https

You can literally get a wildcard cert by putting in the following entry, before any other routing logic:

*.domain.tld {
  respond "Wildcard Bitch!"
}
[–] stratself@lemdro.id 3 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

Caddy does certs by responding to ACME challenges on port 80 and 443. You need to forward those ports from the public internet back to Caddy, have you done that?

Edit: it seems like you're doing DNS challenges. Did you compile Caddy yourself with the right plugins? Have you tested the API token work? Any Caddy logs?

[–] Appoxo@lemmy.dbzer0.com 1 points 2 weeks ago* (last edited 2 weeks ago)

Or do it like traefik can and do TLS challenge by proofing you can add TXT entries on your domain.

[–] Lem453@lemmy.ca 2 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

This is for traefik but might help to understand the process and change it for caddy (https://youtu.be/liV3c9m_OX8)

You should have

Service.local.domain.com

For local only services (Vaultwarden) and

Service.domain.com

For external things (immich)

I'm your router / Pihole locally, you setup the above URLs to point to the IP of caddy

[–] Spiffyman@slrpnk.net 1 points 2 weeks ago

I’m your router / Pihole locally, you setup the above URLs to point to the IP of caddy This is what I must be doing wrong. I have my router point to the url for the lxc services. So it is supposed to point to caddy. Thank you for the tip. I will try it out!

[–] bizarroland@lemmy.world 2 points 2 weeks ago

I had some success using nginx reverse proxy with let's encrypt.

There should be a couple of guides online that will tell you how to do that.

I was running Nginx through Portainer on Proxmox, and the Let's Encrypt certificate was set to my local IP address for nginx.

[–] non_burglar@lemmy.world 2 points 2 weeks ago (1 children)

or ones proxmox could make

In proxmox, ACME is a service for the root CA of the cluster. It does use letsencrypt, but it does not provide certs for clients.

Sounds like you are probably conflating DNS and PKI certificates.

[–] Spiffyman@slrpnk.net 1 points 2 weeks ago

Yes, I probably did. I am familiar with computers, but know next to nothing about networking. So I was trying a bunch of various things I could find to try to get it to work. the proxmox ACME did not get me certs for my server or for a vm of proxmox so I abandoned that method and tried caddy and GoDoxy but never got them to get certs for services after various attempts. So I reached out here since there are many more people smarter than me here.

[–] kokesh@lemmy.world 2 points 2 weeks ago

My setup: My domain-> vps <-wireguard->home ubuntu server behind 4G modem. My home server runs letsencrypt certbot for .mydomain.com My ubuntu server at home runs adguard home as DNS/DHCP/Android Private VPN. I have rules for adguard to forward any client coming from home lan 192.168.1. accessing mydomain.com to go directly to my home server local ip.

That way I run same certs and can access my local services via same urls - immich.mydomain.com runs from outside and inside my network, with ultra fast local uploads without using my modem data, etc.

[–] moonshine69@lemmy.nz 2 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

If you are doing a dns challenge then You need to give caddy access to your domain to perform the dns challenge. Depending on domain provider that is easy or hard. It will briefly change some records that tells let's encrypt you own the domain and then issue the cert

Or you can do http challenge, this requires you to manually configure your domain to point to a publicly accessible caddy endpoint which is probably not what you want, maybe there is a way to make it work through a cloud flare tunnel

Who is your domain provider?

[–] Spiffyman@slrpnk.net 1 points 2 weeks ago (1 children)

I use porkbun and I do the DNS challenge. I know it succeeds because proxmox gets https perfectly fine. But none of my lxc containers get https after doing DNS challenges for them. Not sure what I am doing wrong since I clearly did it right at least once :/

[–] moonshine69@lemmy.nz 1 points 2 weeks ago (1 children)

Nice, ok hmm.. sounds like you are using the router for internal DNS, did you set all the services to point at caddy?

Eg you could try a quick hack in hosts (assuming the caddy ip is 192.168.10.10)

192.168.10.10 grafana.domain.example
192.168.10.10 prometheus.domain.example
192.168.10.10 jellyfin.domain.example

And then navigate to one of the services over https

Main thing is all your internal DNS records need to point at caddy, and then it forwards to the real container IP

Not strictly required but could be worthwhile to get a dedicated internal dns server up.. I use technitium, or there's pi hole or a few other options ..

[–] Spiffyman@slrpnk.net 1 points 2 weeks ago* (last edited 1 week ago) (1 children)

like you are using the router for internal DNS, did you set all the services to point at caddy?

That was the answer! I had it pointed to the services, but once I set them to point at Caddy, it all worked. I cannot believe it was such a simple fix and also that I never picked up on that in all the guides/tutorials/videos I watched about this. Thank you!

[–] moonshine69@lemmy.nz 1 points 1 week ago

Nice :)

[–] curbstickle@anarchist.nexus 1 points 2 weeks ago

How is everything set up? Do you have a quick diagram or anything you can share? I'd like to understand how you have proxmox with a cert but not the rest, or what you mean by your own certs - like from LE? Where is your wildcard cert coming from?

[–] CompactFlax@discuss.tchncs.de -2 points 2 weeks ago* (last edited 2 weeks ago)

Firstly, wildcards are convenient but they break your functionality of authenticating the server to which you are connecting which is half of what TLS does. That may or may not be important to you.

Does it work without TLS? Start there, making sure dns and reverse proxy works, works, then add the certificate/TLS termination.