then the easier method is to install Caddy as docker and use the containername:containerport method?.. did I understand correctly?

Yes, if the only exposed port to the host or outside, is 443 from caddy container, then the only way to access any of those services is HTTPS through caddy.

Okey, so if you skip the whole DNS and use http://PUBLICIP:PORT for any of your docker services, does your browser reach them?

You said you have Caddy on bare metal Ubuntu and your services in CasaOS. Sadly I’ve never used that, but is that a VM on your Ubuntu Server and inside that run your docker containers? If so, maybe that’s what’s stopping Caddy from reaching your containers?! Just guessing tbh.

Ha, I completely ignored the picture because it’s a self post. So there is an instance of caddy running on port 80.

When you say you’re trying to reverse proxy, are you starting up another instance of it instead of restarting the already running service with a new config?

I’m no expert on caddy, so we’re rapidly reaching the limits of my ability to offer anything useful.

I’ve honestly never tried it, since I have the only node in my home network serve the local subnet. It allowed me to statically assign IPs at home and still use them outside of the house. I suppose there’s nothing stopping you from using the overlay network, especially if you have all devices involved on the Tailscale network, but I didn’t feel like doing that :)

It looks like Elvith Ma’[email protected] has you headed in the right direction, so I won’t muddle the waters.

I meant to include this in my earlier comment, but Caddy has a built in caddyfile validator:

caddy fmt --overwrite /etc/caddy/Caddyfile
caddy validate --config /etc/caddy/Caddyfile

Comes in very handy.

If you like, I can send you an example of the Caddyfiles, that I’m using (I used the import directive to split every service into its own Caddyfiles, you could just copy and paste everything in the same file). It will take a few hours until I get home, though.

But basically you can just put every subdomain and it’s target in a separate block and the add some things globally (e.g. passing the original IP, switching off the admin API of Caddy,…)

Something like this should work:

admin off 

servers {
		client_ip_headers X-Forwarded-For X-Real-IP
}

app.example.com {
    reverse_proxy 127.0.0.1:8080
}

app2.example.com {
    reverse_proxy 127.0.0.1:8081
}

api.example.com {
    reverse_proxy 127.0.0.1:8082
    header {
        Access-Control-Allow-Methods "GET, OPTIONS"
        Access-Control-Allow-Origin "*"
    }
}