目录

Caddy

Caddy can manage https certificate automatically.

Install

compose.yml
  1. services:
  2.   caddy:
  3.     image: caddy:latest
  4.     container_name: caddy
  5.     restart: unless-stopped
  6.  
  7.     networks:
  8.       - web
  9.     ports:
  10.       - "80:80"
  11.       - "443:443"
  12.  
  13.     volumes:
  14.       - ./Caddyfile:/etc/caddy/Caddyfile
  15.       - ./data:/data
  16.       - ./config:/config
  17.  
  18. networks:
  19.   web:
  20.     external: true

Then run in docker 

cd ~/services/caddy
docker compose up -d

Config

Write Caddyfile to map your site.

For any change in Caddyfile during its run, reload it using 

cd ~/services/caddy
docker compose exec caddy caddy validate --config /etc/caddy/Caddyfile && \
docker compose exec caddy caddy reload --config /etc/caddy/Caddyfile

Host a static site

  1. xiaobenmao.win {
  2.     encode zstd gzip
  3.     root * /srv/www
  4.     file_server
  5. }

Need to ensure the root path in docker container, here /srv/www, mapped to a real directory using the compose.yml.

Map to a site (reverse_proxy)

  1. auth.xiaobenmao.win {
  2.     reverse_proxy authentik-server-1:9000
  3. }
  4.  
  5. bits.xiaobenmao.win {
  6.     reverse_proxy bits-wordpress:80
  7. }
  8.  
  9. wiki.xiaobenmao.win {
  10.     reverse_proxy pkb:8080
  11. }

Redirect

  1. www.xiaobenmao.win {
  2.     redir https://xiaobenmao.win{uri}
  3. }

{uri} will copy all path and parameters as-is to the redirected one.

Authentication required page (with Authentik)

  1. url.to.website {
  2.     encode zstd gzip
  3.  
  4.     # Authentik outpost
  5.     handle /outpost.goauthentik.io/* {
  6.         reverse_proxy authentik-server-1:9000
  7.     }
  8.  
  9.     # sample: no need auth for index page
  10.     handle index.html {
  11.         reverse_proxy xxx:80
  12.     }
  13.  
  14.     # rest pages need auth
  15.     handle {
  16.         forward_auth authentik-server-1:9000 {
  17.             uri /outpost.goauthentik.io/auth/caddy
  18.             copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name
  19.         }
  20.  
  21.         reverse_proxy xxx:80
  22.     }
  23. }

Take note the caddy in uri /outpost.goauthentik.io/auth/caddy specify the host program, alternatives like /outpost.goauthentik.io/auth/nginx for Nginx and /outpost.goauthentik.io/auth/traefik for Traefik. Do not change it.

Then create a new forward auth provider in Authentik. Go to Applications - Providers - New Provider, select Proxy Provider, and fill in details. Select authorization flow as default-provider-authorization-implicit-consent (Authorize Application), and type forward auth (single application).

After that, create a new application with this provider. Bind users or access groups to this application.

Add the application into default outpost (authentik Embedded Outpost) via Applications - Outposts.

Testing should have 302 response for auth required page, while the remaining pages are normal. 

curl -I https://url.to.website/index.html
curl -I https://url.to.website/test.html