Hello! I have 2 services that are only being accessed locally but require HTTPS so I am using Caddy & DuckDNS w/ DNS-01 to reverse proxy them. In DuckDNS, both subdomains are pointing at the local IP address of Caddy, and my Caddyfile has:

service1.duckdns.org:443 {
        tls {
                dns duckdns {
                        api_token API-TOKEN
                }
        }
        reverse_proxy 192.168.0.51:8080
	}

service2.duckdns.org:443 {
        tls {
                dns duckdns {
                        api_token API-TOKEN
                }
        }
        reverse_proxy 192.168.0.20:8080
	}

The issue is that I can access https://service1.duckdns.org/ (within my home network), but I can't access https://service2.duckdns.org/ (502 Bad Gateway). Caddy is running in a LXC in Proxmox, and Service1 is on a different VM on the same Proxmox machine, while Service2 is on a different machine on my network. I don't see any entries in my router's firewall logs or PiHole that indicates something is blocking it. I enabled logging in Caddy for both services and I am only able to see activity for Service1, so I guess that means something is blocking Service2 from reaching Caddy entirely?

I'm able to access service2 directly from the IP address but I'm a novice in networking so I'm trying to understand and learn what could be causing this. Any help would be appreciated!

Edit: service2 is ActualBudget and I had configured it to use the certs using the instructions here (https://actualbudget.org/docs/config/https/) when I didn't need to (since Caddy handles all of this already.. i think)

you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 1 month ago (2 children)

Take out the entry for service1 first to simplify the problem.

But from what I can see it looks right. Does service 2 have a self signed ssl certificate? If yes you'll need a TLS setting in that caddy block to ignore validation.

  • source
  • hideshow 2 child comments
  • [–] [S] 1 point 1 month ago (1 child)

    I don't think it's self-signed.. I used Caddy to generate the certs and copied them over into the config for the service. The service2 that I'm unable to access is ActualBudget and I followed their instructions from their docs (https://actualbudget.org/docs/config/https)

  • source
  • parent
  • hideshow 1 child comment