6 ms·

Ok I'll bite again. Do you want a caddy service embedded with every web app you self host or are you running a single one serving all your apps? From my under

by smashed 1mo ago

Ok I'll bite again. Do you want a caddy service embedded with every web app you self host or are you running a single one serving all your apps? From my understanding if you want acme http challenges to just work with let's encrypt you probably need to use a single, separated caddy to front all your apps. In that case if I ship a caddy service pre configured to do TLS termination with my app it's just more trouble for you no?

dsvf 1mo ago
Fair enough, http is enough - I anyways have one caddy to rule them all. However, if your app is picky about reverse proxying, e.g. headers, please add a sample caddy config. It's often the first thing I'm looking for if I'm trying out a tool and want to host it under a subdirectory before configuring a subdomain.
- sam_lowry_ 1mo ago
  No, HTTP is not enough, I submitted a couple HTTP-only links to HN lately, they got flagged within half an hour, even HN crowd can not open HTTP links anymore ;-)
  - smashed 1mo ago
    That's not really HN's fault but all modern browsers will warn the user before accessing an http site with a security warning. My point was not to use http only as a finished solution, but to let the admin front the http-only service with their TLS termination solution of choice.
    - dsvf 1mo ago
      ... Of which (TLS terminators) caddy is IMO the easiest for hobbyists, as was the starting point of this subthread
      - sam_lowry_ 1mo ago
        I already commented on this twice here, but here it goes again: I self-host Immich with Caddy as TLS terminator, and it's far from obvious. They all run on a small N150 PC in my closet, the same PC serves as my internet router. Both Immich and Caddy run in podman-compose, and there are firewall rules that allow incoming traffic to Caddy and outgoing traffic from Caddy to update certificates. There's also a tricky setup of Systemd dependencies that make sure podman networking and firewall rules play nicely together and with other system config, like the bridge for the 2.4Gz range internal Wi-Fi and for external 5Gz Wi-Fi 6 card. If not for the LLM help, I would have spent many days figuring out all the rough edges of this setup. Which is exactly the point OP is making. Hobbying webhosting is hard nowadays.
    - sam_lowry_ 1mo ago
      We are talking about hobbyists here.
chillfox 1mo ago
Just provide a docker compose file.
sam_lowry_ 1mo ago
I posted this in a sibling thread, but it's also appropriate here. I self-host Immich with Caddy, and it's complex, really. Caddy runs in podman compose next to Immich, there are firewall rules to allow traffic in and out and proper dependencies in custom systemd units in case podman networking goes bust after firewall rules are reloaded and a readme that covers all that. Exactly the point OP is making.

by smashed 1mo ago

dsvf 1mo ago

Fair enough, http is enough - I anyways have one caddy to rule them all. However, if your app is picky about reverse proxying, e.g. headers, please add a sample caddy config. It's often the first thing I'm looking for if I'm trying out a tool and want to host it under a subdirectory before configuring a subdomain.

sam_lowry_ 1mo ago
No, HTTP is not enough, I submitted a couple HTTP-only links to HN lately, they got flagged within half an hour, even HN crowd can not open HTTP links anymore ;-)
- smashed 1mo ago
  That's not really HN's fault but all modern browsers will warn the user before accessing an http site with a security warning. My point was not to use http only as a finished solution, but to let the admin front the http-only service with their TLS termination solution of choice.
  - dsvf 1mo ago
    ... Of which (TLS terminators) caddy is IMO the easiest for hobbyists, as was the starting point of this subthread
    - sam_lowry_ 1mo ago
      I already commented on this twice here, but here it goes again: I self-host Immich with Caddy as TLS terminator, and it's far from obvious. They all run on a small N150 PC in my closet, the same PC serves as my internet router. Both Immich and Caddy run in podman-compose, and there are firewall rules that allow incoming traffic to Caddy and outgoing traffic from Caddy to update certificates. There's also a tricky setup of Systemd dependencies that make sure podman networking and firewall rules play nicely together and with other system config, like the bridge for the 2.4Gz range internal Wi-Fi and for external 5Gz Wi-Fi 6 card. If not for the LLM help, I would have spent many days figuring out all the rough edges of this setup. Which is exactly the point OP is making. Hobbying webhosting is hard nowadays.
  - sam_lowry_ 1mo ago
    We are talking about hobbyists here.

chillfox 1mo ago

Just provide a docker compose file.

sam_lowry_ 1mo ago

I posted this in a sibling thread, but it's also appropriate here. I self-host Immich with Caddy, and it's complex, really. Caddy runs in podman compose next to Immich, there are firewall rules to allow traffic in and out and proper dependencies in custom systemd units in case podman networking goes bust after firewall rules are reloaded and a readme that covers all that. Exactly the point OP is making.