Caddy Reverse Proxy

Change host file

C:\Windows\System32\drivers\etc\hosts

Add

#Caddy

127.0.0.1 foo.com.local

Start caddy

caddy fmt --overwrite --config .\Caddyfile

caddy run --config .\Caddyfile

Import Root CA

caddy trust

To check Root CA go to

C:\Users\acelya\AppData\Roaming\Caddy\pki\authorities\local

You will see root.crt and root.key files

My certificate is at

C:\Users\acelya\AppData\Roaming\Caddy\certificates\local\foo.com.local

Check Root CA

Run

certmgr.msc

Go to "Trusted Root Certification Authorities -> Certificates"

You should see Caddy Local Authority

Visit

https://foo.com.local

Import Root CA To Remote Clients

Copy root.crt file to other client computers and install it into the "Trusted Root Certification Authorities" store

Command to import on Windows (run as Administrator)

certutil -addstore -f "ROOT" root.crt

Or via GUI

- Double click root.crt -> Install certificate

- Select Local Machine -> Place all certificates in the following store

- Browse to Trusted Root Certification Authorities -> OK -> Finish

Why root.crt and not intermediate.crt ?

- root.crt - The root CA certificate. Clients trust this once, then autimatically trust every certificate Caddy issues

- intermediate.crt - signed by root.crt, but clients need the root in their trust store to validate the chain. Distributing the intermediate alone doesn't help unless the root in already trusted.

Örnek Caddyfile

# Caddy auto_https normally binds to port 80 for HTTP -> HTTPS redirects

# disable_redirects keeps TLS on 443 but prevents binding to port 80

# Needed on Windows where port 80 required admin privileges

{

  auto_https disable_redirects

}

# HTTPS-only listener on port 44

foo.com.local:443 {

  tls internal

  # Swagger UI-served by the Spring Boot app

  handle /swagger-ui/* {

    reverse_proxy localhost:8080

  }

 # OpenAPI docs served by the Spring Boot app

  handle /v3/api-docs/* {

    reverse_proxy localhost:8080

  }

 # REST endpoints

  handle /api/* {

    reverse_proxy localhost:8080

  }

 # Everything else -> frontend

  handle {

    reverse_proxy localhost:3000

  }

}