# Caddy

Caddy is the reverse proxy and TLS terminator for the homelab. A single caddy
container on dankclaw (192.168.0.143) fronts every service on both hosts. It
runs Caddy v2.11.7 (verified in-container 2026-10-19) from the custom
`localhost/franksdank/caddy-porkbun:latest` image (xcaddy-built with the
Porkbun DNS-01 module, built locally on dankclaw).
Since 2026-08-26 it is managed as a Podman Quadlet unit (`caddy.container`)
installed to `~/.config/containers/systemd/`, providing boot-persistent,
auto-restart service management.


The Caddyfile lives in the serverAppConfigs repo at
`dankclaw/Caddyfile`. `deploy.sh` renders basicauth hashes from the host `.env`
(`REPLACE_WITH_HASH` → real bcrypt) into
`/home/dank/Containers/caddy/Caddyfile`, which the container mounts read-only;
Caddy's config file watcher (admin API, not disabled) hot-reloads on change.
The Caddyfile joins the `dankclaw_default` compose network so container-name
upstreams (authentik-server, grafana, etc.) still resolve.

TLS: Let's Encrypt wildcard certs via Porkbun DNS-01. The `acme_dns` block in
the Caddyfile reads API keys from `/home/dank/Containers/caddy/env` (deployed
from the repo's git-ignored `.env`). No inbound port 80/443 reachability is
needed from the internet — DNS-01 works entirely from the LAN, where Pi-hole
resolves `*.franksdank.cloud` names to dankclaw.

The porkbun DNS module source: [caddy-dns/porkbun](https://github.com/caddy-dns/porkbun).

* [Caddyfile Syntax](caddyfile.md) — Caddy Caddyfile reference — directive and matcher syntax, named matchers, directive sorting, and the `handle`/`route` order rule. Grounded in caddyserver.com (fetched 2026-08-28).