this post was submitted on 16 Sep 2025
43 points (97.8% liked)

Selfhosted

51489 readers
383 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
43
If I use Caddy for reverse-proxying into another local machine... is my local connection not HTTPS? (discuss.tchncs.de)
submitted 1 day ago by unknowing8343@discuss.tchncs.de to c/selfhosted@lemmy.world
15 comments fedilink hide all child comments
 

Mind that I am very noob into self-hosting, reverse proxies and the like

When I saw that Caddy automatically handled the HTTPS thingies I was like "this is my moment then to go into self-hosting". Caddy seemed so simple.

Turns out... I am suddenly discovering that the connection between the caddy machine and the Home Assistant machine (both in the local network) is non-encrypted. So if another appliance in my local network went rogue... bum, all my info gets leaked... right?

This might sound weird because it might actually be super-duper complicated but... how come in 2025 we still don't auto-encrypt local comms?

Please be kind. Lot's of love. Hopefully I'll dig my way to self-hosting wisdom.

you are viewing a single comment's thread
view the rest of the comments
[–] InnerScientist@lemmy.world 3 points 1 day ago (1 children)

There are multiple reasons but the most important one is: You didn't enable it.

Caddy fully supports https to the reverse proxy targets, though you'd have to get those targets trusted certificates otherwise caddy wouldn't connect.

The default protocol for backends is http, most of the time this isn't a problem because:

  • The web server runs on the local machine
  • The web server runs in containers/vms on the local machine
    • or is running in a VM and has a direct virtual connection with the caddy vm
  • The connection to the Backend is encrypted with a VPN
  • Caddy and the web server are directly connected or connected through an otherwise isolated network

Because https requires certificates that are somewhat difficult to set up for internal servers (and were even harder to get before) the default mostly is just to encrypt on another layer of the stack. Afaik at least.

[–] FiduciaryOne@lemmy.world 2 points 1 day ago

Good write-up. I also have Caddy with no HTTPS to the back end service, and was just thinking "I should set that up" when I realized...all the services are on the same ProxMox host, so that have direct access via virtualization, and so won't be in clear text over the network at all (or at least I think so). Thanks!