caddy-https-reverse-proxy

To set up an HTTPS reverse proxy using Caddy, you install and run it directly on a remote Linux host without Docker, configuring a Caddyfile to front your local HTTP backend and automatically obtain Let's Encrypt certificates for trusted HTTPS.

Yes, Caddy can issue TLS certificates without a public domain by automatically switching to DNS-01 challenges using DuckDNS as a fallback, allowing automatic certificate issuance even when direct domain ownership is unavailable.

No, you do not need Docker to deploy a Caddy reverse proxy on a remote server. This approach installs and runs Caddy directly on the remote Linux host, configuring the Caddyfile without requiring any Docker containerization.

Domain-first TLS prioritizes user-owned domains to obtain certificates directly from Let's Encrypt. Caddy implements this by validating DNS and TLS configurations during deployment to ensure trusted HTTPS is correctly fronting the local HTTP backend.

You can safely roll back a Caddy reverse proxy deployment by using the built-in health checks, health endpoints, and explicit rollback steps provided during the configuration process, ensuring safe operations if DNS or TLS validation fails.

Configuring a Caddy HTTPS reverse proxy remotely requires providing ssh_host, ssh_user, domain, backend_upstream, and contact_email to properly establish the connection and set up domain-first TLS on the target host.