Differences

This shows you the differences between two versions of the page.

--- infrastructure:caddy-reverse-proxy [2026/08/22 06:45] – created - external edit 127.0.0.1
+++ infrastructure:caddy-reverse-proxy [2026/08/22 12:18] (current) – external edit 127.0.0.1
@@ Line 1: / Line 1: @@
-# Internal Reverse Proxy (Caddy on OPNsense)
+# Caddy Reverse Proxy — Deployed (Path A: LAN-only)
-Caddy runs on OPNsense (192.168.0.1) providing SSL-terminated reverse proxy for internal LAN services. Auto-TLS via Let's Encrypt DNS challenge (Cloudflare).
+## What this is
-## Access
+OPNsense Caddy plugin running with `auto_https off` + per-site `tls internal`, serving 6 services on `*.kaburu.lan` over HTTPS using Caddy's locally-trusted CA. No public exposure. No DNS provider. No Let's Encrypt.
-Local clients with OPNsense DNS can use:
+## Architecture
-| Service | URL | Backend |
-|---|---|---|
-| Open WebUI | `https://openwebui.kaburu.lan` | 192.168.0.253:3000 |
-| Portainer | `https://portainer.kaburu.lan` | 192.168.0.253:9443 |
-| Ollama API | `https://ollama.kaburu.lan` | 192.168.0.253:11434 |
-| Frigate NVR | `https://frigate.kaburu.lan` | 192.168.0.252:5000 |
-| Omada Controller | `https://omada.kaburu.lan` | 192.168.0.252:8043 |
-| Home Assistant | `https://ha.kaburu.lan` | 192.168.0.252:8123 |
-## How it works
 ```
-Browser → https://openwebui.kaburu.lan
+LAN device (192.168.0.x)
-  → DNSMasq resolves to 192.168.0.1
+  ↓ DNS: *.kaburu.lan → 192.168.0.1 (OPNsense Unbound override)
-  → Caddy terminates SSL (valid LE cert)
+  ↓ HTTPS:443 → OPNsense Caddy
-  → Proxies to 192.168.0.253:3000
+  ↓ reverse_proxy → LAN backend (192.168.0.253 or .252)
 ```
-## DNS
+No firewall port-forwarding. No WAN exposure. Certs are signed by Caddy's internal CA — install once on each device, then forget about it.
+## Services
+| Hostname | Backend | Notes |
+|----------|---------|-------|
+| `openwebui.kaburu.lan` | `http://192.168.0.253:3000` | Open WebUI on kaburuaibox |
+| `portainer.kaburu.lan` | `https://192.168.0.253:9443` | Portainer on kaburuaibox (TLS skip-verify) |
+| `ollama.kaburu.lan` | `http://192.168.0.253:11434` | Ollama API on kaburuaibox |
+| `frigate.kaburu.lan` | `http://192.168.0.252:5000` | Frigate NVR on ubuntu-svr |
+| `omada.kaburu.lan` | `https://192.168.0.252:8043` | TP-Link Omada controller (TLS skip-verify) |
+| `ha.kaburu.lan` | `http://192.168.0.252:8123` | Home Assistant on ubuntu-svr |
+## OPNsense UI configuration (Steve)
+Services → Caddy → Domains → Add (per service):
+- Domain: `<hostname>` (e.g. `openwebui.kaburu.lan`)
+- Listen Port: `443`
+- TLS: **Use internal CA** (NOT Let's Encrypt)
+Services → Caddy → Reverse Proxy → Add (per service):
+- Domain: `<hostname>`
+- Directive: `reverse_proxy`
+- Upstream: `<backend>` (e.g. `http://192.168.0.253:3000`)
+- For HTTPS backends: select `https://` and enable `tls_insecure_skip_verify`
+Apply.
+## DNS overrides
+Pushed via `scripts/push-unbound-overrides.py`. Records added:
+- `kaburu.lan → 192.168.0.1`
+- `*.kaburu.lan → 192.168.0.1` (one A record per service)
+## Trust Caddy's CA on devices
+Pull the root CA: `scripts/export-caddy-ca.sh` (run via OPNsense shell MCP)
+Install on each device — see instructions in script output.
+## Verification
+```bash
+# From any LAN device with Caddy CA trusted:
+curl -v https://openwebui.kaburu.lan
+# Expect: TLS handshake succeeds (no cert warning), 200 OK
+```
-DNSMasq on OPNsense serves `*.kaburu.lan` → 192.168.0.1. Only works for DHCP clients using OPNsense as DNS. Tailscale clients continue to use IPs directly — no change.
+## Future: Path B (off-LAN access)
-## Configuration
+If you need phone-on-cellular access later, add Cloudflare Tunnel:
+. Run `cloudflared` on kaburuaibox or kaburusvr
+. Each `*.kaburu.casa` → tunnel → Caddy on OPNsense
+. CF Access enforces email/SSO login
+. LAN devices stay on `*.kaburu.lan` (cleaner), remote devices use `*.kaburu.casa` + Access auth
-Managed via OPNsense web UI: **Services → Caddy Web Server**.
+See `wiki/infrastructure/cf-tunnel-plan.md` (TODO: write this when actually doing it).
-- **DNS Provider**: Cloudflare (token in `/root/.secrets/cloudflare` on kaburusvr)
+## Files
-- **Certs**: Auto-TLS via Let's Encrypt DNS challenge
-- **Listen**: All interfaces, port 443
-- **Backends**: Plain HTTP, except Portainer/Omada which use HTTPS with skip_verify
-## No impact on
+- `/home/kaburu/wiki/scripts/push-unbound-overrides.py` — pushes Unbound A records via OPNsense API
+- `/home/kaburu/wiki/scripts/unbound-kaburu-lan.sh` — shell-script version (legacy, use the Python one)
+- `/home/kaburu/wiki/scripts/export-caddy-ca.sh` — pulls Caddy's root CA for device install
-- **Tailscale**: Routes 192.168.0.0/24 directly via subnet router — unchanged
+## Troubleshooting
-- **External sites**: CyberPanel/LiteSpeed on kaburusvr handles public HTTPS — unchanged
-- **OPNsense firewall rules**: No NAT changes needed
+- **Caddy won't start**: check `sockstat -l | grep caddy` — Caddy needs `caddy.sock` admin socket. Run `service caddy restart`.
+- **"Address already in use" on :80**: OPNsense lighttpd binds :80. Ensure `auto_https off` and `http_port 0` are set in the Caddyfile (Caddy global block).
+- **Cert warnings in browser**: Caddy's CA isn't trusted on this device. Re-run `export-caddy-ca.sh` and install.
+- **DNS not resolving**: `drill openwebui.kaburu.lan @192.168.0.1` — should return 192.168.0.1. If not, re-run `push-unbound-overrides.py`.