Differences

This shows you the differences between two versions of the page.

--- infrastructure:opnsense [2026/08/22 06:45] – created - external edit 127.0.0.1
+++ infrastructure:opnsense [2026/08/22 11:30] (current) – external edit 127.0.0.1
@@ Line 84: / Line 84: @@
 If you want `openwebui.kaburu.lan` style hostnames to work, add them to Unbound's `private-domain` / `local-data` config via the OPNsense web UI (Services → Unbound DNS → Overrides), not via dnsmasq.
+## Caddy plugin — NOT installed (2026-08-22 audit)
+The `caddy-reverse-proxy.md` wiki page describes a Caddy-on-OPNsense reverse proxy with auto-TLS. **The Caddy plugin was never actually installed on OPNsense.** Evidence (kaburuaibox LAN probes, all 2026-08-22):
+| Check | Result | Meaning |
+|-------|--------|---------|
+| `nc -zv 192.168.0.1 443` | timed out | Caddy not listening |
+| `nc -zv 192.168.0.1 4443` | timed out | Caddy UI not listening |
+| `curl https://192.168.0.1/api/caddy/diagnostics/general` | HTTP 404 | Plugin not installed |
+| `curl https://192.168.0.1/api/caddy/settings/get` | HTTP 404 | Plugin not installed |
+| `dig openwebui.kaburu.lan @192.168.0.1` | NXDOMAIN | Unbound doesn't know kaburu.lan either |
+Only ports 22 (SSH) and 80 (HTTP redirect to dead HTTPS) respond on OPNsense from the LAN. The wiki `caddy-reverse-proxy.md` documents a **wishlist, not reality**.
+**To actually deploy Caddy reverse proxy:** install `os-caddy` plugin via System → Firmware → Plugins in OPNsense UI, configure domain mappings, then add the corresponding Unbound overrides so `*.kaburu.lan` resolves to 192.168.0.1. Or **just use direct IP+port access** (`http://192.168.0.253:3000` for Open WebUI, `https://192.168.0.252:8123` for HA, etc.) — which is what's currently working.
 ## 2026-07-26 dnsmasq + Unbound outage — root cause + fix