# Caddy Reverse Proxy — Planned, Not Deployed

⚠️ **This page describes a planned configuration that was never actually deployed.** See [[opnsense]] audit entry "Caddy plugin — NOT installed" for proof.

## Why

Internal LAN services (Open WebUI, Portainer, Frigate, Home Assistant, etc.) would benefit from:
- Friendly URLs (`https://openwebui.kaburu.lan` instead of `http://192.168.0.253:3000`)
- Automatic TLS via Let's Encrypt DNS-01 challenge (Cloudflare)
- Single certificate authority across LAN services

## Current state (2026-08-22)

- Caddy plugin **not installed** on OPNsense
- No listener on :443 or :4443
- `caddy-hosts.conf` exists in dnsmasq drop-ins but is **dead weight** (dnsmasq has `port=0`, Unbound doesn't know `kaburu.lan`)

## Workaround

Direct IP+port access works fine for everything:

| Service | URL |
|---------|-----|
| Open WebUI | `http://192.168.0.253:3000` |
| Portainer | `https://192.168.0.253:9443` |
| Ollama API | `http://192.168.0.253:11434` |
| Frigate NVR | `http://192.168.0.252:5000` |
| Omada Controller | `https://192.168.0.252:8043` |
| Home Assistant | `http://192.168.0.252:8123` |

Tailscale clients use 100.x.x.x addresses, same ports.

## If you ever want to deploy this

1. Install `os-caddy` plugin via OPNsense UI: System → Firmware → Plugins
2. Configure Caddy domains + backends (Services → Caddy Web Server)
3. Add `*.kaburu.lan` Unbound overrides pointing to 192.168.0.1 (Services → Unbound DNS → Overrides)
4. Delete the dead `caddy-hosts.conf` from dnsmasq drop-ins
5. Update this page to mark it `status: DEPLOYED`