# Caddy Reverse Proxy — Planned, Not Deployed

⚠️ This page describes a planned configuration that was never actually deployed. See opnsense audit entry “Caddy plugin — NOT installed” for proof.

## Why

Internal LAN services (Open WebUI, Portainer, Frigate, Home Assistant, etc.) would benefit from: - Friendly URLs (`https://openwebui.kaburu.lan` instead of `http://192.168.0.253:3000`) - Automatic TLS via Let's Encrypt DNS-01 challenge (Cloudflare) - Single certificate authority across LAN services

## Current state (2026-08-22)

- Caddy plugin not installed on OPNsense - No listener on :443 or :4443 - `caddy-hosts.conf` exists in dnsmasq drop-ins but is dead weight (dnsmasq has `port=0`, Unbound doesn't know `kaburu.lan`)

## Workaround

Direct IP+port access works fine for everything:

Tailscale clients use 100.x.x.x addresses, same ports.

## If you ever want to deploy this

1. Install `os-caddy` plugin via OPNsense UI: System → Firmware → Plugins 2. Configure Caddy domains + backends (Services → Caddy Web Server) 3. Add `*.kaburu.lan` Unbound overrides pointing to 192.168.0.1 (Services → Unbound DNS → Overrides) 4. Delete the dead `caddy-hosts.conf` from dnsmasq drop-ins 5. Update this page to mark it `status: DEPLOYED`