# Caddy Reverse Proxy — Planned, Not Deployed
⚠️ This page describes a planned configuration that was never actually deployed. See opnsense audit entry “Caddy plugin — NOT installed” for proof.
## Why
Internal LAN services (Open WebUI, Portainer, Frigate, Home Assistant, etc.) would benefit from: - Friendly URLs (`https://openwebui.kaburu.lan` instead of `http://192.168.0.253:3000`) - Automatic TLS via Let's Encrypt DNS-01 challenge (Cloudflare) - Single certificate authority across LAN services
## Current state (2026-08-22)
- Caddy plugin not installed on OPNsense - No listener on :443 or :4443 - `caddy-hosts.conf` exists in dnsmasq drop-ins but is dead weight (dnsmasq has `port=0`, Unbound doesn't know `kaburu.lan`)
## Workaround
Direct IP+port access works fine for everything:
| Service | URL |
| ——— | —– |
| Open WebUI | `http://192.168.0.253:3000` |
| Portainer | `https://192.168.0.253:9443` |
| Ollama API | `http://192.168.0.253:11434` |
| Frigate NVR | `http://192.168.0.252:5000` |
| Omada Controller | `https://192.168.0.252:8043` |
| Home Assistant | `http://192.168.0.252:8123` |
Tailscale clients use 100.x.x.x addresses, same ports.
## If you ever want to deploy this
1. Install `os-caddy` plugin via OPNsense UI: System → Firmware → Plugins 2. Configure Caddy domains + backends (Services → Caddy Web Server) 3. Add `*.kaburu.lan` Unbound overrides pointing to 192.168.0.1 (Services → Unbound DNS → Overrides) 4. Delete the dead `caddy-hosts.conf` from dnsmasq drop-ins 5. Update this page to mark it `status: DEPLOYED`