Kaburu Wiki

This is an old revision of the document!

---

# Internal Reverse Proxy (Caddy on OPNsense)

Caddy runs on OPNsense (192.168.0.1) providing SSL-terminated reverse proxy for internal LAN services. Auto-TLS via Let's Encrypt DNS challenge (Cloudflare).

## Access

Local clients with OPNsense DNS can use:

## How it works

``` Browser → https://openwebui.kaburu.lan

→ DNSMasq resolves to 192.168.0.1
→ Caddy terminates SSL (valid LE cert)
→ Proxies to 192.168.0.253:3000

```

## DNS

DNSMasq on OPNsense serves `*.kaburu.lan` → 192.168.0.1. Only works for DHCP clients using OPNsense as DNS. Tailscale clients continue to use IPs directly — no change.

## Configuration

Managed via OPNsense web UI: Services → Caddy Web Server.

- DNS Provider: Cloudflare (token in `/root/.secrets/cloudflare` on kaburusvr) - Certs: Auto-TLS via Let's Encrypt DNS challenge - Listen: All interfaces, port 443 - Backends: Plain HTTP, except Portainer/Omada which use HTTPS with skip_verify

## No impact on

- Tailscale: Routes 192.168.0.0/24 directly via subnet router — unchanged - External sites: CyberPanel/LiteSpeed on kaburusvr handles public HTTPS — unchanged - OPNsense firewall rules: No NAT changes needed