How to Set Up Caddy as a Reverse Proxy

Why Caddy

Caddy is a modern web server whose killer feature is automatic HTTPS: it obtains and renews Let's Encrypt certificates for you with zero configuration. Combined with a remarkably readable config file, it's the fastest way to give every homelab service a clean hostname and a valid certificate.

By the end you'll route several internal services through Caddy with HTTPS, using either public DNS or a DNS-challenge for fully internal names.

Prerequisites

• A domain name you control (even a cheap one).
• DNS records you can edit.
• Docker (recommended) or a Linux host.

Step 1: Run Caddy in Docker

Create a folder and a compose.yaml:

services:
  caddy:
    image: caddy:2
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
 
volumes:
  caddy_data:
  caddy_config:

The caddy_data volume is important — it stores your certificates so they aren't re-requested on every restart (which could hit Let's Encrypt rate limits).

Step 2: Write the Caddyfile

Create a file named Caddyfile:

jellyfin.example.com {
    reverse_proxy 192.168.1.10:8096
}
 
nextcloud.example.com {
    reverse_proxy 192.168.1.10:8080
}

That's genuinely all it takes. Caddy will:

1. Request a certificate for each hostname.
2. Redirect HTTP to HTTPS automatically.
3. Renew certificates before they expire.

Point the two subdomains' DNS A records at your public IP (and forward ports 80/443 to the server), then:

docker compose up -d

Step 3: Internal-only services with a DNS challenge

If you don't want to expose ports 80/443 to the internet, use a DNS challenge so Caddy can prove domain ownership through your DNS provider instead. This lets you get valid certificates for purely internal hostnames.

Use a Caddy image built with your DNS provider's plugin (for example Cloudflare) and configure it with an API token:

{
    acme_dns cloudflare YOUR_CLOUDFLARE_API_TOKEN
}
 
home.example.com {
    reverse_proxy 192.168.1.10:3000
}

Now home.example.com resolves on your LAN, gets a real certificate, and is never exposed to the public internet.

Step 4: Handy Caddy features

• Basic auth — protect an app that has no login:

grafana.example.com {
    basic_auth {
        admin JDJhJDE0... # hashed with: caddy hash-password
    }
    reverse_proxy localhost:3000
}

• Compression and headers — add encode gzip zstd and security headers in a snippet reused across sites.
• Multiple upstreams — Caddy can load-balance across several backends.

Caddy vs. Nginx Proxy Manager

Prefer Caddy if you like config-as-code and want the simplest possible TLS. Prefer Nginx Proxy Manager if you want a point-and-click UI. Both are excellent; the choice is about workflow.

Troubleshooting

• Certificate not issued — check that ports 80/443 reach the server, or that your DNS-challenge token is valid.
• 502 Bad Gateway — the upstream address/port is wrong or the service is down.
• Rate-limited by Let's Encrypt — make sure the caddy_data volume persists so certs are reused.

Next steps

Put your dashboards, media server and cloud behind Caddy, then add Fail2ban and a VPN for defense in depth.