SSL made easier with a reverse proxy

[pwhodges 1833]

Well done.  Just check how long the certificate lasts and make a diary entry to renew it when required.

Paul

[HairyBizRat 12]

1 hour ago, pwhodges said:

Well done.  Just check how long the certificate lasts and make a diary entry to renew it when required.

Paul

Side question - any idea how to change this stupid user name i have? When I click on my profile on the top right there is no option to change it 

[guunter 38]

30 minutes ago, mjroberts said:

Side question - any idea how to change this stupid user name i have? When I click on my profile on the top right there is no option to change it 

In the dashboard click the 3 dots next to your server name to change it.

[HairyBizRat 12]

7 minutes ago, guunter said:

In the dashboard click the 3 dots next to your server name to change it.

Sorry, I meant my username in these EMBY forums 

[TMCsw 170]

Send a PM to @Abobader

[podonnell 40]

I am pretty sure my configuration is good but I wanted to check in here to validate something I saw -- recently set up an external client and I'm seeing

Emby for Apple TV 1.9.0

Apple TV

72.231.19.117 http/1.1

I changed the above IP to a random one, but the key here is the http.

My stack is --> DDNS service --> Caddy --> Emby

My understanding is that I'm seeing http because the connection is technically from Caddy to Emby, which is internal.
I believe I can see the external IP due to a setting with caddy that allows me to see the originating IP?

Most importantly, there's no access to my server via IP or DNS name over HTTP when I tested. I can only get in https
Further, the only rule on my firewall is for Caddy, which is HTTPS

Just wanted to validate why I am seeing the http above, and again -- I believe that's because it's technically speaking to caddy via http on my internal network only?

[darkassassin07 613]

The 'http' here isn't https vs http, it's just denoting http protocol version 1.1 is being used.

That may or may not be wrapped in a ssl/tls layer to make it into https (probably is if you're using a proxy in front), but that won't be shown there.

[Helmuth 1]

Am I correct in thinking that these instructions are only suitable for servers and not for Windows PCs? Because I tried it on my Windows 11 PC, but it didn't work.

[justinrh 212]

3 minutes ago, Helmuth said:

Am I correct in thinking that these instructions are only suitable for servers and not for Windows PCs? Because I tried it on my Windows 11 PC, but it didn't work.

Linux, Windows PC or Server, or MacOS will do.  I run a RP and Emby on my Win10 PC.

[HairyBizRat 12]

21 minutes ago, Helmuth said:

Am I correct in thinking that these instructions are only suitable for servers and not for Windows PCs? Because I tried it on my Windows 11 PC, but it didn't work.

It’s been a while but no this works for Windows 11 as that’s how I have it setup and using SSL Certificate from IONOS which is my domain provider 

[Helmuth 1]

Then I did something wrong. Run_Caddy.bat file closes immediately after opening.

Run_Caddy.bat.txt caddyfile.txt

[justinrh 212]

caddy run --config ...

Read the docs or run caddy in a CMD window to look at the help.  I'd also suggest using the caddyfile config file first to get used to the configuration and test it out before using the JSON config syntax.

Edited April 9 by justinrh

[muzicman0 70]

your CaddyFile looks like a v1 Caddy file.  I assume you are on v2.  Here is mine for reference:

{
        email steve@xxxxxxxxxx.com
}

emby.mydomain.com {
        reverse_proxy 10.3.0.124:8096
}

I have more in my Caddy File, but this is all it should take to get it working.

 

Edited April 10 by muzicman0

[pwhodges 1833]

Also, there is very little reason to use json rather than a Caddyfile.

Paul

[Helmuth 1]

Thanks!

Edited April 11 by Helmuth

[Helmuth 1]

7 hours ago, muzicman0 said:

your CaddyFile looks like a v1 Caddy file.  I assume you are on v2.  Here is mine for reference:

{
        email steve@xxxxxxxxxx.com
}

emby.mydomain.com {
        reverse_proxy 10.3.0.124:8096
}

I have more in my Caddy File, but this is all it should take to get it working.

 

Thanks, that's why it didn't work. Thanks also to everyone else who gave me advice.

[muzicman0 70]

Now that you have it working, there are some really nice extras you can add as needed/wanted:

for example, this block:

xxxxx.xxxxx.com {
        import logging Media
        @denied not client_ip 10.1.0.0/16 10.201.201.0/24
        abort @denied
        reverse_proxy 10.0.254.10:8043 {
        transport http {
                tls
                tls_insecure_skip_verify
        }
    }
}

will import a subroutine called logging and log calls to just this block to a file named Media.  It will also deny traffic from anything not in the 10.1.0.0/16 or 10.201.201.0/24 subnets (if you want a certificate on a locally accessed service only for instance).  It will also allow you to access local https services that use a self signed cert.

Here is my logging subroutine, I put it just under the email block.

#log file procedure
(logging) {
        log {
                output file /var/log/caddy/{args[0]}.log {
                        roll_size 5MiB # Set max size 5 MB
                        roll_keep 2 # Keep at most 2 log files
                        roll_keep_for 96h # Keep log files for 4 days
                }
        }
}

I use linux, but you can change the output file to a Windows path I'm sure.