SSL made easier with a reverse proxy

[pwhodges 2012]

Well done.  Just check how long the certificate lasts and make a diary entry to renew it when required.

Paul

[HairyBizRat 21]

1 hour ago, pwhodges said:

Well done.  Just check how long the certificate lasts and make a diary entry to renew it when required.

Paul

Side question - any idea how to change this stupid user name i have? When I click on my profile on the top right there is no option to change it 

[guunter 49]

30 minutes ago, mjroberts said:

Side question - any idea how to change this stupid user name i have? When I click on my profile on the top right there is no option to change it 

In the dashboard click the 3 dots next to your server name to change it.

[HairyBizRat 21]

7 minutes ago, guunter said:

In the dashboard click the 3 dots next to your server name to change it.

Sorry, I meant my username in these EMBY forums 

[TMCsw 246]

Send a PM to @Abobader

[podonnell 47]

I am pretty sure my configuration is good but I wanted to check in here to validate something I saw -- recently set up an external client and I'm seeing

Emby for Apple TV 1.9.0

Apple TV

72.231.19.117 http/1.1

I changed the above IP to a random one, but the key here is the http.

My stack is --> DDNS service --> Caddy --> Emby

My understanding is that I'm seeing http because the connection is technically from Caddy to Emby, which is internal.
I believe I can see the external IP due to a setting with caddy that allows me to see the originating IP?

Most importantly, there's no access to my server via IP or DNS name over HTTP when I tested. I can only get in https
Further, the only rule on my firewall is for Caddy, which is HTTPS

Just wanted to validate why I am seeing the http above, and again -- I believe that's because it's technically speaking to caddy via http on my internal network only?

[darkassassin07 652]

The 'http' here isn't https vs http, it's just denoting http protocol version 1.1 is being used.

That may or may not be wrapped in a ssl/tls layer to make it into https (probably is if you're using a proxy in front), but that won't be shown there.

[Helmuth 1]

Am I correct in thinking that these instructions are only suitable for servers and not for Windows PCs? Because I tried it on my Windows 11 PC, but it didn't work.

[justinrh 259]

3 minutes ago, Helmuth said:

Am I correct in thinking that these instructions are only suitable for servers and not for Windows PCs? Because I tried it on my Windows 11 PC, but it didn't work.

Linux, Windows PC or Server, or MacOS will do.  I run a RP and Emby on my Win10 PC.

[HairyBizRat 21]

21 minutes ago, Helmuth said:

Am I correct in thinking that these instructions are only suitable for servers and not for Windows PCs? Because I tried it on my Windows 11 PC, but it didn't work.

It’s been a while but no this works for Windows 11 as that’s how I have it setup and using SSL Certificate from IONOS which is my domain provider 

[Helmuth 1]

Then I did something wrong. Run_Caddy.bat file closes immediately after opening.

Run_Caddy.bat.txt caddyfile.txt

[justinrh 259]

caddy run --config ...

Read the docs or run caddy in a CMD window to look at the help.  I'd also suggest using the caddyfile config file first to get used to the configuration and test it out before using the JSON config syntax.

Edited April 9, 2025 by justinrh

[muzicman0 84]

your CaddyFile looks like a v1 Caddy file.  I assume you are on v2.  Here is mine for reference:

{
        email steve@xxxxxxxxxx.com
}

emby.mydomain.com {
        reverse_proxy 10.3.0.124:8096
}

I have more in my Caddy File, but this is all it should take to get it working.

 

Edited April 10, 2025 by muzicman0

[pwhodges 2012]

Also, there is very little reason to use json rather than a Caddyfile.

Paul

[Helmuth 1]

Thanks!

Edited April 11, 2025 by Helmuth

[Helmuth 1]

7 hours ago, muzicman0 said:

your CaddyFile looks like a v1 Caddy file.  I assume you are on v2.  Here is mine for reference:

{
        email steve@xxxxxxxxxx.com
}

emby.mydomain.com {
        reverse_proxy 10.3.0.124:8096
}

I have more in my Caddy File, but this is all it should take to get it working.

 

Thanks, that's why it didn't work. Thanks also to everyone else who gave me advice.

[muzicman0 84]

Now that you have it working, there are some really nice extras you can add as needed/wanted:

for example, this block:

xxxxx.xxxxx.com {
        import logging Media
        @denied not client_ip 10.1.0.0/16 10.201.201.0/24
        abort @denied
        reverse_proxy 10.0.254.10:8043 {
        transport http {
                tls
                tls_insecure_skip_verify
        }
    }
}

will import a subroutine called logging and log calls to just this block to a file named Media.  It will also deny traffic from anything not in the 10.1.0.0/16 or 10.201.201.0/24 subnets (if you want a certificate on a locally accessed service only for instance).  It will also allow you to access local https services that use a self signed cert.

Here is my logging subroutine, I put it just under the email block.

#log file procedure
(logging) {
        log {
                output file /var/log/caddy/{args[0]}.log {
                        roll_size 5MiB # Set max size 5 MB
                        roll_keep 2 # Keep at most 2 log files
                        roll_keep_for 96h # Keep log files for 4 days
                }
        }
}

I use linux, but you can change the output file to a Windows path I'm sure.

[mausfield 2]

Can anyone attest to any necessary alternations to this guide given it is about 5 years old?

[rdhardi 42]

2 hours ago, mausfield said:

Can anyone attest to any necessary alternations to this guide given it is about 5 years old?

I used this guide in 2022 when this post was 2 years old then, and it worked perfectly for me. I already owned my own domain, so the only alteration that I recall was using Caddy v2 (since it was probably out of beta at that point). 3 years later and it's still working perfectly for me. I check it from time to time, but for me, Caddy is truly "set it & forget it".

[Santiag0 10]

On 1/14/2020 at 3:55 PM, MikeB111 said:

Yes, that's another great improvement.  If running Emby on the same server as Caddy, your caddyfile.txt can point to localhost:8096 instead of 10.0.0.100:8096 (or whatever your actual IP is).  I just made a few modifications to my caddyfile.txt based on these suggestions (added logs, removed gzip, removed timeouts, changed to localhost) and it all works great.

So this way you wouldn't need a static ip if you used localhost:8096 it should still work correct?