skills.rest
erfianugrah
erfianugrahCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

caddy

Configure and operate a custom Caddy reverse-proxy with WAF enforcement and TLS automation.

1|Updated Mar 18, 2024
Search Tags:#docker compose#waf#acme#caddy#authelia#rfc2136#wafctl
One-click install
npx skills add https://github.com/erfianugrah/dotfiles --skill caddy-erfianugrah
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: caddy
Source: https://github.com/erfianugrah/dotfiles/tree/main/.pi/agent/skills/caddy
Command: npx skills add https://github.com/erfianugrah/dotfiles --skill caddy-erfianugrah

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the problem of securely running a custom reverse-proxy (Caddy) with consistent WAF enforcement and reliable TLS automation across many sites without breaking auth, secrets, or deployments.

Core Features & Use Cases

  • Custom Caddy build + plugin coverage: Builds and runs a host-network Caddy image with the xcaddy plugin set needed for Cloudflare DNS, RFC2136/Dynamic DNS, L4 handling, body matching, policy engine enforcement, and DDoS mitigation.
  • WAF management plane (wafctl + dashboard): Centralizes WAF rule generation, logs-to-plugin feedback, and runtime policy updates so you can debug and adjust protections without redeploying containers.
  • Operational safety for secrets and reloads: Guides the correct SOPS/Composer vs raw container restart workflow, includes ACME troubleshooting patterns, and prevents common pitfalls like the restart-caddy SOPS footgun.
  • Auth integration and site-level patterns: Provides Authelia forward-auth integration patterns (including mixed routing and research/bearer bypass) that work consistently with per-site WAF and logging idioms.

Quick Start

Use the caddy skill to add a new site block for example.com in ~/ergo/caddy-compose while keeping WAF, TLS (Cloudflare or RFC2136), and forward-auth integration consistent with the existing snippet idiom.

Frequently Asked Questions about caddy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure a Caddy reverse-proxy with integrated WAF and Authelia forward-auth?▼

To configure a Caddy reverse-proxy with WAF and Authelia, you add site blocks using established Caddyfile import snippet idioms, ensuring per-site WAF enforcement and forward-auth routing remain consistent across your deployment.

How does Caddy handle TLS automation with Cloudflare DNS and RFC2136 dynamic DNS?▼

Caddy handles TLS automation by utilizing a custom xcaddy build with Cloudflare DNS and RFC2136 plugins, maintaining the TSIG secret chain to Knot for dynamic DNS updates and reliable certificate provisioning across sites.

Why does restarting the Caddy container break SOPS secrets and how do I safely apply changes?▼

Restarting the Caddy container directly breaks SOPS secrets because it bypasses the decryption chain, so you must use the SOPS/Composer restart workflow to safely apply configuration changes and prevent deployment failures.

Can I update WAF rules and runtime policies in Caddy without redeploying containers?▼

You can update WAF rules without redeploying containers by using the wafctl management plane and dashboard, which centralizes rule generation, logs-to-plugin feedback, and runtime policy updates for the Caddy reverse-proxy.

What is the best way to troubleshoot ACME or TLS policy behavior in a custom Caddy build?▼

The best way to troubleshoot ACME or TLS policy behavior in a custom Caddy build is to follow established ACME troubleshooting patterns, checking the wafctl-to-Caddy admin routing and verifying the RFC2136 secret chain to Knot.

Does Caddy support mixed routing and bearer bypass for Authelia forward-auth integration?▼

Caddy supports mixed routing and bearer bypass for Authelia forward-auth integration by applying specific site-level patterns that work consistently with the existing WAF enforcement and logging idioms in your deployment.

Related Skills

Explore More Software Engineering Skills→
erfianugraherfianugrah
1

knot-dns

Deploys Knot DNS on Fly.io with TSIG-protected RFC 2136 updates.

Community
Advanced
NightreaverNightreaver
6

ssh_host_reload

Reload the in-memory SSH host registry from hosts.toml without restarting the server.

Community
Basic
saavy1saavy1
2

deploying-public-apps

Automates deployment of public-facing apps with per-app manifests, DDNS, and Caddy routing.

Community
Advanced
L3DigitalNetL3DigitalNet
6

traefik

Configure and manage Traefik reverse proxy with Docker labels and Let's Encrypt.

Official
Intermediate