If I use Caddy for reverse-proxying into another local machine... is my local connection not HTTPS?
-
Mind that I am very noob into self-hosting, reverse proxies and the like
When I saw that Caddy automatically handled the HTTPS thingies I was like “this is my moment then to go into self-hosting”. Caddy seemed so simple.
Turns out… I am suddenly discovering that the connection between the caddy machine and the Home Assistant machine (both in the local network) is non-encrypted. So if another appliance in my local network went rogue… bum, all my info gets leaked… right?
This might sound weird because it might actually be super-duper complicated but… how come in 2025 we still don’t auto-encrypt local comms?
Please be kind. Lot’s of love. Hopefully I’ll dig my way to self-hosting wisdom.
-
Mind that I am very noob into self-hosting, reverse proxies and the like
When I saw that Caddy automatically handled the HTTPS thingies I was like “this is my moment then to go into self-hosting”. Caddy seemed so simple.
Turns out… I am suddenly discovering that the connection between the caddy machine and the Home Assistant machine (both in the local network) is non-encrypted. So if another appliance in my local network went rogue… bum, all my info gets leaked… right?
This might sound weird because it might actually be super-duper complicated but… how come in 2025 we still don’t auto-encrypt local comms?
Please be kind. Lot’s of love. Hopefully I’ll dig my way to self-hosting wisdom.
If you want everything on your local lan to have SSL, look into Step CA. Its not completely beginners friendly, but if you’re serious about selfhosting you will manage to set it up
Caddy works with it also, and their examples are very helpful. -
If you want everything on your local lan to have SSL, look into Step CA. Its not completely beginners friendly, but if you’re serious about selfhosting you will manage to set it up
Caddy works with it also, and their examples are very helpful.Or simply create your rootCA, IntermediateCA, keys and certifictes with openSSL.
Neither of those are begginer friendly but openSSL is probably a bit easier to get started. There’s a nice book with openSSL (if you are interested I migh look how it’s called) and the last chapter is all about how to create your mini-CA and everthing else to serve your proxy with valid certificates for your homelab.
-
Or simply create your rootCA, IntermediateCA, keys and certifictes with openSSL.
Neither of those are begginer friendly but openSSL is probably a bit easier to get started. There’s a nice book with openSSL (if you are interested I migh look how it’s called) and the last chapter is all about how to create your mini-CA and everthing else to serve your proxy with valid certificates for your homelab.
The reason i chose Step CA over openSSL is because with step CA you can automate certificate renewal without any manual intervention. I don’t know how that would work with openSSL except some heavy scripting?
-
Mind that I am very noob into self-hosting, reverse proxies and the like
When I saw that Caddy automatically handled the HTTPS thingies I was like “this is my moment then to go into self-hosting”. Caddy seemed so simple.
Turns out… I am suddenly discovering that the connection between the caddy machine and the Home Assistant machine (both in the local network) is non-encrypted. So if another appliance in my local network went rogue… bum, all my info gets leaked… right?
This might sound weird because it might actually be super-duper complicated but… how come in 2025 we still don’t auto-encrypt local comms?
Please be kind. Lot’s of love. Hopefully I’ll dig my way to self-hosting wisdom.
Depends on what you want. You can have the application have an https certificate which could either be one issued my a globally trusted issuer or could just be a self issued certificate that caddy is configured to trust. And caddy can then add the globally trusted certificates from let’s encrypt or whatever. But that definitely requires extra steps. Just, how secure do you want to be?
-
The reason i chose Step CA over openSSL is because with step CA you can automate certificate renewal without any manual intervention. I don’t know how that would work with openSSL except some heavy scripting?
Yeah thats correct !
I Wouldn’t say heavy though (maybe I see it that way because I got a bit better with bash and the like :p) because you can make use of CRL to revoke your certificates and renew them very easily with your intermediate and ready to use config files.
But yeah, there isn’t any automated way to manage certificates like Smallstep does
-
Yeah thats correct !
I Wouldn’t say heavy though (maybe I see it that way because I got a bit better with bash and the like :p) because you can make use of CRL to revoke your certificates and renew them very easily with your intermediate and ready to use config files.
But yeah, there isn’t any automated way to manage certificates like Smallstep does
You mentioned a book though… Now i’m curious
-
Mind that I am very noob into self-hosting, reverse proxies and the like
When I saw that Caddy automatically handled the HTTPS thingies I was like “this is my moment then to go into self-hosting”. Caddy seemed so simple.
Turns out… I am suddenly discovering that the connection between the caddy machine and the Home Assistant machine (both in the local network) is non-encrypted. So if another appliance in my local network went rogue… bum, all my info gets leaked… right?
This might sound weird because it might actually be super-duper complicated but… how come in 2025 we still don’t auto-encrypt local comms?
Please be kind. Lot’s of love. Hopefully I’ll dig my way to self-hosting wisdom.
Your choice I don’t encrpt local comms because it is all in machine. Go to proxy and proxy goes to another container but never leaves the machine but don’t see a reason to encrypt. Even HA in a seperate machine what are they going to see.
