Caddy as a Traefik replacement? #388

New Issue

decentral1se · 2023-01-23T08:24:08Z

decentral1se commented

2023-01-23 08:24:08 +00:00

https://dev.to/jhot/caddy-docker-proxy-like-traefik-but-better-565l

![image](/attachments/b55f7045-1382-452a-a430-bd8a73624be2) https://dev.to/jhot/caddy-docker-proxy-like-traefik-but-better-565l

image.png

53 KiB

decentral1se added the

enhancement

label 2023-01-23 08:24:08 +00:00

3wordchant commented

2023-01-23 15:58:59 +00:00

Things we're currently doing in Traefik which we'd need to work out in Caddy to make it a drop-in replacement:

OIDC login for arbitrary sites (example)
HTTP Basic auth for arbitrary sites (no public example)
Forwarding arbitrary ports (current list)

I think that's it?

Also to answer @joenas's question in #coopcloud-tech:

Also does Caddy not require an email for LE certs?

No! Strongly recommended tho.

Things we're currently doing in Traefik which we'd need to work out in Caddy to make it a drop-in replacement: - OIDC login for arbitrary sites ([example](https://git.coopcloud.tech/coop-cloud/custom-html/src/branch/main/compose.sso.yml)) - HTTP Basic auth for arbitrary sites (no public example) - Forwarding arbitrary ports ([current list](https://git.coopcloud.tech/coop-cloud/traefik/src/branch/master/traefik.yml.tmpl)) I think that's it? Also to answer @joenas's question in #coopcloud-tech: > Also does Caddy not require an email for LE certs? No! Strongly recommended tho.

codegod100 commented

2023-02-21 23:37:10 +00:00

I haven't used caddy that much. It feels simpler though based on my memory. I feel like the biggest thing is weighing the cost of the lift to switchover vs the benefit of using something new. We are already using traefik and that shouldn't be understated. Although it's still early days so that shouldn't matter a whole lot. Do we know approx how many operators are using abra in production?

3wordchant commented

2023-02-26 19:00:25 +00:00

Do we know approx how many operators are using abra in production?

No. My rough guess might be about 5-15 organisations and individuals.

I feel like the biggest thing is weighing the cost of the lift to switchover vs the benefit of using something new.

We could potentially allow both as options, they'd ignore each other's labels.

Unless we can work out a find/replace (maybe using yq?), it'd probably take at least 5 minutes minimum per recipe, so around 8 hours to add Caddy support to all recipes.

> Do we know approx how many operators are using abra in production? No. My rough guess might be about 5-15 organisations and individuals. > I feel like the biggest thing is weighing the cost of the lift to switchover vs the benefit of using something new. We could potentially allow both as options, they'd ignore each other's labels. Unless we can work out a find/replace (maybe using `yq`?), it'd probably take at least 5 minutes minimum per recipe, so around 8 hours to add Caddy support to all recipes.

3wordchant referenced this issue

2023-02-26 19:02:43 +00:00

Add a nicer fallback page to Traefik #115

codegod100 commented

2023-03-01 00:34:21 +00:00

Adding some resources:

Reddit thread by caddy author on caddy/traefik:
https://www.reddit.com/r/selfhosted/comments/dmve6n/comment/f55nviu/?utm_source=reddit&utm_medium=web2x&context=3

caddy community post about configuring caddy to use docker containers:
https://caddy.community/t/caddy-reverse-proxy-nextcloud-collabora-vaultwarden-with-local-https/12052

https://github.com/lucaslorentz/caddy-docker-proxy

Adding some resources: Reddit thread by caddy author on caddy/traefik: https://www.reddit.com/r/selfhosted/comments/dmve6n/comment/f55nviu/?utm_source=reddit&utm_medium=web2x&context=3 caddy community post about configuring caddy to use docker containers: https://caddy.community/t/caddy-reverse-proxy-nextcloud-collabora-vaultwarden-with-local-https/12052 https://github.com/lucaslorentz/caddy-docker-proxy

❤️ 2

3wordchant commented

2023-03-01 00:37:52 +00:00

caddy community post about configuring caddy to use docker containers:
https://caddy.community/t/caddy-reverse-proxy-nextcloud-collabora-vaultwarden-with-local-https/12052

we would probably need the "inversion of configuration" approach using labels that's provided by caddy-docker-proxy, like we do with Traefik, to preserve the current "don't need to edit a reverse proxy config file every time we add a new app to a server" behaviour. So we'd need to pull anything that looks interesting from that page (e.g. fallback responses like respond /admin* "The admin panel is disabled, please configure the 'ADMIN_TOKEN' variable to enable it") into the docker-label format.

> caddy community post about configuring caddy to use docker containers: > https://caddy.community/t/caddy-reverse-proxy-nextcloud-collabora-vaultwarden-with-local-https/12052 we would probably need the "inversion of configuration" approach using labels that's provided by [`caddy-docker-proxy`](https://github.com/lucaslorentz/caddy-docker-proxy), like we do with Traefik, to preserve the current "don't need to edit a reverse proxy config file every time we add a new app to a server" behaviour. So we'd need to pull anything that looks interesting from that page (e.g. fallback responses like `respond /admin* "The admin panel is disabled, please configure the 'ADMIN_TOKEN' variable to enable it"`) into the docker-label format.

codegod100 commented

2023-03-01 00:48:39 +00:00

we would probably need the "inversion of configuration" approach using labels that's provided by caddy-docker-proxy,

Yeah I literally just realized this and added link to their github repo like 2 minutes ago hahaha

>we would probably need the "inversion of configuration" approach using labels that's provided by caddy-docker-proxy, Yeah I literally just realized this and added link to their github repo like 2 minutes ago hahaha

😆 1

codegod100 commented

2023-03-01 01:11:05 +00:00

ostensibly we could automagically insert caddy labels into recipes using domain variables from config files and just delete the traefik labels in our current recipes. Do you see any issues with that?

codegod100 commented

2023-03-01 01:14:58 +00:00

I guess compose files can have multiple services so it's a lot of magic to determine which ones need labels so maybe not. I do like that there is less label config in caddy though 🤷‍♀️

👍 1

3wordchant commented

2023-03-04 05:22:31 +00:00

ostensibly we could automagically insert caddy labels into recipes using domain variables from config files ..

Automating adding labels as far as possible would be great. Almost all recipes have a ...loadbalancer.server.port= Traefik label on web-accessible services, which could be a good start?

and just delete the traefik labels in our current recipes. Do you see any issues with that?

Until there's an answer to (at least most of) the so-far missing features in comment 15327 then some of us will need to keep on Traefik to some degree.

So having both in some/all recipes, while kinda duplicative, would be a way for folks to try out Caddy sooner while keeping existing stuff working.

> ostensibly we could automagically insert caddy labels into recipes using domain variables from config files .. Automating adding labels as far as possible would be great. Almost all recipes have a `...loadbalancer.server.port=` Traefik label on web-accessible services, which could be a good start? > and just delete the traefik labels in our current recipes. Do you see any issues with that? Until there's an answer to (at least most of) the so-far missing features in [comment 15327](#issuecomment-15327) then some of us will need to keep on Traefik to some degree. So having both in some/all recipes, while kinda duplicative, would be a way for folks to try out Caddy sooner while keeping existing stuff working.

👍 1

3wordchant referenced this issue

2023-04-10 21:47:43 +00:00

Global template for labels when/if we move to caddy #428

3wordchant referenced this issue from coop-cloud/caddy

2023-08-20 16:28:29 +00:00

Find a better solution for on_demand TLS #1

3wordchant commented

2023-08-20 16:30:15 +00:00

coop-cloud/caddy is a thing now! 🚀

And I just used it for the first (AFAIK) successful Co-op Cloud caddy deployment (of federatedwiki).

Still no ideas about the missing features listed in comment #1 but this is a promising start.

[`coop-cloud/caddy`](https://git.coopcloud.tech/coop-cloud/caddy/) is a thing now! 🚀 And I just used it for the first (AFAIK) successful Co-op Cloud caddy deployment (of `federatedwiki`). Still no ideas about the missing features listed in [comment #1](https://git.coopcloud.tech/coop-cloud/organising/issues/388#issuecomment-15327) but this is a promising start.

🎉 2

3wordchant commented

2023-10-20 08:32:46 +00:00

OIDC login for arbitrary sites

https://caddyserver.com/docs/caddyfile/directives/forward_auth

> OIDC login for arbitrary sites https://caddyserver.com/docs/caddyfile/directives/forward_auth

wykwit commented

2024-01-05 23:58:48 +00:00

Caddy is awesome and seems to works great instead of Traefik. All you really need for a basic setup is to deploy the proxy and just add these two labels from OP to the compose.yml of your target application.

I also wanted to disable automatic HTTPS, because in my self-hosting setup there are additional layers between my server and the internet.
In the compose.yml of Caddy it was simply:

  4 services:
  5   app:
...
 17     deploy:
 18       labels:
 19         - "caddy.auto_https=off"

Definitely +1 for more Caddy support in recipes!

Caddy is awesome and seems to works great instead of Traefik. All you really need for a basic setup is to deploy the proxy and just add these two labels from OP to the compose.yml of your target application. I also wanted to disable automatic HTTPS, because in my self-hosting setup there are additional layers between my server and the internet. In the compose.yml of Caddy it was simply: ``` 4 services: 5 app: ... 17 deploy: 18 labels: 19 - "caddy.auto_https=off" ``` Definitely +1 for more Caddy support in recipes!

❤️ 2

decentral1se referenced this issue from a commit

2024-03-27 06:46:36 +00:00

docs: point to caddy work

decentral1se commented

2024-12-25 15:40:01 +00:00

There's also caddy-docker-upstreams.

Caddy seems to work even better than Traefik for *.foo.com wildcard setups (seems much faster) and it would be possible to have a custom "this is a co-op cloud install" and 404 page also.

We should gather ourselves to invest in a migration plan at some point! Ditching traefik would be amazing.

There's also [`caddy-docker-upstreams`](https://github.com/invzhi/caddy-docker-upstreams). Caddy seems to work even better than Traefik for `*.foo.com` wildcard setups (seems much faster) and it would be possible to have a custom "this is a co-op cloud install" and 404 page also. We should gather ourselves to invest in a migration plan at some point! Ditching traefik would be amazing.

3wordchant commented

2024-12-29 23:31:25 +00:00

Quick glance, caddy-docker-upstreams seems to have a more sensible syntax but maybe supports a lot fewer types of Caddyfile entry? Things which we are using which seem to be missing include:

setting the ask endpoint for auto-SSL
defining a block with multiple domains / subdomains

Quick glance, `caddy-docker-upstreams` seems to have a more sensible syntax but maybe supports a lot fewer types of Caddyfile entry? Things which we are using which seem to be missing include: * setting the `ask` endpoint for auto-SSL * defining a block with multiple domains / subdomains

Sign in to join this conversation.

No Milestone

No project

No Assignees

4 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: toolshed/organising#388