Caddy v2 serves as the reverse proxy for all services, handling both Tailscale (HTTP) and public (HTTPS) routing.
Path: /opt/caddy/
Ports: 80, 443
| File | Purpose |
|---|---|
docker-compose.yml |
Container definition with volumes |
Caddyfile |
Routing rules |
.env |
Environment variables (admin email) |
.htpasswd |
basic_auth credentials for docs.autonomicllc.com |
caddy_data -- Let's Encrypt certificates and auto-renewal datacaddy_config -- Caddy runtime config| Host | Backend | Notes |
|---|---|---|
paperless.tailc67641.ts.net |
paperless-ngx:8000 |
Document management |
wiki.tailc67641.ts.net |
wiki:3000 |
Knowledge base |
db.tailc67641.ts.net |
adminer:8080 |
Database management (Tailscale only) |
status.tailc67641.ts.net |
Caddy internal | Status page |
| Host | Backend | Auth | Notes |
|---|---|---|---|
vps.autonomicllc.com |
Caddy internal | None | Status/landing page |
docs.autonomicllc.com |
paperless-ngx:8000 |
basic_auth | .htpasswd file |
wiki.autonomicllc.com |
wiki:3000 |
None | Knowledge base (public) |
basic_auth for docs.autonomicllc.com uses a file-based approach (Caddy 2.10):
basic_auth /etc/caddy/.htpasswd
The .htpasswd file contains: admin <bcrypt_hash>
To regenerate the hash:
docker exec caddy caddy hash-password -plaintext "newpassword"
echo "admin <hash>" > /opt/caddy/.htpasswd
docker compose -f /opt/caddy/docker-compose.yml restart caddy
Caddy passes X-Forwarded-Proto automatically to upstream services. This is critical for Django-based apps like Paperless-ngx, which use SECURE_PROXY_SSL_HEADER=HTTP_X_FORWARDED_PROTO,https to know the original request was HTTPS. Without this, Django generates http:// URLs in CSRF tokens and redirects, causing login failures.
/opt/<service>/docker-compose.ymlproxy network (external)/opt/caddy/Caddyfiledocker compose -f /opt/caddy/docker-compose.yml restart caddy*.autonomicllc.com subdomainscaddy_data volume.envServices with sensitive data (like Adminer for database access) are only exposed via Tailscale routes. They use HTTP since Tailscale provides WireGuard encryption at the network layer. These services have no public HTTPS route and are not accessible from the open internet.