caddy.md (3873B)
1 # Caddy 2 2 3 ## Requirements 4 5 For this guide you will need [Caddy 2](https://caddyserver.com/), there are no other dependencies. Caddy manages Lets Encrypt certificates and renewal for them. 6 7 Caddy is in the most popular package managers, or you can get a static binary. For all latest installation guides, refer to [their manual](https://caddyserver.com/docs/install). 8 9 ### Debian, Ubuntu, Raspbian 10 11 ```bash 12 # Add the keyring for their custom repository. 13 sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https 14 curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg 15 curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list 16 17 # Update packages and install it 18 sudo apt update 19 sudo apt install caddy 20 ``` 21 22 ### Fedora, Redhat, Centos 23 24 ```bash 25 dnf install 'dnf-command(copr)' 26 dnf copr enable @caddy/caddy 27 dnf install caddy 28 ``` 29 30 ### Arch 31 32 ```bash 33 pacman -Syu caddy 34 ``` 35 36 ### FreeBSD 37 ```bash 38 sudo pkg install caddy 39 ``` 40 41 ## Configure GoToSocial 42 43 If GoToSocial is already running, stop it. 44 45 ```bash 46 sudo systemctl stop gotosocial 47 ``` 48 In your GoToSocial config turn off Lets Encrypt by setting `letsencrypt-enabled` to `false`. 49 50 If you we running GoToSocial on port 443, change the `port` value back to the default `8080`. 51 52 If the reverse proxy will be running on the same machine, set the `bind-address` to `"localhost"` so that the GoToSocial server is only accessible via loopback. Otherwise it may be possible to bypass your proxy by connecting to GoToSocial directly, which might be undesirable. 53 54 ## Set up Caddy 55 56 We will configure Caddy 2 to use GoToSocial on our main domain example.org. Since Caddy takes care of obtaining the Lets Encrypt certificate, we only need to configure it properly once. 57 58 In most simple use cases Caddy defaults to a file called Caddyfile. It can reload on changes, or can be configured through an HTTP API for zero downtime, but this is out of our current scope. 59 60 ```bash 61 sudo mkdir -p /etc/caddy 62 sudo vim /etc/caddy/Caddyfile 63 ``` 64 65 While editing the file above, you should replace 'example.org' with your domain. Your domain should occur twice in the current configuration. If you have chosen another port number for GoToSocial other than port 8080, change the port number on the reverse proxy line to match that. 66 67 The file you're about to create should look like this: 68 69 ```Caddyfile 70 example.org { 71 # Optional, but recommended, compress the traffic using proper protocols 72 encode zstd gzip 73 74 # The actual proxy configuration to port 8080 (unless you've chosen another port number) 75 reverse_proxy * http://127.0.0.1:8080 { 76 # Flush immediatly, to prevent buffered response to the client 77 flush_interval -1 78 } 79 } 80 ``` 81 82 By default, caddy sets `X-Forwarded-For` in forwarded requests. To make this and rate limiting work, set the `trusted-proxies` configuration variable. See the [rate limiting](../../api/ratelimiting.md) and [general configuration](../../configuration/general.md) docs 83 84 For advanced configuration check the [reverse_proxy directive](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy) at the Caddy documentation. 85 86 Now check for configuration errors. 87 88 ```bash 89 sudo caddy validate 90 ``` 91 92 If everything is fine, you should get some info lines as output. Unless there are lines marked with *[err]* in front of them, you are all set. 93 94 Everything working? Great! Then restart caddy to load your new config file. 95 96 ```bash 97 sudo systemctl restart caddy 98 ``` 99 100 If everything went right, you're now all set to enjoy your GoToSocial instance, so we are going to start it again. 101 102 ```bash 103 sudo systemctl start gotosocial 104 ``` 105 106 ## Results 107 108 You should now be able to open the splash page for your instance in your web browser, and will see that it runs under HTTPS!