3 ms·

here's my caddy config for a reverse proxy with TLS: sub.domain.com { reverse_proxy localhost:8080 }

kuschku 4y ago
You mean sub.domain.com, sub.domain.com. { reverse_proxy localhost:8080 } ? Because caddy currently doesn’t handle DNS names correctly, so you have to duplicate every single virtual hostname config (it’s a long-standing open bug) [EDIT: Thanks to francislavoie for reminding me about the shorter syntax for this]
- francislavoie 4y ago
  Actually, we mean: sub.domain.com, sub.domain.com. { reverse_proxy localhost:8080 } But seriously. Can you stop posting about this every single time there's even a vague mention of Caddy on HN? It's tired. You've gotten your answer before. Huge majority of people don't care about trailing dot domains. Trailing dots are complicated and really not worth the complexity it would involve to support them. See https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-dot/ https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-...
  - kuschku 4y ago
    > Can you stop posting about this every single time there's even a vague mention of Caddy on HN? It's tired It’s a genuine issue I’ve got with Caddy, and if someone recommends Caddy, I’m justified to mention the drawbacks of Caddy. In this case, a user recommended switching from nginx to Caddy, and nginx users (who expect trailing dot domains to just work) should keep this drawback in mind. Every time you compare Caddy or Traefik to nginx or apache, you should expect to also see the drawbacks of Caddy and Traefik mentioned.
    - gjs278 4y ago
    - mholt 4y ago
      You're not being a productive member of the community. You only complain about Caddy, instead of giving solid technical arguments for your case. We have presented ample evidence, experience, and technical reasoning to support our argument, but you continue to ignore the logical, technical, and complex arguments and instead complain to rack up fake Internet points here. We want to make a better product, but you need to convince us that your way is better than all the evidence, experience, and technical reasons we have already presented.
      - kuschku 4y ago
        See that’s exactly the issue. You expect me to do work and spend time just to convince you to be standards-compliant. How can I trust caddy complies with standards in other areas if caddy isn’t willing to follow the standard (which really doesn’t take much work) in this area? It’d be different if the de facto and the de jure standard diverged, as e.g., with IRC, but that’s not the case. nginx, Apache, IIS, Google’s GWS, they all follow the standard exactly, it’s just traefik and caddy that don’t. It’s not an issue of this situation in of itself, it’s an issue of eroding trust. It’s the famous brown m&ms. P.S.: Your arguments explain why implementing this would be a lot of work (keeping the ticket open as known issue is something I’d be fine with), but they can’t justify ignoring the standard and closing it as wontfix.
        francislavoie 4y ago
        > (which really doesn’t take much work) Except it actually does take a lot of work, because it's not as simple as you make it out to be. It's very complex. Look at the blog post I linked above from the author of cURL, looks at how much time was wasted just to support that "feature". If trailing dots weren't supported, there would be less code, and less headaches for everyone. And either way, your argument that because we aren't "standards-compliant" here means we won't follow standards elsewhere is the slippery slope fallacy. Show us evidence of where we aren't standards compliant, then we'll talk.
        kuschku 4y ago
        I originally wrote a detailed response to this, but instead I’ll just say this: It’s one thing to limit the scope of your project. cURL is trying to support every de facto and de jure standard out there, your project doesn’t have to. A lot of tail-end features have very diminishing returns. My own projects don’t do it either. But it’s something entirely else if you just close the issues as WONTFIX, claim they’re not part of a standard (until you’re proven wrong), then claim it’s not used in the real world (it is, otherwise cURL wouldn’t implement it), then verbally attack users who point out that you’re not supporting it. Just accept it, acknowledge that you’re not supporting it and that it’s not part of your scope. Own your faults, just be honest. I’ve got far more persistent and far more annoying users complaining about missing features in Quasseldroid on every release or post for the past decade, but that’s no reason to get angry with them.
  - You-Are-Right 4y ago
- nousermane 4y ago
  Hey, at least caddy does case-insensetive hostname match, so you don't need to repeat the domain 2^12 times </s> Seriously though - that's a pretty bizarre bug, absent from both nginx and apache httpd. And that attitude in sibling comment doesn't help either.
  - kuschku 4y ago
    It’s not just the sibling comment that has this attitude, it’s also mholt himself displaying the same attitude. This hostile opinionated approach is part of what has kept me from using Caddy for the past few years (I went back to nginx at first, and once I started using k8s I also chose nginx as ingress controller there). :/
    - nyolfen 4y ago
      i have to say it is pretty weird to persistently complain about software you haven't used for years lol. i have also never used a trailing dot in a domain in 20+ years.
      - kuschku 4y ago
        1. Just because I’m not running servers using caddy doesn’t mean I’m not affected by this bug, because some of my clients intentionally always postfix addresses they access with a dot to avoid internal DNS resolution. 2. I’d love to use caddy. I’m especially interested in using it for my status page, as that needs to be hosted outside my normal cluster. Ideally it should be an absolutely minimal setup (so nothing except caddy + status page, with status monitors on other servers reporting back to the status page). This would be the perfect use case for caddy, but right now I’m using an overcomplicated nginx setup because I don’t feel like I can trust caddy.
mholt 4y ago
You don't even need a config file for that! $ caddy reverse-proxy --from sub.domain.com --to localhost:8080 Done :)

You mean sub.domain.com, sub.domain.com. { reverse_proxy localhost:8080 } ? Because caddy currently doesn’t handle DNS names correctly, so you have to duplicate every single virtual hostname config (it’s a long-standing open bug) [EDIT: Thanks to francislavoie for reminding me about the shorter syntax for this]

francislavoie 4y ago
Actually, we mean: sub.domain.com, sub.domain.com. { reverse_proxy localhost:8080 } But seriously. Can you stop posting about this every single time there's even a vague mention of Caddy on HN? It's tired. You've gotten your answer before. Huge majority of people don't care about trailing dot domains. Trailing dots are complicated and really not worth the complexity it would involve to support them. See https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-dot/ https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-...
- kuschku 4y ago
  > Can you stop posting about this every single time there's even a vague mention of Caddy on HN? It's tired It’s a genuine issue I’ve got with Caddy, and if someone recommends Caddy, I’m justified to mention the drawbacks of Caddy. In this case, a user recommended switching from nginx to Caddy, and nginx users (who expect trailing dot domains to just work) should keep this drawback in mind. Every time you compare Caddy or Traefik to nginx or apache, you should expect to also see the drawbacks of Caddy and Traefik mentioned.
  - gjs278 4y ago
  - mholt 4y ago
    You're not being a productive member of the community. You only complain about Caddy, instead of giving solid technical arguments for your case. We have presented ample evidence, experience, and technical reasoning to support our argument, but you continue to ignore the logical, technical, and complex arguments and instead complain to rack up fake Internet points here. We want to make a better product, but you need to convince us that your way is better than all the evidence, experience, and technical reasons we have already presented.
    - kuschku 4y ago
      See that’s exactly the issue. You expect me to do work and spend time just to convince you to be standards-compliant. How can I trust caddy complies with standards in other areas if caddy isn’t willing to follow the standard (which really doesn’t take much work) in this area? It’d be different if the de facto and the de jure standard diverged, as e.g., with IRC, but that’s not the case. nginx, Apache, IIS, Google’s GWS, they all follow the standard exactly, it’s just traefik and caddy that don’t. It’s not an issue of this situation in of itself, it’s an issue of eroding trust. It’s the famous brown m&ms. P.S.: Your arguments explain why implementing this would be a lot of work (keeping the ticket open as known issue is something I’d be fine with), but they can’t justify ignoring the standard and closing it as wontfix.
      - francislavoie 4y ago
        > (which really doesn’t take much work) Except it actually does take a lot of work, because it's not as simple as you make it out to be. It's very complex. Look at the blog post I linked above from the author of cURL, looks at how much time was wasted just to support that "feature". If trailing dots weren't supported, there would be less code, and less headaches for everyone. And either way, your argument that because we aren't "standards-compliant" here means we won't follow standards elsewhere is the slippery slope fallacy. Show us evidence of where we aren't standards compliant, then we'll talk.
        kuschku 4y ago
        I originally wrote a detailed response to this, but instead I’ll just say this: It’s one thing to limit the scope of your project. cURL is trying to support every de facto and de jure standard out there, your project doesn’t have to. A lot of tail-end features have very diminishing returns. My own projects don’t do it either. But it’s something entirely else if you just close the issues as WONTFIX, claim they’re not part of a standard (until you’re proven wrong), then claim it’s not used in the real world (it is, otherwise cURL wouldn’t implement it), then verbally attack users who point out that you’re not supporting it. Just accept it, acknowledge that you’re not supporting it and that it’s not part of your scope. Own your faults, just be honest. I’ve got far more persistent and far more annoying users complaining about missing features in Quasseldroid on every release or post for the past decade, but that’s no reason to get angry with them.
- You-Are-Right 4y ago
nousermane 4y ago
Hey, at least caddy does case-insensetive hostname match, so you don't need to repeat the domain 2^12 times </s> Seriously though - that's a pretty bizarre bug, absent from both nginx and apache httpd. And that attitude in sibling comment doesn't help either.
- kuschku 4y ago
  It’s not just the sibling comment that has this attitude, it’s also mholt himself displaying the same attitude. This hostile opinionated approach is part of what has kept me from using Caddy for the past few years (I went back to nginx at first, and once I started using k8s I also chose nginx as ingress controller there). :/
  - nyolfen 4y ago
    i have to say it is pretty weird to persistently complain about software you haven't used for years lol. i have also never used a trailing dot in a domain in 20+ years.
    - kuschku 4y ago
      1. Just because I’m not running servers using caddy doesn’t mean I’m not affected by this bug, because some of my clients intentionally always postfix addresses they access with a dot to avoid internal DNS resolution. 2. I’d love to use caddy. I’m especially interested in using it for my status page, as that needs to be hosted outside my normal cluster. Ideally it should be an absolutely minimal setup (so nothing except caddy + status page, with status monitors on other servers reporting back to the status page). This would be the perfect use case for caddy, but right now I’m using an overcomplicated nginx setup because I don’t feel like I can trust caddy.

mholt 4y ago

You don't even need a config file for that! $ caddy reverse-proxy --from sub.domain.com --to localhost:8080 Done :)