4 ms·

Fair enough, http is enough - I anyways have one caddy to rule them all. However, if your app is picky about reverse proxying, e.g. headers, please add a sample

by dsvf 2mo ago

Fair enough, http is enough - I anyways have one caddy to rule them all. However, if your app is picky about reverse proxying, e.g. headers, please add a sample caddy config. It's often the first thing I'm looking for if I'm trying out a tool and want to host it under a subdirectory before configuring a subdomain.

sam_lowry_ 2mo ago
No, HTTP is not enough, I submitted a couple HTTP-only links to HN lately, they got flagged within half an hour, even HN crowd can not open HTTP links anymore ;-)
- smashed 2mo ago
  That's not really HN's fault but all modern browsers will warn the user before accessing an http site with a security warning. My point was not to use http only as a finished solution, but to let the admin front the http-only service with their TLS termination solution of choice.
  - sam_lowry_ 2mo ago
    We are talking about hobbyists here.
  - dsvf 2mo ago
    ... Of which (TLS terminators) caddy is IMO the easiest for hobbyists, as was the starting point of this subthread
    - sam_lowry_ 2mo ago
      I already commented on this twice here, but here it goes again: I self-host Immich with Caddy as TLS terminator, and it's far from obvious. They all run on a small N150 PC in my closet, the same PC serves as my internet router. Both Immich and Caddy run in podman-compose, and there are firewall rules that allow incoming traffic to Caddy and outgoing traffic from Caddy to update certificates. There's also a tricky setup of Systemd dependencies that make sure podman networking and firewall rules play nicely together and with other system config, like the bridge for the 2.4Gz range internal Wi-Fi and for external 5Gz Wi-Fi 6 card. If not for the LLM help, I would have spent many days figuring out all the rough edges of this setup. Which is exactly the point OP is making. Hobbying webhosting is hard nowadays.

4 ms·

Fair enough, http is enough - I anyways have one caddy to rule them all. However, if your app is picky about reverse proxying, e.g. headers, please add a sample

by dsvf 2mo ago

sam_lowry_ 2mo ago
No, HTTP is not enough, I submitted a couple HTTP-only links to HN lately, they got flagged within half an hour, even HN crowd can not open HTTP links anymore ;-)
- smashed 2mo ago
  That's not really HN's fault but all modern browsers will warn the user before accessing an http site with a security warning. My point was not to use http only as a finished solution, but to let the admin front the http-only service with their TLS termination solution of choice.
  - sam_lowry_ 2mo ago
    We are talking about hobbyists here.
  - dsvf 2mo ago
    ... Of which (TLS terminators) caddy is IMO the easiest for hobbyists, as was the starting point of this subthread
    - sam_lowry_ 2mo ago
      I already commented on this twice here, but here it goes again: I self-host Immich with Caddy as TLS terminator, and it's far from obvious. They all run on a small N150 PC in my closet, the same PC serves as my internet router. Both Immich and Caddy run in podman-compose, and there are firewall rules that allow incoming traffic to Caddy and outgoing traffic from Caddy to update certificates. There's also a tricky setup of Systemd dependencies that make sure podman networking and firewall rules play nicely together and with other system config, like the bridge for the 2.4Gz range internal Wi-Fi and for external 5Gz Wi-Fi 6 card. If not for the LLM help, I would have spent many days figuring out all the rough edges of this setup. Which is exactly the point OP is making. Hobbying webhosting is hard nowadays.