Using caddy + apache, to access by tailscale only

[u/VE3VVS]

I just want to bounce an idea I thought of that would simplify my setup of my self hosted web base services.
First I access my system only by Tailscale, there is reverse proxy, no registered domain, nothing. I access all my docker services via tailscale services that are provisioned by Docktail, and everything works.
However I have a few (3-4) web base custom services that run on a bare metal installed apache web server, but I want to access them also via tailscale, with a let’s crypt cert (the web apps require https) so while i could (and to) use tailscale cert to get the required https certificate, I have to remember to renew the cert every 90 days, while not too complicated or tedious I wanted to automate the process.
So I thought if I moved apache to say 8080 then installed caddy to act as a reverse proxy to the apache but caddy would only be acceptable via tailscale and would use the tailscale domain it would get the required cert and renew them.
The question is does this sound like a dumb overly complicated way of doing this and would it there be any conflict as i’m using tailscale services for my docker stuff and potentially caddy for the bare metal web stuff.
It seems reasonable to me, but I have a tendency to sometimes over complicate things the other people think I’ve lost my mind (which I probably have 😉).
If anyone has the time to just tell me it’s not a bad idea or it’s dumb and move on that’s fine. I know some would just ask AI the question, but I being old school would prefer to ask people even at the risk of being downvoted 😎

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.

[u/deltatux]

Is there a specific reason you need to use Apache? Caddy is a very capable HTTPS server in its own right, putting Caddy in front of Apache without more context seems redundant.

[u/VE3VVS → u/deltatux]

Yes your right and I should have probably stated, a couple of the web apps specify they are written for use with apache, and while the could probably be modified to work with any web server I was really hoping to avoid that particular rabbit hole 🕳️

[u/deltatux → u/VE3VVS]

In that case yes, you can put Caddy in front of Apache, using Caddy solely as a reverse proxy. If those Apache apps are in containers, some prefer pure reverse proxies like Traefik.

[u/CivilIntention7747]

Not dumb, but you can skip Caddy entirely if the only goal is automatic renewal of the tailnet cert. Tailscale can hand the cert straight to apache: tailscale cert --cert-file /etc/ssl/tailnet.crt --key-file /etc/ssl/tailnet.key yourhost.your-tailnet.ts.net renews the cert when it is inside the renewal window and is a no-op otherwise, so a weekly systemd timer that runs that and then systemctl reload apache2 is the whole automation. Apache stays on 443, nothing new to learn or run.

If you do want Caddy, it is also a perfectly sane design and it is the one that removes the timer entirely: Caddy asks the local tailscaled for the cert when the site address in the Caddyfile is the ts.net name, and it renews on its own. Move apache to 127.0.0.1:8080 so nothing reaches it except Caddy, and bind Caddy to the node's tailscale address (or just rely on there being no port forward, which is the same thing in practice).

Conflict with the Docktail-provisioned Tailscale Services: none that I have hit, as long as two things are not both trying to own 443 on the same tailscale address. Services live on their own service addresses, so bare-metal apache or Caddy on the node's own address does not collide. One ss -ltnp after setup to confirm who holds 443 and you are done.

If it were mine I would do the tailscale cert plus timer version: one fewer daemon, apache already does vhosts fine, and the cert rotation you are trying to forget about becomes a log line.

[u/VE3VVS → u/CivilIntention7747]

okay thank you 🙏 that actually is the answer I was hoping for. I had in my usual overthinking and complicating method never even thought realized I could just set up the renewal through apache as you describe, I think the caddy thing got stuck in my head thinking it might otherwise be useful as it’s a pretty decent swiss army knife piece of software, but truth be told, the immediate need/solution is your first mentioned approach and I will proceed to follow that path of advice. Thanks

[u/CivilIntention7747 → u/VE3VVS]

Glad it landed. Two small gotchas so the timer does not bite you later: tailscale cert needs HTTPS certificates enabled for the tailnet in the admin console (DNS section) or it will just error, and if the timer runs as a non-root user that user needs tailscale set --operator=<user> once. Run it by hand first, then let the timer take over.

[u/VE3VVS → u/CivilIntention7747]

Yes I was reading about cert on the tailscale site only a few moments ago, thanks.

[u/Outrageous_Ad_4801]

putting caddy in front to handle the tailscale bind and proxying to apache on localhost works totally fine. did something similar for an old app that strictly needed apache rewrite rules and never had any issues with it.