I have a minipc with proxmox on it. I have tried caddy in a lxc to set up DNS challenges to my owned domain and I set the url in my router to point to the IP (for example, proxmox.DOMAIN.com could be 192.168.10.22). The hope was to have everything local within my house and nothing needs the internet to be accessed. Some services I can host in proxmox NEED https to use, which I could not get working with my own certs or ones proxmox could make, thus Caddy. However, I get proxmox with a proper cert, but i cannot get any of the other services from proxmox working. If I were doing it all manually, I would expect DNS issues with the domain, but from what I understand, Caddy by default does wildcard domains which should mean that my services should work. but they do not. Networking is new to me so perhaps I am missing something obvious. Any guidance would be appreciated.
Two things that I think are tripping you up:
DNS. Your router only maps
proxmox.DOMAIN.comto 192.168.10.22. The other services (in LXCs, with their own container IPs) resolve to nothing, so the browser can’t reach Caddy for them at all - that’s why Proxmox works and the rest don’t. Either add a record per service name pointing at the right IP, or forward those service ports into Caddy.Certs. If you want to stay fully local (nothing needs the internet), skip DNS challenges entirely: Caddy has a built-in CA (
tls internalin the site block). It auto-issues self-signed certs for whatever hostname you hit, no challenge, no DNS. You do need to export that CA and install it as a trusted root on the machines you browse from, but after that every service works with zero DNS configuration.Wildcard aside: DNS-01 + wildcard only covers issuance, it doesn’t fix the resolution gap in point 1.
If you’re open to egress, a quick tunnel (cloudflared) removes cert management completely - Cloudflare terminates TLS on a random public URL. That’s how I expose a small self-hosted API of mine; the trade-off is the URL changes on every tunnel restart.
+1 for cloudflare tunnels. But if you want to host locally, nginx proxy manager has a very intuitive gui you’ll be able to host your sites on.
Example:
Docker container exposes port 8989 for sonarr. Nginx proxy manager entry will be: Sonarr.mydomain.com > http://192.168.0.50:8888/ There’s a setting to allow ssl for your domain.
In your domain registrar, just put the a record for sonarr.mydomain.com to the local IP of nginx proxy manager, in this case let’s assume it’s the same IP as sonarr.
So now in your house your computer calls the domain, your dns server responds with 192.168.0.50. That’s the IP of your proxy.
Your proxy gets your request. Sees you’re trying to access sonarr, and passes your query along to it.
But like I said, cloudflare tunnels removes ALL of this and even supports google / azure SSO to keep you secure and keep logins convenient.