remote

README

remote

Allows caddy to listen on a remote host. Useful if you want to serve from a connection blocking port forwards.

Issues and warnings

Since this will only wrap connections from the http server, DNS challenges must be used.

server

Requires a regular wireguard server with the required ports forwarded.

config

Add to the listener_wrappers section of the caddy config before tls.

If keyFile is used public, private, and preShared must not be used.

{
    "public": "wT6Z7BlAMtWSEznj4jXRMNhr/iQkasKCy8XVUS2SdxU=", // base64 wireguard public key
    "private": "yE694OFKyGCj6X7vPww/iE21OGvPLi1QdoCcs3YeJFA=", // base64 wireguard private key
    "preShared": "Ox9i+l+7Obvk+3+5q4M8v66liFtMr8sdAkYKHBelfxA=", // base64 wireguard pre-shared key
    "keyFile": "/path/to/keyfile.key", // path to keyfile (optional)
    "persistentKeepAlive": 25, // default 25 (optional)
    "endpoint": "example.com:1234", // endpoint of wireguard server
    "address": "192.168.1.2" // address of caddy in the tunnel
}

wireguard {
    public <base64 wireguard public key>
    private <base64 wireguard private key>
    preShared <base64 wireguard pre-shared key>
    keyFile <path to keyfile (optional)>
    persistentKeepAlive <default 25 (optional)>
    endpoint <endpoint of wireguard server>
    address <address of caddy in the tunnel>
}

keyfile

PRIVATE=<base64 private key>
PUBLIC=<base64 public key>
PSK=<base64 psk>