{"id":46,"date":"2026-05-12T02:00:16","date_gmt":"2026-05-11T18:00:16","guid":{"rendered":"https:\/\/blog.kwitsukasa.top\/?p=46"},"modified":"2026-05-12T02:03:18","modified_gmt":"2026-05-11T18:03:18","slug":"%e8%85%be%e8%ae%af%e4%ba%91-caddy-%e5%8f%8d%e5%90%91%e4%bb%a3%e7%90%86%e9%83%a8%e7%bd%b2%e6%96%b9%e6%a1%88","status":"publish","type":"post","link":"https:\/\/blog.kwitsukasa.top\/?p=46","title":{"rendered":"\u817e\u8baf\u4e91 Caddy \u53cd\u5411\u4ee3\u7406\u90e8\u7f72\u65b9\u6848"},"content":{"rendered":"\n

1. \u67b6\u6784\u8bf4\u660e<\/h2>\n\n\n\n
\u516c\u7f51\u7528\u6237\n  \u2193 HTTPS\n\u817e\u8baf\u4e91\u8f7b\u91cf\u670d\u52a1\u5668 Caddy\n  \u2193 WireGuard \u96a7\u9053\n\u98de\u725b OS \u670d\u52a1<\/code><\/pre>\n\n\n\n
\u5173\u952e\u5730\u5740\uff1a<\/p>\n\n\n\n
\u817e\u8baf\u4e91\u516c\u7f51 IP\uff1a<PUBLIC_IPV4>\n\u98de\u725b WireGuard IP\uff1a10.66.66.2\nCaddy \u90e8\u7f72\u4f4d\u7f6e\uff1a\u817e\u8baf\u4e91\u8f7b\u91cf\u670d\u52a1\u5668\nCaddy \u8fd0\u884c\u65b9\u5f0f\uff1aDocker Compose<\/code><\/pre>\n\n\n\n
Caddy \u8d1f\u8d23\uff1a<\/p>\n\n\n\n
1. \u5bf9\u5916\u63d0\u4f9b HTTPS\n2. \u81ea\u52a8\u7533\u8bf7 TLS \u8bc1\u4e66\n3. \u6309\u57df\u540d\u53cd\u4ee3\u5230\u98de\u725b\u5185\u7f51\u670d\u52a1\n4. \u5c06\u516c\u7f51\u8bf7\u6c42\u8f6c\u53d1\u5230 10.66.66.2:\u670d\u52a1\u7aef\u53e3<\/code><\/pre>\n\n\n\n
\n\n\n\n
2. \u524d\u7f6e\u6761\u4ef6<\/h2>\n\n\n\n
\u786e\u4fdd WireGuard \u5df2\u7ecf\u8fde\u901a\u3002<\/p>\n\n\n\n
\u817e\u8baf\u4e91\u6267\u884c\uff1a<\/p>\n\n\n\n
ping -c 4 10.66.66.2<\/code><\/pre>\n\n\n\n
\u6d4b\u8bd5\u98de\u725b\u670d\u52a1\u7aef\u53e3\uff1a<\/p>\n\n\n\n
curl -I http:\/\/10.66.66.2:5666\ncurl -I http:\/\/10.66.66.2:18080<\/code><\/pre>\n\n\n\n
\u80fd\u8fd4\u56de HTTP \u54cd\u5e94\u540e\uff0c\u518d\u914d\u7f6e Caddy\u3002<\/p>\n\n\n\n
\n\n\n\n
3. DNS \u914d\u7f6e<\/h2>\n\n\n\n
\u5728\u57df\u540d\u89e3\u6790\u4e2d\u6dfb\u52a0 A \u8bb0\u5f55\uff0c\u5168\u90e8\u6307\u5411\u817e\u8baf\u4e91\u516c\u7f51 IP\uff1a<\/p>\n\n\n\n
test.example.com   A   <PUBLIC_IPV4>\nnas.example.com    A   <PUBLIC_IPV4>\nblog.example.com   A   <PUBLIC_IPV4>\nmcs.example.com    A   <PUBLIC_IPV4>\nmcd.example.com    A   <PUBLIC_IPV4>\nminio.example.com  A   <PUBLIC_IPV4>\ns3.example.com     A   <PUBLIC_IPV4><\/code><\/pre>\n\n\n\n
\u68c0\u67e5\u89e3\u6790\uff1a<\/p>\n\n\n\n
dig test.example.com +short<\/code><\/pre>\n\n\n\n
\u5e94\u8fd4\u56de\uff1a<\/p>\n\n\n\n
<PUBLIC_IPV4><\/code><\/pre>\n\n\n\n
\n\n\n\n
4. \u817e\u8baf\u4e91\u9632\u706b\u5899\u653e\u884c<\/h2>\n\n\n\n
\u817e\u8baf\u4e91\u8f7b\u91cf\u5e94\u7528\u670d\u52a1\u5668\u63a7\u5236\u53f0\u653e\u884c\uff1a<\/p>\n\n\n\n
TCP 80\nTCP 443<\/code><\/pre>\n\n\n\n
\u5982\u679c\u67d0\u4e2a\u670d\u52a1\u5fc5\u987b\u901a\u8fc7\u81ea\u5b9a\u4e49 HTTPS \u7aef\u53e3\u8bbf\u95ee\uff0c\u4f8b\u5982\uff1a<\/p>\n\n\n\n
https://mcd.example.com:24444<\/code><\/pre>\n\n\n\n
\u8fd8\u9700\u8981\u653e\u884c\uff1a<\/p>\n\n\n\n
TCP 24444<\/code><\/pre>\n\n\n\n
\u7cfb\u7edf UFW \u653e\u884c\uff1a<\/p>\n\n\n\n
ufw allow 80\/tcp\nufw allow 443\/tcp\nufw allow 24444\/tcp\nufw reload\nufw status<\/code><\/pre>\n\n\n\n
\n\n\n\n
5. \u5b89\u88c5 Docker \u548c Compose<\/h2>\n\n\n\n
\u817e\u8baf\u4e91\u6267\u884c\uff1a<\/p>\n\n\n\n
apt update\napt install -y curl ca-certificates gnupg lsb-release\n\ncurl -fsSL https:\/\/get.docker.com | sh\n\nsystemctl enable docker\nsystemctl start docker\n\napt install -y docker-compose-plugin<\/code><\/pre>\n\n\n\n
\u53ef\u9009\uff1a\u914d\u7f6e Docker \u955c\u50cf\u6e90\u3002<\/p>\n\n\n\n
mkdir -p \/etc\/docker\n\ncat > \/etc\/docker\/daemon.json <<'EOF'\n{\n  \"registry-mirrors\": [\n    \"https:\/\/mirror.ccs.tencentyun.com\",\n    \"https:\/\/docker.m.daocloud.io\",\n    \"https:\/\/docker.1ms.run\"\n  ],\n  \"dns\": [\n    \"223.5.5.5\",\n    \"223.6.6.6\",\n    \"119.29.29.29\",\n    \"8.8.8.8\"\n  ]\n}\nEOF\n\nsystemctl daemon-reload\nsystemctl restart docker<\/code><\/pre>\n\n\n\n
\n\n\n\n
6. \u521b\u5efa Caddy \u76ee\u5f55<\/h2>\n\n\n\n
mkdir -p \/opt\/nas-gateway\/caddy\/data\nmkdir -p \/opt\/nas-gateway\/caddy\/config\nmkdir -p \/opt\/nas-gateway\/caddy\/site\n\ncd \/opt\/nas-gateway<\/code><\/pre>\n\n\n\n
\n\n\n\n
7. \u521b\u5efa Docker Compose<\/h2>\n\n\n\n
cat > \/opt\/nas-gateway\/docker-compose.yml <<'EOF'\nservices:\n  caddy:\n    image: caddy:latest\n    container_name: caddy\n    network_mode: host\n    volumes:\n      - .\/caddy\/Caddyfile:\/etc\/caddy\/Caddyfile\n      - .\/caddy\/site:\/srv\n      - .\/caddy\/data:\/data\n      - .\/caddy\/config:\/config\n    restart: unless-stopped\nEOF<\/code><\/pre>\n\n\n\n
network_mode: host<\/code> \u7528\u4e8e\u8ba9 Caddy \u76f4\u63a5\u76d1\u542c\u817e\u8baf\u4e91\u670d\u52a1\u5668\u7684 80\/443 \u7aef\u53e3\u3002<\/p>\n\n\n\n
\n\n\n\n
8. \u7f16\u5199 Caddyfile<\/h2>\n\n\n\n
\u6839\u636e\u5b9e\u9645\u57df\u540d\u548c\u7aef\u53e3\u4fee\u6539\u3002<\/p>\n\n\n\n
cat > \/opt\/nas-gateway\/caddy\/Caddyfile <<'EOF'\n# \u6d4b\u8bd5\u670d\u52a1\ntest.example.com {\n    reverse_proxy 10.66.66.2:18080\n}\n\n# \u98de\u725b\u7ba1\u7406\u540e\u53f0\uff0c\u540e\u7aef HTTP 5666\nnas.example.com {\n    reverse_proxy 10.66.66.2:5666\n}\n\n# WordPress\uff0cDocker \u5916\u90e8\u6620\u5c04\u7aef\u53e3 48080\nblog.example.com {\n    reverse_proxy 10.66.66.2:48080 {\n        header_up Host {host}\n        header_up X-Real-IP {remote_host}\n        header_up X-Forwarded-For {remote_host}\n        header_up X-Forwarded-Proto https\n        header_up X-Forwarded-Host {host}\n        header_up X-Forwarded-Port 443\n    }\n}\n\n# MCS Web \u7ba1\u7406\u7aef\nmcs.example.com {\n    reverse_proxy 10.66.66.2:23333 {\n        header_up Host {host}\n        header_up X-Real-IP {remote_host}\n        header_up X-Forwarded-For {remote_host}\n        header_up X-Forwarded-Proto https\n        header_up X-Forwarded-Host {host}\n        header_up X-Forwarded-Port 443\n    }\n}\n\n# MinIO Console\nminio.example.com {\n    reverse_proxy 10.66.66.2:9001 {\n        header_up Host {host}\n        header_up X-Real-IP {remote_host}\n        header_up X-Forwarded-For {remote_host}\n        header_up X-Forwarded-Proto https\n        header_up X-Forwarded-Host {host}\n    }\n}\n\n# MinIO S3 API\ns3.example.com {\n    reverse_proxy 10.66.66.2:9000 {\n        header_up Host {host}\n        header_up X-Real-IP {remote_host}\n        header_up X-Forwarded-For {remote_host}\n        header_up X-Forwarded-Proto https\n        header_up X-Forwarded-Host {host}\n    }\n}\nEOF<\/code><\/pre>\n\n\n\n
\n\n\n\n
9. MCD 24444 \u7279\u6b8a\u7aef\u53e3\u914d\u7f6e<\/h2>\n\n\n\n
\u5982\u679c MCD \u5fc5\u987b\u901a\u8fc7\uff1a<\/p>\n\n\n\n
https://mcd.example.com:24444<\/code><\/pre>\n\n\n\n
\u8bbf\u95ee\uff0c\u5219 Caddyfile \u589e\u52a0\uff1a<\/p>\n\n\n\n
mcd.example.com:24444 {\n    encode gzip\n\n    reverse_proxy 10.66.66.2:24444 {\n        header_up Host {host}\n        header_up X-Real-IP {remote_host}\n        header_up X-Forwarded-For {remote_host}\n        header_up X-Forwarded-Proto https\n        header_up X-Forwarded-Host {host}\n        header_up X-Forwarded-Port 24444\n        header_up X-Forwarded-Ssl on\n        header_up Upgrade {http.request.header.Upgrade}\n        header_up Connection {http.request.header.Connection}\n        flush_interval -1\n    }\n}<\/code><\/pre>\n\n\n\n
\u5982\u679c MCD \u540e\u7aef\u5f00\u542f\u4e86 HTTPS \u4e14\u4f7f\u7528\u81ea\u7b7e\u8bc1\u4e66\uff0c\u5219\u6539\u4e3a\uff1a<\/p>\n\n\n\n
mcd.example.com:24444 {\n    encode gzip\n\n    reverse_proxy https:\/\/10.66.66.2:24444 {\n        header_up Host {host}\n        header_up X-Real-IP {remote_host}\n        header_up X-Forwarded-For {remote_host}\n        header_up X-Forwarded-Proto https\n        header_up X-Forwarded-Host {host}\n        header_up X-Forwarded-Port 24444\n        header_up X-Forwarded-Ssl on\n        header_up Upgrade {http.request.header.Upgrade}\n        header_up Connection {http.request.header.Connection}\n\n        transport http {\n            tls_insecure_skip_verify\n        }\n\n        flush_interval -1\n    }\n}<\/code><\/pre>\n\n\n\n
\u63a8\u8350\u65b9\u5f0f\uff1a<\/p>\n\n\n\n
MCD \u540e\u7aef ssl=false\nCaddy \u5bf9\u5916\u63d0\u4f9b HTTPS\nCaddy \u5230\u540e\u7aef\u8d70 HTTP<\/code><\/pre>\n\n\n\n
\n\n\n\n
10. \u542f\u52a8 Caddy<\/h2>\n\n\n\n
cd \/opt\/nas-gateway\ndocker compose up -d caddy<\/code><\/pre>\n\n\n\n
\u67e5\u770b\u65e5\u5fd7\uff1a<\/p>\n\n\n\n
docker logs -f caddy<\/code><\/pre>\n\n\n\n
\u9a8c\u8bc1\u914d\u7f6e\uff1a<\/p>\n\n\n\n
docker exec -it caddy caddy validate --config \/etc\/caddy\/Caddyfile<\/code><\/pre>\n\n\n\n
\n\n\n\n
11. \u91cd\u8f7d\u6216\u91cd\u542f Caddy<\/h2>\n\n\n\n
\u4fee\u6539 Caddyfile \u540e\u6267\u884c\uff1a<\/p>\n\n\n\n
cd \/opt\/nas-gateway\ndocker compose restart caddy<\/code><\/pre>\n\n\n\n
\u67e5\u770b\u65e5\u5fd7\uff1a<\/p>\n\n\n\n
docker logs --tail=120 caddy<\/code><\/pre>\n\n\n\n
\n\n\n\n
12. \u9a8c\u8bc1\u8bbf\u95ee<\/h2>\n\n\n\n
\u817e\u8baf\u4e91\u672c\u673a\u6d4b\u8bd5 Caddy\uff1a<\/p>\n\n\n\n
curl -I -H \"Host: test.example.com\" http:\/\/127.0.0.1<\/code><\/pre>\n\n\n\n
\u6d4b\u8bd5 HTTPS\uff1a<\/p>\n\n\n\n
curl -Ik https:\/\/test.example.com<\/code><\/pre>\n\n\n\n
\u6d4b\u8bd5\u540e\u7aef\uff1a<\/p>\n\n\n\n
curl -I http:\/\/10.66.66.2:18080\ncurl -I http:\/\/10.66.66.2:5666\ncurl -I http:\/\/10.66.66.2:48080\ncurl -I http:\/\/10.66.66.2:23333<\/code><\/pre>\n\n\n\n
\u5982\u679c\u662f HTTPS \u540e\u7aef\uff1a<\/p>\n\n\n\n
curl -Ik https:\/\/10.66.66.2:24444<\/code><\/pre>\n\n\n\n
\n\n\n\n
13. \u5e38\u89c1\u95ee\u9898<\/h2>\n\n\n\n
13.1 Caddy \u672a\u542f\u52a8<\/h3>\n\n\n\n
\u8868\u73b0\uff1a<\/p>\n\n\n\n
DNS \u6b63\u786e\nWireGuard \u6b63\u5e38\ncurl \u540e\u7aef\u6b63\u5e38\n\u57df\u540d\u8bbf\u95ee\u4e0d\u4e86<\/code><\/pre>\n\n\n\n
\u5904\u7406\uff1a<\/p>\n\n\n\n
cd \/opt\/nas-gateway\ndocker compose up -d caddy\ndocker logs -f caddy<\/code><\/pre>\n\n\n\n
13.2 80\/443 \u88ab\u5176\u4ed6\u670d\u52a1\u5360\u7528<\/h3>\n\n\n\n
\u68c0\u67e5\uff1a<\/p>\n\n\n\n
ss -tulpn | grep -E ':80|:443'<\/code><\/pre>\n\n\n\n
\u5982\u679c nginx \u5360\u7528\u817e\u8baf\u4e91 80\/443\uff1a<\/p>\n\n\n\n
systemctl stop nginx\nsystemctl disable nginx<\/code><\/pre>\n\n\n\n
\u5982\u679c\u662f Docker nginx\uff1a<\/p>\n\n\n\n
docker ps\ndocker stop <\u5bb9\u5668\u540d\u6216ID>\ndocker rm <\u5bb9\u5668\u540d\u6216ID><\/code><\/pre>\n\n\n\n
\u7136\u540e\u91cd\u542f Caddy\uff1a<\/p>\n\n\n\n
cd \/opt\/nas-gateway\ndocker compose restart caddy<\/code><\/pre>\n\n\n\n
13.3 \u540e\u7aef HTTP\/HTTPS \u5199\u53cd<\/h3>\n\n\n\n
\u5982\u679c\uff1a<\/p>\n\n\n\n
curl -Ik https:\/\/10.66.66.2:24444<\/code><\/pre>\n\n\n\n
\u62a5\uff1a<\/p>\n\n\n\n
wrong version number<\/code><\/pre>\n\n\n\n
\u8bf4\u660e\u540e\u7aef\u662f HTTP\uff0cCaddy \u5e94\u5199\uff1a<\/p>\n\n\n\n
reverse_proxy 10.66.66.2:24444<\/code><\/pre>\n\n\n\n
\u5982\u679c\uff1a<\/p>\n\n\n\n
curl -I http:\/\/10.66.66.2:24444<\/code><\/pre>\n\n\n\n
\u8fd4\u56de\uff1a<\/p>\n\n\n\n
Empty reply from server<\/code><\/pre>\n\n\n\n
\u4f46\uff1a<\/p>\n\n\n\n
curl -Ik https:\/\/10.66.66.2:24444<\/code><\/pre>\n\n\n\n
\u80fd\u901a\uff0c\u8bf4\u660e\u540e\u7aef\u662f HTTPS\uff0cCaddy \u5e94\u5199\uff1a<\/p>\n\n\n\n
reverse_proxy https:\/\/10.66.66.2:24444 {\n    transport http {\n        tls_insecure_skip_verify\n    }\n}<\/code><\/pre>\n\n\n\n
13.4 Caddy \u8fd4\u56de 502<\/h3>\n\n\n\n
\u67e5\u770b\u65e5\u5fd7\uff1a<\/p>\n\n\n\n
docker logs --tail=120 caddy<\/code><\/pre>\n\n\n\n
\u5e38\u89c1\u539f\u56e0\uff1a<\/p>\n\n\n\n
1. \u540e\u7aef\u670d\u52a1\u6ca1\u542f\u52a8\n2. \u540e\u7aef\u7aef\u53e3\u5199\u9519\n3. \u540e\u7aef HTTP\/HTTPS \u5199\u53cd\n4. \u540e\u7aef\u4f7f\u7528\u81ea\u7b7e HTTPS\uff0c\u4f46 Caddy \u672a\u8bbe\u7f6e tls_insecure_skip_verify\n5. \u540e\u7aef\u670d\u52a1\u4e0d\u63a5\u53d7\u5f53\u524d Host<\/code><\/pre>\n\n\n\n
13.5 Socket.IO \/ WebSocket \u670d\u52a1\u5f02\u5e38<\/h3>\n\n\n\n
\u5982\u679c\u65e5\u5fd7\u4e2d\u51fa\u73b0\uff1a<\/p>\n\n\n\n
\/socket.io\/\nEOF\nstatus 502<\/code><\/pre>\n\n\n\n
Caddy \u914d\u7f6e\u4e2d\u52a0\u5165\uff1a<\/p>\n\n\n\n
header_up Upgrade {http.request.header.Upgrade}\nheader_up Connection {http.request.header.Connection}\nflush_interval -1<\/code><\/pre>\n\n\n\n
\u5e76\u68c0\u67e5\u670d\u52a1\u81ea\u8eab\u914d\u7f6e\uff1a<\/p>\n\n\n\n
public_url = https:\/\/\u5bf9\u5e94\u57df\u540d\ntrust_proxy = true\nssl = false<\/code><\/pre>\n\n\n\n
\n\n\n\n
14. \u751f\u4ea7\u5efa\u8bae<\/h2>\n\n\n\n
14.1 \u98de\u725b\u7ba1\u7406\u540e\u53f0\u52a0 Basic Auth<\/h3>\n\n\n\n
\u751f\u6210\u5bc6\u7801 hash\uff1a<\/p>\n\n\n\n
docker run --rm caddy:latest caddy hash-password<\/code><\/pre>\n\n\n\n
Caddyfile \u793a\u4f8b\uff1a<\/p>\n\n\n\n
nas.example.com {\n    basicauth {\n        admin <HASH>\n    }\n\n    reverse_proxy 10.66.66.2:5666\n}<\/code><\/pre>\n\n\n\n
14.2 \u6570\u636e\u5e93\u4e0d\u8d70 Caddy<\/h3>\n\n\n\n
MySQL \u4e0d\u662f HTTP \u534f\u8bae\uff0c\u4e0d\u5e94\u4f7f\u7528\u666e\u901a Caddy \u53cd\u4ee3\u3002<\/p>\n\n\n\n
\u63a8\u8350\uff1a<\/p>\n\n\n\n
MySQL \u53ea\u8d70 WireGuard \u5185\u7f51\u8bbf\u95ee\nHost: 10.66.66.2\nPort: 3306<\/code><\/pre>\n\n\n\n
\u6216\u4f7f\u7528 Adminer\/phpMyAdmin \u8fd9\u7c7b Web \u5de5\u5177\uff0c\u518d\u901a\u8fc7 Caddy \u66b4\u9732\u3002<\/p>\n\n\n\n
\n\n\n\n
15. \u6700\u7ec8\u7ef4\u62a4\u547d\u4ee4<\/h2>\n\n\n\n
cd \/opt\/nas-gateway\n\ndocker compose ps\ndocker logs -f caddy\ndocker compose restart caddy\ndocker compose pull\ndocker compose up -d\ndocker image prune -f<\/code><\/pre>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
1. \u67b6\u6784\u8bf4\u660e \u5173\u952e\u5730\u5740\uff1a Caddy \u8d1f\u8d23\uff1a 2. \u524d\u7f6e\u6761\u4ef6 \u786e\u4fdd WireGuard \u5df2\u7ecf\u8fde\u901a\u3002 \u817e\u8baf\u4e91\u6267 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[10],"class_list":["post-46","post","type-post","status-publish","format-standard","hentry","category-nas","tag-nas"],"_links":{"self":[{"href":"https:\/\/blog.kwitsukasa.top\/index.php?rest_route=\/wp\/v2\/posts\/46","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.kwitsukasa.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.kwitsukasa.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.kwitsukasa.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.kwitsukasa.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=46"}],"version-history":[{"count":2,"href":"https:\/\/blog.kwitsukasa.top\/index.php?rest_route=\/wp\/v2\/posts\/46\/revisions"}],"predecessor-version":[{"id":49,"href":"https:\/\/blog.kwitsukasa.top\/index.php?rest_route=\/wp\/v2\/posts\/46\/revisions\/49"}],"wp:attachment":[{"href":"https:\/\/blog.kwitsukasa.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=46"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.kwitsukasa.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=46"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.kwitsukasa.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=46"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}