Caddy reverse proxy fails with a login page

Submitted ⁨⁨2⁩ ⁨weeks⁩ ago⁩ by ⁨xavier666@lemmy.umucat.day⁩ to ⁨selfhosted@lemmy.world⁩

Hello all,

I figured that a chunk of the selfhost community is using Caddy, so decided to post my query here. I am a novice in Caddy, so I might be saying some incorrect terms.

Some information

The router and the host running Caddy, are different machines
The router page is running HTTP, but I am accessing it via HTTPS through Caddy
Caddy is running via Docker.

I have a couple of services running on a host, so I access them via Caddy’s reverse proxy. Now I am also trying to access my router login via the same reverse proxy. This is what the router entry in the caddyfile looks like

.
.
{
    local_certs
}
login.router.lan {
	reverse_proxy 192.168.1.1:80
}
.
.

With this entry, I can access the login page. However, when I enter the password, I feel like it’s attempting to login but then it just comes back to the original login page. When I access it directly, the login is successful. I also have Pihole running and the Pihole login process works fine. So I suspect that the router login page is expecting some extra information from Caddy to forward it to the login page.

After some searching online and some LLM wrangling, I figured it’s some cookie issue or my login page is expecting a certain host.

What should I add to my Caddyfile so that the login redirect works?

source

Comments

Sort:hotnew top

a14o@feddit.org ⁨2⁩ ⁨weeks⁩ ago

Seems like the router doesn’t like how the headers are passed on. You could try:

login.router.lan {
    reverse_proxy 192.168.1.1:80 {
        header_up Host {upstream_hostport}
    }
}

caddyserver.com/docs/caddyfile/…/reverse_proxy#he…

source

irmadlad@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
Semi related, you can check the validity of Caddy entries into the caddyfile:

sudo caddy fmt --overwrite /etc/caddy/Caddyfile

caddy validate --config /etc/caddy/Caddyfile

Where /etc/caddy/Caddyfile points to your caddyfile.
source

xavier666@lemmy.umucat.day ⁨2⁩ ⁨weeks⁩ ago

I have tried this, but unfortunately, it did not work. I have tried this suite of commands

login.router.lan {
    reverse_proxy 192.168.1.1:80 {
        # Preserve original host and scheme
        header_up Host {upstream_hostport}
        header_up X-Forwarded-Proto {http.request.scheme}
        header_up X-Forwarded-Host {http.request.host}
        header_up X-Forwarded-For {http.request.remote.host}

        # Keep cookies intact
        header_up Cookie {http.request.header.Cookie}
        header_down Set-Cookie {http.response.header.Set-Cookie}

        # Preserve Origin/Referer for CSRF tokens
        header_up Origin https://{http.request.host}
        header_up Referer https://{http.request.host}{http.request.uri.path}
    }
}

Info: My caddy uses HTTPS but the router login page is HTTP. Not sure if this is relevant.

source

iamthetot@piefed.ca ⁨2⁩ ⁨weeks⁩ ago
I don’t have anything to help you, other than to say you’re probably onto it being something specific about your router wanting more info from the reverse proxy. I have an actiontec modem I proxy behind nginx proxy manager and it works fine without any additional configuration, though.

What I really wanted to comment on was my surprise that everyone in a self hosting community assumed you were exposing that to the public when you absolutely did not say anything that implied it. Do none of you reverse proxy your local services? It’s wonderful!

source
- xavier666@lemmy.umucat.day ⁨2⁩ ⁨weeks⁩ ago
  
  Do none of you reverse proxy your local services? It’s wonderful!
  
  Yes please! I don’t want to type the port number when multiple services are running on the same server.
  
  what cert are you using?
  
  It’s a self-signed local cert. I’m not using Let’s Encrypt. Does it require a valid domain name to work?
  
  source
  - iamthetot@piefed.ca ⁨2⁩ ⁨weeks⁩ ago
    The setup I have does require a domain name, yes. I DNS challenge through cloudflare at the moment to get a wildcard cert for *.domain.tld and use that for my local services, including my modem, to serve with https.
    
    source
mrnobody@reddthat.com ⁨2⁩ ⁨weeks⁩ ago
Why are you exposing your router login to the open web?? No bueno!

I take it you’re hitting that page via browsing to your public IP or domain name you setup? I’m no expert but it sounds like you’re using a self signed cert and using https to login to your router and it doesn’t like that…

source
- xavier666@lemmy.umucat.day ⁨2⁩ ⁨weeks⁩ ago
  I use wireguard when I’m outside. So I first turn wireguard and then access all my stuff.
  
  But it sounds like you’re using a self signed cert and using https to login to your router and it doesn’t like that
  
  Any way to trick my router login page? It’s a TP-Link router
  
  source
lmr0x61@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
I have to echo what others have said, and tell you exposing your router’s login to the public internet is very risky (if you’re referring to the WiFi router in your home). I would strongly recommend some other solution to whatever broader problem you’re trying to solve with this—why do you need to access your router login from outside your home? Can the logging in (and presumably tinkering) be done at home? Definitely things to think through before proceeding.

source
UnpledgedCatnapTipper@piefed.blahaj.zone ⁨2⁩ ⁨weeks⁩ ago
Does accessing your router page via caddy work when you’re actually on your home network and not accessing it via wireguard? Have you tried a different web browser to rule out your LLM suggested cookie issues entirely?

source
- xavier666@lemmy.umucat.day ⁨2⁩ ⁨weeks⁩ ago
  Does accessing your router page via caddy work when you’re actually on your home network
  
  Unfortunately no, which rules out an issue with wireguard.
  
  Have you tried a different web browser to rule out your LLM suggested cookie issues
  
  It’s not the stale cookie issue which goes away when opening a website in incognito. I think it expects the cookie to have the original host information.
  
  Let me paste the list of issues the LLM mentioned. The following section is from the LLM
  
  <LLM>
  
  The router’s web UI expects the original hostname (e.g., 192.168.0.1) and builds redirects or CSRF tokens based on it. Caddy sends its own host (myproxy.example.com).
  
  Authentication cookies are set for the original domain and may be dropped or rewritten by the proxy, causing the server to think the user is unauthenticated.
  
  The router returns Location: 192.168.0.1… which points the browser back to the internal address, bypassing the proxy.
  
  Tokens are generated using the Origin or Referer header; the proxy changes these, making the token invalid on POST.
  
  The router forces HTTPS or blocks HTTP when it sees a mismatch, and Caddy may be terminating TLS while the upstream expects plain HTTP.
  
  Some admin UIs use WebSocket for status updates; if Caddy doesn’t forward the upgrade, the page may reload to the login screen.
  
  The router’s UI may be served from / but expects relative paths; Caddy’s uri rewrite can break those links.
  
  </LLM>
  
  It has also mentioned some solutions for each cause. But I don’t want to blindly apply them without knowing what is wrong.
  
  source
  - UnpledgedCatnapTipper@piefed.blahaj.zone ⁨2⁩ ⁨weeks⁩ ago
    My best suggestion would be to try enabling web sockets and see if it changes anything. I did find a post for a similar issue that someone was having with a different reverse proxy, but I’m not sure if it’ll be helpful.
    
    https://github.com/NginxProxyManager/nginx-proxy-manager/issues/2099
    
    source
Decronym@lemmy.decronym.xyz ⁨2⁩ ⁨weeks⁩ ago
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters

DNS Domain Name Service/System

HTTP Hypertext Transfer Protocol, the Web

IP Internet Protocol

nginx Popular HTTP server

[Thread #102 for this comm, first seen 18th Feb 2026, 14:11] [FAQ] [Full list] [Contact] [Source code]

source

Fewer Letters	More Letters
DNS	Domain Name Service/System
HTTP	Hypertext Transfer Protocol, the Web
IP	Internet Protocol
nginx	Popular HTTP server