ScuroNeko/mtg
1
0
Fork 0
mirror of https://github.com/ScuroNeko/mtg.git synced 2026-09-02 00:11:56 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix ACME HTTP-01 passthrough in HAProxy config

Browse Source 
Add an ACL that routes /.well-known/acme-challenge/ requests on :80
to Caddy instead of redirecting to HTTPS, so Let's Encrypt certificate
issuance works out of the box.

Also simplify Caddyfile to use Caddy's http_port/https_port directives.
This commit is contained in:
dolonet
2026-04-10 10:50:26 +00:00
parent 0c1d001949
commit d0412b21f6
4 changed files with 19 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
contrib/sni-router/README.md
+3 -10
View File
@@ -45,16 +45,9 @@ docker compose exec mtg mtg access /config/config.toml
## ACME (Let's Encrypt) notes
Caddy needs to answer the ACME HTTP-01 challenge on port 80. The
default `haproxy.cfg` redirects all `:80` traffic to HTTPS. If Caddy
cannot obtain a certificate, either:
1. Temporarily stop HAProxy, let Caddy bind `:80` directly for the
initial certificate, then start the full stack; or
2. Use DNS-01 validation in the Caddyfile (requires a DNS provider
plugin); or
3. Add an HAProxy ACL that passes `/.well-known/acme-challenge/`
requests to the Caddy backend instead of redirecting.
HAProxy passes `/.well-known/acme-challenge/` requests on `:80` to
Caddy so that HTTP-01 validation works out of the box. Make sure your
domain's DNS A/AAAA record points to this server before starting.
## Architecture