Reverse proxy with Caddy + auto-TLS
One Caddyfile, automatic Let's Encrypt certificates, HTTP/3 and sane defaults — the fastest path to TLS in front of any app.
Caddy is the lowest-maintenance TLS terminator: it obtains and renews certificates automatically and speaks HTTP/3 out of the box. Ideal as the front door for apps running on your NoctisNode VPS.
Install
apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list
apt update && apt install -y caddyOne-file config
caddy reload applies changes with zero downtime. Certificates are requested automatically the moment a domain resolves to the server's IP — NoctisNode IPs are clean, so ACME checks pass on the first try.
# /etc/caddy/Caddyfile
example.com {
reverse_proxy 127.0.0.1:3000
encode zstd gzip
headers {
Strict-Transport-Security "max-age=63072000"
X-Content-Type-Options nosniff
}
}Tips
- ▹Use DNS-01 challenges if the site must stay reachable before DNS cuts over.
- ▹For onion services, terminate TLS at Caddy only on the clearnet mirror — the onion side needs no certificate.
- ▹Keep the upstream bound to 127.0.0.1 so it is never reachable directly.