Merged
Conversation
- Complete experiment report with deployment procedure and test results - Evaluation conclusion with recommendation to adopt Caddy - Configuration files with redacted secrets - WebSocket test passed (critical success criterion where Pingoo failed) - All HTTPS endpoints verified working - Automatic Let's Encrypt certificates (~3-4 seconds for 3 domains)
- Use tabs instead of spaces for indentation (Caddy standard) - Add comment warning about tab requirement to prevent future issues - Fixes warning: 'Caddyfile input is not formatted' - Verified on server after restart - no warnings
- Add section explaining single-file vs multi-file (import) configuration - Document trade-offs between approaches - Recommend single-file for initial implementation (consistent with docker-compose pattern) - Note that multi-file pattern can be adopted later if needed
- Explain HTTP/2 and HTTP/3 warnings on port 80 (expected, redirect-only port) - Explain OCSP stapling warning (security feature working correctly) - Clarify that all warnings indicate correct, secure behavior - Add verification commands for HTTP/2 and HTTP/3 on port 443 - Add OCSP to project dictionary
- Use 'caddy validate' command to verify configuration is valid - Follows same healthcheck pattern as other services (Prometheus, Grafana) - Verified working on test server (status: healthy) - Healthcheck runs every 10s with 5s timeout
- Add comment clarifying healthcheck is built into torrust/tracker image
- Documents endpoint: http://localhost:${HEALTH_CHECK_API_PORT}/health_check
- Prevents future confusion about missing healthcheck configuration
- Add comprehensive security scan for caddy:2.10 image - Document 4 vulnerabilities (3 HIGH, 1 CRITICAL) in dependencies - Scan shows Alpine base is clean, vulnerabilities only in Go binary deps - Assessment: Safe to deploy with monitoring, patches expected soon - Add Phase 6 to implementation plan: Update security workflow - Document requirement to add caddy to .github/workflows/docker-security-scan.yml - Add 'smallstep' to project-words.txt for spell checking - Add experiments/ to .gitignore to prevent committing files with secrets
- Deploy Caddy configuration to production at /opt/torrust/ - Move Caddyfile to storage/caddy/etc/ following project conventions - All services running healthy with HTTPS working - Update experiment-files to match production structure - Add production-deployment.md documenting deployment process - Update conclusion.md and README.md with production status - Production serves as reference for future Tera template creation
josecelano
force-pushed
the
270-evaluate-caddy-for-https-termination
branch
from
5dfb0bb to
5026ea9
Compare
Member
Author
|
ACK 5026ea9 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Evaluation of Caddy v2.10 as TLS termination proxy for Torrust Tracker deployments.
Status: ✅ Evaluation Complete - Recommend Adoption
Closes #270
Key Results
/api/health_check→ HTTP/2 200/announceand/health_check→ HTTP/2 200WebSocket Test (Critical)
This was the critical failure point for Pingoo (#234).
Documentation
docs/research/caddy-tls-proxy-evaluation/experiment-full-stack.mddocs/research/caddy-tls-proxy-evaluation/conclusion.mddocs/research/caddy-tls-proxy-evaluation/experiment-files/(secrets redacted)Recommendation
ADOPT CADDY as the TLS termination proxy for Torrust Tracker deployments.
Rationale:
Next Steps
Draft Status
This PR is marked as draft to allow for additional improvements while colleagues review the evaluation results.