# Behind Caddy

Serve the panel and status page over HTTPS with Caddy.

[Caddy](https://caddyserver.com) serves the panel and the status page on separate
domains, both routed to port 8484.

## Deploy with Docker Compose

1. Point both domains at your server and allow inbound ports 80 and 443.

2. Download the Compose file and Caddyfile:

   ```sh
   curl -fsSLO https://raw.githubusercontent.com/piotrkowski/kogut/main/deploy/docker/caddy.compose.yml
   curl -fsSLO https://raw.githubusercontent.com/piotrkowski/kogut/main/deploy/docker/Caddyfile
   ```

3. Replace `acme.com` with your domain in both files:

   ```caddy title="Caddyfile"
   kogut.acme.com {
       reverse_proxy kogut:8484
   }

   status.acme.com {
       reverse_proxy kogut:8484
   }
   ```

4. Start the services:

   ```sh
   docker compose -f caddy.compose.yml up -d
   ```

5. When Caddy has its certificate, open `https://kogut.acme.com` and create your
   account with the setup token from the log:

   ```sh
   docker compose -f caddy.compose.yml logs kogut | grep setup_token
   ```

## Set the status domain

Add this to `/data/kogut.toml` in kogut's volume:

```toml title="kogut.toml"
[brand]
status_domain = "status.acme.com"
```

To mount the file from the host instead, see
[Docker configuration](https://docs.kogut.dev/installation/docker/#configuration).

## Client addresses behind a proxy

Add Caddy's container address or its network's subnet to `[server] trusted_proxies` in
`kogut.toml`, so kogut uses forwarded client addresses for rate limits and visitor
counts. Find the subnet with:

```sh
docker network inspect <network> --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}'
```

Trust only your proxy's address or its actual subnet, not a broad range such as
`172.16.0.0/12` or `10.0.0.0/8`.

Until the proxy is trusted, every visitor has the proxy's address, such as `172.18.0.1`,
so visitors count as one and share one rate limit. When nearly all recent page views
come from one private address that sends `X-Forwarded-For`, the **Overview** names it
and shows the lines to copy:

```toml
[server]
trusted_proxies = ["172.18.0.1"]
```

If `kogut.toml` already has a `[server]` table or a `trusted_proxies` list, add it there.
kogut reloads the file and the warning clears. A container's address can change when it
is recreated; the network's subnet does not. See
[Configuration](https://docs.kogut.dev/reference/configuration/#server) for address formats.

## Use Caddy on the host

If Caddy already runs on the server, route both domains to kogut on loopback:

```caddy title="Caddyfile"
kogut.acme.com {
	reverse_proxy 127.0.0.1:8484
}

status.acme.com {
	reverse_proxy 127.0.0.1:8484
}
```

With the [Linux service](https://docs.kogut.dev/installation/linux/#configure-the-service), set
`KOGUT_LISTEN=127.0.0.1:8484` and `KOGUT_URL=https://kogut.acme.com`, restart kogut, and
reload Caddy. Loopback is trusted, so no `trusted_proxies` entry is needed.

## Add forward auth

For a Caddyfile with Authelia or another forward-auth provider, see
[Forward auth](https://docs.kogut.dev/sign-in/forward-auth/#configure-caddy-with-authelia).