Behind Caddy

Caddy serves the panel and the status page on separate domains, both routed to port 8484.

Deploy with Docker Compose

1. Point both domains at your server and allow inbound ports 80 and 443.

2. Download the Compose file and Caddyfile:

   curl -fsSLO https://raw.githubusercontent.com/piotrkowski/kogut/main/deploy/docker/caddy.compose.yml
   curl -fsSLO https://raw.githubusercontent.com/piotrkowski/kogut/main/deploy/docker/Caddyfile

3. Replace acme.com with your domain in both files:

   kogut.acme.com {
       reverse_proxy kogut:8484
   }
   
   status.acme.com {
       reverse_proxy kogut:8484
   }

4. Start the services:

   docker compose -f caddy.compose.yml up -d

5. When Caddy has its certificate, open https://kogut.acme.com and create your account with the setup token from the log:

   docker compose -f caddy.compose.yml logs kogut | grep setup_token

Set the status domain

Add this to /data/kogut.toml in kogut’s volume:

[brand]
status_domain = "status.acme.com"

To mount the file from the host instead, see Docker configuration.

Client addresses behind a proxy

Add Caddy’s container address or its network’s subnet to [server] trusted_proxies in kogut.toml, so kogut uses forwarded client addresses for rate limits and visitor counts. Find the subnet with:

docker network inspect <network> --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}'

Trust only your proxy’s address or its actual subnet, not a broad range such as 172.16.0.0/12 or 10.0.0.0/8.

Until the proxy is trusted, every visitor has the proxy’s address, such as 172.18.0.1, so visitors count as one and share one rate limit. When nearly all recent page views come from one private address that sends X-Forwarded-For, the Overview names it and shows the lines to copy:

[server]
trusted_proxies = ["172.18.0.1"]

If kogut.toml already has a [server] table or a trusted_proxies list, add it there. kogut reloads the file and the warning clears. A container’s address can change when it is recreated; the network’s subnet does not. See Configuration for address formats.

Use Caddy on the host

If Caddy already runs on the server, route both domains to kogut on loopback:

kogut.acme.com {
	reverse_proxy 127.0.0.1:8484
}

status.acme.com {
	reverse_proxy 127.0.0.1:8484
}

With the Linux service, set KOGUT_LISTEN=127.0.0.1:8484 and KOGUT_URL=https://kogut.acme.com, restart kogut, and reload Caddy. Loopback is trusted, so no trusted_proxies entry is needed.

Add forward auth

For a Caddyfile with Authelia or another forward-auth provider, see Forward auth.