CT101 — Caddy Routing

CT101 is the single ingress point for all public traffic on Helsinki2. It runs Caddy v2 with automatic TLS.

Container

Property	Value
CTID	101
IP	192.168.100.101
Service	Caddy v2
Config	/etc/caddy/Caddyfile

Current Route Table

Domain	Backend	Notes
crm.echohuman.org	192.168.100.220:7010	EchoHuman Twenty CRM
analytics.echohuman.org	192.168.100.220:7020	Matomo Analytics
docsaurus.echohuman.org	192.168.100.220:7030	This Docusaurus site
crm.lifehousestroud.org.uk	192.168.100.220:3000	Lifehouse Twenty CRM

Adding a Route

pct exec 101 -- bash
nano /etc/caddy/Caddyfile
# Add:
# new-subdomain.domain.org {
#     reverse_proxy 192.168.100.220:PORT
# }
systemctl reload caddy

Verifying Caddy Config

pct exec 101 -- caddy validate --config /etc/caddy/Caddyfile

TLS

Caddy obtains certificates automatically from Let's Encrypt via HTTP-01 challenge. Certificates are stored in /var/lib/caddy/.local/share/caddy/.

Password Protection

To add basic auth to a route (e.g. for Docsaurus):

docsaurus.echohuman.org {
    basicauth {
        user $2a$14$... # bcrypt hash — generate with: caddy hash-password
    }
    reverse_proxy 192.168.100.220:7030
}

Generate a password hash on CT101:

pct exec 101 -- caddy hash-password --plaintext 'yourpassword'