Caddy配置指南


下载安装

从Github的release页下载相应操作系统的最新版本,使用dpkg安装

1
2
wget https://github.com/caddyserver/caddy/releases/download/v2.7.6/caddy_2.7.6_linux_amd64.deb
sudo dpkg -i caddy_2.7.6_linux_amd64.deb

验证是否正确安装

  1. 二进制文件位置

    1
    2
    which caddy
    # /usr/bin/caddy
  1. caddy用户 (若未建立请手动添加👉添加用户

    1
    2
    id caddy
    # uid=998(caddy) gid=998(caddy) groups=998(caddy),33(www-data)
  2. systemd配置文件

安装完成后会自动生成systemd配置文件,位于/lib/systemd/system/caddy.service,内容如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
[Unit]
Description=Caddy
Documentation=https://caddyserver.com/docs/
After=network.target network-online.target
Requires=network-online.target

[Service]
Type=notify
User=caddy
Group=caddy
ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile
ExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile --force
TimeoutStopSec=5s
LimitNOFILE=1048576
LimitNPROC=512
PrivateTmp=true
ProtectSystem=full
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE

[Install]
WantedBy=multi-user.target

可见caddy默认加载的Caddyfile配置文件位于/etc/caddy/Caddyfile,在后续配置站点的过程中,也只需要编辑该文件即可。

添加用户(可选)

添加一个名为caddy的用户用于运行Caddy程序。

1
2
3
4
5
6
7
8
sudo groupadd --system caddy
sudo useradd --system \
--gid caddy \
--create-home \
--home-dir /var/lib/caddy \
--shell /usr/sbin/nologin \
--comment "Caddy web server" \
caddy

注意:caddy用户的home目录位于/var/lib/caddy

配置文件

1
vim /etc/caddy/Caddyfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# To use your own domain name (with automatic HTTPS), first make
# sure your domain's A/AAAA DNS records are properly pointed to
# this machine's public IP, then replace ":80" below with your
# domain name.

:80 {
# Set this path to your site's directory. if your root path starts with /, you'll need to add a * matcher token to distinguish it from a path matcher.
root * /usr/share/caddy

# Enable the static file server.
file_server

# Another common task is to set up a reverse proxy:
# reverse_proxy localhost:8080

# Or serve a PHP site through php-fpm:
# php_fastcgi localhost:9000
}

# Refer to the Caddy docs for more information:
# https://caddyserver.com/docs/caddyfile

常用配置

官方文档:https://caddyserver.com/docs/caddyfile

静态文件

加上brower可以显示文件列表,否则只能访问指定路径的文件。

1
2
3
4
5
:8005 {
root * /var/lib/caddy
file_server brower
}

注意:自定义路径时需要注意,目录权限需要设为用户caddy:caddy可访问

为方便起见,可创建/var/www作为静态网站目录。

1
2
sudo mkdir /var/www
sudo chmod 777 /var/www

反向代理

1
2
3
4
5
6
7
8
9
:8005 {
reverse_proxy /v1/* localhost:9000
reverse_proxy /v2/* localhost:9001
@websockets { # 通过header中的字段匹配websocket请求
header Connection *Upgrade*
header Upgrade websocket
}
reverse_proxy @websockets localhost:6001
}

路径匹配

有时候会需要根据路径把请求转发给不同的服务器,比如将/v1/开头的转发给openai,把/v2/开头的转发给closeai,但转发给closeai接收的路径也需要是/v1/,这就需要先匹配/v2/再替换成/v1/再转发给closeai服务器。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
:8080 {
import log_file openai
reverse_proxy /v1/* {
to https://api.openai.com
header_up Host api.openai.com

}
handle_path /v2/* { # 注意:该操作会自动移除匹配到的前缀
rewrite * /v1{uri}
reverse_proxy {
to https://api.closeai.com
header_up Host api.closeai.com
}
}
}

错误码处理

1
2
3
4
5
6
7
8
9
10
11
12
13
:8080 {
...
handle_errors {
@5xx `{err.status_code} >= 500 && {err.status_code} < 600`
handle @5xx {
respond "503 \{\"msg\": \"Proxy Server Error\"\}"
}

handle {
respond "{err.status_code} {err.status_text}"
}
}
}

日志文件

为方便多站点复用配置,可以新建一个snippet:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
(log_file) {
log {
format filter {
wrap console
fields {
request>headers>User-Agent delete
}
}
output file /var/log/caddy/{args[0]}.access.log {
roll_size 10mb
roll_keep 3
roll_keep_for 7d
}
}
}

在站点配置中引用log_file即可,后面加上一个参数,表示自定义的文件名,如:

1
2
3
4
gh.luzy.top {
import log_file gh
reverse_proxy * localhost:7703
}

其他

使用ufw管理防火墙

设置默认关闭所有端口

1
2
3
sudo apt-get install ufw
sudo ufw enable
sudo ufw default deny

设置启用端口(可用服务名或端口号)

1
2
3
sudo ufw allow 22/tcp
sudo ufw allow http
sudo ufw allow https

删除规则

1
sudo ufw delete allow https

查询状态

1
ufw status

重载firewall

1
ufw reload
作者

江风引雨

发布于

2024-03-06

更新于

2024-07-10

许可协议

CC BY 4.0

评论