Tutorial: Expose a loopback service behind Caddy

Goal: Publish a new HTTP app on aux the same way production stacks do: listen on 127.0.0.1 only, terminate TLS at Caddy, open nothing extra on the firewall.

Time: ~25 minutes
Level: Intermediate
Caution: Editing /etc/caddy/Caddyfile affects live traffic. Use a disposable hostname or coordinate a maintenance window. Prefer validating config before reload.

Prerequisites

• SSH as ty with sudo
• A free subdomain DNS A/AAAA record already pointing at 147.93.186.68 (or use an existing test name you control)
• Read System architecture once

1. Run a throwaway app on loopback

Example with a static file server (replace port if busy):

mkdir -p /tmp/caddy-lab && echo 'ok-aux-lab' > /tmp/caddy-lab/index.html
python3 -m http.server 18999 --bind 127.0.0.1 --directory /tmp/caddy-lab

In another session:

curl -s http://127.0.0.1:18999/
# expect: ok-aux-lab

2. Confirm it is not public

From a machine off the host (or via a quick external check), http://147.93.186.68:18999 should not connect. UFW only allows 22/80/443.

3. Add a Caddy site block

sudo cp /etc/caddy/Caddyfile /etc/caddy/Caddyfile.bak-$(date -u +%Y%m%dT%H%M%SZ)
sudoedit /etc/caddy/Caddyfile

Append a block (use your real hostname):

lab.example.com {
    reverse_proxy 127.0.0.1:18999
}

4. Validate, then reload

sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy
curl -sI https://lab.example.com | head -10
curl -s https://lab.example.com

Expect a valid certificate and body ok-aux-lab.

5. Clean up

Stop the Python server. Remove the lab block (or leave disabled). Reload Caddy again. Delete the backup only after you confirm production vhosts still work:

curl -sI https://cloud.cadenceworks.tech | head -3

Success criteria

• [ ] App bound to 127.0.0.1, not 0.0.0.0
• [ ] No new UFW allow rules required
• [ ] caddy validate passed before reload
• [ ] HTTPS worked through Caddy
• [ ] Production fronts still respond after cleanup

Where the real vhosts live

See Caddy reference and DNS map.