caddy-reverse-proxy_skill

Overview

This skill adds, manages, and troubleshoots Caddy reverse proxy routes to expose local apps via wildcard subdomains with automatic HTTPS. It focuses on routing *.YOUR_DOMAIN to local services while limiting access to a Tailscale-only setup and automating certificate issuance via DNS-01 challenges.

How this skill works

You declare app routes in a Caddyfile that import a DNS-01 TLS snippet for Vercel DNS and point each subdomain to a local port using reverse_proxy. The skill supports creating background services for each app, reloading Caddy without restarting the service, and automating certificate provisioning via Let's Encrypt. It also provides commands and snippets to restart Caddy and verify DNS and TLS status.

When to use it

• Expose multiple local development apps under *.YOUR_DOMAIN with HTTPS and wildcard subdomains.
• Automate certificate issuance for local services when using Vercel DNS for DNS-01 ACME challenges.
• Route traffic to services running on different local ports without exposing them publicly (Tailscale-only access).
• Quickly add or remove dev servers and have URLs like https://myapp.YOUR\_DOMAIN resolve.
• Troubleshoot TLS, DNS resolution, and Caddy configuration for local proxying.

Best practices

• Run each app as a background service (systemd on Linux or LaunchAgent/LaunchDaemon on macOS) so ports are stable and managed.
• Keep a single canonical Caddyfile in ~/.config/caddy/Caddyfile and reload Caddy with the local API to apply changes without downtime.
• Use the correct DNS provider plugin: this skill ships with caddy-dns/vercel by default; swap it for your provider if needed.
• Wait 30–60 seconds after reload for DNS-01 challenges and certificate provisioning to complete before testing TLS.
• Log and monitor Caddy errors (tail /var/log/caddy-error.log) and verify DNS with dig to debug resolution issues.

Example use cases

• Map a local React dev server at localhost:3123 to https://frontend.YOUR\_DOMAIN during development.
• Run multiple microservices on different ports and expose them as service1.YOUR_DOMAIN, service2.YOUR_DOMAIN, etc.
• Use dev-serve integration to bring up ephemeral development sites with one command and automatic Caddy routing.
• Integrate local apps with an internal OpenClaw gateway while keeping access restricted to the Tailscale network.
• Quickly rotate an expired Vercel API token and confirm certificates reissue without removing routes.