Caddy As A TLS Front Door
Caddy with HTTPS on: the package serves plain HTTP with a Server header and an admin API any local process can use. This role gives private names a certificate from Caddy's own CA (public ones get Let's Encrypt), redirects HTTP, sends HSTS and the security headers, drops Server, turns the admin API off, and serves files or proxies an upstream. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-19 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-caddy-https?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [Caddy As A TLS Front Door](https://www.iac-bazaar.com/catalog/ansible-caddy-https?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# Caddy As A TLS Front Door: https://www.iac-bazaar.com/catalog/ansible-caddy-https (download from your IaC Bazaar account)
```Preview:
Documentation
caddy-https
Caddy as a TLS front door: HTTPS by default (its own CA for private names,
Let's Encrypt for public ones), HTTP redirected, HSTS and the usual security
headers on every response, no Server header, no admin API. Serves a
directory or proxies an upstream. Original role for EL 10, live-tested with
podman on Rocky Linux 10.
Caddy is in EPEL. AppStream on EL 10 does not carry it; the role enables
EPEL first (caddy_https_enable_epel: false if you mirror it).
The package serves plain HTTP. Its Caddyfile is http:// on port 80 from
/usr/share/caddy, and every response says Server: Caddy. Caddy's whole
point is automatic HTTPS; the package configuration switches it off. This
role writes a site block for a real address, and the live test proves HTTP
answers with a permanent redirect to HTTPS.
Private names get real certificates too. tls internal makes Caddy run
its own CA, so localhost, an internal hostname or an IP gets a certificate a
client can verify against one root file
(/var/lib/caddy/.local/share/caddy/pki/authorities/local/root.crt). The
live test verifies the chain against exactly that file, with certificate
checking on, and negotiates TLS 1.3. The role does not push that root into the
host's trust store (skip_install_trust); distributing a CA root is a
decision, not a side effect.
The admin API is off. Caddy listens on localhost:2019 by default and
any local process can replace the running configuration through it. This
role turns it off and restarts Caddy on changes instead of reloading through
it; the live test reads the listening sockets and expects no :2019.
Public hostnames: set caddy_https_site_address to the name,
caddy_https_tls: auto and caddy_https_acme_email; the role refuses auto
without an email. Ports 80 and 443 must reach the host for the ACME
challenge.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-varnish
Varnish from AppStream as a loopback HTTP cache with health-probed backends and PURGE limited to the addresses you list. Its VCL is checked before it lands, with -j none because the compiler cannot read root's temp files, and reloaded so the cache survives. The live test sees MISS then HIT with one origin request, a working purge and a refused one. Original role, live-tested on Rocky Linux 10.
ansible-httpd-tls
httpd with mod_ssl from AppStream on EL 10: one TLS site, an explicit protocol floor and cipher list, HSTS, and the plain port doing nothing but redirecting. The live test reads the site with the certificate the role installed, checks the headers, and is refused when it asks for a cipher outside the list. Original role, live-tested on Rocky Linux 10.
ansible-nginx
Verified wrapper around geerlingguy.nginx pinned at 3.3.0 plus an IaC Bazaar hardening overlay (server_tokens off, security headers, default-vhost removal); live-tested for idempotence and functionally verified: systemd unit active, HTTP 200, headers present, no version leak.
ansible-php-fpm
php-fpm from AppStream on EL 10: one pool on a unix socket, open_basedir closed around its own tree, and the process-spawning functions removed. The live test runs PHP through the socket, is refused a read outside the tree, watches a call to a removed function stop the request, and finds nothing listening on TCP. Original role, live-tested on Rocky Linux 10.