One address for all your home-lab apps: a reverse proxy with Caddy

Use Caddy to put several self-hosted apps behind friendly names with automatic HTTPS, without memorising ports.

intermediateUpdated 2026-11-02

Self-hosting a few apps quickly turns into a list of ports: :8090 for cameras, :8096 for media, :3000 for a dashboard. A reverse proxy sits in front of them and sends each request to the right app based on its name. With Caddy it can also take care of HTTPS certificates for you.

The 30-second version

Caddy’s quick-start shows a single command that forwards one port to another:

caddy reverse-proxy --from :2080 --to :9000

Its config-file version (a Caddyfile) is just as short:

:2080

reverse_proxy :9000

Several apps, one name each

A Caddyfile that gives every app its own hostname. The addresses are examples, so swap in your own:

cameras.home.example.com {
    reverse_proxy 192.168.1.50:8090
}

media.home.example.com {
    reverse_proxy 192.168.1.60:8096
}

dash.home.example.com {
    reverse_proxy localhost:3000
}

Run Caddy in the folder with the file (caddy run), or install it as a service. Point each name at the Caddy machine in DNS: a local DNS server, your router, or a public DNS record if the names are public.

How HTTPS works here

Caddy’s automatic HTTPS docs describe two paths:

  • Public names (a real domain you own, reachable from the internet): Caddy gets a publicly trusted certificate on its own. Requirements:
    • The domain’s DNS points at the server.
    • Ports 80 and 443 are open from the internet to Caddy.
    • Caddy’s data folder is writable and persistent.
    • HTTP is automatically redirected to HTTPS.
  • localhost, IP addresses and internal-only names: Caddy creates its own local certificate authority and signs certificates with it. It tries to add that CA to your computer’s trust store (it may ask for your password), but other devices won’t trust it until you install the root certificate on them. The root lives under pki/authorities/local in Caddy’s data folder.

Ports below 1024

Listening on 80 and 443 needs extra permission on Linux and macOS. Caddy’s docs give the options:

  • Run it as root.

  • Grant just that capability on Linux:

    sudo setcap cap_net_bind_service=+ep $(which caddy)

  • Use a high port instead, such as example.com:8443.

Think before exposing anything

A reverse proxy makes it easy to publish apps to the internet. That’s not always a good idea. Camera systems, NAS admin pages and dashboards often have weak logins. Safer patterns:

  • Keep the proxy inside your network only, and reach it from outside through a VPN such as WireGuard or Tailscale.
  • If something must be public, put authentication in front of it and keep the app updated.

Sources