eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions

Fix Caddy v2.11 Host header rewrite breaking proxied services

Browse source 
Caddy v2.11 (#7454) auto-rewrites the Host header to match the
upstream address for HTTPS backends. This causes services behind
Tailscale Ingress to see *.tail8d86e.ts.net instead of *.ops.eblu.me,
breaking Authentik OAuth flows, Homepage host validation, and other
services that check the Host header.

Only apply header_up for HTTPS backends (Tailscale Ingress); HTTP
backends (forge, registry, jellyfin, sifaka) are unaffected.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Erich Blume 2026-03-15 18:28:18 -07:00
commit 1f0308bbd2
2 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
ansible/roles/caddy/templates/Caddyfile.j2
View file

@ -31,7 +31,15 @@
{% for service in caddy_services %}
@{{ service.name }} host {{ service.host }}
handle @{{ service.name }} {
{% if service.backend.startswith('https://') %}
reverse_proxy {{ service.backend }} {
# Caddy v2.11+ rewrites Host to upstream for HTTPS backends.
# Preserve the original Host so services see *.ops.eblu.me.
header_up Host {http.request.host}
}
{% else %}
reverse_proxy {{ service.backend }}
{% endif %}
}
{% endfor %}

1
docs/changelog.d/+caddy-v2.11-host-header.bugfix.md Normal file
View file

@ -0,0 +1 @@
Fix Caddy v2.11 breaking change: preserve original Host header for HTTPS upstreams.