caddy setting

[Denvador]

Hi. Thanks for creating mtproxymax. I want to configure traffic for a site other than mtproto on the same server. However, when configured, caddy uses port 443, and mtproxymax can't run on port 443 anymore. If I save the /opt/mtproxymax/mtproxy/config.toml file and change the settings, port_mask = 8443
host_mask = "127.0.0.1" , mtproxymax will redirect local site traffic to the /opt/mtproxymax/mtproxy/config.toml configuration file, overwriting it on reboot. How can I solve this, or am I setting it up incorrectly?

[Denvador]

GNU nano 7.2 /opt/mtproxymax/mtproxy/config.toml

MTProxyMax — telemt configuration

Generated: 2026-04-15 10:50:11 UTC

[general]
prefer_ipv6 = false
fast_mode = true
use_middle_proxy = true
log_level = "normal"

ad_tag = "" # Get from @MTProxybot

[general.modes]
classic = false
secure = false
tls = true

[general.links]
show = ["default"]

public_host = ""

public_port = 443

[server]
port = 443
listen_addr_ipv4 = "0.0.0.0"
listen_addr_ipv6 = "::"
proxy_protocol = false

metrics_listen = "127.0.0.1:9090"
metrics_whitelist = ["127.0.0.1", "::1"]

[timeouts]
client_handshake = 30
tg_connect = 10
client_keepalive = 15
client_ack = 90

[censorship]
tls_domain = "duckling.work.gd"
unknown_sni_action = "mask"
mask = true
mask_port = 8443
mask_host = "127.0.0.1"
fake_cert_len = 2048

Note: geo-blocking is enforced at the host firewall level (iptables/nftables),

not via telemt config. See: mtproxymax info -> Geo-Blocking

[access]
replay_check_len = 65536
replay_window_secs = 1800
ignore_time_skew = false

and caddy setting

127.0.0.1:8443 {

root * /var/www/html

file_server

encode gzip

header {

    -Server

    X-Content-Type-Options nosniff

}

}

[SamNet-dev]

Your setup is correct — MTProxyMax on port 443, Caddy on 127.0.0.1:8443, masking forwards non-proxy traffic to Caddy.

You no longer need to edit settings.conf or config.toml manually — we just added CLI and TUI support for this:

CLI:

mtproxymax mask-backend 127.0.0.1:8443

TUI: Settings > [m] Set mask backend

Both persist the setting and restart the proxy automatically.

Also make sure Caddy listens on HTTP (not HTTPS) at 127.0.0.1:8443, since the engine forwards the raw TLS connection:

http://127.0.0.1:8443 {
    root * /var/www/html
    file_server
}

Run mtproxymax update to get the new command.