2.3.100 Satellite Caddy

Caddy

Handle: caddy
Local URL: http://localhost:34980

Caddy is an HTTP reverse proxy with optional automatic HTTPS. Harbor starts it with a local-only welcome/health route. Choose a Caddyfile to proxy the Harbor services you want; Caddy does not auto-discover Docker containers or change the routing of other services. Harbor's existing Traefik service remains available independently.

Starting

harbor up caddy
curl http://localhost:34980/health

The default route returns ok from /health. To try a real reverse proxy to Harbor Ollama, select the provided example Caddyfile and start both services:

harbor down caddy
harbor config set caddy.config "$(harbor home)/services/caddy/examples/ollama.Caddyfile"
harbor up caddy ollama
curl http://localhost:34980/api/tags

The example listens on the local HTTP port and forwards requests to ollama:11434 on Harbor's internal Docker network. It exposes Ollama without an API login, so keep the default loopback binding for this example. To return to the default welcome route:

harbor down caddy
harbor config set caddy.config "$(harbor home)/services/caddy/Caddyfile"
harbor up caddy

To proxy another service, copy one of the Caddyfiles to a path you own, change the reverse_proxy target to the service's container port (not its host-published port), and set caddy.config to that absolute file path. Start Caddy and the target in the same Harbor selection. Check the target's Compose file for its internal port. Caddy's reverse-proxy reference documents path routing, multiple upstreams, and health checks.

Configuration

Setting	Default	Purpose
caddy.image, caddy.version	caddy:2-alpine	Official Docker image
caddy.bind_host	127.0.0.1	Host address for HTTP and HTTPS ports
caddy.http_host_port	34980	Host HTTP port, mapped to container port 80
caddy.https_host_port	34943	Host HTTPS port, mapped to container port 443
caddy.config	./services/caddy/Caddyfile	Path to the Caddyfile mounted read-only

For public HTTPS, use a Caddyfile with a real domain name, point DNS at this host, and configure the ports so inbound 80/443 reach Caddy. Set caddy.bind_host to 0.0.0.0 only when that exposure is intentional. Do not run Caddy and Traefik on the same host ports. Protect services that lack their own authentication before exposing them publicly. Caddy's /data and /config live in the persistent caddy-data and caddy-config Docker volumes; back up /data to retain certificates and account state. The default Caddyfile disables its administrative API; restart with harbor up caddy after changing a mounted file.

If you edit services/caddy/default.env in a Git checkout, run harbor config update to copy new defaults into the local .env. Change local settings through harbor config set, not by editing .env directly.