Environment Variables

[samcro1967]

I am trying to figure out how to use environment variables with Caddyfile. I saw on the caddy forum to add them as labels to the container and caddy will pick them up. I tried this and the variable is not being picked up by caddy. Environment variables for other services in docker-compose are working.

Does anything different need to be done with caddy-docker-proxy in the mix? Wanted to check here before I post to the forum.

docker-compose

  caddy:
    hostname: caddy    
    image: caddy220216
    container_name: caddy
    restart: always
    environment:
      - TZ=${TZ}
      - CADDY_DOCKER_CADDYFILE_PATH=/data/CaddyFile
      - email=${EMAIL}
    ports:
      - 8069:8069
      - 443:443
      - 2019:2019
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - "${docker}/caddy2/data:/data"
      - "${docker}/caddy2/config:/config"

.env file

EMAIL=user@mydomain.net

Caddyfile contents

{
	http_port	8069
	https_port	443
	email {env.EMAIL} #also tried {$EMAIL}
	debug
	log {
		output file /data/caddy.log
        level warn
		format console
    }

Caddyfile from container logs
{
http_port 8069
https_port 443
email ${EMAIL}
debug
log {
output file /data/caddy.log
level warn
format console
}

[emilylange]

Hi! :)

Environment variables are case-sensitive.

Your Caddyfile looks alright to me, except the env var case.
.env ($EMAIL) -> docker-compose.yml ($email=$EMAIL) -> container ($email)

You could either change your docker-compose.yml:

[...]
    environment:
      - TZ=${TZ}
      - CADDY_DOCKER_CADDYFILE_PATH=/data/CaddyFile
-     - email=${EMAIL}
+     - EMAIL=${EMAIL}
[...]

or your Caddyfile:

{
	http_port	8069
	https_port	443
-	email {env.EMAIL} #also tried {$EMAIL}
+	email {env.email} #also tried {$email}
	debug
	log {

If that didn't help, please double-check that docker-compose config properly substitutes the var from your .env file and post some (caddy) logs.

[samcro1967]

Changed all references to it to all caps, but still seeing the same behavior. Maybe I missed something or did not understand.

Changed Docker-compose to

    environment:
      - TZ=${TZ}
      - CADDY_DOCKER_CADDYFILE_PATH=/data/CaddyFile
      - EMAIL=${EMAIL}

Caddyfile is still

{
	http_port	8069
	https_port	443
	email {env.EMAIL}
	debug

env file is still

EMAIL=user@mydomain.net

Looking at the environment variables thru Portainer shows that caddy has a environment variable called EMAIL with a value of user@mydomain.net

caddy logs showing {env.EMAIL} instead of user@mydomain.net

{"level":"info","ts":1646938445.9433947,"logger":"docker-proxy","msg":"Running caddy proxy server"}
{"level":"info","ts":1646938445.9446514,"logger":"admin","msg":"admin endpoint started","address":"tcp/localhost:2019","enforce_origin":false,"origins":["[::1]:2019","127.0.0.1:2019","localhost:2019"]}
{"level":"info","ts":1646938445.944758,"msg":"autosaved config (load with --resume flag)","file":"/config/caddy/autosave.json"}
{"level":"info","ts":1646938445.9447775,"logger":"docker-proxy","msg":"Running caddy proxy controller"}
{"level":"info","ts":1646938445.9452648,"logger":"docker-proxy","msg":"Start","CaddyfilePath":"/data/CaddyFile","LabelPrefix":"caddy","PollingInterval":30,"ProcessCaddyfile":true,"ProxyServiceTasks":true,"IngressNetworks":"[]"}
{"level":"info","ts":1646938445.9454207,"logger":"docker-proxy","msg":"Caddy ContainerID","ID":"d84ed896ca00f25463eae0e5da24832d2b00eede6bf875b8b0b496c7a5f5696f"}
{"level":"info","ts":1646938445.9456854,"logger":"docker-proxy","msg":"Connecting to docker events"}
{"level":"info","ts":1646938445.947507,"logger":"docker-proxy","msg":"IngressNetworksMap","ingres":"map[12d99874b921591e07c8c2c0c50f6fb013984cd9045b8b0dda296fea3ce8cc18:true]"}
{"level":"info","ts":1646938445.9589396,"logger":"docker-proxy","msg":"Swarm is available","new":false}
{"level":"info","ts":1646938445.9592667,"logger":"docker-proxy","msg":"Skipping swarm config caddyfiles because swarm is not available"}
{"level":"info","ts":1646938445.9825513,"logger":"docker-proxy","msg":"Skipping swarm services because swarm is not available"}
{"level":"info","ts":1646938446.0091374,"logger":"docker-proxy","msg":"New Caddyfile","caddyfile":"{\n\thttp_port 8069\n\thttps_port 443\n\temail {env.EMAIL}\
...
rest of the caddyfile in the middle
...
\"issuers\":[{\"email\":\"{env.EMAIL}\",\"module\":\"acme\"},{\"email\":\"{env.EMAIL}\",\"module\":\"zerossl\"}]}]}}}}"}
{"level":"info","ts":1646938446.0145211,"logger":"docker-proxy","msg":"Sending configuration to","server":"localhost"}
{"level":"info","ts":1646938446.0152571,"logger":"admin.api","msg":"received request","method":"POST","host":"localhost:2019","uri":"/load","remote_addr":"127.0.0.1:34518","headers":{"Accept-Encoding":["gzip"],"Content-Length":["21617"],"Content-Type":["application/json"],"User-Agent":["Go-http-client/1.1"]}}
{"level":"info","ts":1646938446.0184815,"msg":"redirected default logger","from":"stderr","to":"/data/caddy.log"}
{"level":"info","ts":1646938446.4118617,"logger":"docker-proxy","msg":"Successfully configured","server":"localhost"}

Logs show it is not being replaced with the variable vaule.

[francislavoie]

Use {$EMAIL} instead. I don't think {env.*} style is supported for the email option.

[samcro1967]

Seeing the same results with {$EMAIL}. I also tried {$EMAIL} as well in some other spots in Caddyfile in case it is an issue with just the global email directive. I set it on some of the options for caddy-security and see the same results.

[francislavoie]

Run docker inspect caddy (or whatever the container name is that docker-compose assigned it) and check the env in there, make sure the values look right

[samcro1967]

It appears to be correct there as well.

docker inspect caddy --format='{{range .Config.Env}}{{println .}}{{end}}'

TZ=America/Chicago
CADDY_DOCKER_CADDYFILE_PATH=/data/CaddyFile
EMAIL=user@mydomain.net
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
CADDY_VERSION=v2.4.6
XDG_CONFIG_HOME=/config
XDG_DATA_HOME=/data
TIMEZONE=America/Chicago

[emilylange]

That looks good.

And the excerpt from the logs you posted look about right to me, too.

Could please you compare your /data/caddy/acme/ directory to the following structure:

caddy/acme
└── acme-v02.api.letsencrypt.org-directory
    └── users
        └── user@mydomain.net
            ├── user.json
            └── user.key

3 directories, 2 files

Well, not really compare them, just check whether you can see your email in there.
Both variants ({$EMAIL} and {env.EMAIL}) worked in my local tests.

[samcro1967]

Yes, they do exist as your example shows. I thought that {env.EMAIL} would be expanded to user@mydomain.net when I looked at the caddy logs. Your last comment leads me to believe that is not the case which make sense from a security perspective. So maybe everything is fine. I just checked and I am able to access my site with {env.EMAIL} in my Caddyfile.

This did not work when I initially tried it. I am having a different issue that started over the past few weeks with certificate renewal. It is possible that when I was initially testing and thought this was not working that the certificate issue was occurring. I have not given up on solving that myself so I have not asked for help yet in the caddy forum. I wanted to get environment variables setups first to remove sensitive information from my Caddyfile which I should have done from day one.

[emilylange]

{$<env var>} should get substituted when converting a Caddyfile to json (e.g. caddy adapt or what happens in this plugin internally), while {env.<env var>} will defer the substitution until runtime.¹

This only really matters (imho) if you run caddy-docker-proxy in a cluster (or something similar with controller and worker).

I believe this issue is solved now if those acme accounts look like they should 🎉
And feel free to ask any further question on the https://caddy.community forum :)

Footnotes

1. https://caddyserver.com/docs/caddyfile/concepts#environment-variables ↩