Skip to content

origin_caddy

The internal origin TLS terminator (home, 10.20.30.10) — the mirror of vps_edge for the home side:

  • Custom caddy built with the rfc2136 DNS provider (xcaddy --with github.com/caddy-dns/rfc2136), for ACME DNS-01 to the hidden Bind primary.
  • Caddyfile — reverse-proxy vhosts to the DMZ backends (data-driven origin_vhosts), tls internal until origin_acme_enabled flips to real LE.
  • WireGuard CLIENT — home dials out to each edge (origin_wg_edges), reusing /etc/wireguard/caddy.key (pubkey preserved across runs).
  • caddy.env — the acme TSIG secret (from vault) for RFC2136.
  • IP forwarding (+ optional masquerade) so edges can AXFR the hidden primary over the tunnel.

Built-in modules only. Applied by the origin play in site.yml (host caddy).

Flipping to real Let's Encrypt (Phase 2)

Once the edges make the names publicly resolvable (so LE can see the DNS-01 challenge), set origin_acme_enabled: true (e.g. in host_vars/caddy.yml) and re-run. The Caddyfile then enables the acme_dns rfc2136 block and drops tls internal; certs are issued at the origin and the private key never leaves home (edges only pass through).

Edge AXFR routing

The edge pulls zones from the hidden primary 10.20.30.40 (a different host than the tunnel endpoint 10.20.200.1). origin_ip_forward: true lets the origin forward tunnel→primary; set origin_axfr_masquerade: true so the primary needs no return route (it sees the origin as the AXFR source). Left off by default; enable + validate when you bring up an edge.

Gotchas

  • Reuses caddy.key (creates:) so the origin pubkey is stable; on a fresh rebuild it regenerates — then update edge_home_wg_pubkey on the edges (the role prints the pubkey).
  • The Caddyfile task validates with the built binary before writing — a bad template can't take Caddy down.