Skip to content

certify-reverse

certify-reverse turns a small Docker host into a DNS-validated HTTPS reverse proxy. You describe services in YAML, provide a DNS API token, and the runtime builds the matching Caddy DNS plugin, obtains certificates, writes local DNS configuration, and exposes an operator dashboard.

  • :material-rocket-launch:{ .lg .middle } I want a working service

    Follow the 15-minute quickstart. It includes a complete demo backend, copy-and-paste configuration, checks, and cleanup.

  • :material-school:{ .lg .middle } I am new to DNS and reverse proxies

    Read Core concepts first. It explains every moving part without assuming Caddy, ACME, or Docker networking knowledge.

  • :material-docker:{ .lg .middle } I want a realistic deployment

    Build the WordPress + Telegram webhook example with one database, two upstreams, HTTPS, health checks, and safe secret placeholders.

  • :material-book-open-page-variant:{ .lg .middle } I need offline documentation

    Run ./caddy-docker.sh docs. It produces a searchable static site, an A4 PDF handbook, HTML handbook, compressed man pages, checksums, and an archive.

What it does

For each configured upstream, certify-reverse can generate a public HTTPS host such as notes.example.net and forward requests to a private target such as notes:8080.

browser
   |
   | HTTPS: notes.example.net
   v
Caddy + DNS-01 certificate
   |
   | HTTP inside Docker network
   v
notes:8080

The project also generates:

  • a Caddyfile and dnsmasq configuration under caddy-data/;
  • a status dashboard at status.<domain>;
  • certificate and crt.sh status snapshots;
  • exported internal CA files for HTTPS upstream trust;
  • local commands for start, stop, verification, release work, and documentation.

Choose the right path

You are trying to… Start with…
See the smallest complete setup 15-minute quickstart
Understand the terminology Core concepts
Configure several services Configuration
Deploy a real application stack WordPress + Telegram
Operate an existing installation Operations
Diagnose a failure Troubleshooting
Look up one command Command reference
Publish the docs Documentation publishing

What you need

  • Docker with the docker compose subcommand;
  • a domain you control;
  • an API token for a Caddy-supported DNS provider;
  • ports 80 and 443 available on the proxy host;
  • port 53 available only when you enable the bundled dnsmasq service for LAN DNS.

Use a restricted DNS token

The DNS token can modify records in your zone. Create the narrowest token your provider supports, keep .env out of version control, and rotate the token if it is ever copied into logs, screenshots, or chat.

Documentation formats

The same Markdown sources feed every published format:

docs/*.md
   ├── MkDocs Material -> dist/docs/site/
   ├── Pandoc          -> dist/docs/certify-reverse-handbook.html
   ├── WeasyPrint      -> dist/docs/certify-reverse-handbook.pdf
   └── Pandoc man      -> dist/docs/man/*.1 + *.1.gz

See Documentation publishing for the exact commands and pinned toolchain policy.