caddy-cloudflare-wildcard-proxylisted

This skill should be used when standing up Caddy as a reverse proxy for internal/homelab domains with a wildcard TLS certificate via Cloudflare DNS-01, when a Caddyfile needs one certificate to cover many internal hostnames, when routing Caddy to a backend that's deliberately bound to loopback only and reachable via an existing Tailscale Serve endpoint, when a Caddy instance itself needs to be loopback-only and a request returns an empty 200 response or `ss -tlnp` shows it listening on `*:port` despite the site address looking like `127.0.0.1:port`, or when debugging a fresh unprivileged LXC where tailscaled fails with "/dev/net/tun does not exist" or MagicDNS doesn't register into systemd-resolved. Trigger phrases include "caddy wildcard cert", "caddy dns-01 cloudflare", "caddy custom build dns plugin", "reverse proxy to tailscale serve backend", "loopback-bound service reverse proxy", "tun device does not exist unprivileged lxc", "tailscale magicdns not registering systemd-resolved", "split-horizon internal
jackson2w/claude-code-skills · ★ 1 · DevOps & Infrastructure · score 64

Install: claude install-skill jackson2w/claude-code-skills

# Caddy + Cloudflare DNS-01 wildcard proxy for internal domains Pattern for fronting several internal/homelab services with friendly hostnames (`service.example.dev`) under one real, trusted wildcard certificate, without any public DNS record — Cloudflare is used purely as the ACME DNS-01 challenge provider. ## Custom Caddy build for DNS plugins Stock Caddy packages (apt, official binary releases) do **not** include DNS provider modules — DNS-01 wildcard certs need `caddy-dns/cloudflare` (or the equivalent for another provider), which isn't in the default build. Rather than requiring a Go toolchain + `xcaddy` on the target host, fetch a prebuilt custom binary from Caddy's official build server: ``` https://caddyserver.com/api/download?os=linux&arch=amd64&p=github.com%2Fcaddy-dns%2Fcloudflare ``` Verified live: returns HTTP 200, `content-disposition: attachment; filename="caddy_linux_amd64_custom"`. Swap `p=` for a different DNS provider module path, or chain multiple `&p=` params for more than one plugin. Use `ansible.builtin.get_url` (or plain `curl`) straight to `/usr/local/bin/caddy`, mode `0755` — no build step needed on the target. ## One wildcard cert covering many hostnames Put every internal hostname in a **single site block** keyed on the apex + wildcard, and route by `Host` header inside it with `@matcher`/`handle` pairs — not one site block per hostname (that issues a separate cert per name): ```caddyfile { email you@example.com } example.dev, *.exampl