Domains, Caddy and Cloudflare

How it works

Only Caddy faces the internet (ports 80 and 443). It obtains and renews HTTPS certificates itself and serves:

Address	What is there
example.com	Client website and its API. /admin and the admin API return “not found” here
admin.example.com	Admin panel. Open only to allowed addresses
docs.example.com	This documentation site. Installed with the engine; without a docs DNS record the site and admin work, but Caddy keeps retrying the certificate for it

The Caddy config is validated before a restart: if it has an error, the update stops and the site keeps running on the old config.

Cloudflare

We recommend proxying the domain through Cloudflare (orange cloud): it hides the server IP and protects against DDoS.

1. Add the domain to Cloudflare and change the NS servers at your registrar.
2. DNS: A records @ and admin (and docs if needed) pointing to the server IP, proxy on.
3. SSL/TLS → Overview: mode Full (strict).
4. SSL/TLS → Edge Certificates: turn off “Always Use HTTPS” — Caddy redirects to HTTPS itself, and with this option the first certificate is not issued.

Real client IP

Behind Cloudflare the server sees Cloudflare addresses. Caddy takes the real IP from the CF-Connecting-IP header only when the request comes from Cloudflare addresses, so it cannot be spoofed by bypassing the proxy. The client country (CF-IPCountry) is trusted the same way. Limits, bans, admin access and logs depend on the real IP.

The list of Cloudflare ranges is built into the Caddy config. Cloudflare rarely changes it (cloudflare.com/ips); changes come with engine updates.

Without Cloudflare

The engine works without Cloudflare: plain A records, Caddy gets certificates itself. Cloudflare headers are simply not used — the client IP comes from the connection.

Security headers

Caddy sends HSTS (one year, with subdomains), X-Content-Type-Options: nosniff, Referrer-Policy and hides its version. The admin panel is hidden from search engines (X-Robots-Tag: noindex); the documentation is public.