{"id":18929101,"url":"https://github.com/jwillikers/caddy-ovh-image","last_synced_at":"2026-03-16T12:30:15.978Z","repository":{"id":104838327,"uuid":"607402063","full_name":"jwillikers/caddy-ovh-image","owner":"jwillikers","description":"Caddy container image built with the OVH module for the DNS-01 ACME challenge","archived":false,"fork":false,"pushed_at":"2025-02-03T00:25:19.000Z","size":194,"stargazers_count":1,"open_issues_count":2,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-14T21:38:55.209Z","etag":null,"topics":["buildah","caddy","container","dns","image","nix","oci","oci-image","ovh","podman"],"latest_commit_sha":null,"homepage":"","language":"Nix","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jwillikers.png","metadata":{"files":{"readme":"README.adoc","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.adoc","code_of_conduct":"CODE_OF_CONDUCT.adoc","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-02-27T22:41:06.000Z","updated_at":"2025-01-29T14:31:34.000Z","dependencies_parsed_at":null,"dependency_job_id":"473e52f1-17b1-45a6-8487-afdc604f1134","html_url":"https://github.com/jwillikers/caddy-ovh-image","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwillikers%2Fcaddy-ovh-image","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwillikers%2Fcaddy-ovh-image/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwillikers%2Fcaddy-ovh-image/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwillikers%2Fcaddy-ovh-image/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jwillikers","download_url":"https://codeload.github.com/jwillikers/caddy-ovh-image/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239927824,"owners_count":19719835,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["buildah","caddy","container","dns","image","nix","oci","oci-image","ovh","podman"],"created_at":"2024-11-08T11:30:06.751Z","updated_at":"2026-03-16T12:30:15.918Z","avatar_url":"https://github.com/jwillikers.png","language":"Nix","funding_links":[],"categories":[],"sub_categories":[],"readme":"= Caddy OVH Image\nJordan Williams \u003cjordan@jwillikers.com\u003e\n:experimental:\n:icons: font\nifdef::env-github[]\n:tip-caption: :bulb:\n:note-caption: :information_source:\n:important-caption: :heavy_exclamation_mark:\n:caution-caption: :fire:\n:warning-caption: :warning:\nendif::[]\n:Asciidoctor_: https://asciidoctor.org/[Asciidoctor]\n:Buildah: https://buildah.io/[Buildah]\n:Caddy: https://caddyserver.com[Caddy]\n:Caddy-OVH-Module: https://github.com/caddy-dns/ovh[Caddy OVH Module]\n:certbot-dns-ovh-documentation: https://certbot-dns-ovh.readthedocs.io/en/stable/[certbot-dns-ovh Documentation]\n:Git: https://git-scm.com/[Git]\n:Linux: https://www.linuxfoundation.org/[Linux]\n:OVH-Create-Token-Page: https://www.ovh.com/auth/api/createToken[OVH Create Token Page]\n:Podman: https://podman.io/[Podman]\n:pre-commit: https://pre-commit.com/[pre-commit]\n\nimage:https://github.com/jwillikers/caddy-ovh-image/workflows/Build/badge.svg[\"Build Status\", link=\"https://github.com/jwillikers/caddy-ovh-image/actions?query=workflow%3ABuild\"]\n\nA container image for the running the Caddy reverse-proxy complete with the {Caddy-OVH-Module} capable of completing the ACME DNS-01 challenge.\n\n== Synopsis\n\nImage:: https://quay.io/repository/jwillikers/caddy-ovh[quay.io/jwillikers/caddy-ovh]\n\nTags::\n* `latest`\n\nSupported architectures::\n* `aarch64`\n// * todo RISC-V\n* `x86_64`\n\nLabels::\n`io.containers.autoupdate=registry`::: Enables automatic updates when using {Podman} and the _fully-qualified_ image name.\n\n== Quick Start\n\nI recommend putting the Caddy container along with all of the containers it will proxy on a dedicated Podman network with the DNS option enabled.\nThis makes it easy to delegate to the corresponding containers and doesn't require port-forwarding on their part, which means port address conflicts won't be an issue.\nA dedicated Podman network also provides better isolation.\nIf you need to, you can also use the Caddy container with host networking with other containers using host networking or those using the default `slirp4netns` networking mode.\nThe example instructions here use dedicated Podman network.\nFor more information on the configuring OVH DNS via the DNS-01 challenge, refer to the {certbot-dns-ovh-documentation}.\nIt explains the related configuration in more detail.\n\n. Allow rootless containers to publish to ports 80 and 443 by lowering the starting port for the range of unprivileged ports.\nThis makes it possible to run the Caddy container rootless and use the standard HTTP and HTTPS ports.\n+\n./etc/sysctl.d/99-lower-unprivileged_port_start.conf\n[source]\n----\n; Allow publishing to lower port numbers without requiring superuser privileges.\nnet.ipv4.ip_unprivileged_port_start=80\n----\n\n. Load the new sysctl configuration.\n+\n[,sh]\n----\nsudo sysctl --system\n----\n\n. Open the default HTTP and HTTPS ports, 80 and 443 respectively, in the firewall, since rootless Podman won't be able to open these ports for the container.\n+\n[,sh]\n----\nsudo firewall-cmd --add-port=80/tcp --add-port=443/tcp --permanent\n----\n\n. Reload the firewall rules that were just saved.\n+\n[,sh]\n----\nsudo firewall-cmd --reload\n----\n\n. Create a new Podman network which will have DNS networking enabled by default.\n+\n[,sh]\n----\npodman network create --ipv6\n----\n\n. Open the {OVH-Create-Token-Page} in a web browser.\n\n. Enter the _Application name_, i.e. `Caddy ROCKPro64`.\n\n. Enter an _Application description.\nI used `ACME DNS-01 Challenge Provider`.\n\n. Select the time after which the token will expire in the _Validity_ field.\nI use `Unlimited` to avoid the token expiring.\n\n. The required _Rights_ are `/domain/zone/*` for each of `GET`, `PUT`, `POST`, and `DELETE`.\n\n. Store your OVH application key as a Podman secret to avoid exposing it.\n+\n[,sh]\n----\nprintf '****' '%s' | podman secret create ovh_application_key -\n----\n\n. Store your OVH application secret as a Podman secret to avoid exposing it.\n+\n[,sh]\n----\nprintf '****' '%s' | podman secret create ovh_application_secret -\n----\n\n. Store your OVH consumer key as a Podman secret to avoid exposing it.\n+\n[,sh]\n----\nprintf '****' '%s' | podman secret create ovh_consumer_key -\n----\n\n. In your Caddyfile, be sure to provide the previously stored secrets to the module.\nThen it's just a matter of proxying to hosts using the network's domain name, `dns.podman` by default.\nThe following Caddyfile demonstrates enabling the OVH DNS-01 ACME challenge globally and configuring a reverse-proxy to a container running Gitea on the same Podman network.\n+\n.Caddyfile\n[source]\n----\n{\n\temail jordan@jwillikers.com\n\tacme_dns ovh {\n\t\tendpoint {$OVH_ENDPOINT}\n\t\tapplication_key {$OVH_APPLICATION_KEY}\n\t\tapplication_secret {$OVH_APPLICATION_SECRET}\n\t\tconsumer_key {$OVH_CONSUMER_KEY}\n\t}\n\t# For testing\n\t# acme_ca https://acme-staging-v02.api.letsencrypt.org/directory\n}\n\ngitea.example {\n\treverse_proxy gitea.dns.podman:3000\n}\n----\n\n. Run Caddy rootless, forwarding the appropriate ports, proving the OVH secrets, and mounting the Caddyfile along with the necessary directories.\n+\n[,sh]\n----\npodman run \\\n  --cap-add NET_BIND_SERVICE \\\n  --detach \\\n  --env OVH_ENDPOINT=\"ovh-eu\" \\\n  --label \"io.containers.autoupdate=registry\" \\\n  --name caddy \\\n  --network podman1 \\\n  --publish 80:80/tcp \\\n  --publish 443:443/tcp \\\n  --rm \\\n  --secret ovh_application_key,type=env,target=OVH_APPLICATION_KEY \\\n  --secret ovh_application_secret,type=env,target=OVH_APPLICATION_SECRET \\\n  --secret ovh_consumer_key,type=env,target=OVH_CONSUMER_KEY \\\n  --volume $PWD:/etc/caddy:Z \\\n  --volume caddy-config:/config/:Z \\\n  --volume caddy-data:/data/:Z \\\n  quay.io/jwillikers/caddy-ovh:latest\n----\n\n=== Kubernetes\n\nThe Caddy container can also be configured and run via Kubernetes YAML.\nThese instructions use the same Podman network created in the previous section.\n\n. Configure a Kubernetes YAML file with the necessary secrets for OVH.\n+\n.caddy-secrets.yaml\n[,yaml]\n----\ninclude::caddy-secrets.yaml[]\n----\n\n. Load the secrets into Podman.\n+\n[,sh]\n----\npodman play kube caddy-secrets.yaml\n----\n\n. Delete the secrets file.\n+\n[,sh]\n----\nrm caddy-secrets.yaml\n----\n\n. Configure the path to the `Caddyfile` in the `caddy.yaml` Kubernetes YAML file.\n+\n.caddy.yaml\n[,yaml]\n----\ninclude::caddy.yaml[]\n----\n\n. Run the Caddy pod using the Kubernetes YAML file.\n+\n[,sh]\n----\npodman play kube --network podman --replace\n----\n\n== Build\n\n. Install an implementation of Nix, such as https://lix.systems[Lix] used here.\n+\n[,sh]\n----\ncurl -sSf -L https://install.lix.systems/lix | sh -s -- install\n----\n\n. Clone this repository.\n+\n[,sh]\n----\ngit clone git@github.com:jwillikers/caddy-ovh-image.git\n----\n\n. Change into the project directory.\n+\n[,sh]\n----\ncd caddy-ovh-image\n----\n\n. Install direnv for your system according to the https://direnv.net/docs/installation.html[direnv installation instructions].\n+\n[,sh]\n----\nsudo rpm-ostree install direnv\nsudo systemctl reboot\n----\n\n. Integrate direnv with your shell by following the instructions on the https://direnv.net/docs/hook.html[direnv Setup page].\n\n. Permit the direnv configuration in the repository.\n+\n[,sh]\n----\ndirenv allow\n----\n\n. Build the image with `nix build`.\n+\n[,sh]\n----\nnix build\n----\n\n== Contributing\n\nContributions in the form of issues, feedback, and even pull requests are welcome.\nMake sure to adhere to the project's link:CODE_OF_CONDUCT.adoc[Code of Conduct].\n\n== Open Source Software\n\nThis project is built on the hard work of countless open source contributors.\nSeveral of these projects are enumerated below.\n\n* {Asciidoctor_}\n* {Buildah}\n* {Caddy}\n* {Caddy-OVH-Module}\n* {Git}\n* {Linux}\n* {Podman}\n* {pre-commit}\n\n== Code of Conduct\n\nRefer to the project's link:CODE_OF_CONDUCT.adoc[Code of Conduct] for details.\n\n== License\n\nThis repository is licensed under the https://www.gnu.org/licenses/gpl-3.0.html[GPLv3], a copy of which is provided in the link:LICENSE.adoc[license file].\n\n© 2023-2024 Jordan Williams\n\n== Authors\n\nmailto:{email}[{author}]\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjwillikers%2Fcaddy-ovh-image","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjwillikers%2Fcaddy-ovh-image","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjwillikers%2Fcaddy-ovh-image/lists"}