Caddy Dual TLS + Cloudflare Tunnel Setup

This architecture provides End-to-End Dual TLS Encryption:

1. Edge TLS (Cloudflare Edge Certificate): Cloudflare terminates HTTPS for public visitors on the internet.
2. Origin TLS (Let's Encrypt / ACME Certificate): Caddy automatically requests and renews valid SSL/TLS certificates using the Cloudflare DNS-01 ACME challenge plugin.
3. Tunnel Transport: Cloudflare Tunnel (cloudflared) connects to Caddy over HTTPS://caddy:443 with strict origin TLS verification.

---

📁 File Structure

• Dockerfile: Builds Caddy with github.com/caddy-dns/cloudflare using xcaddy.
• docker-compose.yml: Runs caddy and cloudflared on the shared Docker bridge network.
• Caddyfile: Configures synotrip.kucial.com & blog.kucial.com with DNS-01 TLS challenge.
• .env: Stores CLOUDFLARE_API_TOKEN and CLOUDFLARE_TUNNEL_TOKEN.
• data/: Persistent volume storing Caddy's Let's Encrypt certificates.

---

🚀 Setup & Cloudflare Dashboard Configuration

1. In .env

• CLOUDFLARE_API_TOKEN: Token with Zone:DNS:Edit permission (allows Caddy to complete the DNS-01 challenge).
• CLOUDFLARE_TUNNEL_TOKEN: Token from Cloudflare Zero Trust Tunnels.

2. In Cloudflare Zero Trust Dashboard (Public Hostnames)

Add your subdomains under your Tunnel's Public Hostnames:

Public Hostname	Service Type	URL	Origin Server Name (under Additional Settings -> TLS)
synotrip.kucial.com	HTTPS	caddy:443	synotrip.kucial.com
blog.kucial.com	HTTPS	caddy:443	blog.kucial.com

Note

Setting Origin Server Name tells cloudflared which SNI hostname to send to Caddy during the TLS handshake, allowing Caddy to serve the matching Let's Encrypt certificate.

3. Start Services

docker compose up -d --build

4. Zero-Downtime Reload

docker compose exec caddy caddy reload --config /etc/caddy/Caddyfile