Reverse Proxy (Caddy)

The optional Caddy reverse proxy terminates TLS in front of IntelliAsk. Its PROXY_* keys in config/.env, the TLS modes, enabling/disabling it, and links to the official Caddy docs.

The reverse proxy is an optional Caddy container that sits in front of IntelliAsk and handles HTTPS, HTTP→HTTPS redirect, HTTP/2/3, WebSockets, and compression automatically — including obtaining and auto-renewing certificates. Caddy is a small single-binary proxy (idles ~30–40 MB).

Overview


Compose file	`config/proxy.compose.yml`
Service name	`proxy`
Image variable	`PROXY_IMAGE` (e.g. `caddy:2.8-alpine`)
Config	`PROXY_*` keys in `config/.env`
Exposed	`443` (or `80` when TLS is `off`)
Certs	persisted at `${STORAGE_ROOT}/caddy`

The proxy is opt-in

The proxy reads its PROXY_* settings from the single config/.env like every other component. intelliask only includes it when PROXY_ENABLED=true. The public hostname lives once in config/.env as PUBLIC_HOST and the proxy reads it from there.

Environment variables

All proxy settings use the PROXY_ prefix in config/.env:

Variable	Default	What it does
`PROXY_ENABLED`	`true`	Master switch — when `true`, the proxy is included in the stack.
`PROXY_IMAGE`	`caddy:2.8-alpine`	Image + tag to run.
`PROXY_CPUS`	`0.25`	CPU ceiling.
`PROXY_MEMORY`	`128m`	Memory ceiling.
`PROXY_HTTPS_PORT`	`443`	Published HTTPS port (only 443 is exposed).
`PROXY_TLS_MODE`	`internal`	How TLS certs are handled — see below.
`PROXY_ACME_EMAIL`	–	Contact email for ACME (`auto` mode).
`PROXY_UPSTREAM`	`intelliask:3080`	Backend the proxy forwards to.
`PROXY_MAX_BODY_SIZE`	`100m`	Max request/upload size.
`PROXY_CERT_DIR`	`./proxy/certs`	Folder holding `cert.pem` + `key.pem` when mode is `file`.

The public hostname comes from PUBLIC_HOST in config/.env (used as Caddy's server_name).

TLS modes (`PROXY_TLS_MODE`)

Mode	What it does	When to use
`auto`	Public cert via Let's Encrypt (ACME) + auto-renew. Needs a public, internet-reachable `PUBLIC_HOST` and `PROXY_ACME_EMAIL`.	Public deployments with real DNS.
`internal`	Caddy's built-in CA (self-signed, auto-renewed). No internet needed; clients must trust Caddy's root.	Internal/dev (`.intra`). Default.*
`file`	Bring-your-own cert: put `cert.pem` + `key.pem` in `PROXY_CERT_DIR`. You renew the files.	An internal-CA cert your clients already trust.
`off`	Plain HTTP on `:80`, no TLS.	Quick local/test only.

Tell the app TLS terminates here

When the proxy terminates TLS, set PUBLIC_SCHEME=https and TRUST_PROXY=1 (one proxy hop) in config/.env so the rate limiter sees the real client IP.

Enabling / disabling

The easiest path is at provision time:

intelliask provision --with-proxy

Or toggle it later with the module command (it flips PROXY_ENABLED / INTELLIASK_BIND and re-applies):

intelliask module enable proxy
intelliask module disable proxy

See Reverse Proxy for TLS modes and flags.

With the proxy on, provisioning binds the app port to 127.0.0.1 so only :443 is reachable externally — open inbound 443 at the host firewall and default-deny the rest.

Updating the proxy

# 1. Bump the tag in config/.env, e.g. PROXY_IMAGE=caddy:2.9-alpine
# 2. Pull + recreate only the proxy
intelliask update proxy

Issued/renewed certs persist under ${STORAGE_ROOT}/caddy, so a restart won't re-issue (avoids ACME rate limits).