Selfhosted

Hello there. I perfectly understand the risks of my setup. Since it's a commercial off-the-shelf router, i can't run a reverse proxy on it, so this is the best that i can do (other than VLANs). It's also a private network, so I guess it's fine.

I used a bit of AI which said that such embedded devices don't work with reverse proxies. Finding which exact parameters as respected by the router will be time-consuming and the end result is not that great.

Semi related, you can check the validity of Caddy entries into the caddyfile:

• sudo caddy fmt --overwrite /etc/caddy/Caddyfile
• caddy validate --config /etc/caddy/Caddyfile

Where /etc/caddy/Caddyfile points to your caddyfile.

I have tried this, but unfortunately, it did not work. I have tried this suite of commands

login.router.lan {
    reverse_proxy 192.168.1.1:80 {
        # Preserve original host and scheme
        header_up Host {upstream_hostport}
        header_up X-Forwarded-Proto {http.request.scheme}
        header_up X-Forwarded-Host {http.request.host}
        header_up X-Forwarded-For {http.request.remote.host}

        # Keep cookies intact
        header_up Cookie {http.request.header.Cookie}
        header_down Set-Cookie {http.response.header.Set-Cookie}

        # Preserve Origin/Referer for CSRF tokens
        header_up Origin https://{http.request.host}
        header_up Referer https://{http.request.host}{http.request.uri.path}
    }
}

Info: My caddy uses HTTPS but the router login page is HTTP. Not sure if this is relevant.

Do none of you reverse proxy your local services? It’s wonderful!

Yes please! I don't want to type the port number when multiple services are running on the same server.

what cert are you using?

It's a self-signed local cert. I'm not using Let's Encrypt. Does it require a valid domain name to work?

I use wireguard when I'm outside. So I first turn wireguard and then access all my stuff.

But it sounds like you’re using a self signed cert and using https to login to your router and it doesn’t like that

Any way to trick my router login page? It's a TP-Link router

Does accessing your router page via caddy work when you’re actually on your home network

Unfortunately no, which rules out an issue with wireguard.

Have you tried a different web browser to rule out your LLM suggested cookie issues

It's not the stale cookie issue which goes away when opening a website in incognito. I think it expects the cookie to have the original host information.

Let me paste the list of issues the LLM mentioned. The following section is from the LLM

<LLM>

1. The router’s web UI expects the original hostname (e.g., 192.168.0.1) and builds redirects or CSRF tokens based on it. Caddy sends its own host (myproxy.example.com).
2. Authentication cookies are set for the original domain and may be dropped or rewritten by the proxy, causing the server to think the user is unauthenticated.
3. The router returns Location: http://192.168.0.1/... which points the browser back to the internal address, bypassing the proxy.
4. Tokens are generated using the Origin or Referer header; the proxy changes these, making the token invalid on POST.
5. The router forces HTTPS or blocks HTTP when it sees a mismatch, and Caddy may be terminating TLS while the upstream expects plain HTTP.
6. Some admin UIs use WebSocket for status updates; if Caddy doesn’t forward the upgrade, the page may reload to the login screen.
7. The router’s UI may be served from / but expects relative paths; Caddy’s uri rewrite can break those links.

</LLM>

It has also mentioned some solutions for each cause. But I don't want to blindly apply them without knowing what is wrong.

Nothing is exposed to public, other than my wireguard port. I'm running caddy internally. All DNS entries are local only. The router login page cannot be accessed from outside.