Skip to main content
Caddy is the public edge in the production Compose stack. It listens on TCP 80/443 and UDP 443, obtains certificates for domain names, and proxies to services on the private Docker network.

​
Host layout

​
DNS and firewall

Create A/AAAA records for configured hosts, allow inbound 80/443, and keep application/data ports closed. Caddy needs outbound network access for certificate issuance.

​
WebSocket requirements

Socket.IO requires HTTP upgrade support, suitable idle timeouts, and consistent forwarded scheme/host information. Caddy’s reverse_proxy supports upgrades automatically, but an upstream cloud load balancer must also allow them.

​
Protect logs

Dozzle mounts the Docker socket read-only, which still exposes sensitive operational visibility. Use its authentication plus a VPN, identity-aware proxy, mutual TLS, or strict IP allowlist. Do not rely on an obscure hostname.
If Caddy is placed behind another proxy, configure trusted proxy headers deliberately. The gateway trusts the first proxy for client IP/rate limiting; an incorrect chain can spoof addresses or rate-limit the proxy itself.

​
Verify

Then test a real widget Socket.IO session in browser developer tools.
Last modified on July 17, 2026