Terminate TLS with a reverse proxy (Caddy)

nightshipd speaks plain HTTP with no built-in TLS. For anything past localhost, terminate HTTPS in a reverse proxy. Caddy is the easy default — automatic Let’s Encrypt — but nginx or Traefik work just as well.

Never expose nightshipd’s port directly to the internet.

It has no TLS and no rate limiting appropriate for a raw public port. A reverse proxy terminates HTTPS, and nightshipd only ever listens for plain HTTP behind it.

With Docker Compose

The Compose setup already includes a Caddy service. All it needs is a Caddyfile next to the compose file — point your domain’s DNS record at the host first:

builds.example.com {
    reverse_proxy nightshipd:8080
}

Caddy fetches and renews a Let’s Encrypt certificate automatically. Inside the Compose network it reaches the server by service name (nightshipd:8080).

Bare-metal Caddy

For a systemd server, install Caddy from your distro, point a DNS record at the host, and use /etc/caddy/Caddyfile:

builds.example.com {
    encode zstd gzip
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
    }
    reverse_proxy 127.0.0.1:8080
}

caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy

Caddy obtains and renews the certificate over the ACME HTTP-01 challenge — which is why port 80 must stay open.

Firewall

sudo ufw allow 22
sudo ufw allow 80
sudo ufw allow 443
sudo ufw enable

Prefer nginx or Traefik? Fine — nightshipd only speaks plain HTTP and doesn’t care what terminates TLS. Just proxy your domain to 127.0.0.1:8080 (or nightshipd:8080 in Docker) and keep the server’s own port off the public internet.

← All guides