TLS and the proxy
Caddy runs inside the Nearhost process, with its storage under ~/.config/nearhost/caddy. It listens on 443 for HTTPS and on 80 only to redirect to HTTPS.
The local CA
Section titled “The local CA”The internal certificate authority, “Nearhost Local CA”, is created on first run. Nearhost never ships a shared key or a wildcard certificate.
nearhost trust installs its root into the system trust store, with one password prompt: the System keychain on macOS, your distribution’s certificate store on Linux. It also updates the separate stores that Firefox and Linux Chromium-based browsers use, when certutil is installed. nearhost untrust reverses all of it. See Install for the Linux and Firefox setup.
Per-alias certificates
Section titled “Per-alias certificates”Leaf certificates are issued automatically, one per alias. Because the CA is created on your machine, nobody else holds a key that can sign for your .test names.
What the proxy sets
Section titled “What the proxy sets”Each enabled project is a site block, https://<alias>, with reverse_proxy 127.0.0.1:<local port>.
- The
Hostheader is passed through unchanged. X-Forwarded-Proto: httpsandX-Forwarded-Forare set.- WebSocket upgrades pass through.
- Responses are not buffered.
Reloads without dropping connections
Section titled “Reloads without dropping connections”Config changes apply through Caddy’s in-process reload. Adding or removing a project leaves the connections of other projects open.