Self-hosted with Caddy and Domain. POST requests without httpS

S

SaarPhil•2/13/25, 9:56 PM

I think you mixed it up a bit.

TLS terminated by Caddy, no TLS between Caddy and Zitadel

https://127.0.0.1.sslip.io {
    tls /etc/certs/selfsigned.crt /etc/certs/selfsigned.key
    reverse_proxy h2c://zitadel-external-tls:8080
}

https://127.0.0.1.sslip.io {
    tls /etc/certs/selfsigned.crt /etc/certs/selfsigned.key
    reverse_proxy h2c://zitadel-external-tls:8080
}

https://127.0.0.1.sslip.io {
    tls /etc/certs/selfsigned.crt /etc/certs/selfsigned.key
    reverse_proxy h2c://zitadel-external-tls:8080
}

https://127.0.0.1.sslip.io {
    tls /etc/certs/selfsigned.crt /etc/certs/selfsigned.key
    reverse_proxy h2c://zitadel-external-tls:8080
}

ZITADEL_EXTERNALPORT=443
ZITADEL_EXTERNALSECURE=true
ZITADEL_TLS_ENABLED=false

ZITADEL_EXTERNALPORT=443
ZITADEL_EXTERNALSECURE=true
ZITADEL_TLS_ENABLED=false

ZITADEL_EXTERNALPORT=443
ZITADEL_EXTERNALSECURE=true
ZITADEL_TLS_ENABLED=false

ZITADEL_EXTERNALPORT=443
ZITADEL_EXTERNALSECURE=true
ZITADEL_TLS_ENABLED=false

This configuration is suitable for environments in which Zitadel and the reverse proxy are located on the same machine.

S

SaarPhil•2/13/25, 9:57 PM

---

TLS terminated by Caddy + self signed TLS between Caddy and Zitadel

https://127.0.0.1.sslip.io {
    tls /etc/certs/selfsigned.crt /etc/certs/selfsigned.key
    reverse_proxy https://zitadel-enabled-tls:8080 {
        transport http {
            tls_insecure_skip_verify
        }
    }
}

https://127.0.0.1.sslip.io {
    tls /etc/certs/selfsigned.crt /etc/certs/selfsigned.key
    reverse_proxy https://zitadel-enabled-tls:8080 {
        transport http {
            tls_insecure_skip_verify
        }
    }
}

https://127.0.0.1.sslip.io {
    tls /etc/certs/selfsigned.crt /etc/certs/selfsigned.key
    reverse_proxy https://zitadel-enabled-tls:8080 {
        transport http {
            tls_insecure_skip_verify
        }
    }
}

https://127.0.0.1.sslip.io {
    tls /etc/certs/selfsigned.crt /etc/certs/selfsigned.key
    reverse_proxy https://zitadel-enabled-tls:8080 {
        transport http {
            tls_insecure_skip_verify
        }
    }
}

ZITADEL_EXTERNALPORT=443
ZITADEL_EXTERNALSECURE=true
ZITADEL_TLS_ENABLED=true
ZITADEL_TLS_CERTPATH=/etc/certs/selfsigned.crt
ZITADEL_TLS_KEYPATH=/etc/certs/selfsigned.key

ZITADEL_EXTERNALPORT=443
ZITADEL_EXTERNALSECURE=true
ZITADEL_TLS_ENABLED=true
ZITADEL_TLS_CERTPATH=/etc/certs/selfsigned.crt
ZITADEL_TLS_KEYPATH=/etc/certs/selfsigned.key

ZITADEL_EXTERNALPORT=443
ZITADEL_EXTERNALSECURE=true
ZITADEL_TLS_ENABLED=true
ZITADEL_TLS_CERTPATH=/etc/certs/selfsigned.crt
ZITADEL_TLS_KEYPATH=/etc/certs/selfsigned.key

ZITADEL_EXTERNALPORT=443
ZITADEL_EXTERNALSECURE=true
ZITADEL_TLS_ENABLED=true
ZITADEL_TLS_CERTPATH=/etc/certs/selfsigned.crt
ZITADEL_TLS_KEYPATH=/etc/certs/selfsigned.key

This configuration is better than the first one, but also has a downside: you have to take care of updating certificates on your Zitadel instance.

S

SaarPhil•2/13/25, 9:59 PM

---

no TLS at all

http://127.0.0.1.sslip.io {
    reverse_proxy h2c://zitadel-disabled-tls:8080
}

http://127.0.0.1.sslip.io {
    reverse_proxy h2c://zitadel-disabled-tls:8080
}

http://127.0.0.1.sslip.io {
    reverse_proxy h2c://zitadel-disabled-tls:8080
}

http://127.0.0.1.sslip.io {
    reverse_proxy h2c://zitadel-disabled-tls:8080
}

ZITADEL_EXTERNALPORT=80
ZITADEL_EXTERNALSECURE=false
ZITADEL_TLS_ENABLED=false

ZITADEL_EXTERNALPORT=80
ZITADEL_EXTERNALSECURE=false
ZITADEL_TLS_ENABLED=false

ZITADEL_EXTERNALPORT=80
ZITADEL_EXTERNALSECURE=false
ZITADEL_TLS_ENABLED=false

ZITADEL_EXTERNALPORT=80
ZITADEL_EXTERNALSECURE=false
ZITADEL_TLS_ENABLED=false

This configuration should only be used for development purposes. It is unsafe. NEVER USE IT IN PRODUCTION!

S

SaarPhil•2/13/25, 10:14 PM

@Raccine This reminds me of something I was thinking about some time ago.
Zitadel could provide a configuration option that makes it take care of TLS itself.
Giving it a domain name + admin mail it could acquire certificates through Let's encrypt itself.
So, you as an administrator wouldn't have to take care about that anymore.

S

SaarPhil•2/17/25, 6:16 AM

Which configuration did you use?

S

SaarPhil•2/19/25, 5:42 PM

I posted several examples you could go with. Which one of them did you use?

S

SaarPhil•2/26/25, 1:02 PM

Why would you provide self signed certificates (see your env vars) when disabling tls?

S

SaarPhil•2/26/25, 1:03 PM

That doesn't seem right and to me it seems as if you mixed various configurations into one

Vvik So you are saying that this is the cause POST req are done over http? And GET r...

S

SaarPhil•2/27/25, 8:05 AM

No, that shouldn't cause such an issue.

S

SaarPhil•2/27/25, 8:16 AM

Having an inconsistent configuration might cause other issues though.

S

SaarPhil•2/27/25, 4:52 PM

It might be some caching, some inproper updating of urls, or similar.
Do you have a reverse proxy in place? They sometimes tend to cache GET requests.

T

TobiWan•3/20/25, 1:43 PM

I am struggeling to get TLS to work with ngrok.
When accessing zitadel the frontend tries to use http:// besides I configured ZITADEL_EXTERNALSECURE: true

S

SaarPhil•3/20/25, 5:28 PM

@TobiWan please open a separate thread for your issue.