Recommended: Option A - Domain + Let's Encrypt

DNS Setup (AWS)

When to Use This Option?

Choose this option when you have (or can obtain) a domain. Caddy automatically obtains and renews a trusted Let's Encrypt certificate with no manual management.

Step 1: Point DNS at Your Domain

Goal: Make your subdomain resolve to the VM's public IP.

In AWS Console (Route53):

1. Go to Route53 > Hosted Zones

2. Select your domain.

3. Create a new A record:

Record Type	Name	Value
A	hivel.yourcompany.com	<vm-public-ip>

Recommendation: Use an Elastic IP for the VM so the address doesn't change on instance restart.

Wait for DNS propagation (a few minutes), then verify.

# Replace hivel.yourcompany.com with your actual domain.

dig +short hivel.yourcompany.com

Expected result: Command returns your VM's public IP address.

Step 2: Open Required Ports

In AWS Console (EC2 Security Group):

1. Go to EC2 > Security Groups

2. Select your VM's security group

3. Add these inbound rules:

Type	Port	Source	Purpose
Custom TCP	80	0.0.0.0/0	Let's Encrypt HTTP-01 certificate validation challenge
Custom TCP	443	0.0.0.0/0, or your office/VPN CIDR	HTTPS traffic to the UI

Important: Port 80 must be reachable from the public internet for certificate issuance to succeed, even though all application traffic will use HTTPS.

Step 3: Configure and Start Caddy

On the VM:

Replace hivel.yourcompany.com with your actual domain in all commands below.

Create the Caddy configuration file:

mkdir -p ~/caddy && cd ~/caddy

cat > Caddyfile <<'EOF'
hivel.yourcompany.com {
    reverse_proxy localhost:3000
}
EOF

Start the Caddy container:

docker run -d --name caddy --restart unless-stopped --network host \
  -v $(pwd)/Caddyfile:/etc/caddy/Caddyfile \
  -v caddy_data:/data \
  caddy:2

What this does:

• --network host allows Caddy to reach the UI container via localhost:3000 without additional Docker network configuration

• -v caddy_data:/data persists certificates across container restarts

Expected result: docker ps | grep caddy shows the Caddy container as Up.

If it fails: See Certificate Not Issued in Troubleshooting.

Step 4: Verify the Setup

On the VM, check Caddy logs:

docker logs -f caddy

Wait for the success message: Look for a line confirming certificate obtained successfully.

In your browser, navigate to:

https://hivel.yourcompany.com

Expected result: The page loads and the browser shows a trusted certificate with no warnings.

If it fails: See Certificate Not Issued in Troubleshooting.

Next step: HTTPS setup is complete. Your Hivel UI is now securely accessible at https://hivel.yourcompany.com.

For ongoing Caddy management (restart, stop, view logs), see Managing the Caddy Container.

Back to Setup and Prerequisites

Option B: Self-Signed