Troubleshooting

DNS Setup (AWS)

Issue 1: Certificate Not Issued / ACME Errors

Symptom: Caddy logs show ACME/certificate errors, or the HTTPS URL shows an untrusted certificate instead of a trusted one.

Likely causes:

• DNS hasn't fully propagated yet

• Port 80 is blocked by the security group (needed for Let's Encrypt validation)

• The DNS A record points to the wrong IP

Diagnostics (run on the VM):

Replace hivel.yourcompany.com with your actual domain.

# Confirm DNS resolves to VM's IP
dig +short hivel.yourcompany.com

# Confirm port 80 is reachable from the internet
curl -I http://hivel.yourcompany.com

# Check Caddy's logs for the specific ACME error
docker logs caddy --tail 100

Resolution:

1. If dig doesn't return your VM's IP: Wait for DNS propagation (typically 5–15 minutes). Re-run dig +short to confirm.

2. If curl times out: Port 80 is blocked. In AWS Console:

   • Go to EC2 > Security Groups > Your VM's security group

   • Add an inbound rule: Custom TCP, port 80, source 0.0.0.0/0

   • Wait ~1 minute and restart Caddy: docker restart caddy

3. If both work but Caddy still shows errors: Check your A record points to the correct VM IP in AWS Route53.

How to verify the fix:

docker logs -f caddy

Wait for a line confirming certificate obtained successfully, then open your HTTPS URL in a browser. It should show a trusted certificate.

For support: Provide docker logs caddy --tail 100, output of dig +short, and output of curl -I http://hivel.yourcompany.com.

Issue 2: Connection Refused on Port 443

Symptom: Navigating to the HTTPS URL fails immediately with "connection refused" or times out.

Likely causes:

• Caddy container isn't running

• Port 443 isn't open in the VM's security group

Diagnostics (run on the VM):

# Check if Caddy container is running
docker ps | grep caddy

Then verify port 443 is open in AWS Console:

• Go to EC2 > Security Groups > Your VM's security group

• Look for an inbound rule on port 443

Resolution:

1. If Caddy isn't running: Start it:

   docker start caddy

1. If port 443 isn't open: In AWS Console, add an inbound rule:

   • Type: Custom TCP

   • Port: 443

   • Source: 0.0.0.0/0 (or your office/VPN CIDR)

How to verify the fix: Navigate to your HTTPS URL. It should connect and load.

For support: Provide output of docker ps -a | grep caddy and a screenshot of your security group's inbound rules.

Issue 3: HTTPS Loads but Shows Blank Page or 502 Error

Symptom: The HTTPS URL connects and loads, but the page is blank or shows a 502 error.

Likely cause: The Hivel UI container itself isn't healthy - this is a deployment issue unrelated to Caddy.

Diagnostics (run on the VM):

# Check if the UI container is running
docker ps | grep insightly-ui

# Test if the UI is reachable directly on port 3000
curl -I http://localhost:3000

Resolution:

The issue is with the UI container, not Caddy. Fixing Caddy's configuration won't help until the UI itself is healthy.

1. Check the UI container's logs:

   docker logs insightly-ui

1. If the UI isn't running or is failing, refer to Troubleshooting in the main deployment guide for help with the deployment itself.

How to verify the fix:

curl -I http://localhost:3000

Should return a healthy response (HTTP 200). Then reload your HTTPS URL - it should load correctly.

For support: Provide docker logs insightly-ui and the output of curl -I http://localhost:3000.

Back to Managing the Caddy Container

Quick Reference