Option A - Domain + Let's Encrypt (Recommended)
DNS Setup (Azure)
Choose this whenever you have a domain available. Caddy automatically obtains and renews a trusted certificate from Let's Encrypt - no manual certificate management required.
Step 1: Point DNS at VM
Goal: get a DNS name resolving to VM before requesting a certificate for it.
Create an A record for your chosen subdomain pointing at VM's public IP. Use an Azure Static Public IP if you haven't allocated one, so the address doesn't change on instance restart.
Record Type
Name
Value
A
hivel.yourcompany.com
\<vm-public-ip>
Expected result: dig +short hivel.yourcompany.com returns VM's IP. Allow a few minutes for DNS propagation before continuing.
Step 2: Open Required Ports
On VM's Network Security Group, add:
Type
Port
Source
Purpose
Custom (TCP)
80
Any
Required for the Let's Encrypt HTTP-01 validation challenge
Custom (TCP)
443
Any, or your office/VPN CIDR
HTTPS traffic to the UI
Note: Port 80 must be reachable from the public internet for certificate issuance to succeed, even if all application traffic will use HTTPS.
Step 3: Configure and Start Caddy
Goal: run Caddy as a Docker container that terminates TLS and forwards to the UI on port 3000.
Prerequisites: DNS resolving (Step 1) and ports open (Step 2).
On VM, replace hivel.yourcompany.com with your actual domain:
--network host lets Caddy reach the UI container via the port it already publishes on the host (localhost:3000), with no additional Docker network configuration.
Step 4: Verify
Expected result: a log line confirming certificate issuance (certificate obtained successfully), then open:
The connection should show a trusted certificate with no browser warning.
If it fails: see Certificate not issued.
Last updated