Option B - No Domain Yet (Self-Signed, Temporary)

DNS Setup (Azure)

Use this only to unblock testing before DNS/domain setup is complete. Not recommended for client-facing production use - browsers will show an untrusted-certificate warning.

mkdir -p ~/caddy && cd ~/caddy
 
cat > Caddyfile <<'EOF'
:443 {
    tls internal
    reverse_proxy localhost:3000
}
EOF
 
docker run -d --name caddy --restart unless-stopped --network host \
  -v $(pwd)/Caddyfile:/etc/caddy/Caddyfile \
  -v caddy_data:/data \
  caddy:2

Open inbound port 443 only (no ACME challenge needed, so port 80 is not required for this option). Then browse to:

https://<vm-public-ip>

Expected result: Click through the browser's certificate warning ("Advanced" → "Proceed"). The page still loads over https://, which satisfies the secure-context requirement described above.

Option A - Domain + Let's Encrypt

Upgrading from Option B → A