# Caddy Proxy Manager
Caddy Proxy Manager - A modern web interface for Caddy Server with WAF, mTLS, forward auth, geo blocking, REST API, and traffic analytics.

Open Source · Docker · Next.js · shadcn/ui

# Control Every Edge.

The modern web interface for Caddy Server. WAF protection, automatic HTTPS, mTLS, forward auth, geo blocking, L4 TCP/UDP proxying, traffic analytics, a full REST API, and a complete audit trail. All in one place.

Get Started
View Source
Everything included

## Powerful Simplicity

Everything you need to manage your infrastructure, nothing you don't.

⇄

### Reverse Proxy

Multiple upstreams, load balancing (8 policies), health checks, custom headers, location rules, redirects, rewrites, and upstream DNS pinning.

🔌

### L4 TCP/UDP Proxy

Layer 4 stream proxying for TCP and UDP. TLS SNI matching, proxy protocol, health checks, and geo blocking at the transport layer.

🚪

### Forward Auth Portal

Built-in identity provider for protecting apps without an external IdP. Credential and OAuth login, user groups, and per-host access control.

🛡️

### WAF

Web Application Firewall powered by Coraza with OWASP CRS. Block SQLi, XSS, LFI, and RCE with per-host control and rule suppression.

🔒

### Auto HTTPS & mTLS

Automatic TLS via ACME with Let's Encrypt and Cloudflare DNS-01. Built-in CA for mutual TLS with role-based path access control.

📈

### Traffic Analytics

Live request charts, protocol breakdown, country heatmap, top user agents, and blocked request log powered by ClickHouse.

🌍

### Geo Blocking

Block or allow by country, continent, ASN, CIDR, or exact IP per host, with priority allow-override rules and fail-closed mode.

🔗

### REST API

Full REST API under `/api/v1/` with Bearer token auth, API token management, and interactive OpenAPI 3.1.0 docs at `/api-docs`.

🔑

### Access Control

HTTP basic auth, forward auth with user groups, mTLS RBAC with path-based rules, and three-tier user roles (Viewer, User, Admin).

🪪

### OAuth / SSO

OAuth2/OIDC authentication with any compliant provider — Authentik, Keycloak, Auth0, and more. Account linking from the Profile page.

🔄

### Instance Sync

Master/slave configuration sync for multi-instance deployments. Push proxy hosts, certs, and settings to replicas on every change.

📋

### Audit Log

Every configuration change is tracked with user attribution and full-text search. Dark mode, mobile UI, and search across all views.

Traffic Intelligence

## See every request,
in real time.

Charts, protocol breakdown, country heatmaps, user agent breakdowns, and a paginated blocked-request log. Filter by host or pick any time range — all powered by ClickHouse with 90-day retention.

Proxy Management

## Every reverse proxy,
one interface.

Search across all hosts, toggle them on or off instantly, and configure upstreams, load balancing, and access lists without touching a config file.

TLS Certificates

## HTTPS by default.
Visibility built in.

Caddy handles certificate issuance automatically. The Certificates page shows issuer, expiry, and status for every managed cert. Import custom certs or use the built-in CA to issue internal client certificates.

Configuration

## Every option,
without the YAML.

The host editor exposes load balancing policies, forward auth, location rules, redirects, DNS pinning, geo blocking, mTLS, and WAF settings all from a single form.

Security

## WAF protection,
zero config.

Enable the Coraza-powered WAF with OWASP Core Rule Set in one click. View blocked and detected events, suppress noisy rules globally or per host, and add custom SecLang directives.

Authentication

## Protect any app,
no external IdP.

The built-in forward auth portal redirects unauthenticated visitors to a login page, issues session cookies, and validates every request. Organise users into groups and control access per host — or bring your own OAuth provider.

Automation

## Full REST API,
fully documented.

Manage every resource programmatically through `/api/v1/` with Bearer token authentication. Interactive OpenAPI 3.1.0 docs at `/api-docs`, API token management with optional expiration, and three-tier role-based access.

Open Source

## Deploy in Seconds

A single docker-compose file is all you need.

# Clone and configure
git clone https://github.com/fuomag9/caddy-proxy-manager.git
cd caddy-proxy-manager && cp .env.example .env
# Configure the environment
nano .env
# Start
docker compose up -d

Access at `http://localhost:3000` · Data persists in Docker volumes