Caddy
Trusted Proxies Are an Authentication Boundary: Stop X-Forwarded-For Spoofing
Define the intended reverse-proxy chain, reject untrusted forwarding headers and block unauthorized direct-origin access. Plan allowed and denied path tests while keeping client IP attribution separate from user authentication.
The 2026 Self-Hosted Starter Stack: A Proposed Design
A pragmatic 2026 self-hosted starter stack: host OS, Docker Compose, DNS, remote access, reverse proxy, backups, monitoring, and daily-driver apps.
Nginx Proxy Manager vs Caddy vs Traefik: A Reverse Proxy Decision Tree
A reverse proxy decision tree for homelabs: when to pick Nginx Proxy Manager, Caddy, Traefik, or raw NGINX.
Reverse Proxy Setup Without Security Mistakes: HTTPS for Homelab Apps
A security-first reverse proxy setup guide for homelab services, covering DNS, TLS, access controls, logging, updates, and what not to expose.
What Is the Safest Way to Expose One Self-Hosted App Publicly?
Keep a self-hosted app private when possible. If public access is necessary, limit its permissions, preserve private administration and test unauthorized and direct-origin requests as well as the intended login.
Homelab Reverse Proxy Guide: HTTPS Without Unsafe Exposure
A security-first reverse proxy guide for homelabs, covering DNS, TLS, app exposure, internal-only services, authentication, logging, and validation.