- Setup cloudflare API token
- Log in to Cloudflare and go to the domain you want to enable Caddy for.On the right, you'll see a section with the "API" header. Click "Get your API token": Get your API token
- Under the API tokens block, click "Create Token": User API tokens
- On the "User API Tokens" page, scroll to the bottom and press "Get started" in the Create Custom Token section: Get your API token
- Give your token a descriptive name, and add 2 permissions: Zone - Zone - Read Zone - DNS - Edit API Token settings
- Click "Continue to summary" and you should now see your API token.
- Run
docker compose up --pull "always" --build -d - Setup pihole
- Settings > DNS: Set custom DNS: 10.8.1.4#5053 and Permit all origins
- Setup Local DNS > DNS Records with URLs to Pi host IP
- Setup DDNS to your router & expose WG port from router to be accessible via DDNS
- Setup & connect from a client via Wireguard
- Client uses DDNS url to connect to wireguard VPN. When connected, client is virtually sitting in same docker network that wg-easy & others are in.
- Client tries to open an external website:
- Client tries to resolve DNS through wg-easy vpn. wg-easy calls pihole for dns resolution.
- pihole runs block scripts, then calls cloudflared-dns for dns resolution.
- cloudflared-dns calls 1.1.1.1 over DoH for DNS resolution.
- After DNS resolution, wg-easy works as vpn to pass the requested data from the URL.
- Client opens internal website, like pihole web interface:
- Client tries to resolve DNS through wg-easy vpn. wg-easy calls pihole for dns resolution.
- pihole runs block scripts, and finds the local DNS added for this internal URL. It returns pi's local network IP (192.168.1.xxx)
- Client tries to call the Pi IP with 443 (HTTPS) and URL
- Pi has caddy from docker mapped to 443 port of itself, so request to internal URL is reverse proxied by caddy along with TLS resolution.
- request flow:
- client(wg vpn connected) >>
- internet >>
- ddns resolution >>
- router >>
- Pi >>
- Wireguard(with pihole dns resolution) >>
- Pi >>
- caddy >>
- internal_service (on docker network)