CPM - Caddy Proxy Manager

🚀 Lightweight web UI for managing Caddy reverse proxy
Wildcard SSL • Auto-detection • One-click migration

Dashboard — system overview, alerts, quick actions

Settings — language, theme, wildcard SSL, users

Proxy Rules — visual editor for reverse proxy configuration

Certificates — SSL overview with expiration status

docker pull perteus/caddy-ui:3.2.0
docker pull perteus/caddy-ui:latest

version: '3.8'

services:
  caddy:
    image: caddy:2-alpine
    container_name: caddy_proxy
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./caddy-config:/etc/caddy
      - ./caddy-data:/data

  cpm:
    image: perteus/caddy-ui:3.2.0
    container_name: cpm
    ports:
      - "8501:8501"
    environment:
      - CONTAINER_NAME=caddy_proxy
      - DEFAULT_IP=192.168.1.100
    volumes:
      - ./caddy-config:/caddy-config
      - ./caddy-data:/caddy-data
      - /var/run/docker.sock:/var/run/docker.sock

services:
  caddy:
    image: serfriz/caddy-cloudflare:latest
    container_name: caddy_proxy
    environment:
      - CF_API_TOKEN=${CF_API_TOKEN}
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./caddy-config:/etc/caddy
      - ./caddy-data:/data

  cpm:
    image: perteus/caddy-ui:3.2.0
    container_name: cpm
    privileged: true  # Required for Synology
    ports:
      - "8501:8501"
    environment:
      - CONTAINER_NAME=caddy_proxy
      - DEFAULT_IP=192.168.1.100
    volumes:
      - ./caddy-config:/caddy-config
      - ./caddy-data:/caddy-data
      - /var/run/docker.sock:/var/run/docker.sock

1. Navigate to Settings → Wildcard SSL
2. Add your domain (e.g., zrnek.cz for *.zrnek.cz)
3. Select provider (Cloudflare) and configure API token
4. Migrate existing sites - CPM will offer to update all matching sites

When creating new proxy rules, CPM automatically detects if a wildcard certificate is available and pre-selects it.

CPM generates TLS snippets in snippets.caddy:

(wildcard-tls-zrnek-cz) {
    tls {
        dns cloudflare {env.CF_API_TOKEN}
    }
}

Sites using wildcard import this snippet:

adguard.zrnek.cz {
    import wildcard-tls-zrnek-cz
    import cloudflare_dns
    reverse_proxy 192.168.1.100:3000
}

caddy-config/
├── Caddyfile              # Main config (managed by CPM)
├── snippets.caddy         # Shared snippets + wildcard TLS (auto-generated)
├── sites/
│   ├── wildcard/          # Wildcard site handle blocks
│   │   └── *.domain.caddy
│   └── standard/          # Standard domain {} blocks
│       └── domain.caddy
└── pages/                 # Custom error pages (optional)
    ├── 403.html
    └── 404.html

caddy-data/
└── caddy/
    └── certificates/      # SSL certificates (auto-managed)

For Synology Docker, use privileged: true to allow Docker socket access:

cpm:
  image: perteus/caddy-ui:3.2.0
  privileged: true
  volumes:
    - /volume1/docker/caddy-config:/caddy-config
    - /volume1/docker/caddy-data:/caddy-data
    - /var/run/docker.sock:/var/run/docker.sock

GET  /api/v1/sites    # List all proxy rules
GET  /api/v1/status   # Caddy status
POST /api/v1/reload   # Reload Caddy configuration

# Prerequisites: Go 1.26

git clone https://github.com/TomasZmek/cpm.git
cd cpm

# Build
go build -o cpm ./cmd/cpm

# Run
./cpm

docker build -t perteus/caddy-ui:3.2.0 --no-cache .
docker push perteus/caddy-ui:3.2.0
docker push perteus/caddy-ui:latest

• ✅ Auto-Discovery — automatic detection of running containers
• ✅ Multi-host support — monitor multiple Docker hosts
• ✅ Smart pairing — match existing proxy rules with containers
• ✅ One-click rule creation — pre-filled from discovered containers
• ✅ Local IP autodetection — detects host IP automatically

• ✅ Race condition fix - ValidateSession no longer writes to map under read lock
• ✅ Path traversal fix - ZIP restore is now protected against zip-slip attacks
• ✅ CSRF protection - all forms now protected with CSRF tokens
• ✅ Brute-force protection - login endpoint rate limited (5 attempts / 15 min)
• ✅ Dashboard fix - certificate days remaining now displays correctly
• ✅ Code deduplication - shared utils package, consistent logging

• ✅ Go 1.26 - updated runtime with security fixes
• ✅ Multi-platform - native amd64 and arm64 support (Apple Silicon, Raspberry Pi, Synology)
• ✅ Fiber v2.52.13 - security fixes (CVE-2025-66630, CVE-2026-25882)
• ✅ Docker SDK v28.5.2 - updated Docker client library
• ✅ Internal-only restrictions - restrict site access to internal network only

• ✅ New architecture - Wildcard blocks in Caddyfile, handle blocks for sites
• ✅ Correct TLS handling - No more individual certificate requests
• ✅ Better error reporting - Detailed Caddy output in UI
• ✅ Internal-only fix - Handled at wildcard block level

Contributions welcome! Feel free to submit issues and pull requests.

• 🐛 Report bugs: GitHub Issues
• 💡 Feature requests: GitHub Discussions
• 📦 Source code: GitHub Repository

MIT License - see LICENSE for details.

• Built with Go & Fiber
• Interactivity: HTMX
• Dialogs: SweetAlert2
• Developed with assistance from Claude AI
• 🇰🇷 Korean translation: @redstar-programmer

CPM - Caddy Proxy Manager
Made with ❤️ for home labs
Docker Hub • GitHub