Domains and TLS

Each server runs one Caddy container, vpspilot-proxy, on ports 80 and 443. A domain maps a hostname to an application on that server, and Caddy obtains and renews its certificate automatically.

Add a domain

Pick the application, enter the hostname, and point DNS at the server:

app.example.com.   300  IN  A     203.0.113.10app.example.com.   300  IN  AAAA  2001:db8::10

Once the record resolves, the first HTTPS request triggers certificate issuance through Let’s Encrypt. The owner’s email is given to the certificate authority for expiry notices.

TLS modes

www redirects

Turn on redirect www to add the other variant as a permanent redirect: www.example.com to example.com, or the other way round, depending on which one you add.

DNS and certificate status

DNS is checked from the control plane. Certificate issuer and expiry are read from the server every six hours, or right away with Check. The Certificate expiring alert fires 14 days before a Let’s Encrypt certificate expires.

How config is applied

Every change re-renders the server’s whole Caddyfile from the desired state in the control plane, validates it with Caddy, swaps it in and reloads. If the reload fails, the previous file is restored. VPSPilot only manages its own proxy configuration.

# Managed by VPSPilot. Changes here are overwritten.{	email owner@acme.dev}import /etc/caddy/extra/*.caddyapp.example.com {	log {		output stderr		format json	}	encode zstd gzip	reverse_proxy vp-web:3000}www.app.example.com {	redir https://app.example.com{uri} permanent}

Docker and Compose apps are reached by name on the private network (vp-<app>:<port>); systemd apps through the network's gateway on their public port. Files you put in /var/lib/vpspilot-proxy/extra/*.caddy are imported and never rewritten: the self-hosted dashboard's own site lives there, and you can add sites VPSPilot doesn't manage. The access log feeds each app's traffic metrics.