DNS challenge
Caddy's default HTTP challenge requires public access to port 80. Use the DNS challenge when you need wildcard certificates or cannot expose port 80 during certificate validation.
Caddy DNS providers are modules compiled into the Caddy binary. Coolify's default lucaslorentz/caddy-docker-proxy:2.8-alpine image does not include these modules, so you must build a compatible image from the proxy Docker Compose configuration.
What you need
- a domain hosted by a Caddy DNS provider
- provider credentials that can create and delete DNS records
Changing the proxy image rebuilds the component that serves every public route on the server. A failed module build or invalid Caddy option can leave all routes unavailable.
Add a DNS-enabled Caddy build
Open Servers > your server > Proxy > Configuration. In the caddy service, remove the existing image line and add the provider-specific build, credential, and caddy.acme_dns label below. Keep the existing networks, ports, volumes, and Coolify labels.
Each example visually marks the existing image line in red and the replacement lines in green.
services:
caddy:
image: 'lucaslorentz/caddy-docker-proxy:2.8-alpine'
build:
dockerfile_inline: |
FROM caddy:2.11-builder AS builder
RUN xcaddy build \
--with github.com/lucaslorentz/caddy-docker-proxy/[email protected] \
--with github.com/caddy-dns/[email protected]
FROM caddy:2.11-alpine
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
CMD ["caddy", "docker-proxy"]
environment:
- CADDY_DOCKER_POLLING_INTERVAL=5s
- CADDY_DOCKER_CADDYFILE_PATH=/dynamic/Caddyfile
- CF_API_TOKEN=<cloudflare-api-token>
labels:
- coolify.managed=true
- coolify.proxy=true
- 'caddy.acme_dns=cloudflare {env.CF_API_TOKEN}'For another provider, use the module path and configuration from that provider's repository. Confirm that the module version supports the selected Caddy version before restarting the proxy.
Restart and verify
Save the proxy configuration, then select Restart Proxy. The first restart builds the custom image and can take longer than a normal restart.
Redeploy a resource with an HTTPS domain, open the domain, and inspect its certificate. Check Servers > your server > Proxy > Logs for image-build, module, DNS, or ACME errors.