Unable to use DNS

1

Hello, I am very new to VaultWarden and DNSing, I’ve tried all the tutorials but I just cant seem to get the DNS to work whenever I go to the Site I receive “ERR_CONNECTION_TIMED_OUT”. I am currently using DuckDNS with Caddy all running in docker on Ubuntu 20.04 LTS in a VM with a bridged adapter

compose file

`version: '3.9'

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    environment:
      WEBSOCKET_ENABLED: "true"  # Enable WebSocket notifications.
    volumes:
      - ./vw-data:/data
    ports:
      - 8080:80
      - 3012:3012

  caddy:
    image: caddy:2
    container_name: caddy
    restart: always
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./caddy:/usr/bin/caddy  # Your custom build of Caddy.
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy-config:/config
      - ./caddy-data:/data
    environment:
      DOMAIN: "https://******.duckdns.org"  # Your domain.
      EMAIL: "admin@example.com"                 # The email address to use for ACME registration.
      DUCKDNS_TOKEN: "*********"                   # Your Duck DNS token.
      LOG_FILE: "/data/access.log"

Caddyfile

https://******.duckdns.org {
  log {
    level INFO
    output file {$LOG_FILE} {
      roll_size 10MB
      roll_keep 10
    }
  }

  # Use the ACME DNS-01 challenge to get a cert for the configured domain.
  tls {
    dns duckdns {$DUCKDNS_TOKEN}
  }

  # This setting may have compatibility issues with some browsers
  # (e.g., attachment downloading on Firefox). Try disabling this
  # if you encounter issues.
  encode gzip

  # Notifications redirected to the WebSocket server
  reverse_proxy /notifications/hub vaultwarden:3012

  # Proxy everything else to Rocket
  reverse_proxy vaultwarden:80
}

Caddy logs

{"level":"info","ts":1671602111.902628,"msg":"using provided configuration","config_file":"/etc/caddy/Caddyfile","config_adapter":"caddyfile"}
{"level":"warn","ts":1671602111.918077,"msg":"Caddyfile input is not formatted; run the 'caddy fmt' command to fix inconsistencies","adapter":"caddyfile","file":"/etc/caddy/Caddyfile","line":2}
{"level":"info","ts":1671602111.9241805,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//[::1]:2019","//127.0.0.1:2019","//localhost:2019"]}
{"level":"info","ts":1671602111.9244843,"logger":"http","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv0","https_port":443}
{"level":"info","ts":1671602111.924507,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
{"level":"info","ts":1671602111.9258442,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
{"level":"info","ts":1671602111.9259794,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
{"level":"info","ts":1671602111.9260185,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]}
{"level":"info","ts":1671602111.9260256,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["*********.duckdns.org"]}
{"level":"info","ts":1671602111.9271972,"logger":"tls","msg":"cleaning storage unit","description":"FileStorage:/data/caddy"}
{"level":"info","ts":1671602111.931056,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"info","ts":1671602111.9314158,"msg":"autosaved config (load with --resume flag)","file":"/config/caddy/autosave.json"}
{"level":"info","ts":1671602111.932042,"msg":"serving initial configuration"}
{"level":"info","ts":1671602111.932991,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc0003f9500"}

Any help will be greatly appreciated

2

This assumes that caddy will be able to resolve vaultwarden container by name, which is not true. That is because the default bridge network, created by docker-compose, doesn’t support name resolution.
Try adding this to docker-compsose.yml:

networks:
 - caddy: {}
services:
  caddy:
    networks:
      - caddy
    # ....

  vaultwarden:
    networks:
      - caddy
    # you can also remove 'ports' section from this service
    # .....

Also note, that caddy will prefer acme http-01 challenge over dns-01, even if configured otherwise, unless you use wildcard hostname.

1 Like