The Subfolder Problem

For anyone who’s tried hosting a website from the subfolder, e.g., https://www.example.com/blog, you know that this can often lead to issues like broken links or incorrectly styled elements. This is due to many frameworks assuming you are hosting out of the root of the web site. While Hugo has a way to configure a site for this, there are some things you may need to adjust in order to make it work.

I recently ran into an issue while setting up a self-hosted instance of n8n on a virtual private server (VPS). My workflow included a final step that wrote a file to a folder on the host machine via a Docker bind mount:

volumes:
  - n8n_data:/home/node/.n8n
  - ./local-files:/files

Before starting the containers for the first time, I created the local-files directory in the same location as the docker-compose.yml file. I had done this previously on a Raspberry Pi, where I was also hosting an instance of n8n, and it seemed like the proactive thing to do. Turns out, it wasn’t a good idea.

If you went through the previous post and got Caddy working to obtain TLS/SSL certificates on your home network you may have noticed that the process introduced some inefficiencies in the DNS lookup process. Namely, we’re now going out to a public internet DNS provider, like Cloudflare, as part of the DNS lookup process for a machine on our internal network.

The extra time is a few dozen milliseconds, but if you want to optimize speed, you can add either AdGuard or Pi-Hole to the mix. Both products act as a middleman between your devices and the DNS providers on the public internet. Their primary purpose is to block ads by not forwarding the DNS request if the domain name of the requested address matches a know ad or malware site. However, both products also allow for DNS rewrites (DNS Records if you’re using Pi-hole), which are static mappings of domain names to IP addresses. Basically, it can resolve specific domain names to IP addresses without hitting an upstream Internet DNS service. By utilizing that feature, we’ll end up with this.

The base Caddy Docker image is intentionally lean—around 50MB—to avoid bundling unnecessary components. However, if you need extra functionality, such as automatic SSL certificate issuance using the ACME DNS challenge via Cloudflare and Let’s Encrypt (as I did), you’ll need an image that includes the required plug-in. You have two options: use a community-maintained prebuilt image (the easy way), or build your own (the hard way). Here, we’re going with the hard way.

Here’s the setup.

1. You have one or more services running in Docker containers.
2. The devices that need to access those services are part of a Tailscale network (Tailnet).
3. You own a public domain name (e.g., your-domain.com)
4. You want/need to serve those services via HTTPS
5. You don’t want to open any ports or other holes in your firewall.
6. You don’t want to mess with self-signed certificates or create your own private certificate authority.

If this is your situation, this post might help.