Getting started¶

This page takes you from the AWS Marketplace listing to a running gateway: subscribe, launch, connect, and check that Caddy serves HTTPS on your instance. It takes about ten minutes.

You need: an AWS account with permission to subscribe to AWS Marketplace products and launch EC2 instances.

Open the Caddy HTTPS Gateway listing, review the pricing and terms, and subscribe.

2. Launch the instance¶

Launch from the listing with these settings:

Instance type: t3.medium.
Storage: at least 16 GiB, encrypted gp3.
Security group: no inbound rules are needed. Caddy listens on loopback only. If you want SSH, allow port 22 only from your own administrative address range.
IAM instance profile: to connect with AWS Systems Manager Session Manager, attach a role with the AWS managed policy AmazonSSMManagedInstanceCore. Caddy itself needs no AWS permissions.

3. Connect¶

Connect with Session Manager, from the EC2 console (Connect > Session Manager), and switch to the ubuntu user:

sudo -iu ubuntu

Wait for first boot to finish:

cloud-init status --wait

4. Run the walkthrough¶

bash /opt/sushi/docs/demo.sh

The walkthrough reads the sample API over plain HTTP, fetches the same JSON through the HTTPS proxy using the local certificate, opens the sample page, and checks that the private path refuses a request without a password. Each step prints STEP, COMMAND and RESULT lines, and the script ends with SUSHI_CADDY_DEMO_PASSED.

5. Make your own request¶

The public certificate of the instance's local CA is published at /etc/caddy/local-root.crt. Pass it to curl to trust the HTTPS listener:

curl --cacert /etc/caddy/local-root.crt https://127.0.0.1:8443/api/status.json

You should see:

{"ok":true,"service":"sushi-caddy-origin","path":"/api/status.json"}

To call the password-protected path, let root read the password and hand it to curl on standard input, so it never appears on screen or in your shell history:

sudo awk '{printf "user = \"pilot:%s\"\n", $0}' /etc/caddy/pilot.password \
  | curl --config - --cacert /etc/caddy/local-root.crt \
    https://127.0.0.1:8443/private/api/status.json

Keep the password private

/etc/caddy/pilot.password is readable only by root. Do not paste it into tickets, chat or screen recordings.

6. Open the gateway from your computer¶

Because Caddy listens on loopback, reach it from your own computer with Session Manager port forwarding. With the AWS CLI and the Session Manager plugin installed:

aws ssm start-session --target <instance-id> \
  --document-name AWS-StartPortForwardingSession \
  --parameters '{"portNumber":["8443"],"localPortNumber":["8443"]}'

Copy /etc/caddy/local-root.crt to your computer, then, in another terminal:

curl --cacert local-root.crt https://127.0.0.1:8443/api/status.json

The certificate is public, so copying it is safe. The private key never leaves the instance.

Next steps¶

Point Caddy at your own application in Configuration.