mTLS CookBook With Caddy

{
    # Whitelist specific proxies that forward traffic
    trusted_proxies 10.10.10.3 10.10.10.2
    trusted_proxies_strict true
}

https://content.com {
    tls internal

    tls {
        client_auth {
            mode require_and_verify
            
            # Trust the root CA and specific whitelisted client certificates
            trusted_ca_cert_file          /etc/caddy/client-leaves/root.crt
            trusted_leaf_cert_file        /etc/caddy/client-leaves/strapi.crt
            trusted_leaf_cert_file        /etc/caddy/client-leaves/strapi-ws.crt
        }
    }

    encode gzip

    @allowedIPs {
        remote_ip 10.10.10.3 10.10.10.10
    }
    
    handle @allowedIPs {
        reverse_proxy 127.0.0.1:1337
    }

    handle {
        respond "Access Denied" 403
    }
}

http://127.0.0.1:8080 {
    reverse_proxy https://10.10.10.2:443 {
        transport http {
            tls_server_name content.com
            tls_trusted_ca_certs /var/lib/caddy/mtls/root.crt
            tls_client_auth      /var/lib/caddy/mtls/strapi.crt /var/lib/caddy/mtls/strapi.key
        }
    }
}

# Generate a 4096-bit RSA private key
openssl genpkey -algorithm RSA -out ~/client.key -pkeyopt rsa_keygen_bits:4096

# Create a certificate signing request
openssl req -new -key ~/client.key -subj "/CN=workstation-client" -out ~/client.csr

# Transfer the CSR to the API VM for signing
scp ~/client.csr user@api-vm:/tmp/

CA_DIR=/var/lib/caddy/.local/share/caddy/pki/authorities/local
CSR=/tmp/client.csr
CRT=/etc/caddy/client-leaves/client.crt

# Sign the CSR to issue a 1-year certificate
sudo openssl x509 -req -in $CSR -CA $CA_DIR/root.crt -CAkey $CA_DIR/root.key \
  -CAcreateserial -out $CRT -days 365 -sha256

# Fix ownership and permissions
sudo chown caddy:caddy $CRT
sudo chmod 644 $CRT

# Reload Caddy to recognize the new certificate
sudo caddy reload --config /etc/caddy/Caddyfile

# Fetch the signed certificate from the API VM
scp user@api-vm:/etc/caddy/client-leaves/client.crt ~/

# Bundle the key and certificate (you will be prompted to set an export password)
openssl pkcs12 -export -inkey ~/client.key -in ~/client.crt -certfile ~/root.crt -name "Secure-Client" -out ~/client.p12

# Clean up the raw files after importing the bundle into your browser
shred -u ~/client.key ~/client.crt ~/client.p12

# Allow MySQL access strictly from the API VM
sudo ufw allow in on wg0 proto tcp from 10.10.10.2 to any port 9000 comment 'MySQL from API'

# Allow incoming HTTPS traffic on the API VM from the proxy
sudo ufw allow in proto tcp from 10.10.10.3 to any port 443 comment 'HTTPS from BFF'

// Trust the local loopback and the BFF VM proxy
app.set('trust proxy', (ip: string) => {
  return ip === '127.0.0.1' || ip === '10.10.10.3';
});

# Should succeed and return HTTP 200
curl -sv https://content.com/admin --cert ~/client.crt --key ~/client.key --cacert ~/root.crt -o /dev/null

# Should fail and return an OpenSSL alert (certificate required)
curl -k https://content.com/admin