# Caddy and Apache examples

Choose one proxy/host arrangement for the intended installation. Caddy and Apache are external software, not bundled with MarkStack. These templates do not configure production accounts, DNS, firewall or certificates automatically on your host. Keep reader output separate from private editor/runtime.

# Common contract

V2 editor Host checks use incoming Host, not X-Forwarded-Host. Trusted proxy parser accepts exact addresses/loopback, not generalized CIDR ranges. Its process-local sessions/limiter/current publication job do not provide replicated service coordination. Read Private team editor before adapting.

# Caddy root-site template

docs.example.com {
    root * /srv/field-guide/app/dist
    file_server
    handle_errors 404 {
        rewrite * /404.html
        file_server
    }
}

editor.example.com {
    reverse_proxy 127.0.0.1:3001
}

Public hostname site blocks can activate Caddy automatic HTTPS when its domain/ACME/reachability/storage requirements are met. That is Caddy behavior, not TLS inside V2. Inspect issuance/renewal and actual browser certificate. A private/internal hostname needs its own appropriate certificate trust arrangement.

file_server serves the reviewed root. Its canonical directory behavior can add slash; custom 404 handling uses generated file, and file_server inside handle_errors preserves error status. Test actual missing path. No directory browse is enabled.

Caddy documentation explicitly says site root is not a sandbox: symlinks within it can reach outside. Review artifacts/symlinks and do not place private data there. Bundled preview’s outside-root rejection does not automatically configure a production server.

# Caddy forwarding and validation

These blocks use HTTP loopback upstream, not HTTPS upstream where Host/SNI handling differs by Caddy version. If a CDN is in front, do not assume defaults authenticate every incoming forwarded value. Review both Caddy and V2 trust settings and test spoofed-client-address behavior on staging.

caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile

Validate adapted config, then reload through your installed service procedure during the intended window. A syntax check is not successful issuance, host access, cookies or publication. Do not stack this service on ports already owned by nginx without an explicit architecture decision.

# Apache reader template

<VirtualHost *:443>
    ServerName docs.example.com
    SSLEngine on
    SSLCertificateFile /etc/ssl/example/docs-fullchain.pem
    SSLCertificateKeyFile /etc/ssl/example/docs-key.pem
    DocumentRoot /srv/field-guide/app/dist
    DirectoryIndex index.html
    ErrorDocument 404 /404.html
    <Directory /srv/field-guide/app/dist>
        Options -Indexes -FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>

This block illustrates public reading. Require all granted is not for confidential content; replace with your reviewed reader gate when needed and test resource/index requests too. No source/private runtime belongs under this DocumentRoot. Review filesystem access, installed MIME config and adapted path quoting/layout.

ErrorDocument local path should preserve 404 response rather than redirect a missing request to a successful home. Test it. Subpath hosting requires matching server and generated/authored prefix, and the pin’s 404 home link remains literal /.

# Apache editor template

<VirtualHost *:443>
    ServerName editor.example.com
    SSLEngine on
    SSLCertificateFile /etc/ssl/example/editor-fullchain.pem
    SSLCertificateKeyFile /etc/ssl/example/editor-key.pem
    ProxyRequests Off
    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:3001/
    ProxyPassReverse / http://127.0.0.1:3001/
    RequestHeader set X-Forwarded-Proto "https"
</VirtualHost>

Required modules include ssl, proxy, proxy_http and headers, with actual certificates. ProxyRequests Off keeps this a reverse proxy, not an open forward proxy. ProxyPreserveHost On passes intended browser Host. Restrict editor audience through your actual network/access layer.

Apache’s ProxyAddHeaders defaults On and supplies forwarding information. Review incoming header sanitization plus final chain. V2 walks from right skipping configured trusted peers, and ignores forwarded addresses unless direct peer is trusted. Extra upstream hops need independent reviewed configuration; do not promise this minimal block solves arbitrary CDN chains.

Configure V2 Secure cookie, exact allowed Hosts and real trusted connection addresses. A proxy’s body/time limits are separate from V2 JSON/body/publication behavior. Test expected saves/publish, not just login-page retrieval.

# Apache validation and acceptance

Use your distribution’s installed config-test command, for example apachectl configtest where available. Check modules, actual certificates/keys, service status and rollback first. Reload only through the approved host procedure after syntax success.

Caddy/Apache binaries, TLS issuance and production deployments were not run here. These are official-source-backed templates needing your final syntax/staging/access tests. Reader-only hosts need no Node editor. Review HTTPS proxy for nginx as a separate alternative and Review and release for gates.

# Official sources

Checked 12 October 2026:

• Caddy file server/symlinks.
• Caddy errors/status.
• Caddy forwarding.
• Caddy HTTPS.
• Apache reverse proxy.
• Apache error responses.
• Apache proxy headers/settings.