Caddy Reverse Proxy Multiple Ports
You set up a caddy reverse proxy multiple ports workflow by mapping hostnames or paths to local backend ports. Caddy listens on standard web ports and forwards each request to the right internal service port. Teams often use this setup to run several web apps on one server. Still, broad server roles or shared keys let anyone change routing rules for every app at once. How caddy reverse proxy multiple ports routing works Caddy acts as the single front door for incoming web traffic on a host ma
Reverse Proxy Security: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up a caddy reverse proxy multiple ports workflow by mapping hostnames or paths to local backend ports. Caddy listens on standard web ports and forwards each request to the right internal service port. Teams often use this setup to run several web apps on one server. Still, broad server roles or shared keys let anyone change routing rules for every app at once.
How caddy reverse proxy multiple ports routing works
Caddy acts as the single front door for incoming web traffic on a host machine. It listens on standard public ports for HTTP and HTTPS requests from outside users. Behind the scenes, your team runs several smaller web apps on different local ports. None of those internal ports need direct exposure to the public internet.
You can split incoming traffic across those local ports in two main ways. The first way uses distinct subdomains for each internal app. When a request arrives for a specific subdomain, Caddy sends it to the matching local port. Caddy also gets and renews TLS certificates for each subdomain on its own.
The second way uses URL path prefixes on a single domain name. Requests to one folder path go to your main web app port. Requests to an API path go to a separate backend service port. You can also map custom external ports to different internal ports when needed. Each rule tells the server where to send packets based on the incoming request header.
Managing backend health checks and load balancing
Running many ports behind one server works best when you track service health. Sometimes an app on a local port crashes or stops taking traffic. You can map one domain to several local ports at the same time. This lets you run two or more copies of an app on one host.
Caddy spreads incoming requests across those healthy local ports using basic load balancing rules. It checks each port on a set schedule to see if the app responds. If one local port fails a check, Caddy stops sending user traffic there. When the app comes back online, traffic flows to that port again. This keeps updates smooth when your team deploys new code to local services.
Reverse Proxy Security: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native port routing solves and what it leaves open
Native port routing solves the problem of exposing dozens of random ports through your firewall. It gives users clean domain names and handles TLS encryption in one place. Your network team only has to open standard web ports on the host machine. Internal services stay bound to the local loop interface where external scanners cannot reach them.
Still, network routing only decides where traffic goes and who can reach the front door. It does not check what individual commands or requests do once a user is inside. Engineers who log in to the host to edit routing rules often get broad system permissions. A single bad edit can send production traffic to a test port by mistake. Also, standard web logs only show HTTP paths rather than deep database queries or admin actions. Teams still need a clear way to govern what engineers do during live sessions.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Should I use subdomains or URL paths to route multiple ports?
Subdomains are usually easier to set up and maintain for separate web apps. Some apps break when you serve them under a subfolder path without extra rewrite rules.
Does Caddy handle HTTPS certificates for every routed port?
Yes, Caddy manages TLS certificates at the front door for all your public domain names. Traffic between Caddy and your local ports stays inside the private host network.
Can I listen on custom external ports instead of standard web ports?
Yes, you can bind site blocks to any open external port on your host machine. Just make sure your host firewall allows incoming traffic on those extra ports.