海运的博客

由于nginx监听了443端口，caddy监听其它端口，通过iptables dnat到caddy端口也能使用，但是caddy head会返回alt-svc包含监听的端口，通过使用docker桥接方式启动caddy可解决。
docker build安装caddy镜像：

FROM debian:bullseye
RUN apt update -y
RUN apt install curl net-tools vim iputils-ping -y
RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | tee /etc/apt/trusted.gpg.d/caddy-stable.asc
RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list
RUN apt update -y
RUN apt install caddy

docker build --tag debian-caddy:v1 - < Dockerfile

启动：

docker run -d --name caddy-http3 -p 443:443/udp --dns=172.17.0.1 --restart=always -v /etc/caddy:/etc/caddy -v /data/www.haiyun.me:/data/www.haiyun.me -v /acme/haiyun.me:/acme/haiyun.me debian-caddy:v1 caddy run -config /etc/caddy/Caddyfile

caddy配置文件：

{
  admin off
  auto_https off
  servers  {
    protocol {
      experimental_http3
    }
  }
}
https://www.haiyun.me:443 {
  tls /acme/haiyun.me/haiyun.me.cer /acme/haiyun.me/haiyun.me.key
  reverse_proxy https://www.haiyun.me {
    header_up X-Forwarded-For {remote_host}
    header_down -server
  }
}

nginx添加head:

add_header Alt-Svc "h3=\":443\"; ma=86400,h3-29=\":443\"; ma=86400";  

可通过编译curl支持http3测试。