Trestle
Reverse proxy

HTTPS with Caddy

Keep Trestle on loopback and let Caddy own public TLS. Trust only the loopback address that actually connects to Trestle.

trestle.example.com {
  reverse_proxy 127.0.0.1:7333
}
TRESTLE_HOST=127.0.0.1 TRESTLE_PORT=7333
TRESTLE_TRUSTED_PROXIES=127.0.0.1/32

Or record the same loopback listener in the unit with sudo trestle service install --host 127.0.0.1 --port 7333. The legacy TRESTLE_LISTEN=127.0.0.1:7333 form is also supported.

Required behavior

  • Caddy must replace, not append untrusted, X-Forwarded-For and X-Forwarded-Proto values.
  • Do not trust broad private ranges unless every address in that range is an administered proxy.
  • Leave buffering disabled for /api/v1/realtime so SSE events stream promptly.
  • Set request limits large enough for configured uploads while retaining Trestle's own endpoint limits.
  • Preserve Host so strict origin and CSRF checks match the browser origin.
  • Webhook callbacks and Lambda invocation are outbound and require working DNS and HTTPS egress.

Smoke test

curl -fsS https://trestle.example.com/system/health
curl -fsS https://trestle.example.com/system/version