There are multiple reasons but the most important one is: You didn’t enable it.

Caddy fully supports https to the reverse proxy targets, though you’d have to get those targets trusted certificates otherwise caddy wouldn’t connect.

The default protocol for backends is http, most of the time this isn’t a problem because:

• The web server runs on the local machine
• The web server runs in containers/vms on the local machine
  • or is running in a VM and has a direct virtual connection with the caddy vm
• The connection to the Backend is encrypted with a VPN
• Caddy and the web server are directly connected or connected through an otherwise isolated network

Because https requires certificates that are somewhat difficult to set up for internal servers (and were even harder to get before) the default mostly is just to encrypt on another layer of the stack. Afaik at least.

Just use archive.pdf

Personally I like SpywareOS

 { "OK": "Ah ah ah, you didn't say the magic word." }

Something like yggdrasil would work or a daemon that publishes mdns and connects to known peers.

If root is the only way then most affected apps will halt development due to missing users.

Sure, then two months later pm install gets the same restrictions.

Their lifetime depends on the usage I guess.

I use NixOS and NixOS BTW

I’ve searched for something like this in the past and didn’t find anything.
I’ve though of hacking together a few scripts or 8n8 to interface with freshrss to do this but it’s far down my list™

Disable the firewall if you can to check if that’s the issue, then do a tcpdump using root with the port. Do tcpdump inside the container too and compare what you see to the docker environment.

Is caddy-caddy really the correct image?

Try with this command, it’s the minimal setup that works by default (on my machine): podman run -p 0.0.0.0:5050:80 docker.io/library/caddy:latest

Use ss -tlpn or podman ps to show what ports podman is listening on, my guess is it is only listening on localhost.

I agree with in-app backup solution.

There are three types of apps on my phone:

• Apps that don’t have any important local data (calculator, calendar (synced with web(cal/DAV/…), etc) for which a basic apk backup is enough and doesn’t cause any data corruption.
• Apps that have changing important data and implement backups (WhatsApp, signal)
• Apps that have important data, but that data is static (voyager, Mixplorer) in which I export the data once using in-app settings

Photos are backed up using immich, internal storage is backed up using restic in termux, started automatically from tasker.

This whole setup doesn’t require root btw, with root you can also backup system settings. The only thing I’d want to improve is not having to login to all the apps again but I had to do that even with root backups in the past so I’ll have to wait until google finally stops trying to force everyone into their shitty cloud backups. (Tough chance that…)

I have used Neo Backup before, worked well enough.

Never heard of DataBackup before but their github page doesn’t convince me:

Features

• 🌳 Root needed, support Magisk, KernelSU, APatch

• 🌀 Multi-user Support

• ☁️ Cloud

• 😎 100% Data Integrity

• ⚡ Fast

• ☀️ Easy

• 🌹 …

1 isn’t a feature 3 doesn’t tell me much of anything 3 is a lie and not even logically sound (not even google has 100% data integrity guarantee but this project has?) 4 is barely a feature and missing context or benchmarks 5 easy isn’t a feature 6 what?

Their website and app store pages also have very little content. Meanwhile Neo Backup has tons of docs, infos and I’ve seen more people use it.

Tldr: Use NeoBackup

is kludging NAT for IPv6 not a better solution versus ULA addresses?

There are very few hosts that allow only ipv6 (though there are many who only do ipv4). Ipv6 would improve internet stability and long-term communication when you’re not using a nat but that isn’t what you’re trying to build. Seeing as you’re not getting any advantage anyway I recommend ULA because it won’t get in the way of possible future migration to GUA ipv6 (globally unicast address) and still run over the ipv6 network while also avoiding Nat.

Or is the clear answer just use IPv6 as intended and let the devices handle their privacy with IPv6 privacy extensions?

It’s my clear answer at least.

If you don’t want that you can use ULA addresses for now and later add GUA ipv6 addresses. ULAs are meant to be used when you only have a dynamic ipv6 prefix so that internal devices can have ipv6 internet (GUA) while also having a static ipv6 address(ULA).

Use ULA addresses for hosts inside your LAN, they are static, cannot be used to reach outside your LAN and use IPv6. Then give your server/VPN endpoint a real ipv6, that’s your VPN endpoint. This doesn’t require any nat and can be easily changed to GUA when you want to.

CGnat is a “solution” for running out of ipv4 addresses, it has the same problems as any other nat but the problems are even more noticeable because the out-facing ipv4 address changes more often than the typical home nat configuration and tricks like FTP- and other helpers don’t work as well.

Ipv6 would not only avoid the issues of cgnat, it would avoid cgnat entirely because you don’t need to Nat when you have enough ips.

Most (all?) advantage of ipv6 when compared to ipv4 don’t work behind Nat. Thus there’s no reason to use it.

Either Nat with ipv4 or don’t Nat with ipv6.

Why did you want to use ipv6 when you don’t want what it represents? (End to end communication/IPs)

Either use ipv6 privacy extension (enabled by default, so this can just be called ipv6) or don’t enable ipv6.

That way you have working ipv6 or wait until you come to your senses. Using nat6 ipv6 isn’t worth it.

Connect a lan cable and:

ip a (shows network interfaces and ips

ip a a 192.168.<subnet>.<unused ip>/24 dev <interface> (get the subnet from your router or phone WiFi settings, interface is the interface starting with "en" from the first command, for unused ip just try your phone IP +1)

ip r a default via <router IP> (router IP can be seen in your phones WiFi settings under gateway)

Also checkout /etc/resolv.conf, replace its content with “nameserver 8.8.8.8”

I just follow the software release pages with RSS.