I’ve installed caddy directly on my unbuntu server, but I admin my Jellyfin (and eventually Nextcloud) with Docker via CasaOS interface… is this a problem? Do I need to run Caddy in docker too?

The difference between having caddy or any other reverse proxy in docker alongside other apps/services, is that instead of having to expose ports for every container to the host, and then linking every service/app as, localhost:<host-port> to caddy, you can have them on the same docker network and use <container-name>:<container-port> and only expose 80 443 to the host, meaning that the only way to access app/services is through caddy, that way if you disable port 80 after configuring SSL certificates, you can only access services with HTTPS.

You need to point your sub-domain in the Caddyfile to your designated local port. So just add an entry like this to your Caddyfile

sub.yourdomain.com {
  reverse_proxy XXX.XXX.XXX.XXX:PORT {
   header_up X-Real-IP {remote_host}
  }
  encode zstd gzip
}```

Replace XXX with your public IP and PORT with the local port in your docker container / compose.

Something that might help with using Tailscale and reverse proxying: you don’t have to use the IPs given to you through the tailnet if you don’t want to. Something tailnet nodes can do is serve the local subnet theyre connected to, even if you’re running the self hosted version Headscale, which is what I do. This is how I am able to have my phone and one other pc connected through Headscale/Tailscale, but still access everything on my local network.

Im assuming your Jellyfin is on your local network, and you want to connect to it through Tailscale, but still use HTTPS? If that’s the case, you don’t need to do any kind of port forwarding on your router, as everything is funneled through Tailscale anyway.

If you visit http://<caddy address> what do you see?

What does your caddyfile look like? I have a sneaking suspicion that you left the caddyfile as it comes installed, which indeed uses port 80 to deliver the Caddy success test. If you point your browser to the ip of your server, do you see the 'It Worked!" page that Caddy serves up?

sudo nano /etc/caddy/Caddyfile

Don’t sweat the complications. I know it’s frustrating. Full disclosure, it took me a while to ‘get’ Caddy. Once I did tho, it really is easy peasy. I actually found Cloudflare Tunnels/ZeroTrust easier to set up. I realize some have ‘concerns’ about Cloudflare, which is understandable.