[{"data":1,"prerenderedAt":1096},["ShallowReactive",2],{"post-zh-caddy-tls-http-proxy-with-acme":3},{"id":4,"title":5,"body":6,"cover":1087,"date":1088,"description":1089,"extension":1090,"meta":1091,"navigation":182,"path":1092,"seo":1093,"stem":1094,"__hash__":1095},"posts/posts/caddy-tls-http-proxy-with-acme.md","使用 Caddy + acme.sh 搭建带认证的 TLS 正向代理",{"type":7,"value":8,"toc":1070},"minimark",[9,14,23,26,29,42,45,56,140,143,147,311,324,328,338,438,448,452,455,472,478,577,580,622,626,632,750,753,783,787,790,798,802,805,808,845,849,852,891,895,991,994,1001,1004,1025,1028,1031,1066],[10,11,13],"h2",{"id":12},"为什么选择-caddy","为什么选择 Caddy",[15,16,17,18,22],"p",{},"常见的代理方案（Squid、Nginx）配置繁琐，TLS 支持往往需要额外折腾。Caddy 通过 ",[19,20,21],"code",{},"forwardproxy"," 插件原生支持 HTTPS 正向代理（CONNECT 隧道），配合 Basic Auth 认证，整套方案配置简洁、维护成本低。",[15,24,25],{},"选用 acme.sh 而非 Caddy 内置 ACME，是因为在某些场景下我们需要更灵活地控制证书签发流程。比如使用 DNS-01 验证、指定 CA（ZeroSSL / Let's Encrypt / Buypass）、或者在防火墙不开放 80/443 的机器上获取证书。",[10,27,28],{"id":28},"准备工作",[30,31,32,36,39],"ul",{},[33,34,35],"li",{},"一台有公网 IP 的服务器（本文以 Debian/Ubuntu 为例）",[33,37,38],{},"一个域名，且已将 A 记录解析到服务器 IP",[33,40,41],{},"域名 DNS 服务商支持 API 操作（用于 DNS-01 验证）",[10,43,44],{"id":44},"一键脚本",[15,46,47,48,55],{},"如果你不想手动操作，可以直接使用",[49,50,54],"a",{"href":51,"rel":52},"https://gist.github.com/madeye/9a578ad8c9b8166f999719aa7784aa6f",[53],"nofollow","自动化安装脚本","：",[57,58,63],"pre",{"className":59,"code":60,"language":61,"meta":62,"style":62},"language-bash shiki shiki-themes github-light github-dark","sudo DOMAIN=proxy.example.com \\\n     EMAIL=your@email.com \\\n     PROXY_USER=myuser \\\n     PROXY_PASS=mypassword \\\n     CF_Token=xxx \\\n     CF_Zone_ID=xxx \\\n     bash \u003C(curl -fsSL https://gist.githubusercontent.com/madeye/9a578ad8c9b8166f999719aa7784aa6f/raw/setup-caddy-proxy.sh)\n","bash","",[19,64,65,82,90,98,106,114,122],{"__ignoreMap":62},[66,67,70,74,78],"span",{"class":68,"line":69},"line",1,[66,71,73],{"class":72},"sScJk","sudo",[66,75,77],{"class":76},"sZZnC"," DOMAIN=proxy.example.com",[66,79,81],{"class":80},"sj4cs"," \\\n",[66,83,85,88],{"class":68,"line":84},2,[66,86,87],{"class":76},"     EMAIL=your@email.com",[66,89,81],{"class":80},[66,91,93,96],{"class":68,"line":92},3,[66,94,95],{"class":76},"     PROXY_USER=myuser",[66,97,81],{"class":80},[66,99,101,104],{"class":68,"line":100},4,[66,102,103],{"class":76},"     PROXY_PASS=mypassword",[66,105,81],{"class":80},[66,107,109,112],{"class":68,"line":108},5,[66,110,111],{"class":76},"     CF_Token=xxx",[66,113,81],{"class":80},[66,115,117,120],{"class":68,"line":116},6,[66,118,119],{"class":76},"     CF_Zone_ID=xxx",[66,121,81],{"class":80},[66,123,125,128,131,134,137],{"class":68,"line":124},7,[66,126,127],{"class":76},"     bash",[66,129,130],{"class":76}," \u003C(",[66,132,133],{"class":72},"curl",[66,135,136],{"class":80}," -fsSL",[66,138,139],{"class":76}," https://gist.githubusercontent.com/madeye/9a578ad8c9b8166f999719aa7784aa6f/raw/setup-caddy-proxy.sh)\n",[15,141,142],{},"以下是手动步骤的详细说明。",[10,144,146],{"id":145},"_1-安装-acmesh-并签发证书","1. 安装 acme.sh 并签发证书",[57,148,150],{"className":59,"code":149,"language":61,"meta":62,"style":62},"# 安装 acme.sh\ncurl https://get.acme.sh | sh -s email=your@email.com\n\n# 以 Cloudflare DNS 为例，设置 API Token\nexport CF_Token=\"your_cloudflare_api_token\"\nexport CF_Zone_ID=\"your_zone_id\"\n\n# 签发证书（使用 DNS-01 验证）\n~/.acme.sh/acme.sh --issue --dns dns_cf -d proxy.example.com\n\n# 安装证书到指定目录\nmkdir -p /etc/caddy/certs\n~/.acme.sh/acme.sh --install-cert -d proxy.example.com \\\n  --cert-file /etc/caddy/certs/cert.pem \\\n  --key-file /etc/caddy/certs/key.pem \\\n  --fullchain-file /etc/caddy/certs/fullchain.pem \\\n  --reloadcmd \"systemctl restart caddy\"\n",[19,151,152,158,178,184,189,204,216,220,226,235,240,246,258,269,280,291,302],{"__ignoreMap":62},[66,153,154],{"class":68,"line":69},[66,155,157],{"class":156},"sJ8bj","# 安装 acme.sh\n",[66,159,160,162,165,169,172,175],{"class":68,"line":84},[66,161,133],{"class":72},[66,163,164],{"class":76}," https://get.acme.sh",[66,166,168],{"class":167},"szBVR"," |",[66,170,171],{"class":72}," sh",[66,173,174],{"class":80}," -s",[66,176,177],{"class":76}," email=your@email.com\n",[66,179,180],{"class":68,"line":92},[66,181,183],{"emptyLinePlaceholder":182},true,"\n",[66,185,186],{"class":68,"line":100},[66,187,188],{"class":156},"# 以 Cloudflare DNS 为例，设置 API Token\n",[66,190,191,194,198,201],{"class":68,"line":108},[66,192,193],{"class":167},"export",[66,195,197],{"class":196},"sVt8B"," CF_Token",[66,199,200],{"class":167},"=",[66,202,203],{"class":76},"\"your_cloudflare_api_token\"\n",[66,205,206,208,211,213],{"class":68,"line":116},[66,207,193],{"class":167},[66,209,210],{"class":196}," CF_Zone_ID",[66,212,200],{"class":167},[66,214,215],{"class":76},"\"your_zone_id\"\n",[66,217,218],{"class":68,"line":124},[66,219,183],{"emptyLinePlaceholder":182},[66,221,223],{"class":68,"line":222},8,[66,224,225],{"class":156},"# 签发证书（使用 DNS-01 验证）\n",[66,227,229,232],{"class":68,"line":228},9,[66,230,231],{"class":167},"~",[66,233,234],{"class":196},"/.acme.sh/acme.sh --issue --dns dns_cf -d proxy.example.com\n",[66,236,238],{"class":68,"line":237},10,[66,239,183],{"emptyLinePlaceholder":182},[66,241,243],{"class":68,"line":242},11,[66,244,245],{"class":156},"# 安装证书到指定目录\n",[66,247,249,252,255],{"class":68,"line":248},12,[66,250,251],{"class":72},"mkdir",[66,253,254],{"class":80}," -p",[66,256,257],{"class":76}," /etc/caddy/certs\n",[66,259,261,263,266],{"class":68,"line":260},13,[66,262,231],{"class":167},[66,264,265],{"class":196},"/.acme.sh/acme.sh --install-cert -d proxy.example.com ",[66,267,268],{"class":80},"\\\n",[66,270,272,275,278],{"class":68,"line":271},14,[66,273,274],{"class":72},"  --cert-file",[66,276,277],{"class":76}," /etc/caddy/certs/cert.pem",[66,279,81],{"class":80},[66,281,283,286,289],{"class":68,"line":282},15,[66,284,285],{"class":80},"  --key-file",[66,287,288],{"class":76}," /etc/caddy/certs/key.pem",[66,290,81],{"class":80},[66,292,294,297,300],{"class":68,"line":293},16,[66,295,296],{"class":80},"  --fullchain-file",[66,298,299],{"class":76}," /etc/caddy/certs/fullchain.pem",[66,301,81],{"class":80},[66,303,305,308],{"class":68,"line":304},17,[66,306,307],{"class":80},"  --reloadcmd",[66,309,310],{"class":76}," \"systemctl restart caddy\"\n",[15,312,313,314,319,320,323],{},"如果你使用其他 DNS 服务商，acme.sh 支持数十种 DNS API，参考其 ",[49,315,318],{"href":316,"rel":317},"https://github.com/acmesh-official/acme.sh/wiki/dnsapi",[53],"wiki"," 替换 ",[19,321,322],{},"dns_cf"," 及相关环境变量即可。",[10,325,327],{"id":326},"_2-编译带-forwardproxy-插件的-caddy","2. 编译带 forwardproxy 插件的 Caddy",[15,329,330,331,333,334,337],{},"官方发布的 Caddy 二进制不包含 ",[19,332,21],{}," 插件，需要使用 ",[19,335,336],{},"xcaddy"," 自行编译。",[57,339,341],{"className":59,"code":340,"language":61,"meta":62,"style":62},"# 安装 Go（如果还没有）\nsudo apt install -y golang\n\n# 安装 xcaddy\ngo install github.com/caddyserver/xcaddy/cmd/xcaddy@latest\n\n# 编译带 forwardproxy 的 Caddy\n~/go/bin/xcaddy build --with github.com/caddyserver/forwardproxy=github.com/klzgrad/forwardproxy@naive\n\n# 移动到系统路径\nsudo mv caddy /usr/bin/caddy\nsudo chmod +x /usr/bin/caddy\n",[19,342,343,348,364,368,373,383,387,392,404,408,413,426],{"__ignoreMap":62},[66,344,345],{"class":68,"line":69},[66,346,347],{"class":156},"# 安装 Go（如果还没有）\n",[66,349,350,352,355,358,361],{"class":68,"line":84},[66,351,73],{"class":72},[66,353,354],{"class":76}," apt",[66,356,357],{"class":76}," install",[66,359,360],{"class":80}," -y",[66,362,363],{"class":76}," golang\n",[66,365,366],{"class":68,"line":92},[66,367,183],{"emptyLinePlaceholder":182},[66,369,370],{"class":68,"line":100},[66,371,372],{"class":156},"# 安装 xcaddy\n",[66,374,375,378,380],{"class":68,"line":108},[66,376,377],{"class":72},"go",[66,379,357],{"class":76},[66,381,382],{"class":76}," github.com/caddyserver/xcaddy/cmd/xcaddy@latest\n",[66,384,385],{"class":68,"line":116},[66,386,183],{"emptyLinePlaceholder":182},[66,388,389],{"class":68,"line":124},[66,390,391],{"class":156},"# 编译带 forwardproxy 的 Caddy\n",[66,393,394,396,399,401],{"class":68,"line":222},[66,395,231],{"class":167},[66,397,398],{"class":196},"/go/bin/xcaddy build --with github.com/caddyserver/forwardproxy",[66,400,200],{"class":167},[66,402,403],{"class":76},"github.com/klzgrad/forwardproxy@naive\n",[66,405,406],{"class":68,"line":228},[66,407,183],{"emptyLinePlaceholder":182},[66,409,410],{"class":68,"line":237},[66,411,412],{"class":156},"# 移动到系统路径\n",[66,414,415,417,420,423],{"class":68,"line":242},[66,416,73],{"class":72},[66,418,419],{"class":76}," mv",[66,421,422],{"class":76}," caddy",[66,424,425],{"class":76}," /usr/bin/caddy\n",[66,427,428,430,433,436],{"class":68,"line":248},[66,429,73],{"class":72},[66,431,432],{"class":76}," chmod",[66,434,435],{"class":76}," +x",[66,437,425],{"class":76},[439,440,441],"blockquote",{},[15,442,443,444,447],{},"这里使用的是 klzgrad 维护的 forwardproxy 分支，它支持 naive 协议的流量混淆，抗探测能力更强。如果不需要此特性，可以直接使用官方 ",[19,445,446],{},"github.com/caddyserver/forwardproxy","。",[10,449,451],{"id":450},"_3-配置-caddy","3. 配置 Caddy",[15,453,454],{},"创建 Caddyfile：",[57,456,458],{"className":59,"code":457,"language":61,"meta":62,"style":62},"sudo mkdir -p /etc/caddy\n",[19,459,460],{"__ignoreMap":62},[66,461,462,464,467,469],{"class":68,"line":69},[66,463,73],{"class":72},[66,465,466],{"class":76}," mkdir",[66,468,254],{"class":80},[66,470,471],{"class":76}," /etc/caddy\n",[15,473,474,475,55],{},"编辑 ",[19,476,477],{},"/etc/caddy/Caddyfile",[57,479,483],{"className":480,"code":481,"language":482,"meta":62,"style":62},"language-caddyfile shiki shiki-themes github-light github-dark","{\n  order forward_proxy before file_server\n  admin off\n}\n\n:443, proxy.example.com {\n  tls /etc/caddy/certs/fullchain.pem /etc/caddy/certs/key.pem\n\n  forward_proxy {\n    basic_auth user password123  # 替换为你自己的用户名和密码\n    hide_ip\n    hide_via\n    probe_resistance secret.localhost  # 防主动探测\n  }\n\n  file_server {\n    root * /var/www/html  # 伪装成普通网站\n  }\n}\n","caddyfile",[19,484,485,490,495,500,505,509,514,519,523,528,533,538,543,548,553,557,562,567,572],{"__ignoreMap":62},[66,486,487],{"class":68,"line":69},[66,488,489],{},"{\n",[66,491,492],{"class":68,"line":84},[66,493,494],{},"  order forward_proxy before file_server\n",[66,496,497],{"class":68,"line":92},[66,498,499],{},"  admin off\n",[66,501,502],{"class":68,"line":100},[66,503,504],{},"}\n",[66,506,507],{"class":68,"line":108},[66,508,183],{"emptyLinePlaceholder":182},[66,510,511],{"class":68,"line":116},[66,512,513],{},":443, proxy.example.com {\n",[66,515,516],{"class":68,"line":124},[66,517,518],{},"  tls /etc/caddy/certs/fullchain.pem /etc/caddy/certs/key.pem\n",[66,520,521],{"class":68,"line":222},[66,522,183],{"emptyLinePlaceholder":182},[66,524,525],{"class":68,"line":228},[66,526,527],{},"  forward_proxy {\n",[66,529,530],{"class":68,"line":237},[66,531,532],{},"    basic_auth user password123  # 替换为你自己的用户名和密码\n",[66,534,535],{"class":68,"line":242},[66,536,537],{},"    hide_ip\n",[66,539,540],{"class":68,"line":248},[66,541,542],{},"    hide_via\n",[66,544,545],{"class":68,"line":260},[66,546,547],{},"    probe_resistance secret.localhost  # 防主动探测\n",[66,549,550],{"class":68,"line":271},[66,551,552],{},"  }\n",[66,554,555],{"class":68,"line":282},[66,556,183],{"emptyLinePlaceholder":182},[66,558,559],{"class":68,"line":293},[66,560,561],{},"  file_server {\n",[66,563,564],{"class":68,"line":304},[66,565,566],{},"    root * /var/www/html  # 伪装成普通网站\n",[66,568,570],{"class":68,"line":569},18,[66,571,552],{},[66,573,575],{"class":68,"line":574},19,[66,576,504],{},[15,578,579],{},"几个关键配置说明：",[30,581,582,591,603,611],{},[33,583,584,590],{},[585,586,587],"strong",{},[19,588,589],{},"basic_auth","：设置代理认证的用户名和密码，阻止未授权访问",[33,592,593,602],{},[585,594,595,598,599],{},[19,596,597],{},"hide_ip"," / ",[19,600,601],{},"hide_via","：隐藏客户端真实 IP 和代理标识",[33,604,605,610],{},[585,606,607],{},[19,608,609],{},"probe_resistance","：当收到非代理请求时，伪装成普通网站返回内容，防止主动探测",[33,612,613,618,619,621],{},[585,614,615],{},[19,616,617],{},"file_server","：配合 ",[19,620,609],{}," 使用，放一个普通网页作为伪装",[10,623,625],{"id":624},"_4-配置-systemd-服务","4. 配置 systemd 服务",[15,627,628,629,55],{},"创建 ",[19,630,631],{},"/etc/systemd/system/caddy.service",[57,633,637],{"className":634,"code":635,"language":636,"meta":62,"style":62},"language-ini shiki shiki-themes github-light github-dark","[Unit]\nDescription=Caddy\nAfter=network.target network-online.target\nRequires=network-online.target\n\n[Service]\nType=notify\nUser=root\nExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile\nExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile\nTimeoutStopSec=5s\nLimitNOFILE=1048576\nLimitNPROC=512\n\n[Install]\nWantedBy=multi-user.target\n","ini",[19,638,639,644,652,660,668,672,677,685,693,701,709,717,725,733,737,742],{"__ignoreMap":62},[66,640,641],{"class":68,"line":69},[66,642,643],{"class":72},"[Unit]\n",[66,645,646,649],{"class":68,"line":84},[66,647,648],{"class":167},"Description",[66,650,651],{"class":196},"=Caddy\n",[66,653,654,657],{"class":68,"line":92},[66,655,656],{"class":167},"After",[66,658,659],{"class":196},"=network.target network-online.target\n",[66,661,662,665],{"class":68,"line":100},[66,663,664],{"class":167},"Requires",[66,666,667],{"class":196},"=network-online.target\n",[66,669,670],{"class":68,"line":108},[66,671,183],{"emptyLinePlaceholder":182},[66,673,674],{"class":68,"line":116},[66,675,676],{"class":72},"[Service]\n",[66,678,679,682],{"class":68,"line":124},[66,680,681],{"class":167},"Type",[66,683,684],{"class":196},"=notify\n",[66,686,687,690],{"class":68,"line":222},[66,688,689],{"class":167},"User",[66,691,692],{"class":196},"=root\n",[66,694,695,698],{"class":68,"line":228},[66,696,697],{"class":167},"ExecStart",[66,699,700],{"class":196},"=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile\n",[66,702,703,706],{"class":68,"line":237},[66,704,705],{"class":167},"ExecReload",[66,707,708],{"class":196},"=/usr/bin/caddy reload --config /etc/caddy/Caddyfile\n",[66,710,711,714],{"class":68,"line":242},[66,712,713],{"class":167},"TimeoutStopSec",[66,715,716],{"class":196},"=5s\n",[66,718,719,722],{"class":68,"line":248},[66,720,721],{"class":167},"LimitNOFILE",[66,723,724],{"class":196},"=1048576\n",[66,726,727,730],{"class":68,"line":260},[66,728,729],{"class":167},"LimitNPROC",[66,731,732],{"class":196},"=512\n",[66,734,735],{"class":68,"line":271},[66,736,183],{"emptyLinePlaceholder":182},[66,738,739],{"class":68,"line":282},[66,740,741],{"class":72},"[Install]\n",[66,743,744,747],{"class":68,"line":293},[66,745,746],{"class":167},"WantedBy",[66,748,749],{"class":196},"=multi-user.target\n",[15,751,752],{},"启动服务：",[57,754,756],{"className":59,"code":755,"language":61,"meta":62,"style":62},"sudo systemctl daemon-reload\nsudo systemctl enable --now caddy\n",[19,757,758,768],{"__ignoreMap":62},[66,759,760,762,765],{"class":68,"line":69},[66,761,73],{"class":72},[66,763,764],{"class":76}," systemctl",[66,766,767],{"class":76}," daemon-reload\n",[66,769,770,772,774,777,780],{"class":68,"line":84},[66,771,73],{"class":72},[66,773,764],{"class":76},[66,775,776],{"class":76}," enable",[66,778,779],{"class":80}," --now",[66,781,782],{"class":76}," caddy\n",[10,784,786],{"id":785},"_5-客户端使用","5. 客户端使用",[15,788,789],{},"配置完成后，在客户端使用 HTTPS 代理连接：",[57,791,796],{"className":792,"code":794,"language":795},[793],"language-text","https://user:password123@proxy.example.com:443\n","text",[19,797,794],{"__ignoreMap":62},[799,800,801],"h3",{"id":801},"浏览器",[15,803,804],{},"大多数浏览器支持通过系统代理设置来配置 HTTPS 代理。也可以使用 SwitchyOmega 等扩展，协议选择 HTTPS，填入域名、端口、用户名和密码即可。",[799,806,807],{"id":807},"命令行",[57,809,811],{"className":59,"code":810,"language":61,"meta":62,"style":62},"export https_proxy=https://user:password123@proxy.example.com:443\nexport http_proxy=https://user:password123@proxy.example.com:443\ncurl -I https://www.google.com\n",[19,812,813,824,835],{"__ignoreMap":62},[66,814,815,817,820,822],{"class":68,"line":69},[66,816,193],{"class":167},[66,818,819],{"class":196}," https_proxy",[66,821,200],{"class":167},[66,823,794],{"class":196},[66,825,826,828,831,833],{"class":68,"line":84},[66,827,193],{"class":167},[66,829,830],{"class":196}," http_proxy",[66,832,200],{"class":167},[66,834,794],{"class":196},[66,836,837,839,842],{"class":68,"line":92},[66,838,133],{"class":72},[66,840,841],{"class":80}," -I",[66,843,844],{"class":76}," https://www.google.com\n",[799,846,848],{"id":847},"naiveproxy-客户端","NaiveProxy 客户端",[15,850,851],{},"如果服务端编译时使用了 klzgrad 的 forwardproxy 分支，推荐使用 NaiveProxy 客户端以获得更好的流量混淆效果：",[57,853,857],{"className":854,"code":855,"language":856,"meta":62,"style":62},"language-json shiki shiki-themes github-light github-dark","{\n  \"listen\": \"socks://127.0.0.1:1080\",\n  \"proxy\": \"https://user:password123@proxy.example.com\"\n}\n","json",[19,858,859,863,877,887],{"__ignoreMap":62},[66,860,861],{"class":68,"line":69},[66,862,489],{"class":196},[66,864,865,868,871,874],{"class":68,"line":84},[66,866,867],{"class":80},"  \"listen\"",[66,869,870],{"class":196},": ",[66,872,873],{"class":76},"\"socks://127.0.0.1:1080\"",[66,875,876],{"class":196},",\n",[66,878,879,882,884],{"class":68,"line":92},[66,880,881],{"class":80},"  \"proxy\"",[66,883,870],{"class":196},[66,885,886],{"class":76},"\"https://user:password123@proxy.example.com\"\n",[66,888,889],{"class":68,"line":100},[66,890,504],{"class":196},[10,892,894],{"id":893},"_6-验证与排查","6. 验证与排查",[57,896,898],{"className":59,"code":897,"language":61,"meta":62,"style":62},"# 查看 Caddy 运行状态\nsudo systemctl status caddy\n\n# 查看实时日志\nsudo journalctl -u caddy -f\n\n# 测试证书是否正常\nopenssl s_client -connect proxy.example.com:443 -servername proxy.example.com\n\n# 测试代理是否工作\ncurl -x https://user:password123@proxy.example.com:443 https://httpbin.org/ip\n",[19,899,900,905,916,920,925,940,944,949,969,973,978],{"__ignoreMap":62},[66,901,902],{"class":68,"line":69},[66,903,904],{"class":156},"# 查看 Caddy 运行状态\n",[66,906,907,909,911,914],{"class":68,"line":84},[66,908,73],{"class":72},[66,910,764],{"class":76},[66,912,913],{"class":76}," status",[66,915,782],{"class":76},[66,917,918],{"class":68,"line":92},[66,919,183],{"emptyLinePlaceholder":182},[66,921,922],{"class":68,"line":100},[66,923,924],{"class":156},"# 查看实时日志\n",[66,926,927,929,932,935,937],{"class":68,"line":108},[66,928,73],{"class":72},[66,930,931],{"class":76}," journalctl",[66,933,934],{"class":80}," -u",[66,936,422],{"class":76},[66,938,939],{"class":80}," -f\n",[66,941,942],{"class":68,"line":116},[66,943,183],{"emptyLinePlaceholder":182},[66,945,946],{"class":68,"line":124},[66,947,948],{"class":156},"# 测试证书是否正常\n",[66,950,951,954,957,960,963,966],{"class":68,"line":222},[66,952,953],{"class":72},"openssl",[66,955,956],{"class":76}," s_client",[66,958,959],{"class":80}," -connect",[66,961,962],{"class":76}," proxy.example.com:443",[66,964,965],{"class":80}," -servername",[66,967,968],{"class":76}," proxy.example.com\n",[66,970,971],{"class":68,"line":228},[66,972,183],{"emptyLinePlaceholder":182},[66,974,975],{"class":68,"line":237},[66,976,977],{"class":156},"# 测试代理是否工作\n",[66,979,980,982,985,988],{"class":68,"line":242},[66,981,133],{"class":72},[66,983,984],{"class":80}," -x",[66,986,987],{"class":76}," https://user:password123@proxy.example.com:443",[66,989,990],{"class":76}," https://httpbin.org/ip\n",[10,992,993],{"id":993},"证书自动续期",[15,995,996,997,1000],{},"acme.sh 安装时会自动创建 cron job，证书到期前会自动续期并通过 ",[19,998,999],{},"--reloadcmd"," 重启 Caddy 加载新证书，无需手动干预。",[15,1002,1003],{},"可以手动检查 cron 是否生效：",[57,1005,1007],{"className":59,"code":1006,"language":61,"meta":62,"style":62},"crontab -l | grep acme\n",[19,1008,1009],{"__ignoreMap":62},[66,1010,1011,1014,1017,1019,1022],{"class":68,"line":69},[66,1012,1013],{"class":72},"crontab",[66,1015,1016],{"class":80}," -l",[66,1018,168],{"class":167},[66,1020,1021],{"class":72}," grep",[66,1023,1024],{"class":76}," acme\n",[10,1026,1027],{"id":1027},"小结",[15,1029,1030],{},"整套方案的优势：",[1032,1033,1034,1040,1046,1052,1060],"ol",{},[33,1035,1036,1039],{},[585,1037,1038],{},"配置简单","：Caddyfile 十几行搞定，远比 Nginx + Squid 方案省心",[33,1041,1042,1045],{},[585,1043,1044],{},"TLS 加密","：所有代理流量都走 HTTPS，中间人无法窥探",[33,1047,1048,1051],{},[585,1049,1050],{},"认证机制","：Basic Auth 防止代理被滥用",[33,1053,1054,55,1057,1059],{},[585,1055,1056],{},"抗探测",[19,1058,609],{}," + 伪装网站，非授权访问只能看到普通网页",[33,1061,1062,1065],{},[585,1063,1064],{},"自动续证","：acme.sh 的 cron job 保证证书始终有效",[1067,1068,1069],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":62,"searchDepth":84,"depth":84,"links":1071},[1072,1073,1074,1075,1076,1077,1078,1079,1084,1085,1086],{"id":12,"depth":84,"text":13},{"id":28,"depth":84,"text":28},{"id":44,"depth":84,"text":44},{"id":145,"depth":84,"text":146},{"id":326,"depth":84,"text":327},{"id":450,"depth":84,"text":451},{"id":624,"depth":84,"text":625},{"id":785,"depth":84,"text":786,"children":1080},[1081,1082,1083],{"id":801,"depth":92,"text":801},{"id":807,"depth":92,"text":807},{"id":847,"depth":92,"text":848},{"id":893,"depth":84,"text":894},{"id":993,"depth":84,"text":993},{"id":1027,"depth":84,"text":1027},"/assets/covers/caddy-tls-http-proxy-with-acme.jpg","2026-02-16T00:00:00.000Z","一步步教你用 Caddy 的 forwardproxy 插件和 acme.sh 签发的证书搭建一个安全、高效、带 Basic Auth 认证的 HTTPS 正向代理。","md",{},"/posts/caddy-tls-http-proxy-with-acme",{"title":5,"description":1089},"posts/caddy-tls-http-proxy-with-acme","ue5mB7eiMT-m9CKo0uOLR5XcWwaAlriRFKvdyH1rtXI",1788681981634]