Why Caddy Gives 502 When the Backend Works Fine by IP
A 502 usually means the browser-to-Caddy leg worked and the Caddy-to-upstream leg did not.
reverse proxy
Why an App Works on a Subdomain but Breaks Under /app
Stripping a prefix is easy; making the application believe it lives under that prefix is harder.
Caddy Says My Upstream Is Unhealthy, but the App Is Fine
A synthetic health request measures the service only if it looks like a request the service considers valid.
How I Proxy from One Caddy to Another Without tls_insecure_skip_verify
Internal HTTPS between proxies is useful only when the caller can verify the upstream identity.
Two-Factor Policy Belongs at the Shared Access Boundary
Putting MFA in front of each application separately creates duplicated policy; Authelia gives the protected subdomains one identity boundary.