pico

fix(caddy): add postgres storage backend for distributed ACME challenges draft rss
created pr with 133.1 on 2026-08-10T21:03:41Z · by c8ef7d19
cmds
checkout latest patchset: 
ssh pr.pico.sh print 133 | git am -3
checkout any patchset in a patch request: 
ssh pr.pico.sh print 133.[rev] | git am -3
add changes to patch request: 
git format-patch main --stdout | ssh pr.pico.sh pr add 133
set PR to open (enables RSS notifications): 
ssh pr.pico.sh pr open 133
set PR to draft (stops RSS notifications): 
ssh pr.pico.sh pr draft 133

Patchset 133.1 on 2026-08-10T21:03:41Z · commit 06944c5

→ fix(caddy): add postgres storage backend for distributed ACME challenges
Eric Bower 2026-08-10T20:58:05Z
 
This updates the Caddy Dockerfile to compile with the
`github.com/yroc92/postgres-storage` module and configures `Caddyfile.pgs` to
use it via the existing `DATABASE_URL` environment variable.

Previously, Caddy instances on independent nodes (e.g., US and EU) used their
own local filesystem for ACME storage. This caused on-demand TLS to hang or time
out for custom domains when Let's Encrypt's ACME verification challenge was
randomly routed by DNS to a node that didn't initiate the request.

By using a central Postgres database for storage, all Caddy nodes now share
certificate state and can seamlessly answer ACME challenges initiated by any
other node in the cluster.
Semantic diff summary
0 added, 0 modified, 0 signature changed, 0 removed across 0 analyzed files (2 files skipped: unsupported file type)
+3 -0 caddy/Caddyfile.pgs # 
@@ -1,4 +1,7 @@
 {
+	storage postgres {
+		connection_string {$DATABASE_URL}
+	}
 	on_demand_tls {
 		ask http://web:3000/check
 	}
+2 -1 caddy/Dockerfile # 
@@ -8,7 +8,8 @@ ARG TARGETARCH
 ENV GOOS=${TARGETOS} GOARCH=${TARGETARCH}
 
 RUN xcaddy build \
-    --with github.com/caddy-dns/cloudflare
+    --with github.com/caddy-dns/cloudflare \
+    --with github.com/yroc92/postgres-storage
 
 FROM caddy:alpine
Back to top