CSSTEP 01Point DNS at the right machine
In your domain’s DNS panel, add an A record for app pointing at the public IPv4 of your VPS. Add an AAAA record only if the server and proxy are reachable over IPv6. DNS values below are examples; replace both the domain and IP.
Type Name Value
A app 203.0.113.10STEP 02Understand DNS caching
Resolvers can keep an old answer until its TTL expires. Query the authoritative nameserver and a public resolver when debugging. Repeatedly changing DNS makes diagnosis harder. Check for a stale AAAA record if HTTPS works from one network but not another.
dig +short A app.example.com
dig +short AAAA app.example.comSTEP 03Let the proxy terminate HTTPS
For a host-installed Caddy, use this Caddyfile with an application bound to 127.0.0.1:3000. For the Docker Compose recipe, use app:3000 instead. Caddy can obtain and renew certificates when DNS and inbound challenge traffic are correct. Keep its data directory persistent.
app.example.com {
reverse_proxy 127.0.0.1:3000
}STEP 04Verify from outside
Check the certificate, HTTP-to-HTTPS redirect and a real application response. No insecure API or asset URLs should remain. If ACME issuance fails, inspect Caddy logs, DNS, port reachability, CAA restrictions and any CDN proxy settings before retrying.
curl -I http://app.example.com
curl -I https://app.example.comCOPY → YOUR AI
Take the next step to your AI.
A safe starting prompt for this guide. No secrets. Works with ChatGPT, Claude and other assistants.
Sources and technical documentation
Caddy automatic HTTPS ↗This recipe is a pattern for the stated prerequisites. Verify project compatibility and your actual server configuration before applying it to a live service.