Securing ShinyProxy with Caddy Server
Tags: shinyproxy, shiny, docker, rstats
Published: 2021-08-30 14:13:44

*By: [Peter Solymos](https://hosting.analythium.io/author/peter/)*

**Use Caddy server to obtain TLS certificates for your custom domain and to serve Shiny apps securely with ShinyProxy.**

In a previous post, I explained how to [add a custom domain and HTTPS to your ShinyProxy server using Nginx](https://hosting.analythium.io/custom-domain-and-security-for-shinyproxy-with-nginx/), and how to set up certificate auto-renewals with Certbot. That was a really long post and the setup included many steps.

A while back, I also used [Caddy server to secure a Shiny Server instance](https://hosting.analythium.io/securing-shiny-server-with-caddy/). That process was quite straightforward with a lot fewer moving parts. Let's see if we can do the same for ShinyProxy, as it is pictured below.

<figure>
<img src="https://hosting.analythium.io/content/images/2021/08/SPCaddy.png" class="kg-image" sizes="(min-width: 720px) 720px" srcset="https://hosting.analythium.io/content/images/size/w600/2021/08/SPCaddy.png 600w, https://hosting.analythium.io/content/images/size/w1000/2021/08/SPCaddy.png 1000w, https://hosting.analythium.io/content/images/2021/08/SPCaddy.png 1366w" width="1366" height="768" alt="ShinyProxy setup with Caddy server." /><figcaption aria-hidden="true">ShinyProxy setup with Caddy server.</figcaption>
</figure>

## Prerequisites

Start a Ubuntu 20.04 virtual machine and follow instructions from the [introductory ShinyProxy post](https://hosting.analythium.io/how-to-set-up-shinyproxy-to-host-shiny-apps/) to have the server available on `http://$HOST:8080` with the two demo applications.

For a [Let's Encrypt certificate](https://letsencrypt.org/), you need a fully registered domain name and an email address. I use the `example.com` domain here, you have to substitute your domain name. Add an `A` record with `example.com` pointing to your server's public IP address.

## Install Caddy

Add some keys and update the `apt` sources, then install Caddy:

``` bash
apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo apt-key add -
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list

sudo apt update
sudo apt install caddy
```

Add Caddyfile `/etc/caddy/Caddyfile` with the following content, replace your email in the global configuration block (some challenges and Let's Encrypt notifications require the email, but this block is optional):

``` bash
{
        email your.name@example.com
}

example.com {
        reverse_proxy 127.0.0.1:8080
}
```

Restart Caddy with `systemctl reload caddy`.

## Set the firewall

You can firewall off everything except for the SSH, HTTP, and HTTPS ports:

``` bash
ufw default deny incoming
ufw default allow outgoing
ufw allow ssh
ufw allow http
ufw allow https
ufw --force enable
```

That is it. Now you can visit `https://$HOST` to see the ShinyProxy login page with the secure lock icon:

<figure>
<img src="https://hosting.analythium.io/content/images/2021/08/Screen-Shot-2021-08-14-at-12.24.41-AM-1.png" class="kg-image" sizes="(min-width: 720px) 720px" srcset="https://hosting.analythium.io/content/images/size/w600/2021/08/Screen-Shot-2021-08-14-at-12.24.41-AM-1.png 600w, https://hosting.analythium.io/content/images/size/w1000/2021/08/Screen-Shot-2021-08-14-at-12.24.41-AM-1.png 1000w, https://hosting.analythium.io/content/images/size/w1600/2021/08/Screen-Shot-2021-08-14-at-12.24.41-AM-1.png 1600w, https://hosting.analythium.io/content/images/2021/08/Screen-Shot-2021-08-14-at-12.24.41-AM-1.png 1808w" width="1808" height="1394" />
</figure>

If you decide to destroy your virtual machine, do not forget to remove the DNS record for your custom domain to prevent a [hostile subdomain takeover](https://reposify.com/blog/how-to-avoid-hostile-subdomain-takeovers/).

## Conclusions

The brevity of this post should be convincing enough that adding a custom domain and HTTPS with Caddy is easy as a breeze. Caddy will take care of the certificate renewals.

Remember that it is your job to make sure your app is not exposing sensitive information and that you follow [Docker best practices](https://hosting.analythium.io/best-practices-for-r-with-docker/) to minimize risk to your users.

## Further reading

-   [ShinyProxy documentation: security](https://www.shinyproxy.io/documentation/security/)
-   [ShinyProxy configuration examples](https://github.com/openanalytics/shinyproxy-config-examples)
-   [Caddy server documentation](https://caddyserver.com/docs/)
-   [Should you use HTTPS?](https://doesmysiteneedhttps.com/)