Caddy Cloudflare Wildcard Proxy

This skill should be used when standing up Caddy as a reverse proxy for internal/homelab domains with a wildcard TLS certificate via Cloudflare DNS-01, when a Caddyfile needs one certificate to cover many internal hostnames, when routing Caddy to a backend that's deliberately bound to loopback only and reachable via an existing Tailscale Serve endpoint, when a Caddy instance itself needs to be loopback-only and a request returns an empty 200 response or `ss -tlnp` shows it listening on `*:port` despite the site address looking like `127.0.0.1:port`, or when debugging a fresh unprivileged LXC where tailscaled fails with "/dev/net/tun does not exist" or MagicDNS doesn't register into systemd-resolved. Trigger phrases include "caddy wildcard cert", "caddy dns-01 cloudflare", "caddy custom build dns plugin", "reverse proxy to tailscale serve backend", "loopback-bound service reverse proxy", "tun device does not exist unprivileged lxc", "tailscale magicdns not registering systemd-resolved", "split-horizon internal domain caddy", "caddy empty 200 response", "caddy content-length 0", "caddy site address host matcher not bind", "caddy listening on wildcard despite 127.0.0.1", "tailscale serve empty response from caddy backend".

mkdir -p ~/.claude/skills/caddy-cloudflare-wildcard-proxy
curl -L https://claudskills.com/skills/caddy-cloudflare-wildcard-proxy/SKILL.md \
  -o ~/.claude/skills/caddy-cloudflare-wildcard-proxy/SKILL.md

@misc{caddy-cloudflare-wildcard-proxy-2026,
  author    = {jackson2w},
  title     = {Caddy Cloudflare Wildcard Proxy [Claude Code skill]},
  year      = {2026},
  publisher = {ClaudSkills},
  url       = {https://claudskills.com/skills/caddy-cloudflare-wildcard-proxy/}
}