I am rebuilding my personal certificate authority with Smallstep on a cloud VPS. My previous VPS ran for a few years, but I never documented the setup clearly enough to repeat it later. This time I am keeping a direct record, and I am also switching from traefik to caddy for consistency across my public-facing web servers.
This private CA manages custom domains that are not exposed over the global Internet and is only accessible from my wireguard tunnels.
For this setup, I have 4 primary components.
wireguard- provides secure tunnel capabilities.- AdGuard Home - acts as a DNS server, that returns results for my custom domains and also blocks ads and such for the clients that connect over
wireguard. - Smallstep CA - issues TLS certificates to the services that need it.
- Caddy - serves as the reverse proxy for AdGuard Home and Smallstep CA.
I am breaking this guide into five parts so I do not miss anything important later. I already have an Ansible playbook for this, but I still want a manual record when I need to revisit the setup or test a variation.
In the above diagram, the VPS has a public IP of 1.2.3.4, the wireguard interface has 192.168.200.1, and the webproxy Docker network has the IP 192.168.250.1. I have a guide on setting up WireGuard which is part of this project.
In this setup, I actually created a new docker network with a specific set of IP range so I can have my adguardhome container listening on both the wireguard and webproxy network. Create a new network with the command
docker network create dns --subnet=192.168.250.1/24
This network interface will also be used by caddy that acts as a reverse proxy to forward all requests to the correct container as they would all sit on the same network.
Now we can proceed to Part 2 of the guide, setting up AdGuard Home DNS server.