# Tyblog | Too Simple To Fail: Marrying Nomad, Caddy, and Wireguard
**URL:** https://forum.tjll.net/t/tyblog-too-simple-to-fail-marrying-nomad-caddy-and-wireguard/243
**Category:** uncategorized
**Created:** [February 4, 2022, 7:02pm UTC](https://forum.tjll.net/t/tyblog-too-simple-to-fail-marrying-nomad-caddy-and-wireguard/243 "2022-02-04T19:02:39Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@tyler](https://forum.tjll.net/u/tyler)
#### Post date: [February 4, 2022, 7:02pm UTC](https://forum.tjll.net/t/tyblog-too-simple-to-fail-marrying-nomad-caddy-and-wireguard/243/1 "2022-02-04T19:02:39Z")
My little [lab](https://blog.tjll.net/lab) can afford some experimental allowances given that I’ll never (hopefully) breach the “thousands of hosts” mark. One experiment that paid off recently was ditching [Traefik](https://doc.traefik.io/traefik/v1.7/) v1 for a hybrid setup that uses [Nomad](https://www.nomadproject.io/), [consul-template](https://github.com/hashicorp/consul-template), [Caddy](https://caddyserver.com/), and [wireguard](https://www.wireguard.com/) in order to provide the HTTP routing layer for my services.
* * *
This is a companion discussion topic for the original entry at [https://blog.tjll.net/too-simple-to-fail-nomad-caddy-wireguard/](https://blog.tjll.net/too-simple-to-fail-nomad-caddy-wireguard/)
---
### Author:  [@AlexMikhalev](https://forum.tjll.net/u/AlexMikhalev)
#### Post date: [January 9, 2023, 10:02pm UTC](https://forum.tjll.net/t/tyblog-too-simple-to-fail-marrying-nomad-caddy-and-wireguard/243/2 "2023-01-09T22:02:11Z")
Thank you for this write-up. I have nomad/consul/vault running “distributed system” on my 3 raspberry PI with SeaweedFS.
Have you looked [Fabio](https://github.com/hashicorp/nomad-guides/blob/master/application-deployment/fabio/README.md)? It seems to be specifically designed instead of caddy in such setup - I was excited about caddy, but then I had a bad experience when tried to deploy it on somebodies else jetson nano remotely.
---
### Author:  [@tyler](https://forum.tjll.net/u/tyler)
#### Post date: [January 9, 2023, 10:02pm UTC](https://forum.tjll.net/t/tyblog-too-simple-to-fail-marrying-nomad-caddy-and-wireguard/243/3 "2023-01-09T22:02:12Z")
---
### Author:  [@tylerjl](https://forum.tjll.net/u/tylerjl)
#### Post date: [February 3, 2023, 6:06pm UTC](https://forum.tjll.net/t/tyblog-too-simple-to-fail-marrying-nomad-caddy-and-wireguard/243/4 "2023-02-03T18:06:43Z")
I looked at Fabio briefly, but I was very keen on having my reverse proxy manage my TLS certificates as well, and Fabio seemed a little more service-level load balancing-focused, sort of like a Kubernetes `Service`. That may be mistaken, as I haven’t actually experimented with it very much. But it seems like a solid project and a potential replacement for the role that something ilke Caddy fills 👍
---
### Author:  [@AlexMikhalev](https://forum.tjll.net/u/AlexMikhalev)
#### Post date: [February 3, 2023, 8:09pm UTC](https://forum.tjll.net/t/tyblog-too-simple-to-fail-marrying-nomad-caddy-and-wireguard/243/5 "2023-02-03T20:09:31Z")
I am going your way with caddy, but I am trying to make it even simpler: firecracker vms, redis as KV (instead of consul) and caddy+caddy\_cgi to spin it off.
---
### Author:  [@sbrl](https://forum.tjll.net/u/sbrl)
#### Post date: [September 8, 2023, 12:06am UTC](https://forum.tjll.net/t/tyblog-too-simple-to-fail-marrying-nomad-caddy-and-wireguard/243/6 "2023-09-08T00:06:41Z")
Fabio is cool, but I’ve found there’s a long-standing websockets buffering bug that means that the logs function in the Nomad UI doesn’t work.
Might use this approach to replace Fabio myself!
---
### Author:  [@CAD](https://forum.tjll.net/u/CAD)
#### Post date: [January 31, 2024, 5:41pm UTC](https://forum.tjll.net/t/tyblog-too-simple-to-fail-marrying-nomad-caddy-and-wireguard/243/7 "2024-01-31T17:41:30Z")
Informative post. consul-template is powerful.
Worth mentioning Caddy can generate reverse proxy configs [dynamically from DNS SRV records](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#srv), too. This can be made to work with Consul’s DNS server:
```plaintext
*.lab.mysite.com {
# ...
map {host} {subdomain} {
~(.*)\.lab\.mysite\.com$ ${1}
}
# Proxy services with the 'http-reverse' tag.
handle {
reverse_proxy {
dynamic srv {
name service.consul
service {subdomain}
proto http-reverse
refresh 10s
}
}
}
handle_errors {
# Do whatever you want here to return error info to clients
# when a service is not found, etc.
}
}
```
This config assumes Consul is working as the system’s resolver. A consul agent can be running locally with a [recursors](https://developer.hashicorp.com/consul/docs/agent/config/config-files#recursors) config to pass other DNS requests upstream.
This doesn’t allow as much fine tuning as the templating approach, but at least the `proto` field enables filtering by a service tag.