Caddy + Tailscale Port 443 Conflict

On servers running both Caddy (public HTTPS) and Tailscale (tailnet HTTPS), both services want port 443. This conflict causes Caddy's systemd service to fail with:

listen tcp :443: bind: address already in use

Root Cause

Tailscale binds 100.x.x.x:443 (its specific Tailnet interface IP). Caddy by default binds :443 (all interfaces), which includes the Tailscale IP. The kernel rejects Caddy's bind because the port is already claimed on that specific address.

The public interface IP (e.g. 152.53.192.33:443) is completely unused — only Tailscale's tailnet IP is occupied.

The Fix

Add a global default_bind directive at the top of Caddyfile to restrict Caddy to the public IP only:

{
    default_bind <PUBLIC_IP>
}

Where <PUBLIC_IP> is the server's public-facing interface IP (e.g. 152.53.192.33 for Core).

After the fix

Service	IP Binding	Purpose
Caddy	`<PUBLIC_IP>:443`	Public HTTPS for all domains
Tailscale	`<TAILNET_IP>:443`	Tailnet HTTPS only
Both		No conflict — different IPs

Verification

# Caddy should start cleanly
systemctl start caddy
systemctl is-active caddy  # → "active"

# Both should be bound without conflict
ss -tlnp | grep ':443 '
# Expected: two listeners — one on public IP (Caddy), one on tailnet IP (tailscaled)

# Public-facing sites should respond
curl -sS -o /dev/null -w '%{http_code}' https://core.itpropartner.com/health
# → 200

When This Pattern Applies

Any server running both:

Caddy (or any reverse proxy) wanting :443 for Let's Encrypt + public HTTPS
Tailscale (which binds :443 on its tailnet interface)

This is expected on all servers where Tailscale is used for private infrastructure access AND Caddy serves public web traffic.

1.8 KiB Raw Blame History