Add TLS feature with Caddy

README.md

@@ -49,8 +49,9 @@ The install script will:
 5. Install app dependencies (`bun install`)
 6. Generate `.env` with encryption secrets
 7. Run WireGuard setup (if available)
-8. Install the `wg-quick` helper script
-9. Set up a systemd or OpenRC service (`wgui`)
+8. Install Caddy (`/opt/caddy`)
+9. Install the `wg-quick` helper script
+10. Set up systemd/OpenRC services for `wgui`, `wgui-caddy`, and certificate renewal
 
 The installer **never modifies your firewall** — it will print the commands to
 temporarily allow the dashboard port so you can reach the first login, and then
@@ -82,6 +83,42 @@ Firewall rules are managed per host, automatically:
    Rules that no longer match any host (`temporary`/`orphaned`) are flagged
    with copyable removal commands on the setup page.
 
+### TLS for Tunnel Services
+
+Client routes expose internal services to WireGuard clients over HTTPS. The
+data plane is a dedicated Caddy service (`wgui-caddy`) on `8443`; wg-ui owns
+the route and certificate records and regenerates the Caddyfile. Caddy never
+binds ports 80 or 443, and the host's existing proxy is left alone.
+
+1. If Caddy isn't installed yet, open **Setup → TLS ingress** and click
+   **Install Caddy** (or use the Caddy action on **Setup → Maintenance**).
+   The installer sets up the binary, the `wgui-caddy` service and certificate support.
+
+2. Open a route form from **Routes** (or a host's **Routes** panel) and set
+   the ACME email and staging toggle. No DNS provider token is needed:
+   certificates use manual DNS-01.
+
+   Let's Encrypt requires a public domain you control; internal-only names such
+   as `home.arpa` or `.local` need a private CA instead.
+
+3. Add an A/AAAA record for each route hostname pointing at the host's
+   WireGuard IP. Caddy also restricts each route to the subnet of the host that
+   owns it.
+
+4. Open the route page and click **Issue** (or **Renew**). The dashboard shows
+   the exact `_acme-challenge.<hostname>` TXT record. Add it at Cloudflare,
+   wait for propagation, then click **Validate**.
+
+5. Clients use `https://<hostname>:8443/`. Portless URLs require the host's
+   existing 443 proxy to forward to `127.0.0.1:8443`; wg-ui does not take over
+   443. Caddy allows localhost so that proxy can reach it, which means the
+   proxy itself must enforce who may use those portless URLs.
+
+Manual DNS-01 certificates are renewed from the route page because validation
+needs your registrar. The route list shows expiry warnings. A successful
+issuance reloads Caddy without restarting wg-ui. Check
+`journalctl -u wgui-caddy` for reload failures.
+
 ### Manual (Development)
 
 ```bash
@@ -105,6 +142,10 @@ The `.env` file (gitignored) controls runtime behavior. It is auto-generated dur
 | `ENCRYPTION_KEY`  | Encryption key for sensitive data        | Auto-generated       |
 | `ENCRYPTION_SALT` | Encryption salt for sensitive data       | Auto-generated       |
 | `DATA_DIR`        | Application data directory               | `$INSTALL_DIR/.data` |
+| `CADDY_HTTPS_PORT`| Caddy ingress HTTPS port (never 80/443)  | `8443`               |
+| `CADDY_HTTP_PORT` | Caddy plain HTTP port (never 80)         | `8081`               |
+| `CADDY_INGRESS_ENABLED` | Set to `0` to skip Caddy config sync | `1`                  |
+| `ACME_STAGING`    | Set to `1` to use the Let's Encrypt staging CA | `0`           |
 
 ### Database Configuration
 
@@ -192,6 +233,8 @@ The database consists of the following tables:
 | `clients`         | WireGuard clients per host                      |
 | `hosts`           | WireGuard host configurations                   |
 | `client_rules`    | IP table rules for each client                  |
+| `client_routes`   | HTTPS routes exposed to WireGuard clients       |
+| `tls_certificates`| Certificates used by the Caddy ingress          |
 | `variables`       | Application-wide key-value variables            |
 
 Generate types from the schema:
@@ -206,9 +249,13 @@ bun run db:schema
 | ----------------------------------------------- | ------------ | ------------------------------------------------------------ |
 | `/admin`                                        | Admin        | Dashboard overview                                           |
 | `/admin/hosts`                                  | Admin        | Host management (add, edit, per-host detail)                 |
+| `/admin/routes`                                 | Admin        | Global HTTPS route list with host and certificate status     |
+| `/admin/hosts/[host_id]/routes`                 | Admin        | HTTPS routes and upstreams exposed to tunnel clients         |
+| `/admin/hosts/[host_id]/routes/[route_id]`      | Admin        | Route details, TLS settings and certificate issue/renew      |
 | `/admin/clients`                                | Admin        | Client management (add, edit, client rules per host)         |
 | `/admin/settings`                               | Admin        | Account settings                                             |
 | `/admin/setup`                                  | Super admin  | System setup (hosts, WireGuard tools, update, restart)       |
+| `/admin/setup/tls`                              | Super admin  | Caddy ingress installation and status                        |
 
 ## Development