| 1 | # Running Netdata behind Caddy |
| 2 | |
| 3 | To run Netdata via [Caddy v2 reverse proxy,](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy) set your Caddyfile up like this: |
| 4 | |
| 5 | ```caddyfile |
| 6 | netdata.domain.tld { |
| 7 | reverse_proxy localhost:19999 |
| 8 | } |
| 9 | ``` |
| 10 | |
| 11 | Other directives can be added between the curly brackets as needed. |
| 12 | |
| 13 | To run Netdata in a subfolder: |
| 14 | |
| 15 | ```caddyfile |
| 16 | netdata.domain.tld { |
| 17 | handle_path /netdata/* { |
| 18 | reverse_proxy localhost:19999 |
| 19 | } |
| 20 | } |
| 21 | ``` |
| 22 | |
| 23 | ## Protect access to Netdata |
| 24 | |
| 25 | :::tip Simpler Alternative |
| 26 | |
| 27 | If you use Netdata Cloud, [Bearer Token Protection](/docs/netdata-agent/configuration/secure-your-netdata-agent-with-bearer-token.md) provides authentication with a single setting - no Caddy auth configuration needed. |
| 28 | |
| 29 | ::: |
| 30 | |
| 31 | For Caddy-based authentication, refer to the [Caddy documentation on authentication](https://caddyserver.com/docs/caddyfile/directives/basicauth). |
| 32 | |
| 33 | ## limit direct access to Netdata |
| 34 | |
| 35 | You would also need to instruct Netdata to listen only to `127.0.0.1` or `::1`. |
| 36 | |
| 37 | To limit access to Netdata only from localhost, set `bind socket to IP = 127.0.0.1` or `bind socket to IP = ::1` in `/etc/netdata/netdata.conf`. |