Hi David, Looked at the example on the add on and got the log file below - still not serving up https, but a lot more promising!
6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] scripts: applying...
[fix-attrs.d] scripts: exited 0.
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 00-banner.sh: executing...
-----------------------------------------------------------
Add-on: Caddy 2
Open source web and proxy server with automatic HTTPS
-----------------------------------------------------------
Add-on version: 0.3.0
You are running the latest version of this add-on.
System: Home Assistant OS 5.11 (amd64 / qemux86-64)
Home Assistant Core: 2021.2.3
Home Assistant Supervisor: 2021.02.9
-----------------------------------------------------------
Please, share the above information when looking for help
or support in, e.g., GitHub, forums or the Discord chat.
-----------------------------------------------------------
[cont-init.d] 00-banner.sh: exited 0.
[cont-init.d] 01-log-level.sh: executing...
Log level is set to INFO
[cont-init.d] 01-log-level.sh: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
INFO: Starting Caddy...
INFO: Found custom Caddy at /share/caddy/caddy
v2.3.0 h1:fnrqJLa3G5vfxcxmOH/+kJOcunPLhSBnjgIvjXV/QTA=
INFO: Caddyfile found at /share/caddy/Caddyfile
{"level":"info","ts":1613455749.4342697,"msg":"using provided configuration","config_file":"/share/caddy/Caddyfile","config_adapter":""}
{"level":"info","ts":1613455749.437459,"logger":"admin","msg":"admin endpoint started","address":"tcp/localhost:2019","enforce_origin":false,"origins":["localhost:2019","[::1]:2019","127.0.0.1:2019"]}
{"level":"info","ts":1613455749.4380872,"logger":"http","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv0","https_port":443}
{"level":"info","ts":1613455749.4382966,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
{"level":"info","ts":1613455749.4392517,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["<my-domain>.duckdns.org"]}
{"level":"info","ts":1613455749.4399426,"msg":"autosaved config","file":"/data/caddy/autosave.json"}
{"level":"info","ts":1613455749.4403546,"msg":"serving initial configuration"}
{"level":"info","ts":1613455749.4408722,"logger":"tls.obtain","msg":"acquiring lock","identifier":"<my-domain>.duckdns.org"}
2021/02/15 22:09:09 [INFO][FileStorage:/ssl/caddy] Lock for 'issue_cert_<my-domain>.duckdns.org' is stale (created: 2021-02-15 09:05:10.358163477 -0800 PST, last update: 2021-02-15 09:43:26.46172407 -0800 PST); removing then retrying: /ssl/caddy/locks/issue_cert_<my-domain>.duckdns.org.lock
{"level":"info","ts":1613455749.44215,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc00049cbd0"}
{"level":"info","ts":1613455749.442851,"logger":"tls","msg":"cleaned up storage units"}
{"level":"info","ts":1613455749.4434402,"logger":"tls.obtain","msg":"lock acquired","identifier":”<my-domain>.duckdns.org"}
{"level":"info","ts":1613455749.4639788,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["<my-domain>.duckdns.org"]}
{"level":"info","ts":1613455749.4643369,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["<my-domain>.duckdns.org"]}
{"level":"info","ts":1613455750.4677846,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"<my-domain>.duckdns.org","challenge_type":"dns-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}
{"level":"info","ts":1613455754.0069392,"logger":"tls.issuance.acme.acme_client","msg":"validations succeeded; finalizing order","order":"https://acme-v02.api.letsencrypt.org/acme/order/112679045/7937849578"}
{"level":"info","ts":1613455754.926826,"logger":"tls.issuance.acme.acme_client","msg":"successfully downloaded available certificate chains","count":2,"first_url":"https://acme-v02.api.letsencrypt.org/acme/cert/043dfe191bf902d9d756a69d696993272700"}
{"level":"info","ts":1613455754.9281528,"logger":"tls.obtain","msg":"certificate obtained successfully","identifier":"<my-domain>.duckdns.org"}
{"level":"info","ts":1613455754.9284616,"logger":"tls.obtain","msg":"releasing lock","identifier":"<my-domain>.duckdns.org"}
I put the token behind the duckdns in Caddyfile and removed the on demand reference. I also never answered the question about ports: 443:443,80:80,443:8123. Thank you, Daniel
). A big thank you to you and David for the assistance. I have configured the Caddyfile, add-on config, and port forwarding as you suggested (please see below) and as David pointed out it got a cert which I can now access my https site from internally on the network -