Constrained local root CA for Caddy

ca-config.cnf

[ v3_ca ]
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
# This restricts the CA to ONLY sign domains ending in .lan or .local
nameConstraints = critical, permitted;DNS:.lan, permitted;DNS:.local

Caddyfile

{
    pki {
        ca local {
            name "My Constrained Local CA"
            root {
                cert /etc/caddy/certs/root.crt
                key  /etc/caddy/certs/root.key
            }
            intermediate {
                cert /etc/caddy/certs/intermediate.crt
                key  /etc/caddy/certs/intermediate.key
            }
        }
    }
}

# Your local site blocks will now use this constrained issuer automatically
app.lan {
    tls internal
    reverse_proxy 192.168.25:8080
}