netdata_netdata/docs/Running-behind-caddy.md

Netdata via Caddy

To run Netdata via Caddy's proxying, set your Caddyfile up like this:

netdata.domain.tld {
    proxy / localhost:19999
}

Other directives can be added between the curly brackets as needed.

To run Netdata in a subfolder:

netdata.domain.tld {
    proxy /netdata/ localhost:19999 {
        without /netdata
    }
}

limit direct access to Netdata

You would also need to instruct Netdata to listen only to 127.0.0.1 or ::1.

To limit access to Netdata only from localhost, set bind socket to IP = 127.0.0.1 or bind socket to IP = ::1 in /etc/netdata/netdata.conf.