Caddy v2 greatly simplifies things for proxying websockets. The dumb rewrite hack is no longer necessary because request matchers handle it perfectly.
Caddy is _by far_ the simplest and easiest solution for proxying websockets like this.
As now since pusher-js 6 the encrypted attribute was removed in favor of forceTLS and it is true by default, so we need to use forceTLS: false, to avoid CORS issues.