12 ms·

Caddy 0.10 Released

190 points by anc84 10y ago

blowski 10y ago
When would I use Caddy, rather than using nginx and configuring Let's Encrypt for myself? Honest question.
- knrz 10y ago
  I feel like the niche Caddy's trying to fill is for people who don't want to bother with that, or don't want to learn. If you already know how to set up nginx and LE (like you and I do), its only appeal is relatively minor: potentially saving a quarter or half hour.
  - xiphias 10y ago
    I think over time there will be a similar server written in Rust, where at least we can be sure that there are no buffer overflows..until then nginx is probably better in every situation.
    - shawabawa3 10y ago
      Caddy is written in go, not C, so I'm not sure why it should be especially vulnerable to buffer overflows...
    - ilogik 10y ago
      why would there be buffer overflows in caddy?
    - Sphax 10y ago
      Do we really need someone to mention Rust in every thread ?
      - anaganisk 10y ago
        someone had to say it :p
      - afdsadf 10y ago
        As a member of the Rust Evangelism Strike Force, I am morally obligated to. /s
      - xiphias 10y ago
        No, it just makes sense to have a fast and safe HTTP server at the same time. Go is ona average 3x slower than C according to bechmarks, and it's hard to get rid of this issue because of how the language is architected. I just don't see Caddy as a possible long term replacement for nginx.
    - coldtea 10y ago
      Unless it uses unsafe code (which Rust also provides) Caddy wouldn't have buffer overflows either, since Go is garbage collected and doesn't allow for the kind of pointer arithmetic C does in normal code.
    - deleted 10y ago
      [deleted]
  - interfixus 10y ago
    its only appeal is relatively minor Is that factual, or also something you feel like? To us simple folks, you know, it looks as if Caddy has a number of use cases where it's a much neater fit than nginx. We like the extreme simplicity and the transparency of it all. Some of us also like the Go it's written in. What with the magic Go modularity, you can actually embed this server in your web-app. Or is it the other way round? Comes in handy, at any rate.
    - knrz 10y ago
      That was a feel. I never thought of the idea of embedding it. Thanks for teaching me more!
    - grey-area 10y ago
      What with the magic Go modularity, you can actually embed this server in your web-app. Or is it the other way round? Comes in handy, at any rate. It's the other way round. You can embed your app in the server if you want to get its features for free, though given it uses net/http and most of the features are exposed there you should probably just use that directly instead if you are doing anything significant.
  - yjftsjthsd-h 10y ago
    I'm not opposed to learning, but it's like learning emacs when nano legitimately covers all your use cases: potentially useful, but unconvincing ROI. And if we pretend for a moment that it's really only a quarter hour saved, why would I not save that time if all other things are held fixed? Caddy isn't the universal solution, but it sounds like you're rationalizing using the more complex tool because you know it and have been using it rather than because it's necessarily superior.
  - atonse 10y ago
    The appeal is huge for a huge number of people. It's an opinionated web server. I've used nginx for probably 6-7 years, and not once have I done something I'd consider that special (I've setup fpm, passenger, gzipping of content, TLS, regenerating my DH param, etc). Every single thing I've done, could be implemented in an opinionated away by the web server. I'd love to just say "php" and have it do the right thing. In fact, I'd go as far as to say, it would be amazing if I could just say "proxy ____ drupal" instead of php, and it'll add the drupal rules as well.
  - overcast 10y ago
    When you're a solo entrepreneur/developer/sysadmin/whateverhatineed hat I need to wear. Streamlining processes as much as possible is a good thing. Using something overly complex, just to use it, is silly. I stumbled upon Caddy, because I was struggling with getting LetsEncrypt setup properly for all my sites on Nginx. Now with a few lines of config, all my sites use, redirect to, and update their certificates automatically. One less piece of bullshit I need to sift through for all the projects I'm working on. In my opinion, something like SSL certificates SHOULD be an automated process.
  - andmarios 10y ago
    It all depends on how complex your setup is. Caddy isn't just easy to setup, it is easy to setup every part of it until you reach the end of its functionality. I can set up both nginx and apache (and get paid for it), I've automated LE for new sites via ansible, etc. Nowadays if I can do with caddy, I just use that and proceed to the next task. Also remember that easy (and short) configuration means easier maintenance. Devs also love it, they can develop locally using advanced functionality (e.g proxying an API that doesn't provide CORS).
- dev247 10y ago
  I made the complete switch to Caddy just because the configuration is simplified and it has features like git webhooks built-in. Setting up BasicAuth on a directory is one line in the config. And it's fast. No issues so far, been using Caddy for over a year now.
  - anc84 10y ago
    I vouched for this comment to bring it back from dead. dev247, you seem ghosted for all the account's lifespan for no apparent reason. Contact hn@ycombinator.com to get reset to a proper user account!
    - interfixus 10y ago
      So did I. What's the deal with this absolutely harmless comment being going all grey and dead?
      - anc84 10y ago
        The account was probably automatically flagged by some algorithm 3 years ago. Yay for smart machines and no human oversight!
- shawabawa3 10y ago
  Why would I use nginx and go through the hassle of configuring let's encrypt and sane SSL settings when I could just use caddy? But seriously, for all "hobby" projects I've started recently, and even some production services now, I go straight to caddy. My config consists of a 1 line global config file: import sites-enabled/* And 90% of the individual services have this config: example.com { proxy / http://localhost:5000 { header_upstream Host {host} } } Compared to nginx it's just so much simpler and so far I haven't found myself missing a single feature. (In fact, caddy has active health checks, which nginx only supports for its extortionate enterprise fee)
  - blowski 10y ago
    What's the performance like? Can you use it as a proxy server?
    - shawabawa3 10y ago
      I use it exclusively as a proxy server. I've never noticed any performance issues, I think I saw a benchmark where it said caddy can handle 2000req/s, which is at least an order of magnitude or 2 faster than any upstream service I've used it in front of.
      - coldtea 10y ago
        >I think I saw a benchmark where it said caddy can handle 2000req/s Those are application level numbers (e.g. with logic and all). Caddy should be able to handle an order of magnitude more req/s than that easily.
        anc84 10y ago
        One year ago Matt said 30000req/s: https://forum.caddyserver.com/t/can-i-use-caddy-for-a-high-traffic-site/108/15 https://forum.caddyserver.com/t/can-i-use-caddy-for-a-high-t...
        shawabawa3 10y ago
- grey-area 10y ago
  It's a lot easier than ngxinx + letsencrypt + cron job - there is zero config to get letsencrypt up and running and certs renewing automatically. It supports http2 out of the box and will keep improving as the go net/http library does, performance is good (certainly good enough for 99.9% of the static sites out there, I haven't specifically benchmarked against nginx but response times didn't change much). I'd recommend it as a proxy if you need one, particularly if you need one that handles your tls certs.
- singlow 10y ago
  I use Nginx in production, but caddy on my dev machine, where I might have dozens of test sites running at any time. Those sites all live on subdomains of a dedicated dev domain and I rarely create more than 2 or 3 per week so I can always just use https with certificates generated on the fly. In Nginx I would need to constantly re-run certbot to add subdomains manually.
  - eliaspro 10y ago
    For all local/non-public instances I just use "tls self_signed" and have Caddy generate a cert on demand.
- nemothekid 10y ago
  A lot of the other responses have been focusing on how simple Caddy is to get started with - batteries included. We've been using Caddy for a bit over 2 years in production. At the time we had just moved our infrastructure from an assortment of self-written python scripts to Mesos/Marathon. We were looking for a solution that would reverse proxy to our app servers without having to rely on DNS. I initially thought about writing a plugin for nginx before I found Caddy. When we found Caddy, it was a better solution for us as it was far easier to write a mesos integration for rather than trying to integrate it into nginx.
lol768 10y ago
The MitM detection is interesting. How long until these appliances start altering the HTTP request's User-Agent header to avoid detection (or adding logic such that the handshaking process mimics that of the browser), though? To me, HPKP with preloading seems like a more reliable approach (and browsers shouldn't allow this to be overridden [1]). [1] If this breaks corporate MitM attacks, great. This practice always struck me as incredibly invasive and I'd personally be concerned if an employer was doing this. I think some traffic data should be able to be logged and timestamped in case of abuse (e.g. SNI info, TCP connections, DNS lookups) but I don't see a need to intercept application data - and honestly, it seems like the vast majority of these appliances hinder security.
- vosper 10y ago
  I'd also be concerned if an employer was doing it, unless there was a good reason - and I can think of a few of those. For example, companies that deal with sensitive health, financial or legal information. They may need assurances (or at least a paper trail) that's a lot stronger than "we don't MITM and we trust our employees to do the right thing".
  - martingxx 10y ago
    Even with those reasons, I believe the risk outweighs the potential benefits. It's not just about trusting the intentions and assurances of the company, but also their competency and knowing they're not being compromised etc. Hackers don't care about paper trails. These are things you typically can't measure. If you have untrustworthy employees, you have bigger problems than you can solve with by MITM attacking everyone.
  - tracker1 10y ago
    I've worked at a couple financial institutions where all http/https traffic is proxied transparently (with internal key installed on corp computers)... certainly makes working with command line utils interesting... HTTP_PROXY HTTPS_PROXY are mostly friendly, but some aren't so nice.
  - lol768 10y ago
overcast 10y ago
So far I'm loving Caddy. Super simple to configure, and the auto management of SSL certificates is magical. However, for all of the simplicity, they are still pretty resistant to properly packaging it up in the repositories. By far the longest part of getting it running, is the stupid manual configuration of launch daemons, working directories, and permissions. For software that prides itself on dead simple management, the basics of getting it into a package manager should not even be a discussion. With that said, I 100% moved all of my sites from Nginx to Caddy after the config file setup is around three lines per site.
- bauerd 10y ago
  >the basics of getting it into a package manager should not even be a discussion. Last time I looked into it, their problem was that Caddy plugins must be configured at compile-time, because runtime plugins seem to be hard to do with Golang (besides RPC). Because there's a handful of Caddy plugins, they'd either have to provide a slim package with no plugins, or ship with all or only some blessed plugins. Obviously all approaches have drawbacks … they discussed the option of shipping their own package manager for Caddy plugins, too (shudder). See: https://forum.caddyserver.com/t/packaging-caddy/61 https://forum.caddyserver.com/t/packaging-caddy/61
  - singlow 10y ago
    Nginx had the same issue. Ubuntu ships 3 or 4 versions - nginx-light, nginx, nginx-full, nginx-extras - for different numbers of modules included.
    - finid 10y ago
      With dynamic modules support now in Nginx, that practice should end.
      - JdeBP 10y ago
        As Michael Lustfield said in Debian bug #790623 in October 2015.
papey 10y ago
Awesome product, I'm using it at work and it's incredibly fast. Configuration is easy, documentation is clear. The systemd unit provided in the repo is insane, all the latest security and isolation stuff are in it, a great inpiration for writing good systemd units.
- mixmastamyk 9y ago
  Took me a while to find: https://github.com/mholt/caddy/tree/master/dist/init/linux-systemd https://github.com/mholt/caddy/tree/master/dist/init/linux-s...
jhack 10y ago
This is the first I've heard of Caddy and I'm really impressed by the feature set. Looks like a breath of fresh air, can't wait to try it.
haarts 10y ago
They mention that 'Default Timeouts' have been disabled. Urging users to 'Act according to your threat model!'. I'm not sure I understand. How is not having these timeouts a security thread? Someone could potentially open up enough HTTP connections to starve others from having the opportunity to do so?
- titanomachy 10y ago
  Yeah, you could take all the file descriptors by opening a whole bunch of connections.
- mholt 10y ago
  This is true; but slowloris attacks don't require opening as many connections. We've seen one or two instances where buggy (or malicious?) clients were slowlorising Caddy instances; but we were too eager to enable timeouts by default I think.
  - zzzcpan 10y ago
    No, not having timeouts is rather bad practice. There are a lot of clients out there that never close connections for various reasons. And since TCP doesn't use healthchecks and most systems by default have limits on the number of descriptors per process, your web server in default configuration will simply leak descriptors and memory over time until the whole thing stops working. The only sane choice here is to have timeouts enabled everywhere and explicitly allow them to be disabled, not the other way around.
    - mholt 10y ago
      Believe me, we wanted to do this, but it broke a lot of WebSocket connections and other legitimate, long-lived connections. It confused many users. It's hard to know what is legitimate and what is not. I wish we could configure timeouts on a per-request basis but not without some serious hacking around the net/http lib for now. I do encourage setting timeouts when you are able to. It's easy, for example: timeouts 30s I have heard of occasions where people have done this and it made their servers breathe again. At this point it's just up to your discretion/judgment.
jbergstroem 10y ago
I would just like to bring up how much I admire the way they want to profit off Caddy[1][2]. Sponsorships and focused development; followed by "remember, caddy is open source". My only feedback would be that they introduce a "$50/mo; my bank is not big enough" for people that wants to endorse their model/software. Look at nginx, where new functionality is hidden behind a paywall. I don't want to deny them [nginx devs and sales people] their well-deserved money, but it pushes me away. [1]: https://caddyserver.com/blog/options-for-businesses https://caddyserver.com/blog/options-for-businesses [2]: https://caddyserver.com/pricing https://caddyserver.com/pricing
- mholt 10y ago
  Thanks for the feedback! We are mindful of people who want to contribute funds but aren't able to because of the price. We get a lot of requests for stickers and T-shirts and even jackets/sweaters; so we might go that route for individuals being able to contribute.
  - tnorthcutt 10y ago
    Why not introduce a $50/month (hell, even a "pay what you want") option, with no sponsorship benefits (mentions, link, etc.)? Depending on volume, you could still offer Slack access as a benefit, perhaps if paid up front for a year.
    - mholt 10y ago
      That's possible! We wanted to gauge initial interest first but let me talk to Cory about this.
  - deftnerd 10y ago
    I would be interested in something that made it so when I donated, an additional plugin was created in the download that outputted my support of caddy in the header or as some kind of call to be included in web pages. Something similar to how SVG based icons are used in many Git repos to display TravisCI scan results of the number of downloads. A similar badge could be supplied via plugin to supporters that shows how much the user has donated to the Caddy project or that they're a contributing member.
sergiotapia 10y ago
Caddy is a web server written entirely in Go. Features: - Easy configuration with Caddyfile - Automatic HTTPS via Let's Encrypt; Caddy obtains and manages all cryptographic assets for you - HTTP/2 enabled by default (powered by Go standard library) - Virtual hosting for hundreds of sites per server instance, including TLS SNI - Experimental QUIC support for those that like speed TLS session ticket key rotation for more secure connections - Brilliant extensibility so Caddy can be customized for your needs - Runs anywhere with no external dependencies (not even libc)
- weberc2 10y ago
  Are you sure it doesn't even depend on libc? Most Go programs do end up depending on libc by default; they have to be specially compiled to avoid the libc dep (IIRC, anything that depends on net or net/http or something of that sort).
  - kevinburke 10y ago
    Go ships with both a pure Go and a libc-based DNS resolver. Some systems (like OS X) don't let Go make DNS requests directly. For more see https://golang.org/pkg/net/#hdr-Name_Resolution https://golang.org/pkg/net/#hdr-Name_Resolution
    - cutsoup 10y ago
      > Some systems (like OS X) don't let Go make DNS requests directly. I don't think this is a reasonable summary of the situation on OS X. That being that if you turn the firewall on and then turn on block of incoming connections on 10.11 and earlier, responses seem to get dropped. Characterizing that as a blanket disallowing of direct DNS requests is misleading. (I'm not defending OS X here, it's just that summaries like this turn into cargo cults.)
- pbreit 10y ago
  So is it ready for "prime time"? Should I be considering it over Nginx for side projects or real projects?
bpierre 10y ago
How does it compare with https://traefik.io/ https://traefik.io/ (reverse proxy, written in Go, automatic HTTPS / letsencrypt) ?
- CrowderSoup 10y ago
  It looks like traefik has a few more features tbh, I'll definitely be giving this a serious look.
- tscs37 10y ago
  Traefik is purely a proxy, Caddy is a webserver. Traefik can efficiently deal with proxying HTTP traffic but cannot serve files and is not as easy to configure if you're not using Docker or similar. Caddy can serve files or PHP but is not as good with proxying HTTP traffic.
- doublerebel 10y ago
  Yep, I use the similar eBay/fabio which pulls my LE certs from hashicorp/vault, much better than leaving them in a filesystem. Can't imagine using a proxy/ingress/LB without automatic reactive routing these days. All I have to tell Fabio is what interface to listen to.
  - zenlikethat 10y ago
    Why do you say it's better to pull them from Vault? Unless MTLS is set up talking to Vault, you are pulling secrets unencrypted (and maybe unauthenticated) over the network... a local file system is not bad for small scale deployments if setup with the proper permissions.
nzjrs 10y ago
Anyone with experience using this as a dynamic reverse proxy - I need to proxy certain requests to private container (ports) where the port isn't known until the container is booted, and containers come up and down as users require them.
- doublerebel 10y ago
  eBay/fabio or Traefik.io both fit that description. Linkerd and Envoy probably do too but I have less experience with those.
- xemoka 10y ago
  Sounds like Traefick.io mentioned above should do the trick there. Looks like an interesting tool...
- tyingq 10y ago
  Depending on what that private container is serving up, an API gateway might work better. Tyk is one that's written in golang. It has a rest API and hot reload, so it should be able to handle your use case of dynamically allocated ports. http://tyk.io http://tyk.io
  - deleted 10y ago
    [deleted]
- LeonidBugaev 10y ago
  You can use service discovery tools like Consul or Etcd. Basic idea that on container/app boot, you register your app to service discovery service (you give it IP and current port), and it stores information about your all running apps. After you can use consul Nginx integration (it will dynamically generate Nginx config on all updates, and will restart it). Tyk mentioned here also have Consul service integration and much more.
- zzzcpan 10y ago
  Nginx can proxy to a server specified in a variable. All you have to do is define that variable though perl or lua to get port dynamically from somewhere, like a file.
cdnsteve 10y ago
Does Caddy have a pluggable extension set where you can write your own middleware, in Go?
- zalmoxes 10y ago
  It does and it's documented on the wiki. I've written a few plugins privately, like implementing SCEP into caddy and adding a few other features. Due to the nature of the plug system, you'll have to build caddy yourself if you add customizations like that.
- zalmoxes 10y ago
  https://github.com/mholt/caddy/wiki https://github.com/mholt/caddy/wiki
snowpalmer 10y ago
Any benefit in using this inside a docker container instead of nginx? No need for SSL or many of the other features I'm seeing listed here since it's all behind an Amazon ELB.
- xrstf 10y ago
  We are using Caddy as a simple reverse proxy in Docker environments. The configuration is a bit simpler than nginx and we love the tiny Docker images we can create (not sure how large an nginx-full installation is). That being said, we did run into a few issues that forced us to go back to older Caddy versions, like broken websocket support or the timeout issue in 0.9.5. Also, sometimes the documentation is a bit lacking and unclear. DNS resolution seems to be flaky sometimes (we're using alpine-based containers and sometimes Caddy just won't resolve names of other containers, even though a curl inside the container can resolve the names just fine). So if you've got a working nginx setup, I'd say stick with it. For new projects it is worth to check out Caddy. The issues we ran into occured early in our development process, they didn't just suddenly happen in production, so once you've tested everything, Caddy just works.
mike-cardwell 10y ago
Surprised there isn't more talk about the MITM detection here. Anyone got a TLDR of how this is supposed to work? I'm going to read the full doc when I get home, but I'd be interested in hearing peoples opinions on how accurate it is likely to be.
- kondbg 10y ago
  The authors of the original paper [1] identified that the set of client cipher suites advertised by each browser can be used to fingerprint and identify a browser. Caddy records the cipher suite advertised by the client during the TLS handshake and then later examines the client's user agent. Using the fingerprinting techniques mentioned in the paper, Caddy then determines whether or not the advertised user-agent is compatible with the user-agent that it inferred through the client cipher suites. TLS interception proxies establish their own TLS connection to the server. Depending on what underlying TLS library the proxy uses, it also has its own unique fingerprint. When the TLS proxy forwards the user's request, Caddy detects the mismatch and flags it as a MITM. [1] https://jhalderm.com/pub/papers/interception-ndss17.pdf https://jhalderm.com/pub/papers/interception-ndss17.pdf
daari0 10y ago
Is ECDHE_ECDSA possible on Caddy?
brotherjerky 10y ago
Is there an official Docker image yet?
- mholt 10y ago
  No, but this is the one I usually recommend for now: https://hub.docker.com/r/abiosoft/caddy/ https://hub.docker.com/r/abiosoft/caddy/
dyeje 10y ago
Pricing page is pretty bad. Draws your eyes with primary colors and bold fonts to $5000/yr and $9900/yr. I had to swallow the sticker shock and look around the page to see the weird, faded side-bubble telling me it's free.
tlrobinson 10y ago
Random question: is there a way to start Caddy as root so it can bind to port 80 (for example) then change the user so a non-root user can send a `USR1` signal to Caddy to get it to reload the configuration?
- zufallsheld 10y ago
  At least with systemd caddy starts as a non-root user, if you use the provided unit-file: https://github.com/mholt/caddy/tree/master/dist/init/linux-systemd https://github.com/mholt/caddy/tree/master/dist/init/linux-s...
  - tlrobinson 10y ago
    Is there something like `setcap` for macOS? Give the caddy binary the ability to bind to privileged ports (e.g. 80, 443) as a non-root user: sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/caddy
    - tyingq 10y ago
      There isn't. There's a port of authbind, but I don't think anyone was able to get it working with caddy. The only solution I've heard of working is using the pf firewall to port forward, for example, 8080 to 80. Like this: https://salferrarello.com/mac-pfctl-port-forwarding/ https://salferrarello.com/mac-pfctl-port-forwarding/
    - deleted 10y ago
      [deleted]
  - JdeBP 10y ago
    Better systemd integration would use the LISTEN_FDS mechanism, letting the service management subsystem open the privileged-access listening socket as instructed by a socket unit.
- jazoom 10y ago
  Yes. From their GitHub readme: Running as root: We advise against this. You can still listen on ports < 1024 using setcap like so: sudo setcap cap_net_bind_service=+ep ./caddy
thearrow 10y ago
PSA for those who use caddy's proxy "without" configuration item - it is broken in 0.10: https://github.com/mholt/caddy/issues/1604 https://github.com/mholt/caddy/issues/1604 This bit our app during testing.
snowpanda 10y ago
I always really liked this video by Matt: https://www.youtube.com/watch?v=ZyVA9tuif4s https://www.youtube.com/watch?v=ZyVA9tuif4s The way he explains things makes me wish he did tutorials for programming languages.

Caddy 0.10 Released

190 points by anc84 10y ago

blowski 10y ago

When would I use Caddy, rather than using nginx and configuring Let's Encrypt for myself? Honest question.

knrz 10y ago
I feel like the niche Caddy's trying to fill is for people who don't want to bother with that, or don't want to learn. If you already know how to set up nginx and LE (like you and I do), its only appeal is relatively minor: potentially saving a quarter or half hour.
- xiphias 10y ago
  I think over time there will be a similar server written in Rust, where at least we can be sure that there are no buffer overflows..until then nginx is probably better in every situation.
  - shawabawa3 10y ago
    Caddy is written in go, not C, so I'm not sure why it should be especially vulnerable to buffer overflows...
  - ilogik 10y ago
    why would there be buffer overflows in caddy?
  - Sphax 10y ago
    Do we really need someone to mention Rust in every thread ?
    - anaganisk 10y ago
      someone had to say it :p
    - afdsadf 10y ago
      As a member of the Rust Evangelism Strike Force, I am morally obligated to. /s
    - xiphias 10y ago
      No, it just makes sense to have a fast and safe HTTP server at the same time. Go is ona average 3x slower than C according to bechmarks, and it's hard to get rid of this issue because of how the language is architected. I just don't see Caddy as a possible long term replacement for nginx.
  - coldtea 10y ago
    Unless it uses unsafe code (which Rust also provides) Caddy wouldn't have buffer overflows either, since Go is garbage collected and doesn't allow for the kind of pointer arithmetic C does in normal code.
  - deleted 10y ago
    [deleted]
- interfixus 10y ago
  its only appeal is relatively minor Is that factual, or also something you feel like? To us simple folks, you know, it looks as if Caddy has a number of use cases where it's a much neater fit than nginx. We like the extreme simplicity and the transparency of it all. Some of us also like the Go it's written in. What with the magic Go modularity, you can actually embed this server in your web-app. Or is it the other way round? Comes in handy, at any rate.
  - knrz 10y ago
    That was a feel. I never thought of the idea of embedding it. Thanks for teaching me more!
  - grey-area 10y ago
    What with the magic Go modularity, you can actually embed this server in your web-app. Or is it the other way round? Comes in handy, at any rate. It's the other way round. You can embed your app in the server if you want to get its features for free, though given it uses net/http and most of the features are exposed there you should probably just use that directly instead if you are doing anything significant.
- yjftsjthsd-h 10y ago
  I'm not opposed to learning, but it's like learning emacs when nano legitimately covers all your use cases: potentially useful, but unconvincing ROI. And if we pretend for a moment that it's really only a quarter hour saved, why would I not save that time if all other things are held fixed? Caddy isn't the universal solution, but it sounds like you're rationalizing using the more complex tool because you know it and have been using it rather than because it's necessarily superior.
- atonse 10y ago
  The appeal is huge for a huge number of people. It's an opinionated web server. I've used nginx for probably 6-7 years, and not once have I done something I'd consider that special (I've setup fpm, passenger, gzipping of content, TLS, regenerating my DH param, etc). Every single thing I've done, could be implemented in an opinionated away by the web server. I'd love to just say "php" and have it do the right thing. In fact, I'd go as far as to say, it would be amazing if I could just say "proxy ____ drupal" instead of php, and it'll add the drupal rules as well.
- overcast 10y ago
  When you're a solo entrepreneur/developer/sysadmin/whateverhatineed hat I need to wear. Streamlining processes as much as possible is a good thing. Using something overly complex, just to use it, is silly. I stumbled upon Caddy, because I was struggling with getting LetsEncrypt setup properly for all my sites on Nginx. Now with a few lines of config, all my sites use, redirect to, and update their certificates automatically. One less piece of bullshit I need to sift through for all the projects I'm working on. In my opinion, something like SSL certificates SHOULD be an automated process.
- andmarios 10y ago
  It all depends on how complex your setup is. Caddy isn't just easy to setup, it is easy to setup every part of it until you reach the end of its functionality. I can set up both nginx and apache (and get paid for it), I've automated LE for new sites via ansible, etc. Nowadays if I can do with caddy, I just use that and proceed to the next task. Also remember that easy (and short) configuration means easier maintenance. Devs also love it, they can develop locally using advanced functionality (e.g proxying an API that doesn't provide CORS).
dev247 10y ago
I made the complete switch to Caddy just because the configuration is simplified and it has features like git webhooks built-in. Setting up BasicAuth on a directory is one line in the config. And it's fast. No issues so far, been using Caddy for over a year now.
- anc84 10y ago
  I vouched for this comment to bring it back from dead. dev247, you seem ghosted for all the account's lifespan for no apparent reason. Contact hn@ycombinator.com to get reset to a proper user account!
  - interfixus 10y ago
    So did I. What's the deal with this absolutely harmless comment being going all grey and dead?
    - anc84 10y ago
      The account was probably automatically flagged by some algorithm 3 years ago. Yay for smart machines and no human oversight!
shawabawa3 10y ago
Why would I use nginx and go through the hassle of configuring let's encrypt and sane SSL settings when I could just use caddy? But seriously, for all "hobby" projects I've started recently, and even some production services now, I go straight to caddy. My config consists of a 1 line global config file: import sites-enabled/* And 90% of the individual services have this config: example.com { proxy / http://localhost:5000 { header_upstream Host {host} } } Compared to nginx it's just so much simpler and so far I haven't found myself missing a single feature. (In fact, caddy has active health checks, which nginx only supports for its extortionate enterprise fee)
- blowski 10y ago
  What's the performance like? Can you use it as a proxy server?
  - shawabawa3 10y ago
    I use it exclusively as a proxy server. I've never noticed any performance issues, I think I saw a benchmark where it said caddy can handle 2000req/s, which is at least an order of magnitude or 2 faster than any upstream service I've used it in front of.
    - coldtea 10y ago
      >I think I saw a benchmark where it said caddy can handle 2000req/s Those are application level numbers (e.g. with logic and all). Caddy should be able to handle an order of magnitude more req/s than that easily.
      - anc84 10y ago
        One year ago Matt said 30000req/s: https://forum.caddyserver.com/t/can-i-use-caddy-for-a-high-traffic-site/108/15 https://forum.caddyserver.com/t/can-i-use-caddy-for-a-high-t...
      - shawabawa3 10y ago
grey-area 10y ago
It's a lot easier than ngxinx + letsencrypt + cron job - there is zero config to get letsencrypt up and running and certs renewing automatically. It supports http2 out of the box and will keep improving as the go net/http library does, performance is good (certainly good enough for 99.9% of the static sites out there, I haven't specifically benchmarked against nginx but response times didn't change much). I'd recommend it as a proxy if you need one, particularly if you need one that handles your tls certs.
singlow 10y ago
I use Nginx in production, but caddy on my dev machine, where I might have dozens of test sites running at any time. Those sites all live on subdomains of a dedicated dev domain and I rarely create more than 2 or 3 per week so I can always just use https with certificates generated on the fly. In Nginx I would need to constantly re-run certbot to add subdomains manually.
- eliaspro 10y ago
  For all local/non-public instances I just use "tls self_signed" and have Caddy generate a cert on demand.
nemothekid 10y ago
A lot of the other responses have been focusing on how simple Caddy is to get started with - batteries included. We've been using Caddy for a bit over 2 years in production. At the time we had just moved our infrastructure from an assortment of self-written python scripts to Mesos/Marathon. We were looking for a solution that would reverse proxy to our app servers without having to rely on DNS. I initially thought about writing a plugin for nginx before I found Caddy. When we found Caddy, it was a better solution for us as it was far easier to write a mesos integration for rather than trying to integrate it into nginx.

lol768 10y ago

The MitM detection is interesting. How long until these appliances start altering the HTTP request's User-Agent header to avoid detection (or adding logic such that the handshaking process mimics that of the browser), though? To me, HPKP with preloading seems like a more reliable approach (and browsers shouldn't allow this to be overridden [1]). [1] If this breaks corporate MitM attacks, great. This practice always struck me as incredibly invasive and I'd personally be concerned if an employer was doing this. I think some traffic data should be able to be logged and timestamped in case of abuse (e.g. SNI info, TCP connections, DNS lookups) but I don't see a need to intercept application data - and honestly, it seems like the vast majority of these appliances hinder security.

vosper 10y ago
I'd also be concerned if an employer was doing it, unless there was a good reason - and I can think of a few of those. For example, companies that deal with sensitive health, financial or legal information. They may need assurances (or at least a paper trail) that's a lot stronger than "we don't MITM and we trust our employees to do the right thing".
- martingxx 10y ago
  Even with those reasons, I believe the risk outweighs the potential benefits. It's not just about trusting the intentions and assurances of the company, but also their competency and knowing they're not being compromised etc. Hackers don't care about paper trails. These are things you typically can't measure. If you have untrustworthy employees, you have bigger problems than you can solve with by MITM attacking everyone.
- tracker1 10y ago
  I've worked at a couple financial institutions where all http/https traffic is proxied transparently (with internal key installed on corp computers)... certainly makes working with command line utils interesting... HTTP_PROXY HTTPS_PROXY are mostly friendly, but some aren't so nice.
- lol768 10y ago

overcast 10y ago

So far I'm loving Caddy. Super simple to configure, and the auto management of SSL certificates is magical. However, for all of the simplicity, they are still pretty resistant to properly packaging it up in the repositories. By far the longest part of getting it running, is the stupid manual configuration of launch daemons, working directories, and permissions. For software that prides itself on dead simple management, the basics of getting it into a package manager should not even be a discussion. With that said, I 100% moved all of my sites from Nginx to Caddy after the config file setup is around three lines per site.

bauerd 10y ago
>the basics of getting it into a package manager should not even be a discussion. Last time I looked into it, their problem was that Caddy plugins must be configured at compile-time, because runtime plugins seem to be hard to do with Golang (besides RPC). Because there's a handful of Caddy plugins, they'd either have to provide a slim package with no plugins, or ship with all or only some blessed plugins. Obviously all approaches have drawbacks … they discussed the option of shipping their own package manager for Caddy plugins, too (shudder). See: https://forum.caddyserver.com/t/packaging-caddy/61 https://forum.caddyserver.com/t/packaging-caddy/61
- singlow 10y ago
  Nginx had the same issue. Ubuntu ships 3 or 4 versions - nginx-light, nginx, nginx-full, nginx-extras - for different numbers of modules included.
  - finid 10y ago
    With dynamic modules support now in Nginx, that practice should end.
    - JdeBP 10y ago
      As Michael Lustfield said in Debian bug #790623 in October 2015.

papey 10y ago

Awesome product, I'm using it at work and it's incredibly fast. Configuration is easy, documentation is clear. The systemd unit provided in the repo is insane, all the latest security and isolation stuff are in it, a great inpiration for writing good systemd units.

mixmastamyk 9y ago
Took me a while to find: https://github.com/mholt/caddy/tree/master/dist/init/linux-systemd https://github.com/mholt/caddy/tree/master/dist/init/linux-s...

jhack 10y ago

This is the first I've heard of Caddy and I'm really impressed by the feature set. Looks like a breath of fresh air, can't wait to try it.

haarts 10y ago

They mention that 'Default Timeouts' have been disabled. Urging users to 'Act according to your threat model!'. I'm not sure I understand. How is not having these timeouts a security thread? Someone could potentially open up enough HTTP connections to starve others from having the opportunity to do so?

titanomachy 10y ago
Yeah, you could take all the file descriptors by opening a whole bunch of connections.
mholt 10y ago
This is true; but slowloris attacks don't require opening as many connections. We've seen one or two instances where buggy (or malicious?) clients were slowlorising Caddy instances; but we were too eager to enable timeouts by default I think.
- zzzcpan 10y ago
  No, not having timeouts is rather bad practice. There are a lot of clients out there that never close connections for various reasons. And since TCP doesn't use healthchecks and most systems by default have limits on the number of descriptors per process, your web server in default configuration will simply leak descriptors and memory over time until the whole thing stops working. The only sane choice here is to have timeouts enabled everywhere and explicitly allow them to be disabled, not the other way around.
  - mholt 10y ago
    Believe me, we wanted to do this, but it broke a lot of WebSocket connections and other legitimate, long-lived connections. It confused many users. It's hard to know what is legitimate and what is not. I wish we could configure timeouts on a per-request basis but not without some serious hacking around the net/http lib for now. I do encourage setting timeouts when you are able to. It's easy, for example: timeouts 30s I have heard of occasions where people have done this and it made their servers breathe again. At this point it's just up to your discretion/judgment.

jbergstroem 10y ago

I would just like to bring up how much I admire the way they want to profit off Caddy[1][2]. Sponsorships and focused development; followed by "remember, caddy is open source". My only feedback would be that they introduce a "$50/mo; my bank is not big enough" for people that wants to endorse their model/software. Look at nginx, where new functionality is hidden behind a paywall. I don't want to deny them [nginx devs and sales people] their well-deserved money, but it pushes me away. [1]: https://caddyserver.com/blog/options-for-businesses https://caddyserver.com/blog/options-for-businesses [2]: https://caddyserver.com/pricing https://caddyserver.com/pricing

mholt 10y ago
Thanks for the feedback! We are mindful of people who want to contribute funds but aren't able to because of the price. We get a lot of requests for stickers and T-shirts and even jackets/sweaters; so we might go that route for individuals being able to contribute.
- tnorthcutt 10y ago
  Why not introduce a $50/month (hell, even a "pay what you want") option, with no sponsorship benefits (mentions, link, etc.)? Depending on volume, you could still offer Slack access as a benefit, perhaps if paid up front for a year.
  - mholt 10y ago
    That's possible! We wanted to gauge initial interest first but let me talk to Cory about this.
- deftnerd 10y ago
  I would be interested in something that made it so when I donated, an additional plugin was created in the download that outputted my support of caddy in the header or as some kind of call to be included in web pages. Something similar to how SVG based icons are used in many Git repos to display TravisCI scan results of the number of downloads. A similar badge could be supplied via plugin to supporters that shows how much the user has donated to the Caddy project or that they're a contributing member.

sergiotapia 10y ago

Caddy is a web server written entirely in Go. Features: - Easy configuration with Caddyfile - Automatic HTTPS via Let's Encrypt; Caddy obtains and manages all cryptographic assets for you - HTTP/2 enabled by default (powered by Go standard library) - Virtual hosting for hundreds of sites per server instance, including TLS SNI - Experimental QUIC support for those that like speed TLS session ticket key rotation for more secure connections - Brilliant extensibility so Caddy can be customized for your needs - Runs anywhere with no external dependencies (not even libc)

weberc2 10y ago
Are you sure it doesn't even depend on libc? Most Go programs do end up depending on libc by default; they have to be specially compiled to avoid the libc dep (IIRC, anything that depends on net or net/http or something of that sort).
- kevinburke 10y ago
  Go ships with both a pure Go and a libc-based DNS resolver. Some systems (like OS X) don't let Go make DNS requests directly. For more see https://golang.org/pkg/net/#hdr-Name_Resolution https://golang.org/pkg/net/#hdr-Name_Resolution
  - cutsoup 10y ago
    > Some systems (like OS X) don't let Go make DNS requests directly. I don't think this is a reasonable summary of the situation on OS X. That being that if you turn the firewall on and then turn on block of incoming connections on 10.11 and earlier, responses seem to get dropped. Characterizing that as a blanket disallowing of direct DNS requests is misleading. (I'm not defending OS X here, it's just that summaries like this turn into cargo cults.)
pbreit 10y ago
So is it ready for "prime time"? Should I be considering it over Nginx for side projects or real projects?

bpierre 10y ago

How does it compare with https://traefik.io/ https://traefik.io/ (reverse proxy, written in Go, automatic HTTPS / letsencrypt) ?

CrowderSoup 10y ago
It looks like traefik has a few more features tbh, I'll definitely be giving this a serious look.
tscs37 10y ago
Traefik is purely a proxy, Caddy is a webserver. Traefik can efficiently deal with proxying HTTP traffic but cannot serve files and is not as easy to configure if you're not using Docker or similar. Caddy can serve files or PHP but is not as good with proxying HTTP traffic.
doublerebel 10y ago
Yep, I use the similar eBay/fabio which pulls my LE certs from hashicorp/vault, much better than leaving them in a filesystem. Can't imagine using a proxy/ingress/LB without automatic reactive routing these days. All I have to tell Fabio is what interface to listen to.
- zenlikethat 10y ago
  Why do you say it's better to pull them from Vault? Unless MTLS is set up talking to Vault, you are pulling secrets unencrypted (and maybe unauthenticated) over the network... a local file system is not bad for small scale deployments if setup with the proper permissions.

nzjrs 10y ago

Anyone with experience using this as a dynamic reverse proxy - I need to proxy certain requests to private container (ports) where the port isn't known until the container is booted, and containers come up and down as users require them.

doublerebel 10y ago
eBay/fabio or Traefik.io both fit that description. Linkerd and Envoy probably do too but I have less experience with those.
xemoka 10y ago
Sounds like Traefick.io mentioned above should do the trick there. Looks like an interesting tool...
tyingq 10y ago
Depending on what that private container is serving up, an API gateway might work better. Tyk is one that's written in golang. It has a rest API and hot reload, so it should be able to handle your use case of dynamically allocated ports. http://tyk.io http://tyk.io
- deleted 10y ago
  [deleted]
LeonidBugaev 10y ago
You can use service discovery tools like Consul or Etcd. Basic idea that on container/app boot, you register your app to service discovery service (you give it IP and current port), and it stores information about your all running apps. After you can use consul Nginx integration (it will dynamically generate Nginx config on all updates, and will restart it). Tyk mentioned here also have Consul service integration and much more.
zzzcpan 10y ago
Nginx can proxy to a server specified in a variable. All you have to do is define that variable though perl or lua to get port dynamically from somewhere, like a file.

cdnsteve 10y ago

Does Caddy have a pluggable extension set where you can write your own middleware, in Go?

zalmoxes 10y ago
It does and it's documented on the wiki. I've written a few plugins privately, like implementing SCEP into caddy and adding a few other features. Due to the nature of the plug system, you'll have to build caddy yourself if you add customizations like that.
zalmoxes 10y ago
https://github.com/mholt/caddy/wiki https://github.com/mholt/caddy/wiki

snowpalmer 10y ago

Any benefit in using this inside a docker container instead of nginx? No need for SSL or many of the other features I'm seeing listed here since it's all behind an Amazon ELB.

xrstf 10y ago
We are using Caddy as a simple reverse proxy in Docker environments. The configuration is a bit simpler than nginx and we love the tiny Docker images we can create (not sure how large an nginx-full installation is). That being said, we did run into a few issues that forced us to go back to older Caddy versions, like broken websocket support or the timeout issue in 0.9.5. Also, sometimes the documentation is a bit lacking and unclear. DNS resolution seems to be flaky sometimes (we're using alpine-based containers and sometimes Caddy just won't resolve names of other containers, even though a curl inside the container can resolve the names just fine). So if you've got a working nginx setup, I'd say stick with it. For new projects it is worth to check out Caddy. The issues we ran into occured early in our development process, they didn't just suddenly happen in production, so once you've tested everything, Caddy just works.

mike-cardwell 10y ago

Surprised there isn't more talk about the MITM detection here. Anyone got a TLDR of how this is supposed to work? I'm going to read the full doc when I get home, but I'd be interested in hearing peoples opinions on how accurate it is likely to be.

kondbg 10y ago
The authors of the original paper [1] identified that the set of client cipher suites advertised by each browser can be used to fingerprint and identify a browser. Caddy records the cipher suite advertised by the client during the TLS handshake and then later examines the client's user agent. Using the fingerprinting techniques mentioned in the paper, Caddy then determines whether or not the advertised user-agent is compatible with the user-agent that it inferred through the client cipher suites. TLS interception proxies establish their own TLS connection to the server. Depending on what underlying TLS library the proxy uses, it also has its own unique fingerprint. When the TLS proxy forwards the user's request, Caddy detects the mismatch and flags it as a MITM. [1] https://jhalderm.com/pub/papers/interception-ndss17.pdf https://jhalderm.com/pub/papers/interception-ndss17.pdf

daari0 10y ago

Is ECDHE_ECDSA possible on Caddy?

brotherjerky 10y ago

Is there an official Docker image yet?

mholt 10y ago
No, but this is the one I usually recommend for now: https://hub.docker.com/r/abiosoft/caddy/ https://hub.docker.com/r/abiosoft/caddy/

dyeje 10y ago

Pricing page is pretty bad. Draws your eyes with primary colors and bold fonts to $5000/yr and $9900/yr. I had to swallow the sticker shock and look around the page to see the weird, faded side-bubble telling me it's free.

tlrobinson 10y ago

Random question: is there a way to start Caddy as root so it can bind to port 80 (for example) then change the user so a non-root user can send a `USR1` signal to Caddy to get it to reload the configuration?

zufallsheld 10y ago
At least with systemd caddy starts as a non-root user, if you use the provided unit-file: https://github.com/mholt/caddy/tree/master/dist/init/linux-systemd https://github.com/mholt/caddy/tree/master/dist/init/linux-s...
- tlrobinson 10y ago
  Is there something like `setcap` for macOS? Give the caddy binary the ability to bind to privileged ports (e.g. 80, 443) as a non-root user: sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/caddy
  - tyingq 10y ago
    There isn't. There's a port of authbind, but I don't think anyone was able to get it working with caddy. The only solution I've heard of working is using the pf firewall to port forward, for example, 8080 to 80. Like this: https://salferrarello.com/mac-pfctl-port-forwarding/ https://salferrarello.com/mac-pfctl-port-forwarding/
  - deleted 10y ago
    [deleted]
- JdeBP 10y ago
  Better systemd integration would use the LISTEN_FDS mechanism, letting the service management subsystem open the privileged-access listening socket as instructed by a socket unit.
jazoom 10y ago
Yes. From their GitHub readme: Running as root: We advise against this. You can still listen on ports < 1024 using setcap like so: sudo setcap cap_net_bind_service=+ep ./caddy

thearrow 10y ago

PSA for those who use caddy's proxy "without" configuration item - it is broken in 0.10: https://github.com/mholt/caddy/issues/1604 https://github.com/mholt/caddy/issues/1604 This bit our app during testing.

snowpanda 10y ago

I always really liked this video by Matt: https://www.youtube.com/watch?v=ZyVA9tuif4s https://www.youtube.com/watch?v=ZyVA9tuif4s The way he explains things makes me wish he did tutorials for programming languages.