23 ms·

Announcing Caddy Commercial Licenses

156 points by OberstKrueger 9y ago

dchest 9y ago
Beginning today, all official Caddy binaries come with an End User License Agreement (EULA) that designates them either for Personal (non-commercial) or Commercial use. To be clear, this EULA applies only to Caddy binaries you download; it does not apply to the source code. Caddy is still open source, and the source code is under the same Apache 2.0 license. Thanks for keeping it open source. I'm very interested in how this business model will work, glad to see people trying different approaches.
- fortythirteen 9y ago
  Since you could pull yesterday's version: OpenOffice -> LibreOffice Gnome -> Mate Caddy -> ?
  - mattl 9y ago
    Wedge. https://github.com/WedgeServer/wedge https://github.com/WedgeServer/wedge
  - dchest 9y ago
    You can pull today's or future versions as it's still open source under the same license. Please read the above quote.
  - bboozzoo 9y ago
    shady
davb 9y ago
> 1/4 price of comparable servers Which servers?
- tiernano 9y ago
  Wondering the same thing... nginx has a commercial option, but does not force you to use it if your using it in a business environment... iis is only available on windows server, and that costs about 600 quid for a standard license. That’s a one off cost... so... it might be quarter of the cost of enterprise (3k give or take) but over the life time of the box, it would end up being more...
  - Whitestrake 9y ago
    Caddy's new commercial licensing, like nginx, is completely optional as the actual source license continues to be Apache 2.0. For any business running their own web servers, compiling Caddy themselves instead of utilizing the build server at caddyserver.com is a trivial step that also gives them greater control over the binary they end up using anyway.
    - tiernano 9y ago
      Yea, but in the case of nginx, their binaries are Free full stop... it’s only extras or support that need license...
- Whitestrake 9y ago
  The most apparent comparison looks to be NGINX Plus, for which the lowest cost tier works out at over $200/month ($2,500/year) per instance. https://www.nginx.com/products/buy-nginx-plus/ https://www.nginx.com/products/buy-nginx-plus/
  - deleted 9y ago
    [deleted]
winter_blue 9y ago
Key Quote: To be clear, this EULA applies only to Caddy binaries you download; it does not apply to the source code. Caddy is still open source, and the source code is under the same Apache 2.0 license. Doesn't this mean that you can simply compile Caddy from source, and avoid having to pay for commercial use? Most Caddy users are likely going be comfortable with compiling stuff, so what benefits does paying bring besides private plugin hosting?
- arghwhat 9y ago
  That's often the case. The answer is priority support and developer time for bugfixes/feature requests, and potentially commercial-only features. Think Red Hat Linux.
- bauerd 9y ago
  AFAIK you have to specify plugins at compile time in the source code. Don't know if the installation scripts/endpoints that spit out the official binaries are open source, though.
- mholt 9y ago
  You're right, you can build from source under the Apache license. Keeping the project truly open source is really important to us, because the community is such a great part of using Caddy. Commercial licenses would only cost hundreds of thousands of dollars per year if your organization has at least 160 instances in use. Keep in mind that modifying the source is required to plug in any plugins, which people tend not to want to bother with. We're also looking into adding more features for our customers.
  - unkown-unknowns 9y ago
    > Keep in mind that modifying the source is required to plug in any plugins, which people tend not to want to bother with. I've only ever used Caddy without plugins, so I'm not familiar with how it works but do you mean that plugins in general must be enabled or that the specific set of plugins I want must be compiled in? If the latter then I think they are not so much plugins as some kind of extension. Please clarify, thanks.
tuananh 9y ago
homepage 503 https://dl.dropboxusercontent.com/s/phh5xebd1jqj27l/2017-09-13%20at%208.41%20PM.png https://dl.dropboxusercontent.com/s/phh5xebd1jqj27l/2017-09-...
- mholt 9y ago
  Ugh, I forgot to raise the file descriptor limit when I re-provisioned the site. Leave it to me to blunder that. :)
notyourday 9y ago
I always find it funny when the announcement of a new, pay for software, especially a web server leads to 503. Especially when it looks like an HTML page.
- mholt 9y ago
  I misconfigured the machine; just raised the file descriptor limit and we should be good now.
romanovcode 9y ago
> If you use Caddy for personal, academic, or non-profit purposes, not much is different. Caddy-Sponsors HTTP Header > If you use or distribute official Caddy binaries at work, or as part of a product/service, you will need a commercial license If I have some personal project which I want to incorporate I need to worry about the license. Oh, time to switch back to NGINX. Thanks for automated HTTPS while it lasted.
- Whitestrake 9y ago
  This is incorrect, or at least only half-true. Caddy is still Apache 2.0 licensed. You can use it for free for commercial purposes. You just can't use the build server at caddyserver.com to download a precompiled Caddy with plugins. Instead, you can download the source, compile it with plugins yourself, then distribute your own binary amongst all your hosts.
  - romanovcode 9y ago
    Yeah, I guess you're right. But then again setting up NGINX with auto SSL would be easier so what's the point. Personally for me Caddy is (was) good because of how easy it is to set it up.
    - Whitestrake 9y ago
      I'm not sure I agree with you there. The most popular Docker image for Caddy, for example, should soon (if it's not already) be compiled from source, rather than from the build server. That means it will remain free to use, and I personally don't have to make a single change. If this has impacted you negatively to the point where setting up nginx is an easier option, well - that's the beauty of choice!
      - tylersmith 9y ago
        But the software in that image will still be written by untrustworthy adware developers. _That_ is the issue.
- 9y ago
deleted 9y ago
[deleted]
st3fan 9y ago
This is all great, I hope this turns into a viable business. But I am just not sure about the approach here. Maybe this is a good moment for someone to finally fork Caddy, remove the Sponsors header, and distribute proper RPMs and DEBs. Then those of us who want to use a truly open source project with no strings attached (special conditions re binaries, EULA, etc.) have nothing to worry about.
- overcast 9y ago
  I've been praying for proper distribution channels for installs. For a project that is all about simplicity in setup, the installation is such a hassle. Manually creating startup entries, directories, process users, horrible.
  - mholt 9y ago
    One of the things we're hoping to offer soon are official distro packages that can be customized with the plugins you want/need.
    - overcast 9y ago
      Thanks Matt, this is DESPERATELY needed for any reasonably sized rollouts(and even my own single personal rollout). Admins don't want to be manually installing software on machines like we're back in the days of compiling everything from source. Can we at least get the base package sorted before? I really don't need custom with any plugins.
    - st3fan 9y ago
      It does not matter if the binary restrictions and EULA are attached to those.
- pepa65 9y ago
  The issue is not forking. It is the build infrastructure to produce all the builds for each OS, architecture, and the desired plugins. This is added value that Caddy adds. It would be great for a replicated infrastructure to materialize. If it is well maintained it is even likely to overtake Caddy in terms of users, because it would be free software.
StavrosK 9y ago
I've been trying to get Caddy more widely deployed at work, and this move is going to alienate commercial customers (at least us) even more than Caddy already does. Not only do they not have repositories, essentially doubling the effort to keep machines up to date (we have to have one process to upgrade everything else, and one process to upgrade just Caddy), but now we can't even download precompiled binaries to deploy on the servers without paying. I could have put up with Caddy not being as mature as nginx for some low-volume deployments, and barely put up with the lack of debs, but having to compile my own binaries across the company isn't worth the integrated TLS certs.
- mholt 9y ago
  > Not only do they not have repositories, essentially doubling the effort to keep machines up to date (we have to have one process to upgrade everything else, and one process to upgrade just Caddy) Cory's working on this, actually. If we can get it working, we should be able to offer official Caddy packages to all our customers, customized just how they need it to be, so your 'apt upgrade' could upgrade Caddy as well, with just the plugins you want. > I could have put up with Caddy not being as mature as nginx for some low-volume deployments, and barely put up with the lack of debs, but having to compile my own binaries across the company isn't worth the integrated TLS certs. Until we have official apt repos, you're welcome to use getcaddy.com which automates builds and installations of Caddy. True, it's not "apt install" but it's pretty close, until we can get apt repos and others available.
  - fps 9y ago
    > True, it's not "apt install" but it's pretty close I feel like maybe you don't know what apt does, or how it's used, if you think that shell script is "pretty close."
  - StavrosK 9y ago
    > it's not "apt install" but it's pretty close It's not close, though, it's very far. With apt, I know things are going to go in their proper place, and are going to get cleaned up afterwards (not to mention the biggest benefit, automatic updates). With a shell script, I don't know what sort of stuff it puts where on my filesystem, and I can't automate the installation easily. My preferred order of installation procedures is: "apt", "manual", and "random shell script" is a distant last, to the point where I sometimes won't try software if the installation procedure isn't sane.
jimangel 9y ago
I completely understand this direction, and really appreciate the work mholt and team has put into Caddy, but I'm disappointed at the same time. I looked forward to spinning up my dumb ideas tied with commerce using Caddy (on a 0 budget). I've been a Caddy evangelist ever since discovering the powers (auto HTTPS, git webhooks, simple config, etc.), I had plans to write blogs about simple sites for simple ideas that can generate money - but nothing that would allow me to swing $100/mo. I understand that I can compile the source and remain compliant, however, part of the charm was the simplicity once paired with docker for rapid dev/deployment. Does anyone know if there's significant pain in maintaining a docker image that compiles source code like Caddy on rebuild?
- codebeaker 9y ago
  I couldn't agree more. The terms seem overly restrictive. Let's hope that they don't "go after" anyone who's not compliant and that this is silently a scheme to force bigger companies into compliance and let the rest of us fly under the radar. As-is, I would owe Caddy $300/month - none of my side projects can sustain that, so I'll be switching back to nginx and some LE cronjobs.
  - StavrosK 9y ago
    Yeah, I have a bunch of side projects that collectively make ~$2/mo. Good thing I didn't replace nginx with Caddy on that server.
  - mholt 9y ago
    No schemes here, just an updated business plan. If the current pricing is too restrictive for your business, feel free to build from source (Caddy source code is Apache licensed)! Or contact us, sales@lightcodelabs.com, if you need a commercial license but your startup / side project has a constrained budget. We'll see if we can work something out for you.
- Whitestrake 9y ago
  > Does anyone know if there's significant pain in maintaining a docker image that compiles source code like Caddy on rebuild? It's insignificant. Multi-stage Dockerfiles mean you can build from the Golang image, pull mholt/caddy, compile to a binary, then distribute the result in a tiny Alpine image. I believe the maintainer of the current most popular Caddy image will be going source-compiled, too, so you might not even need to roll your own Dockerfile.
zaro 9y ago
> If you use Caddy for personal, academic, or non-profit purposes, not much is different. Just a new response header that gives tribute to our sponsors. So now there will be ads even in the HTTP headers. Coming soon, ads in the tcp headers ...
lol768 9y ago
> As of version 0.10.9, Caddy emits an HTTP response header, Caddy-Sponsors, which is similar to the Server header that Caddy already has, except that this one credits our sponsors who make it possible to keep Caddy free for personal use. This header cannot be removed by the Caddyfile, and its presence is required by the non-commercial EULA. This requirement is waived by the commercial license, so the header is not present in those binaries. Really not a fan of this, guess I'll be compiling my own builds from now on. Don't get me wrong, I think charging for commercial licenses (which come with proper support) is a good business model, but my personal site shouldn't suddenly become an advertising outlet. The fact that the headers aren't seen by most non-technical users is moot. I find this practice pretty obnoxious to the point of looking at NGINX Plus for commercial use instead. Edit: Here's my fork https://github.com/WedgeServer/wedge https://github.com/WedgeServer/wedge Second edit: Accusation of trademark violation within an hour of the fork, classy! https://github.com/WedgeServer/wedge/issues/2 https://github.com/WedgeServer/wedge/issues/2
- UseStrict 9y ago
  Wow, in the course of this HN thread I went from learning about Caddy, to deciding against using it. Definitely not cool to immediately threaten legal action almost instantly after forking. Definitely not cool to force a header. I'll be sticking with nginx.
  - callahad 9y ago
    Which is frustrating, because Caddy is a great product, especially from a solo operator standpoint. Configuration is simple and the defaults are sane. The humans behind Caddy are nice people. And while this move has somewhat soured my opinion of the project, I'm not so much angry as I am... sad. I want to use Caddy. I am using Caddy. But I don't want to use this Caddy, at the moment.
    - kuschku 9y ago
      Actually, the defaults are quite insane. For example: You might know that all domain names are in the root zone, named ".", so any domain actually is resolved to e.g. news.ycombinator.com. And if you enter the domain with the dot, it is the same DNS name, and should give you the same result. Apache does that, Nginx does that, Google’s cloud does that, Amazon’s cloud does that, all major sites do that... Caddy considers it irrelevant, and something users should add manually for all of their rules if they want it. Ignoring all the RFCs, because of personal ideals. https://github.com/mholt/caddy/issues/1632 https://github.com/mholt/caddy/issues/1632
ash 9y ago
> We now require declaring a license when requesting a download: > https://caddyserver.com/download/<os>/<arch>?license=personal https://caddyserver.com/download/<os>/<arch>?license=persona... > The value for the license variable can be either personal or commercial. > … > We require the license parameter because we feel it's important for the license to be deliberate, not assumed. To ease the transition into this, though, we'll allow the current syntax (no license parameter) to work for at least 30 more days, and a personal license will be assumed. I think this warning should be more prominent. Lot's of CI builds would mysteriously fail after 30+ days.
- mholt 9y ago
  I'll work on that. But the error message is very clear, so if any error reporting is enabled, it'll be pretty obvious what to do, at least. The fact that people were relying on volunteer-supported infrastructure for their CI builds is a little unnerving to me, hence the move to commercial support.
  - iampims 9y ago
    Why not upload them to GitHub?
    - gtirloni 9y ago
      Exactly, building and pushing to GitHub is a set-and-forget process. Besides, it already needs to be done for paying customers now so what kind of work is that saving Caddy? I don't understand. EDIT: Additionally, it's an error to think that non-paying customers are not contributing. It's actually a pretty basic misunderstanding for an open source company. Users are contributing with bug reports, small fixes, testing, marketing, etc. It amazes me we still see this feeling in 2017. I dare all companies with open source projects to actually close them and replace non-paying customers with QA teams, more developers, more infrastructure, etc. Make sure to increase your budgets and raise your prices accordingly.
      - iampims 9y ago
stephenr 9y ago
Copied comment from the other HN thread: $50 dollars a MONTH PER INSTANCE for a piece of software that wouldn't even start a few months ago because LetsEncrypt was down. I get that software takes time and people need to eat, but holy shit on a stick. Edit: Oh, and I forgot the part where it also doesn't handle FQDN's properly either. Previous discussion, from when LE was down for a day https://news.ycombinator.com/item?id=14375022 https://news.ycombinator.com/item?id=14375022
- Whitestrake 9y ago
  I think your outburst might be rooted in a misunderstanding. As stated in a few other places in this thread, the software remains 100% free, including for commercial purposes. In order to make use of the build server at caddyserver.com, you need to have either a personal or commercial license. The build server provides precompiled binaries with your customized selection of plugins included. The use of the build server is in no way necessary for the deployment of Caddy in any circumstance.
  - stephenr 9y ago
    I understand that the source is available. My surprise is that you think anyone will pay $50 per month per instance forever, for a build service they might use only once, and that still requires them to actually do all the work to install it and run it as a service.
Xunxi 9y ago
What are the key differences between Caddy and Centminmod? I would like to know the comparative speeds, use cases and disadvantages if any. Also congrats to you Holt for taking this bold step to sustain development. Quite recently WangGuard became a victim of freebies and the nonreciprocal donation from users. I hope this endeavor pays off
donatj 9y ago
Caddy is OK, easy to setup on a personal machine, but nginx's performance trumped it completely in our testing. Particularly when requesting large numbers of files concurrently. I genuinely don't know why a business would use Caddy over nginx, especially given the new commercial licensing scheme. nginx really isn't that hard to setup.
- sfifs 9y ago
  Running Caddy is literally copying a binary and your site over and setting up the systemd config. LetsEncrypt works automagically out of the box.
  - rlonstein 9y ago
    > LetsEncrypt works automagically out of the box Provided you let Caddy manage all the certs and/or permit dynamic dns updates on that host. Went through this last night and it's underdocumented when you want to handle it yourself with TXT records and explicit cert/key.
- mholt 9y ago
  The business use case isn't just about performance; businesses also get private plugin hosting, basic email support, and in the future, other amenities as well. We'll be optimizing Caddy more over time. You can also use the http.cache plugin to help with performance: https://caddyserver.com/docs/http.cache https://caddyserver.com/docs/http.cache
pryelluw 9y ago
1. I applaud this effort. 2. Ive been researching sustainable funding models for open source. Will the maintainers be blogging about the progress and results? Would be useful to learn about what they discover.
- nqzero 9y ago
  i've been trying to come up with a license that captures enough of the freedoms of open source to protect the user while allowing for a non-zero cost. my license is below - it's not open source, but if you're willing to consider licenses that are liberal but not OS, i'd love to hear your comments http://db4j.org/pupl/PUPL http://db4j.org/pupl/PUPL
  - pryelluw 9y ago
    Thanks for posting. Ill check it out. :)
- throwa34943way 9y ago
  > 2. Ive been researching sustainable funding models for open source. Will the maintainers be blogging about the progress and results? Would be useful to learn about what they discover. Well, just ask $50.000 from Mozilla for an "open source project" grant "like" Caddy got and you're settled for at least a year. https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-385000-to-open-source-projects-as-part-of-moss-mission-partners-program/ https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-3850...
JamesMcMinn 9y ago
Well, I guess I'm moving switching from Caddy to NGINX then. I like Caddy, it's been great, but I have no interest in paying for support, and I'm certainly not going to pay to remove a HTTP header. Yes, I could spend time setting everything up to build custom versions of Caddy without the header, but it'll be quicker and easier to switch to NGINX. Whilst I really appreciate all the work that has gone into Caddy, I am extremely annoyed that it's now going to cost me at least an afternoon to move away from. If you're an existing Caddy user and don't want to (or can't) pay, your options are either don't upgrade, server ads for Caddys sponsors, or spend a significant amount of time configuring your own build process/switching to something else. I can't help but feel this move is going to be bad for Caddys adoption.
- lol768 9y ago
  Yeah, I'm in the same position now. As you mention, NGINX is reasonably straightforward to set up if you're remotely technical or hell, if you can follow a tutorial. It's a huge shame, because I used to recommend Caddy for how easy it was to get TLS to work.
- mholt 9y ago
  Caddy is still open source, Apache licensed. You can certainly build from source as long as you give attribution and state your changes.
  - JamesMcMinn 9y ago
    Matt, I really do appreciate the work you and others have put into Caddy - it's a fantastic piece of software which has served me well for the past year and a bit. Having said that, this change has put me in a position where I have to invest either time or money into a solution for a problem which I didn't have yesterday, and switching to NGINX seems like the path least likely to cause issues in the future. Having to build my own version of Caddy for every update is a cost I'm not willing to pay. Since I'm being forced to invest in something, it may as well be NGINX, and I suspect I'm not alone in this.
    - 9y ago
Sir_Cmpwn 9y ago
I said further below that this makes Caddy nonfree, but I was corrected - you can still build Caddy from source, remove the bullshit, and distribute your changes and compiled binaries under Apache 2.0. However, after examining the website more I feel the need to write another comment expressing how poorly this is being handled. The website is very misleading - on the download page, it now asks you to pick a license, and says that the "Personal" version is for only personal use and you need to pay for the commercial version. There's no indication until you click through to the full pricing page that the open source version even exists. On that page, you have the same personal/commercial breakdown, also stating that the personal version is strictly for non-commercial use, but with a sidebar mentioning open source. It assumes you understand the Apache 2.0 license and makes no attempt to clarify that businesses can use the open source version. The authors are also wasting no time in going after forks[1] to complain about trademark infringement, so if you want to distribute your own patched Caddy builds you can expect to hear from their lawyers. Absolutely devoid of class. This is a really obnoxious change. I was thinking about switching from Nginx to Caddy but this news is nailing that door shut. [1] https://github.com/WedgeServer/wedge/issues/2 https://github.com/WedgeServer/wedge/issues/2
- Whitestrake 9y ago
  > The authors are also wasting no time in going after forks[1] to complain about trademark infringement, so if you want to distribute your own patched Caddy builds you can expect to hear from their lawyers. Absolutely devoid of class. This in particular doesn't seem fair. Trademark really requires trademark holders to make active efforts to preserve their trademarks as soon as they're aware of potential breaches, or they invite risk. And this is a simple request in the fork's issues page - no lawyers are involved yet, as far as I can tell.
  - Sir_Cmpwn 9y ago
    There's not even a registered trademark, as they stated. And simply distributing a modified version of an open source project under that project's name is absolutely fine and pushing against it is definitely in bad faith. >And this is a simple request in the fork's issues page - no lawyers are involved yet, as far as I can tell. Well, what do you think their next step is if they refuse?
tjholowaychuk 9y ago
Congrats! Good luck. Ignore all the angry people they clearly have no idea what it's like to try and make a living off this stuff, just entitled spoiled brats. Not to mention the salary that most developers make, paying $25-100/m for software you enjoy is not much. IMHO if you can't justify the price, then don't use it.
- Whitestrake 9y ago
  Well, everyone's opinion is valid and useful as feedback. The good part is, if you can't justify the price, surely you can justify the time to write a bash script to compile it yourself? Further up this comments page is one fantastic example. There's still plenty of options, really, not much has changed.
  - tjholowaychuk 9y ago
    For sure, but I think a lot of people have to realize they're not the target market for this kind of thing. You simply cannot make a living from people trying to run their side projects for < $5/m. Seeing people complain about paying for software is just annoying. They should work for free then, if that's their mentality.
    - deleted 9y ago
      [deleted]
    - deleted 9y ago
      [deleted]
    - throwa34943way 9y ago
      Sure, but being granted $50.000 from Mozilla under the claim of supporting an open source project can sustain you for at least 2 years. https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-385000-to-open-source-projects-as-part-of-moss-mission-partners-program/ https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-3850... Mozilla should have given the money to another project.
xena 9y ago
i personally like how one of the first contact bits from caddy to a fork of it is a thinly veiled legal threat: https://github.com/WedgeServer/wedge/issues/2 https://github.com/WedgeServer/wedge/issues/2
callahad 9y ago
Congratulations on the launch, and good luck finding a sustainable means of funding Caddy. It's a uniquely ergonomic webserver. That said, the unalterable Caddy-Sponsors HTTP header feels bad, and cheapens my overall impression of Caddy as a quality product. Now, instead of paying for a license to gain access to enterprise features or support, I'm paying to remove ads. From my webserver. Which now has a custom license that I have to read, remember, and figure out how to comply with. I give up. I'm an individual running 8 little caddy containers on a $5/mo VPS. The cognitive load simply isn't worth it, and I hope you'll reconsider. Otherwise, it's back to cobbling things together with nginx and haproxy. :(
- Whitestrake 9y ago
  > That said, the unalterable Caddy-Sponsors HTTP header feels bad, and cheapens my overall impression of Caddy as a quality product. Hit the nail on the head. There's lots of reasons why this is a non-problem, intellectually speaking, but none of the arguments for this remove the bad taste in my mouth, emotionally speaking. The other news doesn't bother me, but the header... disappoints me.
- tssva 9y ago
  There are a variety of docker containers available which integrate letsencrypt and nginx. Personally I use the linuxserver.io letsencrypt container to proxy my personal projects. You specify the domain names you need a certificate for at container startup via an environment variable and it takes care of getting the certificate issued and renewing as needed. Restarting with additional names added or names removed will result in the previous certificate being revoked and a new one issued as appropriate. This replaced my use of caddy for my personal projects about 3 weeks ago. A decision I debated before making and am now glad I made.
gtirloni 9y ago
If Caddy had focused on providing commercial support to companeis that need it, this would have been a good day. As it is, they are adding artificial roadblocks for open source users while providing minimal benefits to commercial users. Someone didn't think this through or is out of touch with how to make money with open source.
andmarios 9y ago
Not being able to use the release binaries (even from github) for commercial purposes is a bummer but if this is the price to pay for having caddy available as open source, then it is fair. What I am afraid of, is that this friction to start with caddy (because $50 per month is way too much for most use cases) will affect its user base and as a consequence the participation in development. Of course mholt and the team behind caddy are the people who love it the most and care about its future the most, so I trust they will keep pushing forward. For people who find it difficult to build caddy from source, here is an example, provided you have Go installed and configured: go get github.com/mholt/caddy go get github.com/caddyserver/builds cd "$GOPATH/src/github.com/mholt/caddy/caddy" # Enable cors, prometheus plugins. cat <<EOF>caddymain/plugins.go package caddymain import ( _ "github.com/captncraig/cors/caddy" _ "github.com/miekg/caddy-prometheus" ) EOF go get -u -v -f ... || echo "Updated dependencies" go run build.go Edit: updated with the latest build procedure
- Whitestrake 9y ago
  To compile without the `Caddy-Sponsors` header, include this line before the plugin comment: sed -ie '/Header().Set("Caddy-Sponsors/d' ../caddyhttp/httpserver/server.go
  - andmarios 9y ago
    Thanks, although I personally will keep it. When I was maintaining web servers as a living I used to add a custom header here and there, so I see no harm in the practice.
  - tylersmith 9y ago
    This only helps until they start injecting data in different places. Maybe soon they'll add HTML comments or JavaScript to popup a notification. Now that they've shown they don't care about users' data security I don't know why anybody would expect them to stop here.
callahad 9y ago
My first thought upon finding out that Caddy's source was still under an open source license was "can that change, too?" As far as I can tell, the answer is "not unilaterally," as I don't see any requirements for copyright assignment in the contributing guidelines https://github.com/mholt/caddy/blob/master/.github/CONTRIBUTING.md https://github.com/mholt/caddy/blob/master/.github/CONTRIBUT..., nor in merged pull requests.
oliwarner 9y ago
Site is currently down. We've talked at length about the time saving things Caddy may do for you, but crashing under the weight of a static page is not a good advertisement. Edit: it's back, but damage done, I think.
- callahad 9y ago
  The 503 error page was, itself, served by Caddy. Or at least it matched the default Caddy error pages, so those parts were evidently working just fine. :)
stephenr 9y ago
Just when you thought you knew what's going on. The author has claimed that prices will rise after an "introductory period": https://mobile.twitter.com/mholt6/status/908007933115375616 https://mobile.twitter.com/mholt6/status/908007933115375616
kevinburke 9y ago
I'm excited that Caddy has taken steps to ensure its long term survival. Sad people can't be bothered to pay for software they like.
- throwa34943way 9y ago
  > Sad people can't be bothered to pay for software they like They got $50.000 from Mozilla, AKA free software foundations financing commercial software with grants, but what is your opinion on this Mr Burke?
- warrenm 9y ago
  Lots of us (myself, certainly) do pay for software we like This argument doesn't really hold water: there are for-pay editions of all kinds of tools out there - Caddy easily could have taken one of those routes. They didn't.
JosephLark 9y ago
Came back to this thread during lunch, and a few things I'm seeing have me more worried about Caddy than I originally was. Originally it just seemed like a very minor misstep, but now it seems more likely to be the start of something worse. Can I ask - what exactly is Light Code Labs? The page really doesn't say much. It almost seems like some 3rd year Computer Engineering student at BYU came along and talked Matt Holt into creating a business of Caddy? I can't see anything about business expertise, and in the wedge fork trademark issue the other co-founder just responded that he was "part owner of Light Code Labs" and nothing about development. On the site it just says this person "recently got into web development...[and] wants technology to be more intuitive for people to use". It might just be my dislike of fluffy BS, but it seems like red flags to me.
- yroc92 9y ago
  It’s me, the other guy. That bio is pretty old, but it was accurate at the time. Caddy required a legal entity a few years ago for several reasons, so we went with “Light Code Labs”. LCL owns Caddy and is the legal entity through which we do business. mholt was (and still is) very concerned about making Caddy sustainable. I am also concerned about this, since I knew that mholt wasn’t going to maintain the project for free forever. So he invited me to join him and help with logistical things (money/taxes, trademarks, etc.), along with some technical things (currently working on an API for Caddy, as well as implementing apt-get with the build server). mholt is his own person, and I am not in a position to coerce him into doing things he doesn’t want to.
heipei 9y ago
caddyserver.com emits those headers if you want to see them in action: https://urlscan.io/result/8093833b-8ac7-4d18-8f20-a02373f577a1#transactions https://urlscan.io/result/8093833b-8ac7-4d18-8f20-a02373f577... Go to the first transaction, click the show button and click "Show headers". Right now it says: caddy-sponsors - This free web server is made possible by its sponsors: Minio, Uptime Robot, and Sourcegraph Personal opinion: I've never understood the appeal of Caddy except for the builtin Let's Encrypt / TLS automagic support. nginx is very powerful and at the same time pretty easy to configure, and I think they split the features between the Open Source and commercial version pretty reasonably.
- camus2 9y ago
  It has a few bells and whistle and there is some work behind it, no question. HOWEVER, the fact that it relies entirely on go std lib net/http|http2 package implementations personally doesn't make it very useful if your developing your application in Go directly. Caddy team didn't code all that network layer, like Nginx or Apache teams did. You don't need Caddy to add let's encrypt to your Go application.
mattbee 9y ago
@mholt is being exceedingly generous to the whingers on this thread, on top of the generosity he's shown in writing Caddy to start with. It's not 2005 any more, Sun Microsystems is long gone. You won't raise any money from a business model that gives away your best work or selling support contracts alone. Caddy is a real innovation, and brings web server defaults bang up to date - it makes loads of complex configuration easy. It's already distributed in the finest tradition of free software - a liberal source code license with no restrictions. You can do what you want with it. Like GNU in the 80s and OpenBSD in the 90s, Matt is selling the most convenient package and yeah - if that's the one you used and relied on for your infrastructure, you've got to pay, and not very much. Matt has clearly worked hard at making that payment support as much as possible in terms of convenient corporate deployment. I really hope that works out well, and am glad it's a business model that supports Free software without any compromises.
- unethical_ban 9y ago
  Eh. Still kind of shitty to have had access and then have it removed, and then say 'nothing has really changed, guys!'. If they rephrased it to admit they're moving to a Red Hat model of "pay for binary", the news would have fared better. More straightforward, with a direct comparison to a current, successful brand. Let's face it: They realized their product was popular, took advantage of tons of interest and documentation/blogs/hype in the community, then decided to charge for binary distribution. It's a bit of a burn.
  - pheeney 9y ago
    > Let's face it: They realized their product was popular, took advantage of tons of interest and documentation/blogs/hype in the community, then decided to charge for binary distribution. It's a bit of a burn. Or another way of looking at it: Open source has to be subsidized (either through free time or commercial backing) in order to continue to contribute to open source. The amount of time and effort to maintain a popular open source product is insane. They are creating a business model to continue to subsidize their open source contributions. Whats the alternative? Burnout and stagnation which would just result in forks and fracturing of the community if they are lucky.
chrissnell 9y ago
Can projects (for example, Arch Linux) legally create and distribute binaries compiled from source that's modified to remove the header? That's unclear to me.
jimjimjim 9y ago
Such amazing hostility. Open source developers NEVER owe users anything. Never. Stop being so entitled.
- jazoom 9y ago
  I'd agree with you except this is a bait and switch. They're allowed to do it, but it's rude. 30 days is also minimal notice.
kradle 9y ago
Just wanted to add that we've experimented with Caddy awhile back and, while it didn't suit our needs at the time, the first impression was a good one and I've since kept the project in the back of my mind. However, the responses from the Caddy folks here and at https://github.com/WedgeServer/wedge/issues/2 https://github.com/WedgeServer/wedge/issues/2 have been abysmal and without a clear change in course I'd feel embarrassed to recommend it to colleagues. It's not even about the licenses, as others have said, this is just bad form.
- mikewhy 9y ago
  I feel like I'm taking crazy pills: the caddy folks come across fine in that issue. In fact everyone does, except for the person who thinks everyone working at a company are on the list of contributors of a github project.
PenguinCoder 9y ago
To everyone saying that Caddy made it simple for automated LE; I agree, but also, it's not that difficult to setup with NGINX: Edit /var/nginx/ssl_common.conf ssl_certificate /etc/letsencrypt/live/<site>/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/<site>/privkey.pem; location ^~ /.well-known/acme-challenge/ { default_type "text/plain"; allow all; root /var/www/example; auth_basic off; } Edit crontab, add: 30 2 * * 1 /bin/certbot -a webroot --webroot-path=/var/www/example renew --renew-hook "systemctl restart nginx" Make the cert mkdir -p /var/www/example certbot certonly --webroot -w /var/www/example/ -d www.example.com In your NGINX HTTPS server blocks add: include ssl_common.conf That should be it...
- tylersmith 9y ago
  Thanks for posting this. This is pretty much the setup I just replaced Caddy with and it's working well so far.
- gshulegaard 9y ago
  Small improvement, but `reload` should do this while gracefully terminating connections: https://www.guyrutenberg.com/2017/01/01/lets-encrypt-reload-nginx-after-renewing-certificates/ https://www.guyrutenberg.com/2017/01/01/lets-encrypt-reload-... http://nginx.org/en/docs/beginners_guide.html http://nginx.org/en/docs/beginners_guide.html Basically `reload` should have the external appearance of 0 downtime.
  - PenguinCoder 9y ago
    Thanks.
jtmcmc 9y ago
This was a fascinating thread of a product I would possibly have used but now won't...
NuSkooler 9y ago
Hi Matt! I've been using and advocating for Caddy for a while now, but I have to say this is a huge put-off. Don't get me wrong here, I'm in full support of a commercial version... but as you can see from the feedback here, this kind of thing is really frowned upon in the personal / OSS space for a variety of reasons. I encourage you to re-consider added headers. Perhaps look at a more heavy handed download process such as the "Pay as you want" system used by ElementaryOS's download page (https://elementary.io/ https://elementary.io/).
- mholt 9y ago
  Thanks for your comments. I think that this thread can be added to the bucket of all the others that reveal the unhealthy expectation in the FOSS community, and I'm not convinced that the "variety of reasons" are compelling. It's regrettable that our announcement today is so controversial. As much as a donation model is easy and safe, it is not a business plan. (We tried it.)
  - zzzcpan 9y ago
    Maybe there is no big enough market for what Caddy is offering right now. Have you considered pursuing other directions, make it really diverge from nginx, apache features and stand out? Maybe more into an out of the box security solution with integrated scraping protection, ddos protection, vulnerability scanning protection, exploit protection, overload protection, xss/csrf protection, WAF features, full-page caching. Or even into an edge infrastructural solution for hosting companies and such, with dns management and everything.
  - tylersmith 9y ago
    "the unhealthy expectation in the FOSS community" Nobody is "expecting" you to make good software, we're just saying that now that you've turned a formally mostly decent piece of software into adware with an untrustworthy author there's no reason to not just use better software. Software that doesn't molest your traffic. I wish you luck with your business but don't know why anybody would pay for software written by you two ever again.
tylersmith 9y ago
I fully understand commercial licensing, and would willingly pay for it, but I am certainly not paying for software that thinks it's reasonable to inject headers into requests as a form of licensing control. I've been using Caddy as my default web server for a long time but this is prompting me to switch everything over to nginx. I'm seriously bummed this is the route Matt has taken things. What a shockingly awful surprise to wake up to.
greenbast 9y ago
Obligatory link to Richard Stallman on "free vs open": https://www.gnu.org/philosophy/open-source-misses-the-point.en.html https://www.gnu.org/philosophy/open-source-misses-the-point....
deleted 9y ago
[deleted]
throwa34943way 9y ago
Didn't Caddy got like $50.000 from Mozilla to work on the open source version? Is Mozilla OK with this? Maybe Mozilla should give money on free software projects that plan on remaining free instead next time... https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-385000-to-open-source-projects-as-part-of-moss-mission-partners-program/ https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-3850...
deleted 9y ago
[deleted]
nqzero 9y ago
as a developer that's also struggling with finding a balance between the good things that open source helps guarantee and a viable business plan, i'm intrigued by this discussion the approach that caddy has taken appears to be a bit of good cop / bad cop. they're maintaining, at least for now, the apache license but they're also using trademark threats to prevent forks (i believe in violation of the github TOS) the approach that i'm hoping to take is quite different. i'm interested in any feedback (my software is a database engine that in some ways is more convenient than existing dbms for java developers, but similar to caddy in that many good alternatives exist and are free) https://github.com/db4j/pupl https://github.com/db4j/pupl http://db4j.org/pupl/PUPL http://db4j.org/pupl/PUPL - you can freely copy, modify and distribute the software - non-production use is free, as is production use on up to 10 cores - prices are predictable and non-discriminatory how would you feel about using software (in the infrastructure space) under this license ?
memiux 9y ago
Everything is getting expensive.
unlocksmith 9y ago
@mholt It does not matter if Caddy is open source or proprietary. Showing advertisements in the HTTP response header field is an annoyance. Please remove "Minio" from the header. I am also sad about how the opensource version of Caddy project no longer has a website and being ignored. -ab
FrumpMuppet 9y ago
I don't know why people are freaking out about this so much. It's one header. Also, it's been made painfully clear that the source code is not covered by the EULA and is still licensed under Apache 2.0, so if you build from source yourself you can use it without any change, just like before this announcement. It's not like this is some ungodly C project where you need to gather all your dependencies together and debug the build process when it doesn't work on your machine. The project is written in Go and has no external dependencies so building from source is literally just: - Install Go if you don't have it already - Run `go get -u github.com/mholt/caddy/caddy` - cd to $GOPATH/src/github.com/mholt/caddy/caddy - Run `go install` - Use the resulting caddy.exe file for free like you always have done If you don't like the Caddy-Sponsors header then you can just edit the `github.com/mholt/caddy/caddyhttp/header/header.go` file and comment out the lines: if name == "Caddy-Sponsors" || name == "-Caddy-Sponsors" { // see EULA continue } Then build the project, except now you can remove the sponsor header with `-Caddy-Sponsors` in your Caddyfile. If you need a plugin then just download the plugin you want from github and import it before building: https://github.com/mholt/caddy/wiki/Extending-Caddy https://github.com/mholt/caddy/wiki/Extending-Caddy @mholt has made the entire process so unbelievably easy that the whole process takes literally minutes...
vbtechguy 9y ago
Matt's response https://caddy.community/t/the-realities-of-being-a-foss-maintainer/2728/ https://caddy.community/t/the-realities-of-being-a-foss-main...
- warrenm 9y ago
  Yep - where he goes into insulting more-or-less everyone who has criticized him and the project

156 points by OberstKrueger 9y ago

Beginning today, all official Caddy binaries come with an End User License Agreement (EULA) that designates them either for Personal (non-commercial) or Commercial use. To be clear, this EULA applies only to Caddy binaries you download; it does not apply to the source code. Caddy is still open source, and the source code is under the same Apache 2.0 license. Thanks for keeping it open source. I'm very interested in how this business model will work, glad to see people trying different approaches.

fortythirteen 9y ago
Since you could pull yesterday's version: OpenOffice -> LibreOffice Gnome -> Mate Caddy -> ?
- mattl 9y ago
  Wedge. https://github.com/WedgeServer/wedge https://github.com/WedgeServer/wedge
- dchest 9y ago
  You can pull today's or future versions as it's still open source under the same license. Please read the above quote.
- bboozzoo 9y ago
  shady

davb 9y ago

> 1/4 price of comparable servers Which servers?

tiernano 9y ago
Wondering the same thing... nginx has a commercial option, but does not force you to use it if your using it in a business environment... iis is only available on windows server, and that costs about 600 quid for a standard license. That’s a one off cost... so... it might be quarter of the cost of enterprise (3k give or take) but over the life time of the box, it would end up being more...
- Whitestrake 9y ago
  Caddy's new commercial licensing, like nginx, is completely optional as the actual source license continues to be Apache 2.0. For any business running their own web servers, compiling Caddy themselves instead of utilizing the build server at caddyserver.com is a trivial step that also gives them greater control over the binary they end up using anyway.
  - tiernano 9y ago
    Yea, but in the case of nginx, their binaries are Free full stop... it’s only extras or support that need license...
Whitestrake 9y ago
The most apparent comparison looks to be NGINX Plus, for which the lowest cost tier works out at over $200/month ($2,500/year) per instance. https://www.nginx.com/products/buy-nginx-plus/ https://www.nginx.com/products/buy-nginx-plus/
- deleted 9y ago
  [deleted]

winter_blue 9y ago

Key Quote: To be clear, this EULA applies only to Caddy binaries you download; it does not apply to the source code. Caddy is still open source, and the source code is under the same Apache 2.0 license. Doesn't this mean that you can simply compile Caddy from source, and avoid having to pay for commercial use? Most Caddy users are likely going be comfortable with compiling stuff, so what benefits does paying bring besides private plugin hosting?

arghwhat 9y ago
That's often the case. The answer is priority support and developer time for bugfixes/feature requests, and potentially commercial-only features. Think Red Hat Linux.
bauerd 9y ago
AFAIK you have to specify plugins at compile time in the source code. Don't know if the installation scripts/endpoints that spit out the official binaries are open source, though.
mholt 9y ago
You're right, you can build from source under the Apache license. Keeping the project truly open source is really important to us, because the community is such a great part of using Caddy. Commercial licenses would only cost hundreds of thousands of dollars per year if your organization has at least 160 instances in use. Keep in mind that modifying the source is required to plug in any plugins, which people tend not to want to bother with. We're also looking into adding more features for our customers.
- unkown-unknowns 9y ago
  > Keep in mind that modifying the source is required to plug in any plugins, which people tend not to want to bother with. I've only ever used Caddy without plugins, so I'm not familiar with how it works but do you mean that plugins in general must be enabled or that the specific set of plugins I want must be compiled in? If the latter then I think they are not so much plugins as some kind of extension. Please clarify, thanks.

tuananh 9y ago

homepage 503 https://dl.dropboxusercontent.com/s/phh5xebd1jqj27l/2017-09-13%20at%208.41%20PM.png https://dl.dropboxusercontent.com/s/phh5xebd1jqj27l/2017-09-...

mholt 9y ago
Ugh, I forgot to raise the file descriptor limit when I re-provisioned the site. Leave it to me to blunder that. :)

notyourday 9y ago

I always find it funny when the announcement of a new, pay for software, especially a web server leads to 503. Especially when it looks like an HTML page.

mholt 9y ago
I misconfigured the machine; just raised the file descriptor limit and we should be good now.

romanovcode 9y ago

> If you use Caddy for personal, academic, or non-profit purposes, not much is different. Caddy-Sponsors HTTP Header > If you use or distribute official Caddy binaries at work, or as part of a product/service, you will need a commercial license If I have some personal project which I want to incorporate I need to worry about the license. Oh, time to switch back to NGINX. Thanks for automated HTTPS while it lasted.

Whitestrake 9y ago
This is incorrect, or at least only half-true. Caddy is still Apache 2.0 licensed. You can use it for free for commercial purposes. You just can't use the build server at caddyserver.com to download a precompiled Caddy with plugins. Instead, you can download the source, compile it with plugins yourself, then distribute your own binary amongst all your hosts.
- romanovcode 9y ago
  Yeah, I guess you're right. But then again setting up NGINX with auto SSL would be easier so what's the point. Personally for me Caddy is (was) good because of how easy it is to set it up.
  - Whitestrake 9y ago
    I'm not sure I agree with you there. The most popular Docker image for Caddy, for example, should soon (if it's not already) be compiled from source, rather than from the build server. That means it will remain free to use, and I personally don't have to make a single change. If this has impacted you negatively to the point where setting up nginx is an easier option, well - that's the beauty of choice!
    - tylersmith 9y ago
      But the software in that image will still be written by untrustworthy adware developers. _That_ is the issue.
9y ago

deleted 9y ago

[deleted]

st3fan 9y ago

This is all great, I hope this turns into a viable business. But I am just not sure about the approach here. Maybe this is a good moment for someone to finally fork Caddy, remove the Sponsors header, and distribute proper RPMs and DEBs. Then those of us who want to use a truly open source project with no strings attached (special conditions re binaries, EULA, etc.) have nothing to worry about.

overcast 9y ago
I've been praying for proper distribution channels for installs. For a project that is all about simplicity in setup, the installation is such a hassle. Manually creating startup entries, directories, process users, horrible.
- mholt 9y ago
  One of the things we're hoping to offer soon are official distro packages that can be customized with the plugins you want/need.
  - overcast 9y ago
    Thanks Matt, this is DESPERATELY needed for any reasonably sized rollouts(and even my own single personal rollout). Admins don't want to be manually installing software on machines like we're back in the days of compiling everything from source. Can we at least get the base package sorted before? I really don't need custom with any plugins.
  - st3fan 9y ago
    It does not matter if the binary restrictions and EULA are attached to those.
pepa65 9y ago
The issue is not forking. It is the build infrastructure to produce all the builds for each OS, architecture, and the desired plugins. This is added value that Caddy adds. It would be great for a replicated infrastructure to materialize. If it is well maintained it is even likely to overtake Caddy in terms of users, because it would be free software.

StavrosK 9y ago

I've been trying to get Caddy more widely deployed at work, and this move is going to alienate commercial customers (at least us) even more than Caddy already does. Not only do they not have repositories, essentially doubling the effort to keep machines up to date (we have to have one process to upgrade everything else, and one process to upgrade just Caddy), but now we can't even download precompiled binaries to deploy on the servers without paying. I could have put up with Caddy not being as mature as nginx for some low-volume deployments, and barely put up with the lack of debs, but having to compile my own binaries across the company isn't worth the integrated TLS certs.

mholt 9y ago
> Not only do they not have repositories, essentially doubling the effort to keep machines up to date (we have to have one process to upgrade everything else, and one process to upgrade just Caddy) Cory's working on this, actually. If we can get it working, we should be able to offer official Caddy packages to all our customers, customized just how they need it to be, so your 'apt upgrade' could upgrade Caddy as well, with just the plugins you want. > I could have put up with Caddy not being as mature as nginx for some low-volume deployments, and barely put up with the lack of debs, but having to compile my own binaries across the company isn't worth the integrated TLS certs. Until we have official apt repos, you're welcome to use getcaddy.com which automates builds and installations of Caddy. True, it's not "apt install" but it's pretty close, until we can get apt repos and others available.
- fps 9y ago
  > True, it's not "apt install" but it's pretty close I feel like maybe you don't know what apt does, or how it's used, if you think that shell script is "pretty close."
- StavrosK 9y ago
  > it's not "apt install" but it's pretty close It's not close, though, it's very far. With apt, I know things are going to go in their proper place, and are going to get cleaned up afterwards (not to mention the biggest benefit, automatic updates). With a shell script, I don't know what sort of stuff it puts where on my filesystem, and I can't automate the installation easily. My preferred order of installation procedures is: "apt", "manual", and "random shell script" is a distant last, to the point where I sometimes won't try software if the installation procedure isn't sane.

jimangel 9y ago

I completely understand this direction, and really appreciate the work mholt and team has put into Caddy, but I'm disappointed at the same time. I looked forward to spinning up my dumb ideas tied with commerce using Caddy (on a 0 budget). I've been a Caddy evangelist ever since discovering the powers (auto HTTPS, git webhooks, simple config, etc.), I had plans to write blogs about simple sites for simple ideas that can generate money - but nothing that would allow me to swing $100/mo. I understand that I can compile the source and remain compliant, however, part of the charm was the simplicity once paired with docker for rapid dev/deployment. Does anyone know if there's significant pain in maintaining a docker image that compiles source code like Caddy on rebuild?

codebeaker 9y ago
I couldn't agree more. The terms seem overly restrictive. Let's hope that they don't "go after" anyone who's not compliant and that this is silently a scheme to force bigger companies into compliance and let the rest of us fly under the radar. As-is, I would owe Caddy $300/month - none of my side projects can sustain that, so I'll be switching back to nginx and some LE cronjobs.
- StavrosK 9y ago
  Yeah, I have a bunch of side projects that collectively make ~$2/mo. Good thing I didn't replace nginx with Caddy on that server.
- mholt 9y ago
  No schemes here, just an updated business plan. If the current pricing is too restrictive for your business, feel free to build from source (Caddy source code is Apache licensed)! Or contact us, sales@lightcodelabs.com, if you need a commercial license but your startup / side project has a constrained budget. We'll see if we can work something out for you.
Whitestrake 9y ago
> Does anyone know if there's significant pain in maintaining a docker image that compiles source code like Caddy on rebuild? It's insignificant. Multi-stage Dockerfiles mean you can build from the Golang image, pull mholt/caddy, compile to a binary, then distribute the result in a tiny Alpine image. I believe the maintainer of the current most popular Caddy image will be going source-compiled, too, so you might not even need to roll your own Dockerfile.

zaro 9y ago

> If you use Caddy for personal, academic, or non-profit purposes, not much is different. Just a new response header that gives tribute to our sponsors. So now there will be ads even in the HTTP headers. Coming soon, ads in the tcp headers ...

lol768 9y ago

> As of version 0.10.9, Caddy emits an HTTP response header, Caddy-Sponsors, which is similar to the Server header that Caddy already has, except that this one credits our sponsors who make it possible to keep Caddy free for personal use. This header cannot be removed by the Caddyfile, and its presence is required by the non-commercial EULA. This requirement is waived by the commercial license, so the header is not present in those binaries. Really not a fan of this, guess I'll be compiling my own builds from now on. Don't get me wrong, I think charging for commercial licenses (which come with proper support) is a good business model, but my personal site shouldn't suddenly become an advertising outlet. The fact that the headers aren't seen by most non-technical users is moot. I find this practice pretty obnoxious to the point of looking at NGINX Plus for commercial use instead. Edit: Here's my fork https://github.com/WedgeServer/wedge https://github.com/WedgeServer/wedge Second edit: Accusation of trademark violation within an hour of the fork, classy! https://github.com/WedgeServer/wedge/issues/2 https://github.com/WedgeServer/wedge/issues/2

UseStrict 9y ago
Wow, in the course of this HN thread I went from learning about Caddy, to deciding against using it. Definitely not cool to immediately threaten legal action almost instantly after forking. Definitely not cool to force a header. I'll be sticking with nginx.
- callahad 9y ago
  Which is frustrating, because Caddy is a great product, especially from a solo operator standpoint. Configuration is simple and the defaults are sane. The humans behind Caddy are nice people. And while this move has somewhat soured my opinion of the project, I'm not so much angry as I am... sad. I want to use Caddy. I am using Caddy. But I don't want to use this Caddy, at the moment.
  - kuschku 9y ago
    Actually, the defaults are quite insane. For example: You might know that all domain names are in the root zone, named ".", so any domain actually is resolved to e.g. news.ycombinator.com. And if you enter the domain with the dot, it is the same DNS name, and should give you the same result. Apache does that, Nginx does that, Google’s cloud does that, Amazon’s cloud does that, all major sites do that... Caddy considers it irrelevant, and something users should add manually for all of their rules if they want it. Ignoring all the RFCs, because of personal ideals. https://github.com/mholt/caddy/issues/1632 https://github.com/mholt/caddy/issues/1632

ash 9y ago

> We now require declaring a license when requesting a download: > https://caddyserver.com/download/<os>/<arch>?license=personal https://caddyserver.com/download/<os>/<arch>?license=persona... > The value for the license variable can be either personal or commercial. > … > We require the license parameter because we feel it's important for the license to be deliberate, not assumed. To ease the transition into this, though, we'll allow the current syntax (no license parameter) to work for at least 30 more days, and a personal license will be assumed. I think this warning should be more prominent. Lot's of CI builds would mysteriously fail after 30+ days.

mholt 9y ago
I'll work on that. But the error message is very clear, so if any error reporting is enabled, it'll be pretty obvious what to do, at least. The fact that people were relying on volunteer-supported infrastructure for their CI builds is a little unnerving to me, hence the move to commercial support.
- iampims 9y ago
  Why not upload them to GitHub?
  - gtirloni 9y ago
    Exactly, building and pushing to GitHub is a set-and-forget process. Besides, it already needs to be done for paying customers now so what kind of work is that saving Caddy? I don't understand. EDIT: Additionally, it's an error to think that non-paying customers are not contributing. It's actually a pretty basic misunderstanding for an open source company. Users are contributing with bug reports, small fixes, testing, marketing, etc. It amazes me we still see this feeling in 2017. I dare all companies with open source projects to actually close them and replace non-paying customers with QA teams, more developers, more infrastructure, etc. Make sure to increase your budgets and raise your prices accordingly.
    - iampims 9y ago

stephenr 9y ago

Copied comment from the other HN thread: $50 dollars a MONTH PER INSTANCE for a piece of software that wouldn't even start a few months ago because LetsEncrypt was down. I get that software takes time and people need to eat, but holy shit on a stick. Edit: Oh, and I forgot the part where it also doesn't handle FQDN's properly either. Previous discussion, from when LE was down for a day https://news.ycombinator.com/item?id=14375022 https://news.ycombinator.com/item?id=14375022

Whitestrake 9y ago
I think your outburst might be rooted in a misunderstanding. As stated in a few other places in this thread, the software remains 100% free, including for commercial purposes. In order to make use of the build server at caddyserver.com, you need to have either a personal or commercial license. The build server provides precompiled binaries with your customized selection of plugins included. The use of the build server is in no way necessary for the deployment of Caddy in any circumstance.
- stephenr 9y ago
  I understand that the source is available. My surprise is that you think anyone will pay $50 per month per instance forever, for a build service they might use only once, and that still requires them to actually do all the work to install it and run it as a service.

Xunxi 9y ago

What are the key differences between Caddy and Centminmod? I would like to know the comparative speeds, use cases and disadvantages if any. Also congrats to you Holt for taking this bold step to sustain development. Quite recently WangGuard became a victim of freebies and the nonreciprocal donation from users. I hope this endeavor pays off

donatj 9y ago

Caddy is OK, easy to setup on a personal machine, but nginx's performance trumped it completely in our testing. Particularly when requesting large numbers of files concurrently. I genuinely don't know why a business would use Caddy over nginx, especially given the new commercial licensing scheme. nginx really isn't that hard to setup.

sfifs 9y ago
Running Caddy is literally copying a binary and your site over and setting up the systemd config. LetsEncrypt works automagically out of the box.
- rlonstein 9y ago
  > LetsEncrypt works automagically out of the box Provided you let Caddy manage all the certs and/or permit dynamic dns updates on that host. Went through this last night and it's underdocumented when you want to handle it yourself with TXT records and explicit cert/key.
mholt 9y ago
The business use case isn't just about performance; businesses also get private plugin hosting, basic email support, and in the future, other amenities as well. We'll be optimizing Caddy more over time. You can also use the http.cache plugin to help with performance: https://caddyserver.com/docs/http.cache https://caddyserver.com/docs/http.cache

pryelluw 9y ago

1. I applaud this effort. 2. Ive been researching sustainable funding models for open source. Will the maintainers be blogging about the progress and results? Would be useful to learn about what they discover.

nqzero 9y ago
i've been trying to come up with a license that captures enough of the freedoms of open source to protect the user while allowing for a non-zero cost. my license is below - it's not open source, but if you're willing to consider licenses that are liberal but not OS, i'd love to hear your comments http://db4j.org/pupl/PUPL http://db4j.org/pupl/PUPL
- pryelluw 9y ago
  Thanks for posting. Ill check it out. :)
throwa34943way 9y ago
> 2. Ive been researching sustainable funding models for open source. Will the maintainers be blogging about the progress and results? Would be useful to learn about what they discover. Well, just ask $50.000 from Mozilla for an "open source project" grant "like" Caddy got and you're settled for at least a year. https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-385000-to-open-source-projects-as-part-of-moss-mission-partners-program/ https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-3850...

JamesMcMinn 9y ago

Well, I guess I'm moving switching from Caddy to NGINX then. I like Caddy, it's been great, but I have no interest in paying for support, and I'm certainly not going to pay to remove a HTTP header. Yes, I could spend time setting everything up to build custom versions of Caddy without the header, but it'll be quicker and easier to switch to NGINX. Whilst I really appreciate all the work that has gone into Caddy, I am extremely annoyed that it's now going to cost me at least an afternoon to move away from. If you're an existing Caddy user and don't want to (or can't) pay, your options are either don't upgrade, server ads for Caddys sponsors, or spend a significant amount of time configuring your own build process/switching to something else. I can't help but feel this move is going to be bad for Caddys adoption.

lol768 9y ago
Yeah, I'm in the same position now. As you mention, NGINX is reasonably straightforward to set up if you're remotely technical or hell, if you can follow a tutorial. It's a huge shame, because I used to recommend Caddy for how easy it was to get TLS to work.
mholt 9y ago
Caddy is still open source, Apache licensed. You can certainly build from source as long as you give attribution and state your changes.
- JamesMcMinn 9y ago
  Matt, I really do appreciate the work you and others have put into Caddy - it's a fantastic piece of software which has served me well for the past year and a bit. Having said that, this change has put me in a position where I have to invest either time or money into a solution for a problem which I didn't have yesterday, and switching to NGINX seems like the path least likely to cause issues in the future. Having to build my own version of Caddy for every update is a cost I'm not willing to pay. Since I'm being forced to invest in something, it may as well be NGINX, and I suspect I'm not alone in this.
  - 9y ago

Sir_Cmpwn 9y ago

I said further below that this makes Caddy nonfree, but I was corrected - you can still build Caddy from source, remove the bullshit, and distribute your changes and compiled binaries under Apache 2.0. However, after examining the website more I feel the need to write another comment expressing how poorly this is being handled. The website is very misleading - on the download page, it now asks you to pick a license, and says that the "Personal" version is for only personal use and you need to pay for the commercial version. There's no indication until you click through to the full pricing page that the open source version even exists. On that page, you have the same personal/commercial breakdown, also stating that the personal version is strictly for non-commercial use, but with a sidebar mentioning open source. It assumes you understand the Apache 2.0 license and makes no attempt to clarify that businesses can use the open source version. The authors are also wasting no time in going after forks[1] to complain about trademark infringement, so if you want to distribute your own patched Caddy builds you can expect to hear from their lawyers. Absolutely devoid of class. This is a really obnoxious change. I was thinking about switching from Nginx to Caddy but this news is nailing that door shut. [1] https://github.com/WedgeServer/wedge/issues/2 https://github.com/WedgeServer/wedge/issues/2

Whitestrake 9y ago
> The authors are also wasting no time in going after forks[1] to complain about trademark infringement, so if you want to distribute your own patched Caddy builds you can expect to hear from their lawyers. Absolutely devoid of class. This in particular doesn't seem fair. Trademark really requires trademark holders to make active efforts to preserve their trademarks as soon as they're aware of potential breaches, or they invite risk. And this is a simple request in the fork's issues page - no lawyers are involved yet, as far as I can tell.
- Sir_Cmpwn 9y ago
  There's not even a registered trademark, as they stated. And simply distributing a modified version of an open source project under that project's name is absolutely fine and pushing against it is definitely in bad faith. >And this is a simple request in the fork's issues page - no lawyers are involved yet, as far as I can tell. Well, what do you think their next step is if they refuse?

tjholowaychuk 9y ago

Congrats! Good luck. Ignore all the angry people they clearly have no idea what it's like to try and make a living off this stuff, just entitled spoiled brats. Not to mention the salary that most developers make, paying $25-100/m for software you enjoy is not much. IMHO if you can't justify the price, then don't use it.

Whitestrake 9y ago
Well, everyone's opinion is valid and useful as feedback. The good part is, if you can't justify the price, surely you can justify the time to write a bash script to compile it yourself? Further up this comments page is one fantastic example. There's still plenty of options, really, not much has changed.
- tjholowaychuk 9y ago
  For sure, but I think a lot of people have to realize they're not the target market for this kind of thing. You simply cannot make a living from people trying to run their side projects for < $5/m. Seeing people complain about paying for software is just annoying. They should work for free then, if that's their mentality.
  - deleted 9y ago
    [deleted]
  - deleted 9y ago
    [deleted]
  - throwa34943way 9y ago
    Sure, but being granted $50.000 from Mozilla under the claim of supporting an open source project can sustain you for at least 2 years. https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-385000-to-open-source-projects-as-part-of-moss-mission-partners-program/ https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-3850... Mozilla should have given the money to another project.

xena 9y ago

i personally like how one of the first contact bits from caddy to a fork of it is a thinly veiled legal threat: https://github.com/WedgeServer/wedge/issues/2 https://github.com/WedgeServer/wedge/issues/2

callahad 9y ago

Congratulations on the launch, and good luck finding a sustainable means of funding Caddy. It's a uniquely ergonomic webserver. That said, the unalterable Caddy-Sponsors HTTP header feels bad, and cheapens my overall impression of Caddy as a quality product. Now, instead of paying for a license to gain access to enterprise features or support, I'm paying to remove ads. From my webserver. Which now has a custom license that I have to read, remember, and figure out how to comply with. I give up. I'm an individual running 8 little caddy containers on a $5/mo VPS. The cognitive load simply isn't worth it, and I hope you'll reconsider. Otherwise, it's back to cobbling things together with nginx and haproxy. :(

Whitestrake 9y ago
> That said, the unalterable Caddy-Sponsors HTTP header feels bad, and cheapens my overall impression of Caddy as a quality product. Hit the nail on the head. There's lots of reasons why this is a non-problem, intellectually speaking, but none of the arguments for this remove the bad taste in my mouth, emotionally speaking. The other news doesn't bother me, but the header... disappoints me.
tssva 9y ago
There are a variety of docker containers available which integrate letsencrypt and nginx. Personally I use the linuxserver.io letsencrypt container to proxy my personal projects. You specify the domain names you need a certificate for at container startup via an environment variable and it takes care of getting the certificate issued and renewing as needed. Restarting with additional names added or names removed will result in the previous certificate being revoked and a new one issued as appropriate. This replaced my use of caddy for my personal projects about 3 weeks ago. A decision I debated before making and am now glad I made.

gtirloni 9y ago

If Caddy had focused on providing commercial support to companeis that need it, this would have been a good day. As it is, they are adding artificial roadblocks for open source users while providing minimal benefits to commercial users. Someone didn't think this through or is out of touch with how to make money with open source.

andmarios 9y ago

Not being able to use the release binaries (even from github) for commercial purposes is a bummer but if this is the price to pay for having caddy available as open source, then it is fair. What I am afraid of, is that this friction to start with caddy (because $50 per month is way too much for most use cases) will affect its user base and as a consequence the participation in development. Of course mholt and the team behind caddy are the people who love it the most and care about its future the most, so I trust they will keep pushing forward. For people who find it difficult to build caddy from source, here is an example, provided you have Go installed and configured: go get github.com/mholt/caddy go get github.com/caddyserver/builds cd "$GOPATH/src/github.com/mholt/caddy/caddy" # Enable cors, prometheus plugins. cat <<EOF>caddymain/plugins.go package caddymain import ( _ "github.com/captncraig/cors/caddy" _ "github.com/miekg/caddy-prometheus" ) EOF go get -u -v -f ... || echo "Updated dependencies" go run build.go Edit: updated with the latest build procedure

Whitestrake 9y ago
To compile without the `Caddy-Sponsors` header, include this line before the plugin comment: sed -ie '/Header().Set("Caddy-Sponsors/d' ../caddyhttp/httpserver/server.go
- andmarios 9y ago
  Thanks, although I personally will keep it. When I was maintaining web servers as a living I used to add a custom header here and there, so I see no harm in the practice.
- tylersmith 9y ago
  This only helps until they start injecting data in different places. Maybe soon they'll add HTML comments or JavaScript to popup a notification. Now that they've shown they don't care about users' data security I don't know why anybody would expect them to stop here.

callahad 9y ago

My first thought upon finding out that Caddy's source was still under an open source license was "can that change, too?" As far as I can tell, the answer is "not unilaterally," as I don't see any requirements for copyright assignment in the contributing guidelines https://github.com/mholt/caddy/blob/master/.github/CONTRIBUTING.md https://github.com/mholt/caddy/blob/master/.github/CONTRIBUT..., nor in merged pull requests.

oliwarner 9y ago

Site is currently down. We've talked at length about the time saving things Caddy may do for you, but crashing under the weight of a static page is not a good advertisement. Edit: it's back, but damage done, I think.

callahad 9y ago
The 503 error page was, itself, served by Caddy. Or at least it matched the default Caddy error pages, so those parts were evidently working just fine. :)

stephenr 9y ago

Just when you thought you knew what's going on. The author has claimed that prices will rise after an "introductory period": https://mobile.twitter.com/mholt6/status/908007933115375616 https://mobile.twitter.com/mholt6/status/908007933115375616

kevinburke 9y ago

I'm excited that Caddy has taken steps to ensure its long term survival. Sad people can't be bothered to pay for software they like.

throwa34943way 9y ago
> Sad people can't be bothered to pay for software they like They got $50.000 from Mozilla, AKA free software foundations financing commercial software with grants, but what is your opinion on this Mr Burke?
warrenm 9y ago
Lots of us (myself, certainly) do pay for software we like This argument doesn't really hold water: there are for-pay editions of all kinds of tools out there - Caddy easily could have taken one of those routes. They didn't.

JosephLark 9y ago

Came back to this thread during lunch, and a few things I'm seeing have me more worried about Caddy than I originally was. Originally it just seemed like a very minor misstep, but now it seems more likely to be the start of something worse. Can I ask - what exactly is Light Code Labs? The page really doesn't say much. It almost seems like some 3rd year Computer Engineering student at BYU came along and talked Matt Holt into creating a business of Caddy? I can't see anything about business expertise, and in the wedge fork trademark issue the other co-founder just responded that he was "part owner of Light Code Labs" and nothing about development. On the site it just says this person "recently got into web development...[and] wants technology to be more intuitive for people to use". It might just be my dislike of fluffy BS, but it seems like red flags to me.

yroc92 9y ago
It’s me, the other guy. That bio is pretty old, but it was accurate at the time. Caddy required a legal entity a few years ago for several reasons, so we went with “Light Code Labs”. LCL owns Caddy and is the legal entity through which we do business. mholt was (and still is) very concerned about making Caddy sustainable. I am also concerned about this, since I knew that mholt wasn’t going to maintain the project for free forever. So he invited me to join him and help with logistical things (money/taxes, trademarks, etc.), along with some technical things (currently working on an API for Caddy, as well as implementing apt-get with the build server). mholt is his own person, and I am not in a position to coerce him into doing things he doesn’t want to.

heipei 9y ago

caddyserver.com emits those headers if you want to see them in action: https://urlscan.io/result/8093833b-8ac7-4d18-8f20-a02373f577a1#transactions https://urlscan.io/result/8093833b-8ac7-4d18-8f20-a02373f577... Go to the first transaction, click the show button and click "Show headers". Right now it says: caddy-sponsors - This free web server is made possible by its sponsors: Minio, Uptime Robot, and Sourcegraph Personal opinion: I've never understood the appeal of Caddy except for the builtin Let's Encrypt / TLS automagic support. nginx is very powerful and at the same time pretty easy to configure, and I think they split the features between the Open Source and commercial version pretty reasonably.

camus2 9y ago
It has a few bells and whistle and there is some work behind it, no question. HOWEVER, the fact that it relies entirely on go std lib net/http|http2 package implementations personally doesn't make it very useful if your developing your application in Go directly. Caddy team didn't code all that network layer, like Nginx or Apache teams did. You don't need Caddy to add let's encrypt to your Go application.

mattbee 9y ago

@mholt is being exceedingly generous to the whingers on this thread, on top of the generosity he's shown in writing Caddy to start with. It's not 2005 any more, Sun Microsystems is long gone. You won't raise any money from a business model that gives away your best work or selling support contracts alone. Caddy is a real innovation, and brings web server defaults bang up to date - it makes loads of complex configuration easy. It's already distributed in the finest tradition of free software - a liberal source code license with no restrictions. You can do what you want with it. Like GNU in the 80s and OpenBSD in the 90s, Matt is selling the most convenient package and yeah - if that's the one you used and relied on for your infrastructure, you've got to pay, and not very much. Matt has clearly worked hard at making that payment support as much as possible in terms of convenient corporate deployment. I really hope that works out well, and am glad it's a business model that supports Free software without any compromises.

unethical_ban 9y ago
Eh. Still kind of shitty to have had access and then have it removed, and then say 'nothing has really changed, guys!'. If they rephrased it to admit they're moving to a Red Hat model of "pay for binary", the news would have fared better. More straightforward, with a direct comparison to a current, successful brand. Let's face it: They realized their product was popular, took advantage of tons of interest and documentation/blogs/hype in the community, then decided to charge for binary distribution. It's a bit of a burn.
- pheeney 9y ago
  > Let's face it: They realized their product was popular, took advantage of tons of interest and documentation/blogs/hype in the community, then decided to charge for binary distribution. It's a bit of a burn. Or another way of looking at it: Open source has to be subsidized (either through free time or commercial backing) in order to continue to contribute to open source. The amount of time and effort to maintain a popular open source product is insane. They are creating a business model to continue to subsidize their open source contributions. Whats the alternative? Burnout and stagnation which would just result in forks and fracturing of the community if they are lucky.

chrissnell 9y ago

Can projects (for example, Arch Linux) legally create and distribute binaries compiled from source that's modified to remove the header? That's unclear to me.

jimjimjim 9y ago

Such amazing hostility. Open source developers NEVER owe users anything. Never. Stop being so entitled.

jazoom 9y ago
I'd agree with you except this is a bait and switch. They're allowed to do it, but it's rude. 30 days is also minimal notice.

kradle 9y ago

Just wanted to add that we've experimented with Caddy awhile back and, while it didn't suit our needs at the time, the first impression was a good one and I've since kept the project in the back of my mind. However, the responses from the Caddy folks here and at https://github.com/WedgeServer/wedge/issues/2 https://github.com/WedgeServer/wedge/issues/2 have been abysmal and without a clear change in course I'd feel embarrassed to recommend it to colleagues. It's not even about the licenses, as others have said, this is just bad form.

mikewhy 9y ago
I feel like I'm taking crazy pills: the caddy folks come across fine in that issue. In fact everyone does, except for the person who thinks everyone working at a company are on the list of contributors of a github project.

PenguinCoder 9y ago

To everyone saying that Caddy made it simple for automated LE; I agree, but also, it's not that difficult to setup with NGINX: Edit /var/nginx/ssl_common.conf ssl_certificate /etc/letsencrypt/live/<site>/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/<site>/privkey.pem; location ^~ /.well-known/acme-challenge/ { default_type "text/plain"; allow all; root /var/www/example; auth_basic off; } Edit crontab, add: 30 2 * * 1 /bin/certbot -a webroot --webroot-path=/var/www/example renew --renew-hook "systemctl restart nginx" Make the cert mkdir -p /var/www/example certbot certonly --webroot -w /var/www/example/ -d www.example.com In your NGINX HTTPS server blocks add: include ssl_common.conf That should be it...

tylersmith 9y ago
Thanks for posting this. This is pretty much the setup I just replaced Caddy with and it's working well so far.
gshulegaard 9y ago
Small improvement, but `reload` should do this while gracefully terminating connections: https://www.guyrutenberg.com/2017/01/01/lets-encrypt-reload-nginx-after-renewing-certificates/ https://www.guyrutenberg.com/2017/01/01/lets-encrypt-reload-... http://nginx.org/en/docs/beginners_guide.html http://nginx.org/en/docs/beginners_guide.html Basically `reload` should have the external appearance of 0 downtime.
- PenguinCoder 9y ago
  Thanks.

jtmcmc 9y ago

This was a fascinating thread of a product I would possibly have used but now won't...

NuSkooler 9y ago

Hi Matt! I've been using and advocating for Caddy for a while now, but I have to say this is a huge put-off. Don't get me wrong here, I'm in full support of a commercial version... but as you can see from the feedback here, this kind of thing is really frowned upon in the personal / OSS space for a variety of reasons. I encourage you to re-consider added headers. Perhaps look at a more heavy handed download process such as the "Pay as you want" system used by ElementaryOS's download page (https://elementary.io/ https://elementary.io/).

mholt 9y ago
Thanks for your comments. I think that this thread can be added to the bucket of all the others that reveal the unhealthy expectation in the FOSS community, and I'm not convinced that the "variety of reasons" are compelling. It's regrettable that our announcement today is so controversial. As much as a donation model is easy and safe, it is not a business plan. (We tried it.)
- zzzcpan 9y ago
  Maybe there is no big enough market for what Caddy is offering right now. Have you considered pursuing other directions, make it really diverge from nginx, apache features and stand out? Maybe more into an out of the box security solution with integrated scraping protection, ddos protection, vulnerability scanning protection, exploit protection, overload protection, xss/csrf protection, WAF features, full-page caching. Or even into an edge infrastructural solution for hosting companies and such, with dns management and everything.
- tylersmith 9y ago
  "the unhealthy expectation in the FOSS community" Nobody is "expecting" you to make good software, we're just saying that now that you've turned a formally mostly decent piece of software into adware with an untrustworthy author there's no reason to not just use better software. Software that doesn't molest your traffic. I wish you luck with your business but don't know why anybody would pay for software written by you two ever again.

tylersmith 9y ago

I fully understand commercial licensing, and would willingly pay for it, but I am certainly not paying for software that thinks it's reasonable to inject headers into requests as a form of licensing control. I've been using Caddy as my default web server for a long time but this is prompting me to switch everything over to nginx. I'm seriously bummed this is the route Matt has taken things. What a shockingly awful surprise to wake up to.

greenbast 9y ago

Obligatory link to Richard Stallman on "free vs open": https://www.gnu.org/philosophy/open-source-misses-the-point.en.html https://www.gnu.org/philosophy/open-source-misses-the-point....

deleted 9y ago

[deleted]

throwa34943way 9y ago

Didn't Caddy got like $50.000 from Mozilla to work on the open source version? Is Mozilla OK with this? Maybe Mozilla should give money on free software projects that plan on remaining free instead next time... https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-385000-to-open-source-projects-as-part-of-moss-mission-partners-program/ https://blog.mozilla.org/blog/2016/06/22/mozilla-awards-3850...

deleted 9y ago

[deleted]

nqzero 9y ago

as a developer that's also struggling with finding a balance between the good things that open source helps guarantee and a viable business plan, i'm intrigued by this discussion the approach that caddy has taken appears to be a bit of good cop / bad cop. they're maintaining, at least for now, the apache license but they're also using trademark threats to prevent forks (i believe in violation of the github TOS) the approach that i'm hoping to take is quite different. i'm interested in any feedback (my software is a database engine that in some ways is more convenient than existing dbms for java developers, but similar to caddy in that many good alternatives exist and are free) https://github.com/db4j/pupl https://github.com/db4j/pupl http://db4j.org/pupl/PUPL http://db4j.org/pupl/PUPL - you can freely copy, modify and distribute the software - non-production use is free, as is production use on up to 10 cores - prices are predictable and non-discriminatory how would you feel about using software (in the infrastructure space) under this license ?

memiux 9y ago

Everything is getting expensive.

unlocksmith 9y ago

@mholt It does not matter if Caddy is open source or proprietary. Showing advertisements in the HTTP response header field is an annoyance. Please remove "Minio" from the header. I am also sad about how the opensource version of Caddy project no longer has a website and being ignored. -ab

FrumpMuppet 9y ago

I don't know why people are freaking out about this so much. It's one header. Also, it's been made painfully clear that the source code is not covered by the EULA and is still licensed under Apache 2.0, so if you build from source yourself you can use it without any change, just like before this announcement. It's not like this is some ungodly C project where you need to gather all your dependencies together and debug the build process when it doesn't work on your machine. The project is written in Go and has no external dependencies so building from source is literally just: - Install Go if you don't have it already - Run `go get -u github.com/mholt/caddy/caddy` - cd to $GOPATH/src/github.com/mholt/caddy/caddy - Run `go install` - Use the resulting caddy.exe file for free like you always have done If you don't like the Caddy-Sponsors header then you can just edit the `github.com/mholt/caddy/caddyhttp/header/header.go` file and comment out the lines: if name == "Caddy-Sponsors" || name == "-Caddy-Sponsors" { // see EULA continue } Then build the project, except now you can remove the sponsor header with `-Caddy-Sponsors` in your Caddyfile. If you need a plugin then just download the plugin you want from github and import it before building: https://github.com/mholt/caddy/wiki/Extending-Caddy https://github.com/mholt/caddy/wiki/Extending-Caddy @mholt has made the entire process so unbelievably easy that the whole process takes literally minutes...

vbtechguy 9y ago

Matt's response https://caddy.community/t/the-realities-of-being-a-foss-maintainer/2728/ https://caddy.community/t/the-realities-of-being-a-foss-main...

warrenm 9y ago
Yep - where he goes into insulting more-or-less everyone who has criticized him and the project