6 ms·

Caddy 1.0, Caddy 2, and Caddy Enterprise

71 points by mholt 8y ago

chrisweekly 8y ago
Does Caddy (still) need to run as root?
- mholt 8y ago
  No program needs to run as root. What are you referring to?
  - neilsense 8y ago
    Probably because it'll bind to low ports. setcap would fix it for OP.
- beardog 8y ago
  To my knowledge it never had to run as root. On Linux you just give it permission to bind to low ports: https://stackoverflow.com/a/414258 https://stackoverflow.com/a/414258
- penagwin 8y ago
  I'm not aware of it needing root unless somebody else can fill me in? Ports under 1024, of course, need either root or setcap but that's not specific to caddy. https://gist.github.com/kennwhite/bcb9e7a5726a74102cc8cae57003e9f4 https://gist.github.com/kennwhite/bcb9e7a5726a74102cc8cae570...
francislavoie 8y ago
Big news! Very exciting to see Caddy push forwards.
bovermyer 8y ago
Very important excerpt: > Beginning today, commercial licenses are no longer required for commercial use of any Caddy binaries.
- brunoqc 8y ago
  Are they still putting ads in the headers?
  - francislavoie 8y ago
    No ads, that's been long gone, but there's still a "Server: Caddy" header. That's easily removed with "header / -Server" in your Caddyfile. Note that it isn't removed from redirects from HTTP to HTTPS, which is an edgecase, if you're concerned about that (you shouldn't be, honestly).
    - brunoqc 8y ago
      It's a shame that I only learned when they added the ads and not when they removed them. Merci
      - francislavoie 8y ago
        Yeah, it's a shame that the bad publicity gets more visibility than the good on HN sometimes.
        gtirloni 8y ago
        That's not only on HN, it's everywhere and should be quite expected as a fact of life. That's why companies are usually careful about damaging their reputations (just like humans): earning points is much harder. After customers have written your company off, it'll take much more resources to bring them back.
- jack12 8y ago
  I don't understand the change. If I understand the history correctly, previously commercial usage restrictions only applied to official binaries downloaded from their site, and now: >Going forward, only commercial use of ... the download page ... requires a subscription So now you're allowed to commercially use the official binaries without buying a license, but you're not allowed to acquire them without that license? I don't really understand how that's a distinction with any difference. Is the expectation that (non-commercial) 3rd-parties will mirror the official binaries, and that's why it's a useful change?
brunoqc 8y ago
It sounds like Caddy 2 will be open core. I'm not a fan.
- yroc92 8y ago
  What are your reservations with such a model? Just curious.
  - axaxs 8y ago
    Not OP. Inevitably, most time/development is spent NOT on the core. Cool new features are not added to the core. I understand the business model and why, but it's not something end users like to see.
    - vorpalhex 8y ago
      See Elasticsearch for an example of this. "Oh, you actually want auth on that otherwise entirely public cluster? Oh, well, now you better cough up some money for an enterprise subscription..."
      - gtirloni 8y ago
        Which is just fine if they weren't taking free contributions from anywhere. Once you start talking about a community building this great thing, your moral bar should much higher for how you treat users.
- callahad 8y ago
  I've been perfectly happy with with the Free Software offerings from NGINX, HAProxy, Redis, and GitLab, despite all of those operating what sounds likely to be a similar business model for enterprise customers. Probably best to withhold judgment until there's actually something to judge, right?
vorpalhex 8y ago
What does Caddy offer over truly open source projects like Traefik?
- mholt 8y ago
  I'm ready to answer your question, but define "truly open source" for me first.
  - vorpalhex 8y ago
    FOSS, in the sense of freedom of speech as much as beer. Hinky enterprise license requirements for builds, their previous banner on non-enterprise versions, etc are not truly free, just a different kind of cost.
    - eridius 8y ago
      The enterprise license requirement for Caddy 1.0 is for using their build infrastructure, not for using the build. The banner was something that could trivially be removed (if it was even present this way) by compiling from source. FOSS doesn't meant the company doesn't deserve to seek a business model. In fact, I applaud Caddy's approach towards finding a business model without interfering with the FOSS nature of the project itself. If you want to avoid Caddy's business model entirely, just build from source.
      - vorpalhex 8y ago
        Which brings me back to my original query - why bother with that nonsense when I can just use Traefik? If they're fussing with licenses to make money, what's to keep them making future license tweaks that do affect the source?
        eridius 8y ago
        Traefik also has enterprise licenses. I'm not sure what your point is. Literally the only thing Caddy has done that has impacted non-enterprise customers was that sponsor header that they removed pretty quickly when the community told them they didn't want it. And enterprise customers have always had the option of compiling from source if they don't want to buy a license.
reacharavindh 8y ago
I was excited about it and had it in my "check it out for next project" list. Then saw that they were adding "ads" or some arbitrary junk to headers to annoy users into considering a paid tier. I never bothered to look at it again. I saw that the ads thing was removed, but the project lost that bit of trust to be considered seriously after that. It may be a wonderful thing that I am missing out on. But, just saying how my thought process went. I will perhaps try it for some toy projects. But, I will have to watch the words with oil in eyes before using it in any serious projects. If I don't have the time to do that diligence, then this thing will not be considered.... This is the cost of losing trust with potential users.
- roblabla 8y ago
  The "ads" were a simple Caddy-Sponsors header being sent on every HTTP response, containing the string "This free web server is made possible by its sponsors: Minio, Uptime Robot, and Sourcegraph". It could be removed (legally, the license allows it) by compiling from source. This whole thing was largely a non-issue, and overblown. The bigger issue that came with it was a website redesign that was fairly misleading (it looked like Caddy was going to be closed source), but when it was pointed out, it was clarified to clearly point out that Caddy is a Free and Open Source Software. To me, this reinforced my trust in the project. They went the wrong way, people didn't like it, they fixed it. The fact that, in today's world, a single misstep generates an immediate and irrevocable loss of trust, even when that misstep is quickly corrected and apologies are issued, is incredibly weird to me. It pushes people to hide their mistakes instead of being open about them... Disclaimer: I'm a happy user of Caddy, using self-built binaries. I'll take this chance to thank the developers behind Caddy. You have made my life a lot easier :).
  - TAForObvReasons 8y ago
    > The fact that, in today's world, a single misstep generates an immediate and irrevocable loss of trust, even when that misstep is quickly corrected and apologies are issued, is incredibly weird to me. It pushes people to hide their mistakes instead of being open about them... This happened in the past too. What people did in the past was "move to another town", but in the age of the Internet you can't really run away from your public gaffes. In this particular case, it's commendable that Caddy reversed course on the ads. However, many people's first exposure to Caddy was this ad story and it is extremely hard to change first impressions.
regecks 8y ago
Really happy to read that OS packages will be available. Thanks for responding to feedback! All of these changes look great.
SpiffyMelon 8y ago
This is great news! Thank you Matt, and everyone else who has contributed to such an amazing project :)

71 points by mholt 8y ago

chrisweekly 8y ago

Does Caddy (still) need to run as root?

mholt 8y ago
No program needs to run as root. What are you referring to?
- neilsense 8y ago
  Probably because it'll bind to low ports. setcap would fix it for OP.
beardog 8y ago
To my knowledge it never had to run as root. On Linux you just give it permission to bind to low ports: https://stackoverflow.com/a/414258 https://stackoverflow.com/a/414258
penagwin 8y ago
I'm not aware of it needing root unless somebody else can fill me in? Ports under 1024, of course, need either root or setcap but that's not specific to caddy. https://gist.github.com/kennwhite/bcb9e7a5726a74102cc8cae57003e9f4 https://gist.github.com/kennwhite/bcb9e7a5726a74102cc8cae570...

francislavoie 8y ago

Big news! Very exciting to see Caddy push forwards.

bovermyer 8y ago

Very important excerpt: > Beginning today, commercial licenses are no longer required for commercial use of any Caddy binaries.

brunoqc 8y ago
Are they still putting ads in the headers?
- francislavoie 8y ago
  No ads, that's been long gone, but there's still a "Server: Caddy" header. That's easily removed with "header / -Server" in your Caddyfile. Note that it isn't removed from redirects from HTTP to HTTPS, which is an edgecase, if you're concerned about that (you shouldn't be, honestly).
  - brunoqc 8y ago
    It's a shame that I only learned when they added the ads and not when they removed them. Merci
    - francislavoie 8y ago
      Yeah, it's a shame that the bad publicity gets more visibility than the good on HN sometimes.
      - gtirloni 8y ago
        That's not only on HN, it's everywhere and should be quite expected as a fact of life. That's why companies are usually careful about damaging their reputations (just like humans): earning points is much harder. After customers have written your company off, it'll take much more resources to bring them back.
jack12 8y ago
I don't understand the change. If I understand the history correctly, previously commercial usage restrictions only applied to official binaries downloaded from their site, and now: >Going forward, only commercial use of ... the download page ... requires a subscription So now you're allowed to commercially use the official binaries without buying a license, but you're not allowed to acquire them without that license? I don't really understand how that's a distinction with any difference. Is the expectation that (non-commercial) 3rd-parties will mirror the official binaries, and that's why it's a useful change?

brunoqc 8y ago

It sounds like Caddy 2 will be open core. I'm not a fan.

yroc92 8y ago
What are your reservations with such a model? Just curious.
- axaxs 8y ago
  Not OP. Inevitably, most time/development is spent NOT on the core. Cool new features are not added to the core. I understand the business model and why, but it's not something end users like to see.
  - vorpalhex 8y ago
    See Elasticsearch for an example of this. "Oh, you actually want auth on that otherwise entirely public cluster? Oh, well, now you better cough up some money for an enterprise subscription..."
    - gtirloni 8y ago
      Which is just fine if they weren't taking free contributions from anywhere. Once you start talking about a community building this great thing, your moral bar should much higher for how you treat users.
callahad 8y ago
I've been perfectly happy with with the Free Software offerings from NGINX, HAProxy, Redis, and GitLab, despite all of those operating what sounds likely to be a similar business model for enterprise customers. Probably best to withhold judgment until there's actually something to judge, right?

vorpalhex 8y ago

What does Caddy offer over truly open source projects like Traefik?

mholt 8y ago
I'm ready to answer your question, but define "truly open source" for me first.
- vorpalhex 8y ago
  FOSS, in the sense of freedom of speech as much as beer. Hinky enterprise license requirements for builds, their previous banner on non-enterprise versions, etc are not truly free, just a different kind of cost.
  - eridius 8y ago
    The enterprise license requirement for Caddy 1.0 is for using their build infrastructure, not for using the build. The banner was something that could trivially be removed (if it was even present this way) by compiling from source. FOSS doesn't meant the company doesn't deserve to seek a business model. In fact, I applaud Caddy's approach towards finding a business model without interfering with the FOSS nature of the project itself. If you want to avoid Caddy's business model entirely, just build from source.
    - vorpalhex 8y ago
      Which brings me back to my original query - why bother with that nonsense when I can just use Traefik? If they're fussing with licenses to make money, what's to keep them making future license tweaks that do affect the source?
      - eridius 8y ago
        Traefik also has enterprise licenses. I'm not sure what your point is. Literally the only thing Caddy has done that has impacted non-enterprise customers was that sponsor header that they removed pretty quickly when the community told them they didn't want it. And enterprise customers have always had the option of compiling from source if they don't want to buy a license.

reacharavindh 8y ago

I was excited about it and had it in my "check it out for next project" list. Then saw that they were adding "ads" or some arbitrary junk to headers to annoy users into considering a paid tier. I never bothered to look at it again. I saw that the ads thing was removed, but the project lost that bit of trust to be considered seriously after that. It may be a wonderful thing that I am missing out on. But, just saying how my thought process went. I will perhaps try it for some toy projects. But, I will have to watch the words with oil in eyes before using it in any serious projects. If I don't have the time to do that diligence, then this thing will not be considered.... This is the cost of losing trust with potential users.

roblabla 8y ago
The "ads" were a simple Caddy-Sponsors header being sent on every HTTP response, containing the string "This free web server is made possible by its sponsors: Minio, Uptime Robot, and Sourcegraph". It could be removed (legally, the license allows it) by compiling from source. This whole thing was largely a non-issue, and overblown. The bigger issue that came with it was a website redesign that was fairly misleading (it looked like Caddy was going to be closed source), but when it was pointed out, it was clarified to clearly point out that Caddy is a Free and Open Source Software. To me, this reinforced my trust in the project. They went the wrong way, people didn't like it, they fixed it. The fact that, in today's world, a single misstep generates an immediate and irrevocable loss of trust, even when that misstep is quickly corrected and apologies are issued, is incredibly weird to me. It pushes people to hide their mistakes instead of being open about them... Disclaimer: I'm a happy user of Caddy, using self-built binaries. I'll take this chance to thank the developers behind Caddy. You have made my life a lot easier :).
- TAForObvReasons 8y ago
  > The fact that, in today's world, a single misstep generates an immediate and irrevocable loss of trust, even when that misstep is quickly corrected and apologies are issued, is incredibly weird to me. It pushes people to hide their mistakes instead of being open about them... This happened in the past too. What people did in the past was "move to another town", but in the age of the Internet you can't really run away from your public gaffes. In this particular case, it's commendable that Caddy reversed course on the ads. However, many people's first exposure to Caddy was this ad story and it is extremely hard to change first impressions.

regecks 8y ago

Really happy to read that OS packages will be available. Thanks for responding to feedback! All of these changes look great.

SpiffyMelon 8y ago

This is great news! Thank you Matt, and everyone else who has contributed to such an amazing project :)