5 ms·

I've been using Caddy on some personal and community sites for around a year and it's worked out just great! The built in certificate management has been so ni

I've been using Caddy on some personal and community sites for around a year and it's worked out just great! The built in certificate management has been so nice compared to having to manage external letsencrypt tooling. More recently I set up a VM at work to be a domain redirector for a bunch of typo domains to our main domains, since the old outsourced redirectors didn't have TLS, and it was dead simple!

mholt 6y ago
Awesome, glad to hear it! Let me know if you have any suggestions for improvements.
- kuschku 6y ago
  How about supporting absolute hostnames? Even this site (https://news.ycombinator.com./ https://news.ycombinator.com./) supports them just fine, only Caddy doesn’t. Caddy does it so badly that the HSTS preload for caddyserver.com is interpreted by browsers as applying to caddyserver.com. (which is correct), but caddy won't actually serve that spec-compliant website: https://caddyserver.com./ https://caddyserver.com./ (just throws an SSL error)
  - tialaramex 6y ago
    The specification explicitly says what you want is the Wrong Thing™. The designers of SNI didn't leave this vague, they spelled it out first in RFC 3546 and most recently in RFC 6066 https://tools.ietf.org/html/rfc6066#section-3 https://tools.ietf.org/html/rfc6066#section-3 > "HostName" contains the fully qualified DNS hostname of the server, as understood by the client. The hostname is represented as a byte string using ASCII encoding without a trailing dot. † So, when your web browser sends the hostname "news.ycombinator.com." that's not an "absolute hostname" that's just an error. Maybe you can demand that web browsers stop doing that, but they'll likely tell you they don't care, and you should stop writing URLs incorrectly. † The trailing dot rule was in every version, but earliest sources talked about using UTF8 because they pre-date the insight that all this backend (ie not human-facing) stuff can use A-labels which are ASCII and avoid any complicated Unicode problems. This version just says to use ASCII here.
    - kuschku 6y ago
      It's not just SNI that's the issue. Caddy also can't handle Host headers with trailing dots, where the spec explicitly states those should be handled. So while the SNI error is clearly on browsers (and bugs have been already filed), the Host header issue is clearly on caddy (which caddy sees as wontfix)
  - francislavoie 6y ago
    Honestly, in the 5+ years of Caddy, you're the only person I've ever seen complain about this. And you're relentless about it. You bring it up on every thread on HN that ever has a mention of Caddy. It's very annoying. That said, you can just make a site block with that host label and Caddy will handle it just fine. You just need to explicitly ask Caddy for it. example.com, example.com. { ... }
    - kuschku 6y ago
      > That said, you can just make a site block with that host label and Caddy will handle it just fine. You just need to explicitly ask Caddy for it. That's what mholt said as well: It's the site maintainers task to fix it. Yet caddyserver.com still doesn’t support it. > you're the only person I've ever seen complain about this I didn’t actually find the bug myself, someone else did first, but it’s something that’s been annoying me for quite a bit. > You bring it up on every thread on HN that ever has a mention of Caddy. It's very annoying. It’s definitely a red flag something people should know before using caddy, as it’s a sign caddy will also interpret other specs funnily.
      - francislavoie 6y ago
        > Yet caddyserver.com still doesn’t support it. Right, because Matt (and the large majority of everyone on the internet) doesn't care. > It’s definitely a red flag something people should know before using caddy, as it’s a sign caddy will also interpret other specs funnily. Pure FUD. It's such a non-issue. As you've been told many times.
        kuschku 6y ago
        > Pure FUD. It's such a non-issue. As you've been told many times. If it's such a non-issue, why did matt say he wouldn't accept a PR that'd fix this?
        francislavoie 6y ago
        Because it would add unnecessary complexity to the system. It's a waste of time.
ljm 6y ago
Compared to nginx and apache, Caddy is a blast! I would appreciate better and consistent documentation to do more non-trivial things with Caddy, but for your basic use-cases it takes a lot of the pain away. Unfortunately, nginx and Apache still win on the (probably unfair) basis that they've got well over 10 years of history, and all of the cultural knowledge that comes with that.
- schoen 6y ago
  In Apache's case, 25 years of history already! (Wow.)
- mholt 6y ago
  Yeah, I feel that. I want to work on docs and knowledge-transfer a lot more in 2021. 2019 and 2020 were definitely full of sprinting to bring Caddy 2 up to par. I think in terms of major functionality it's settling down now, so docs and guides will be more feasible. In the meantime, I always encourage anyone to contribute to our wiki: https://caddy.community/c/wiki/13 https://caddy.community/c/wiki/13 -- there's already lots of great topics there and room for plenty more, especially examples. Hint: there's a LOT of market space for paid content to master the Caddy web server, if anyone reading this is looking to profit from their expertise...
- linsomniac 6y ago
  Agreed, I almost mentioned documentation but I forgot... My use-cases are ridiculously simple, and it's definitely gotten way better in the last year, but just figuring out the syntax for putting my e-mail address in the config file and how to start the server without it asking me questions on stdin required some trial and error. Nothing major, but there just wasn't much on Google at the time. Docs have gotten way better since. As has the install story. Before it was some scripted thing that I was never quite confident in, now it's a deb package that I feel confident in running updates and Ansible against. And honestly I have not had any problems since installing it.
dmitryminkovsky 6y ago
Yes Caddy is fantastic. My favorite unexpected use case has been testing Apple webhooks and sign in, which requires TLS even for local development. Caddy made this so easy! I just set up DNS for my home address, configured my firewall to serve on public port 443 and fired up Caddy. Would have been endlessly more annoying to configure TLS for local development before Caddy. The config file for this is literally 3 lines: my.public.hostname { reverse_proxy localhost:3000 }
- ericcholis 6y ago
  Excellent use! Like a local ngrok.
  - dmitryminkovsky 6y ago
    Hadn’t heard of ngrok, thanks!

mholt 6y ago

Awesome, glad to hear it! Let me know if you have any suggestions for improvements.

kuschku 6y ago
How about supporting absolute hostnames? Even this site (https://news.ycombinator.com./ https://news.ycombinator.com./) supports them just fine, only Caddy doesn’t. Caddy does it so badly that the HSTS preload for caddyserver.com is interpreted by browsers as applying to caddyserver.com. (which is correct), but caddy won't actually serve that spec-compliant website: https://caddyserver.com./ https://caddyserver.com./ (just throws an SSL error)
- tialaramex 6y ago
  The specification explicitly says what you want is the Wrong Thing™. The designers of SNI didn't leave this vague, they spelled it out first in RFC 3546 and most recently in RFC 6066 https://tools.ietf.org/html/rfc6066#section-3 https://tools.ietf.org/html/rfc6066#section-3 > "HostName" contains the fully qualified DNS hostname of the server, as understood by the client. The hostname is represented as a byte string using ASCII encoding without a trailing dot. † So, when your web browser sends the hostname "news.ycombinator.com." that's not an "absolute hostname" that's just an error. Maybe you can demand that web browsers stop doing that, but they'll likely tell you they don't care, and you should stop writing URLs incorrectly. † The trailing dot rule was in every version, but earliest sources talked about using UTF8 because they pre-date the insight that all this backend (ie not human-facing) stuff can use A-labels which are ASCII and avoid any complicated Unicode problems. This version just says to use ASCII here.
  - kuschku 6y ago
    It's not just SNI that's the issue. Caddy also can't handle Host headers with trailing dots, where the spec explicitly states those should be handled. So while the SNI error is clearly on browsers (and bugs have been already filed), the Host header issue is clearly on caddy (which caddy sees as wontfix)
- francislavoie 6y ago
  Honestly, in the 5+ years of Caddy, you're the only person I've ever seen complain about this. And you're relentless about it. You bring it up on every thread on HN that ever has a mention of Caddy. It's very annoying. That said, you can just make a site block with that host label and Caddy will handle it just fine. You just need to explicitly ask Caddy for it. example.com, example.com. { ... }
  - kuschku 6y ago
    > That said, you can just make a site block with that host label and Caddy will handle it just fine. You just need to explicitly ask Caddy for it. That's what mholt said as well: It's the site maintainers task to fix it. Yet caddyserver.com still doesn’t support it. > you're the only person I've ever seen complain about this I didn’t actually find the bug myself, someone else did first, but it’s something that’s been annoying me for quite a bit. > You bring it up on every thread on HN that ever has a mention of Caddy. It's very annoying. It’s definitely a red flag something people should know before using caddy, as it’s a sign caddy will also interpret other specs funnily.
    - francislavoie 6y ago
      > Yet caddyserver.com still doesn’t support it. Right, because Matt (and the large majority of everyone on the internet) doesn't care. > It’s definitely a red flag something people should know before using caddy, as it’s a sign caddy will also interpret other specs funnily. Pure FUD. It's such a non-issue. As you've been told many times.
      - kuschku 6y ago
        > Pure FUD. It's such a non-issue. As you've been told many times. If it's such a non-issue, why did matt say he wouldn't accept a PR that'd fix this?
        francislavoie 6y ago
        Because it would add unnecessary complexity to the system. It's a waste of time.

ljm 6y ago

Compared to nginx and apache, Caddy is a blast! I would appreciate better and consistent documentation to do more non-trivial things with Caddy, but for your basic use-cases it takes a lot of the pain away. Unfortunately, nginx and Apache still win on the (probably unfair) basis that they've got well over 10 years of history, and all of the cultural knowledge that comes with that.

schoen 6y ago
In Apache's case, 25 years of history already! (Wow.)
mholt 6y ago
Yeah, I feel that. I want to work on docs and knowledge-transfer a lot more in 2021. 2019 and 2020 were definitely full of sprinting to bring Caddy 2 up to par. I think in terms of major functionality it's settling down now, so docs and guides will be more feasible. In the meantime, I always encourage anyone to contribute to our wiki: https://caddy.community/c/wiki/13 https://caddy.community/c/wiki/13 -- there's already lots of great topics there and room for plenty more, especially examples. Hint: there's a LOT of market space for paid content to master the Caddy web server, if anyone reading this is looking to profit from their expertise...
linsomniac 6y ago
Agreed, I almost mentioned documentation but I forgot... My use-cases are ridiculously simple, and it's definitely gotten way better in the last year, but just figuring out the syntax for putting my e-mail address in the config file and how to start the server without it asking me questions on stdin required some trial and error. Nothing major, but there just wasn't much on Google at the time. Docs have gotten way better since. As has the install story. Before it was some scripted thing that I was never quite confident in, now it's a deb package that I feel confident in running updates and Ansible against. And honestly I have not had any problems since installing it.

dmitryminkovsky 6y ago

Yes Caddy is fantastic. My favorite unexpected use case has been testing Apple webhooks and sign in, which requires TLS even for local development. Caddy made this so easy! I just set up DNS for my home address, configured my firewall to serve on public port 443 and fired up Caddy. Would have been endlessly more annoying to configure TLS for local development before Caddy. The config file for this is literally 3 lines: my.public.hostname { reverse_proxy localhost:3000 }

ericcholis 6y ago
Excellent use! Like a local ngrok.
- dmitryminkovsky 6y ago
  Hadn’t heard of ngrok, thanks!