4 ms·

I used to use Nginx for a long while, but for the past several years I’ve been using Caddy instead and it’s been serving me well. Caddy, like Nginx, is open sou

I used to use Nginx for a long while, but for the past several years I’ve been using Caddy instead and it’s been serving me well. Caddy, like Nginx, is open source. What originally made me switch is how dead simple it was to set up Caddy to use Let’s Encrypt with renewal via DNS records using the Caddy Cloudflare plugin. It’s basically just download Caddy with the plugin (or build from source if you prefer), generate token for domain in Cloudflare, paste token into Caddy config file and never worry about it again. The reason that DNS based Let’s Encrypt renewal is superior is that you can even use it on servers that are not serving the site to the Internet. And aside from that just how simple, reliable and free of worry the setup is with Caddy and the Caddy Cloudflare plugin.

wildpeaks 5y ago
Frustratingly, the problem with automated DNS-based is that it doesn't work with all domain registrars, which is a showstopper when you are not allowed to change a customer's existing registrar nor move its NS records.
- GhettoComputers 5y ago
  Its one of those problems blockchain is actually a good solution for but theres no money you can tokenize to sell to others on this idea.
- AlbinoDrought 5y ago
  One workaround can be picking up a cheap domain and CNAMEing _acme-challenge.unsupported-provider.com to _acme-challenge.supported-provider-cheap-domain.com. The rest of the records can be left alone. This is listed on LetsEncrypt as a "delegate" subdomain [1] and on an EFF article as a "throwaway" domain [2]. Some clients just call it "CNAME support" [3]. All the different names muddle search results. I've used a Reddit guide [4] for Cloudflare + goacme/lego. [1] https://letsencrypt.org/docs/challenge-types/#dns-01-challenge https://letsencrypt.org/docs/challenge-types/#dns-01-challen... [2] https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... [3] https://go-acme.github.io/lego/dns/#experimental-features https://go-acme.github.io/lego/dns/#experimental-features [4] https://old.reddit.com/r/selfhosted/comments/je2041/how_do_you_go_about_getting_lets_encrypt_working/g9ec3z0/ https://old.reddit.com/r/selfhosted/comments/je2041/how_do_y...
- ignoramous 5y ago
  > automated DNS-based is that it doesn't work with all domain registrars https://acme.sh https://acme.sh automates dns01 challenges with support for over 100+ registrars: https://github.com/acmesh-official/acme.sh/wiki/dnsapi https://github.com/acmesh-official/acme.sh/wiki/dnsapi. Another good thing is that one can move their registrations and change their nameservers, at will.
mr-karan 5y ago
For my self hosted setup I've shifted to Caddy and not bother about setting up crons etc for SSL. It's just so much nicer to have the Reverse Proxy handle that for you automagically. And the config file is just 2 lines to reverse proxy instead of 20+ equivalent in NGINX.
jakearmitage 5y ago
Nginx is making the same mistakes that dethroned Apache. No one wants to fiddle with a web server. Default to $currentIndustryStandard, make it work, forward to my application.
Apofis 5y ago
The Let's Encrypt Certbot does this automatically for nginx and apache as well, just with a bit of extra config: https://certbot-dns-cloudflare.readthedocs.io/en/stable/ https://certbot-dns-cloudflare.readthedocs.io/en/stable/

wildpeaks 5y ago

Frustratingly, the problem with automated DNS-based is that it doesn't work with all domain registrars, which is a showstopper when you are not allowed to change a customer's existing registrar nor move its NS records.

GhettoComputers 5y ago
Its one of those problems blockchain is actually a good solution for but theres no money you can tokenize to sell to others on this idea.
AlbinoDrought 5y ago
One workaround can be picking up a cheap domain and CNAMEing _acme-challenge.unsupported-provider.com to _acme-challenge.supported-provider-cheap-domain.com. The rest of the records can be left alone. This is listed on LetsEncrypt as a "delegate" subdomain [1] and on an EFF article as a "throwaway" domain [2]. Some clients just call it "CNAME support" [3]. All the different names muddle search results. I've used a Reddit guide [4] for Cloudflare + goacme/lego. [1] https://letsencrypt.org/docs/challenge-types/#dns-01-challenge https://letsencrypt.org/docs/challenge-types/#dns-01-challen... [2] https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... [3] https://go-acme.github.io/lego/dns/#experimental-features https://go-acme.github.io/lego/dns/#experimental-features [4] https://old.reddit.com/r/selfhosted/comments/je2041/how_do_you_go_about_getting_lets_encrypt_working/g9ec3z0/ https://old.reddit.com/r/selfhosted/comments/je2041/how_do_y...
ignoramous 5y ago
> automated DNS-based is that it doesn't work with all domain registrars https://acme.sh https://acme.sh automates dns01 challenges with support for over 100+ registrars: https://github.com/acmesh-official/acme.sh/wiki/dnsapi https://github.com/acmesh-official/acme.sh/wiki/dnsapi. Another good thing is that one can move their registrations and change their nameservers, at will.

mr-karan 5y ago

For my self hosted setup I've shifted to Caddy and not bother about setting up crons etc for SSL. It's just so much nicer to have the Reverse Proxy handle that for you automagically. And the config file is just 2 lines to reverse proxy instead of 20+ equivalent in NGINX.

jakearmitage 5y ago

Nginx is making the same mistakes that dethroned Apache. No one wants to fiddle with a web server. Default to $currentIndustryStandard, make it work, forward to my application.

Apofis 5y ago

The Let's Encrypt Certbot does this automatically for nginx and apache as well, just with a bit of extra config: https://certbot-dns-cloudflare.readthedocs.io/en/stable/ https://certbot-dns-cloudflare.readthedocs.io/en/stable/