3 ms·

The automatic HTTPS feature of Caddy is a game changer. I enabled it once on a server five years ago and never had to take a second look. I am surprised that th

The automatic HTTPS feature of Caddy is a game changer. I enabled it once on a server five years ago and never had to take a second look. I am surprised that this is not a standard feature of all web servers. There is no way I am fighting with certbot (or whatever the recommended software is) anymore. That being said, the rest of the software is not as amazing. Please nginx, could you add automatic HTTPS so I can ditch Caddy?

mholt 5y ago
What is not as amazing?
- nicolaslem 5y ago
  I have not kept up with Caddy in a long while, so take with a grain of salt: - The weird license debacle. - The weird ads in headers debacle. - I had trouble with advanced usage that should have worked but were not flexible enough, like acting as a cache. - The marketing rubbed me the wrong way. It was pointing the deficiencies in other established FOSS web servers, basically treating them as relics while Caddy itself had 10% of their features.
  - mholt 5y ago
    Hmm, so you're hung up on all things we've fixed with Caddy v2 years ago. I recommend giving it a try again with a fresh mindset. It's a totally different product.
    - nicolaslem 5y ago
      I don't know if the tone of the marketing is fixed. In the past I found the lack of humility surrounding the project off putting. Now I go to the website and the first thing I see is a giant "THE ULTIMATE SERVER", not a good start.
      - mholt 5y ago
        We're more confident about that one.
        philipwhiuk 5y ago
        How can you be confident about it being the ultimate server when you say comparing performance can't be done.
        mholt 5y ago
        There's a lot more to "ultimate" than just performance. It's a cross of many dimensions.
  - francislavoie 5y ago
    In case you missed it: https://github.com/caddyserver/caddy/issues/2786 https://github.com/caddyserver/caddy/issues/2786 Those issues are a thing of the past. There's no use bringing it up again, tbh. > like acting as a cache That's fair, we have a WIP cache module here https://github.com/caddyserver/cache-handler https://github.com/caddyserver/cache-handler, it should be ready soon!
    - mholt 5y ago
      I'm excited for that cache module.
tialaramex 5y ago
This is what's crazy. I assumed two things would logically happen in the year or two after Let's Encrypt went live. Firstly, bulk hosts would all either negotiate a very cheap bulk deal with a for-profit CA, or they'd go to Let's Encrypt. That mostly happened, eventually, but there are some hold-outs still, years later. Secondly, all the TLS capable servers, but especially HTTPS would just throw this in as part of the core system. Nope, Caddy is one of a minority that put more than a token effort in, a few others have some optional functionality, that you could choose to use if you know what you're doing, most did nothing, relying on you to roll a Certbot script or whatever to manage the certificates. I figured corporate products, maybe Microsoft tools, stuff like that, might prefer to provide SCEP or any of the half a dozen mechanisms for certificate issuance that pre-dated ACME (what Let's Encrypt does) but lack the actual proof-of-control mechanism. You can imagine Big Corp decides to have a central ACME service doing DNS proof-of-control and then it uses say SCEP internally to issue the certificates to its own servers. That didn't really happen either. The situation outside web servers is even worse. SQL Servers, SMTP† and IMAP, IRC, and so on, can't do this as easily as Caddy does, but few of them even made a token effort. I don't have much faith in the "efficient market" hypothesis, but if you're a server admin and you believe in it this ought to really shake you. Apparently you value your own time at zero dollars. † SMTP is a special case. In principle a CA could (but Let's Encrypt don't) allow you to do proof-of-control via SMTP because it uses one of the ports set aside for proof of control purpose in the Baseline Requirements. So you could imagine a CA offering a new ACME proof-of-control method say smtp-69 that meant suitable mail servers would just get themselves certificates, no extra software. But that is not a thing. Other services like IRC or indeed IMAP are not covered by the BRs and so you could not do this for those servers without a lengthy and political process to amend the BRs first.

mholt 5y ago

What is not as amazing?

nicolaslem 5y ago
I have not kept up with Caddy in a long while, so take with a grain of salt: - The weird license debacle. - The weird ads in headers debacle. - I had trouble with advanced usage that should have worked but were not flexible enough, like acting as a cache. - The marketing rubbed me the wrong way. It was pointing the deficiencies in other established FOSS web servers, basically treating them as relics while Caddy itself had 10% of their features.
- mholt 5y ago
  Hmm, so you're hung up on all things we've fixed with Caddy v2 years ago. I recommend giving it a try again with a fresh mindset. It's a totally different product.
  - nicolaslem 5y ago
    I don't know if the tone of the marketing is fixed. In the past I found the lack of humility surrounding the project off putting. Now I go to the website and the first thing I see is a giant "THE ULTIMATE SERVER", not a good start.
    - mholt 5y ago
      We're more confident about that one.
      - philipwhiuk 5y ago
        How can you be confident about it being the ultimate server when you say comparing performance can't be done.
        mholt 5y ago
        There's a lot more to "ultimate" than just performance. It's a cross of many dimensions.
- francislavoie 5y ago
  In case you missed it: https://github.com/caddyserver/caddy/issues/2786 https://github.com/caddyserver/caddy/issues/2786 Those issues are a thing of the past. There's no use bringing it up again, tbh. > like acting as a cache That's fair, we have a WIP cache module here https://github.com/caddyserver/cache-handler https://github.com/caddyserver/cache-handler, it should be ready soon!
  - mholt 5y ago
    I'm excited for that cache module.

tialaramex 5y ago

This is what's crazy. I assumed two things would logically happen in the year or two after Let's Encrypt went live. Firstly, bulk hosts would all either negotiate a very cheap bulk deal with a for-profit CA, or they'd go to Let's Encrypt. That mostly happened, eventually, but there are some hold-outs still, years later. Secondly, all the TLS capable servers, but especially HTTPS would just throw this in as part of the core system. Nope, Caddy is one of a minority that put more than a token effort in, a few others have some optional functionality, that you could choose to use if you know what you're doing, most did nothing, relying on you to roll a Certbot script or whatever to manage the certificates. I figured corporate products, maybe Microsoft tools, stuff like that, might prefer to provide SCEP or any of the half a dozen mechanisms for certificate issuance that pre-dated ACME (what Let's Encrypt does) but lack the actual proof-of-control mechanism. You can imagine Big Corp decides to have a central ACME service doing DNS proof-of-control and then it uses say SCEP internally to issue the certificates to its own servers. That didn't really happen either. The situation outside web servers is even worse. SQL Servers, SMTP† and IMAP, IRC, and so on, can't do this as easily as Caddy does, but few of them even made a token effort. I don't have much faith in the "efficient market" hypothesis, but if you're a server admin and you believe in it this ought to really shake you. Apparently you value your own time at zero dollars. † SMTP is a special case. In principle a CA could (but Let's Encrypt don't) allow you to do proof-of-control via SMTP because it uses one of the ports set aside for proof of control purpose in the Baseline Requirements. So you could imagine a CA offering a new ACME proof-of-control method say smtp-69 that meant suitable mail servers would just get themselves certificates, no extra software. But that is not a thing. Other services like IRC or indeed IMAP are not covered by the BRs and so you could not do this for those servers without a lengthy and political process to amend the BRs first.