12 ms·

Caddy – The Ultimate Server with Automatic HTTPS

568 points by huang_chung 2y ago

1oooqooq 2y ago
i maintain both caddy and trafficserver. traffic sees dozen of security releases a year... and i always wonder if its less secure or is more secure because people do find the holes there.
daft_pink 2y ago
Super curious if I can easily put this in front of my localhost jupyter notebook server or other service to get https on my local network.
- remram 2y ago
  You'd still need a domain to get a certificate.
  - triyambakam 2y ago
    Couldn't self signed certs work? You would still see a warning in the browser I think but can allow it
    - remram 2y ago
      You don't need Caddy then, use --certfile and --keyfile
      - triyambakam 2y ago
        Caddy is still useful as a reverse proxy. The https is just a nice benefit
        remram 2y ago
        Somebody specifically asked about adding HTTPS to their jupyter notebook, and you are pointing out a solution that is not needed for jupyter, will show certificate errors, and is "useful" only in ways you only hint at. Thank you for your comments.
        triyambakam 2y ago
        Ah yeah, I see I got off course. Thanks for pointing that out
LAC-Tech 2y ago
I gave up on caddy when the documentation around storing logs assumed systemd. I'm just a basic bitch alpine linux user; nginx was easier there.
- francislavoie 2y ago
  Logs are just written out to stderr by default, and when you use systemd it ingests it automatically. If you run it with alpine, it's up to you to wire that up.
bradley_taunt 2y ago
Streamlined “tutorial” for those looking to easily get up and running with Caddy: https://caddy.ninja/ https://caddy.ninja/
therein 2y ago
I'd imagine most of everyone here knows about Caddy. Even mholt. :)
upghost 2y ago
Interesting. Is this supposed to be an NGINX/reverse-proxy replacement, or is it complementary?
- geocrasher 2y ago
  My understanding is that it is standalone.
- vunderba 2y ago
  It's a standalone replacement for NGINX / Apache. I swapped over to it years ago and it's been rock solid, handles HTTPS certificates via ZeroSSL, and config files are very simple to set up. The author of the project is also really responsive.
arccy 2y ago
despite knowing what caddy is, this site turns me off for all the marketing fluff. since when was hn for ads? there's nothing notably technical on the page
- lolinder 2y ago
  > By default, Caddy automatically obtains and renews TLS certificates for all your sites. This is pretty technical, and is an absolute game changer for local TLS setups. Three paragraphs under this quote go into more details. Then a third of the way down the page there's a way to try it out live by changing your DNS records. Right after that are a few config samples. Then there are links to three different white papers. Then more code samples. Then more more code samples. You get the idea. What exactly are you missing here as far as technical stuff? Is it just that they add exciting fonts and stuff on top of the technical stuff?
  - arccy 2y ago
    it's all just marketing fluff
    - kupopuffs 2y ago
      r u sure you want the technical stuff?
      - arccy 2y ago
        it looks like any other marketing site, no talk of how or why anything in particular is implemented the way it is, doesn't admit to any tradeoffs or limitations, all positive spin designed to lure you in.
        lolinder 2y ago
        Your comments are more devoid of technical details than the site is. People keep asking you to clarify what you mean and you seem unable to pin down exactly what is lacking.
geocrasher 2y ago
Last year a coworker mentioned Caddy, so I decided to set it up on a spare box just to see how well it worked with WordPress, PHP etc. It did okay. I didn't do any big tests with it but it seemed to work well enough, and was super simple to configure. It does seem quite niche however.
- jasongill 2y ago
  I have had "move our PHP infrastructure to FrankenPHP" on my todo list for the last year or two - it's Caddy combined with PHP in Go
  - napkid 2y ago
    I did exactly this for my startup (https://easy.green https://easy.green). I'm very happy with this setup so far, with the code embedding feature for on premise delivery. I had to disable the worker mode though, it caused issues with uncommon features in the ORM.
  - indigodaddy 2y ago
    Yep I've used franken a few times it's the easiest php setup one could imagine
  - clementmas 2y ago
    Is FrankenPHP stable? It looks good but quite new
    - francislavoie 2y ago
      Yes, stable and production ready
- DerSaidin 2y ago
  > It did okay. I didn't do any big tests with it but it seemed to work well enough, and was super simple to configure. What issue/experience stop you from saying "it did great"?
samwillis 2y ago
One area we have found Caddy invaluable is for local testing of APIs with HTTP2 during development. Most dev servers are HTTP1 only, and so you are limited to max of 6 concurrent connections to localhost. HTTP2 requires SSL, which would normally make it a PITA to test/setup locally for development. Throw a Caddy reverse proxy in front of your normal dev server and you immediately get HTTP2 via the root certificate it installs in your OS trust store. (https://caddyserver.com/docs/automatic-https https://caddyserver.com/docs/automatic-https) We (ElectricSQL) recommend it for our users as our APIs do long polling, which with HTTP2 doesn't lock up those 6 concurrent connections. I've also found that placing it in front of Vite for normal development makes reloads much faster. Vite uses the JS module system for loading individual files in the browser with support for HMR (hot module replacement), this can result in a lot of concurrent requests for larger apps, creating a queue for those files on the six connections. Other bundlers/build tools bundle the code during development, reducing the number of files loaded into the browser, this created a bit of a debate last year on which is the better approach. With HTTP2 via Caddy in front of Vite you solve all those problems!
- srameshc 2y ago
  I assumed almost everyone (product, enterprise) uses ngork to expose development/localhost server to get HTTP2 now a days, but it's good to realize Caddy can do the job well.
- jsheard 2y ago
  > HTTP2 requires SSL Strictly speaking it doesn't, unencrypted HTTP2 is allowed per the spec (and Caddy supports that mode) but the browsers chose not to support it so it's only really useful when testing non-browser clients or routing requests between servers. HTTP3 does require encryption for reals though, there's no opting out anymore.
  - samwillis 2y ago
    Yep, it's really disappointing they didn't decide to support it for localhost.
hollow-moe 2y ago
Caddy is already powerful as it is but with the L4 plugin it can also work on layer 4 and proxy other stuff. I made a cursed config proxying to a website on HTTP request and towards a Minecraft server all other TCP traffic.
- gear54rus 2y ago
  is there write up or code for that?
  - therein 2y ago
    Here using `layer4.matchers.*` https://github.com/mholt/caddy-l4?tab=readme-ov-file#introduction https://github.com/mholt/caddy-l4?tab=readme-ov-file#introdu...
kstrauser 2y ago
I migrated all my Nginx hosts to use Caddy a while back. It doesn't do anything Nginx can't, but the default configuration is identical to the way I'd previously manually configured servers. It's so pleasant to get an HTTPS site up and running with 3 lines of setup.
sagolikasoppor 2y ago
I have used caddy for years as a reverse proxy for all my side projects. It is one of my favorite pieces of software. So easy to setup and performs very well.
satvikpendem 2y ago
Caddy is pretty nice, I believe Coolify uses it as part of their self-hosted open source PaaS model. Just out of curiosity, are there any alternatives in Rust? I think Pingora is one, as well as River which is built on top of it [0], but I'm not sure how widely used the latter is as a Caddy replacement. [0] https://github.com/memorysafety/river https://github.com/memorysafety/river
- aquariusDue 2y ago
  As far as I know only NGINX Unit[0] might be considered a viable-ish real alternative to Caddy. But other than that nothing comes close to Caddy's ease of use and versatility. You get a lot of stuff and there are heaps of community modules for it, the only downside last time I checked was increased memory usage compared to standard nginx and slower performance as a reverse proxy. Depending on your setup the fact that you have to choose between Caddyfiles (which are easier to reason about than nginx config files) or the REST API for configuration might be a downside to some people. There's a chance I might be wrong about this one though. But to answer your question directly there are no real alternatives in Rust as of now. [0] https://unit.nginx.org/ https://unit.nginx.org/
- cycomanic 2y ago
  AFAIK traefik is written in rust. I don't have any experiences with it though. I only had a brief look when setting up some personal project, but ended up going with caddy, because traefik seemed overkill for my requirements.
  - satvikpendem 2y ago
    Traefik is also written in Go, actually.
    - cycomanic 2y ago
      Ah, I misremembered then. Thanks!
- k_bx 2y ago
rand846633 2y ago
Reading the website top to bottom, I’m now unsure about the trustworthiness of a project that seems so full of itself. Passage after passage about how great it is leaves a bad aftertaste. Maybe it’s just me—unsure. I no longer trust the authors to be honest about known shortcomings, let alone be upfront, truthful, and transparent when dealing with security issues and reported vulnerabilities. I hope I’m wrong. Does anyone know how they’ve handled disclosures in the past?
- CharlesW 2y ago
  Caddy is nearly a decade old, and is very well-regarded. https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=false&query=caddy&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=fal... https://en.wikipedia.org/wiki/Caddy_(web_server) https://en.wikipedia.org/wiki/Caddy_(web_server)
- deleted 2y ago
  [deleted]
- riffic 2y ago
  [flagged]
- jeroenhd 2y ago
  I dislike this style of documentation as well, but Caddy is a proven piece of technology. It can easily replace nginx or any other reverse proxy unless you're using a real niche configuration. Not needing to deal with certbot is also pretty nice. Caddy's writing style isn't necessary big-enterprise-middle-management-friendly, but luckily for big enterprises that want lengthy, dry, and boring, there are plenty of alternatives.
- Deukhoofd 2y ago
  You're unsure about a product because the landing page is positive, and even go so far as to not trust the authors any more? That does sound like a strange expectation for a landing page, which is usually intended to make you want to use a project.
vFunct 2y ago
Another great web server to try is h2o: https://h2o.examp1e.net/ https://h2o.examp1e.net/ Especially for its HTTP/2 and HTTP/3 QUIC support.
- shawnz 2y ago
  Wow, this is exactly what I've been looking for: lightweight, supports CONNECT and CONNECT-UDP with all three HTTP versions, and supports encrypted client hello. Thanks for the recommendation!
- assimpleaspossi 2y ago
  Agree and have been using it for many years for web sites we develop for customers. H3 support has been available for quite some time. Support is also good and the developer is quite active.
- pbowyer 2y ago
  h2o is also one of the few servers to get resource prioritization correct for HTTP/2 and HTTP/3. If resource prioritisation is new, a few references: https://www.youtube.com/watch?v=MV034VqHv5Q https://www.youtube.com/watch?v=MV034VqHv5Q https://calendar.perfplanet.com/2022/http-3-prioritization-demystified/ https://calendar.perfplanet.com/2022/http-3-prioritization-d... https://github.com/andydavies/http2-prioritization-issues https://github.com/andydavies/http2-prioritization-issues
hagbard_c 2y ago
I prefer to keep certificate management separate from individual applications like web servers, mail servers, XMPP servers, database servers and all the other services I run. All of these need certificates so I have centralised certificate management and distribution. This comes down to running certbot in a container with some hook scripts to distribute new or updated certificates to services (running on different containers and machines) which need them, restarting those services when needed. Adding a new site to nginx comes down to copying a template configuration, changing the site name to the correct one, adding whatever configuration needed for the specific service and requesting a new certificate for it. The new certificate automatically gets copied to the container or machine running the service so it is available after reloading the nginx configuration. The same is true for most other services, several of which share certificates because they're running in the same domain. I used the same scheme back when I used lighttpd and will probably use it should I move to another web (or mail or XMPP or whatnot) server.
- defanor 2y ago
  Same here (not certbot and containers, but the part about reusing certificates for multiple services): it feels wrong to couple certificate acquisition with a web server. Apparently it is convenient when there is just a web server out of TLS-using services, or at least when it is in the center of the setup and HTTP-based certificate acquisition is used, which seems to be a common enough case to justify this, but still an odd coupling in general.
- RadiozRadioz 2y ago
  I also do this same thing, but my Nginx configs are templated out via automation. It gives me the best of both worlds: 95% of my sites and their certs are templated out from 3 lines of config each, then for the last special 5% I can insert literal Nginx config. For most uses I have the same experience as someone with Caddy, but for that last 5% I love the "access the full power of Nginx config from the same place" escape hatch.
wim 2y ago
I also find their library for Go (https://github.com/caddyserver/certmagic https://github.com/caddyserver/certmagic) a major timesaver! We're using it to make it easy for people to self-host our app and it takes care of all the TLS cert set up/renewal.
pierot 2y ago
A great alternative is Traefik. We have been using v1 and v2 for several years now in a setup that uses the docker labels for configuration of services.
- therein 2y ago
  When I had first heard of Caddy, I was experimenting with Traefik to replace an nginx setup I had for a long time. Traefik had good potential and momentum at the time. And then Caddy started to gain some momentum too. After that there was a brief moment Caddy made the mistake of taking an ad and including it in the `Server` response header and making it be an opt-out feature. Once that was walked back and the dust has settled, Caddy kept gaining more and more momentum and exposure. Traefik had a web panel that I thought was cool back then but it tried to be too tightly coupled with containers and insisted on making service discovery be an essential core component of its configuration model. At least this is what I remember. At this point I am very happy with caddy and it is what I use pretty much on all my services. Thank you mholt for such a nice project and sorry for being overly critical of the ad in the Server response header very many years ago. :)
  - paulgb 2y ago
    In case anyone is (like me) unfamiliar with the server header ad: https://news.ycombinator.com/item?id=15237923 https://news.ycombinator.com/item?id=15237923 Glad they removed it. Caddy is a great piece of software.
- qntmfred 2y ago
  I also started using traefik a while back with docker labels. it was a bit more to set up than I thought it would be, but now that I've figured it all out it's not too bad. at the time I had seem a lot of people talking about caddy as well and considered using it instead, but traefik had better perf/latency benchmarks and caddy seemed a bit too much geared toward or at least better suited for dev environment scenarios.
gz5 2y ago
The friendly licensing (Apache v2) is important too, especially w/ Caddy's modular architecture (single, static binary compiled for any platform). Meaning ecosystems around Caddy to make it even simpler and more secure, e.g. keep your server private while serving Internet clients. So VPNs like Tailscale (1) or zero implicit trust like OpenZiti (also Apache v2; (2)). Similar to what we have seen with open source k8s ecosystem for example. (1) https://tailscale.com/blog/caddy https://tailscale.com/blog/caddy (and other VPNs but the proprietary bits in the commercial TS service make it easier to use) (2) https://github.com/openziti-test-kitchen/ziti-caddy https://github.com/openziti-test-kitchen/ziti-caddy (disclosure: maintainer...there may be other open source zero implicit trust options with these types of Caddy integrations)
- trashburger 2y ago
  > modular architecture > single, static binary compiled for any platform Huh? Aren't these exact opposites?
  - mholt 2y ago
    Plugins (modules) are compiled in statically.
    - pjmlp 2y ago
      Just like in the 1980's.
      - infogulch 2y ago
        Build-time modularity is a great balance between flexibility, installation simplicity, startup reliability, and binary size. Look at all these comments put off at the idea that maybe the tiny annoyance of building the software to have the exact features you want is worth it for reducing deployment complexity. It's kinda sad actually, compiling software should not be so scary.
        2y ago
martinbaun 2y ago
I absolutely love Caddy. Used it for years. Very reliable and so easy to setup once you learn the basics. The documentation is a bit hard to get, but it saved me so much time and energy compared to trying to get letsencrypt working reliable ontop of NGINX.
- codetrotter 2y ago
  I used Caddy for a couple of years but eventually went back to Nginx. For the Let's Encrypt certs I use certbot and have my Nginx configs set up to point to the appropriate directories for the challenges for each domain. The only difficulty I sometimes have is the situation where I am setting up a new domain or subdomain, and Nginx refuses to start all together because I don’t have the cert yet. It’s probably not too complicated to get the setup right so that Nginx starts listening on port 80 only, instead of refusing to start just because it doesn’t have the cert for TLS needed to start up the listener on port 443. But for me it happens just rarely enough that I instead first make the config and outcomment the TLS/:443 parts and start it so that I can respond to the request from Let’s Encrypt for the /.well-known/blah blah stuff, and then I re-enable listening on with TLS and restart Nginx. I also used DNS verification for a while as well, so I’m already aware that’s an option too. But I kind of like the response on :80 method. Even if I’ve managed to make it a bit inconvenient for myself to do so.
- throwaway94244 2y ago
  I tried to setup Caddy last year as a reverse proxy for all paths matching "/backend", and serve the rest as static files from a directory. I had to give up, because the documentation was not good enough. I tried the JSON config format that seems to be the recommended format, but most examples on Google use the old format. To make it even more complicated the official documentation mentions configuration options, without informing that it requires plugins that is not necessarily installed on Ubuntu. Apparently they just assume that you will compile it from scratch with all options included. Lots of time was wasted before I found a casual mention of it in some discussion forum (maybe stack overflow, don't remember). I just wanted the path to be rewritten to remove the "/backend" path before proxying it to the service. I guess that is uncommon for a reverse proxy, and have to be placed in a separate module I may appear overly critical, but I really spent a lot of time and made an honest attempt I'll go back to nginx. Setting up let's encrypt requires some additional steps, but at least it's well documented and can be found in Google searches if necessary
rfurmani 2y ago
I'm serving AI models on Lambda Labs and after some trial and error I found having a single vllm server along with caddy, behind cloudflare dns, to work really well and really easy to set up vllm serve ${MODEL_REPO} --dtype auto --api-key $HF_TOKEN --guided-decoding-backend outlines --disable-fastapi-docs & sudo caddy reverse-proxy --from ${SUBDOMAIN}.sugaku.net --to localhost:8000 &
- mococa 2y ago
  You can use Cloudflare Tunnel, which is even better and simple than having an extra service.
- homebrewer 2y ago
  It's really best to avoid running web servers as root. It's easy to forward the port 80 with iptables, change the kernel knob to let unprivileged users use port 80 and above, or set the network capability on the binary. https://stackoverflow.com/questions/413807/ https://stackoverflow.com/questions/413807/
andrewstuart 2y ago
One day a number of years ago I decided I'd totally had anough of the arcane and difficult to debug Nginx configuration. I heard about how Caddy did automatic https, and given the searing pain of doing https on Nginx, decided to make the switch. Never regeretted it. Caddy it always up to the job even for sophisticated reverse proxying configs.
NetOpWibby 2y ago
I just launched a new site with Caddy today: https://uchu.style https://uchu.style Caddy is so awesome. I actually have a few other sites on the same server and updating my config is hella simple. I spent several years optimizing my nginx setup and I haven't touched it in years (I was obsessed about getting a perfect security score).
oliwary 2y ago
Caddy coupled with Caddy-Docker-Proxy [0] is a marvelous way to set up a server with multiple docker projects. I have it running on a couple of servers, and it just works! [0] https://github.com/lucaslorentz/caddy-docker-proxy https://github.com/lucaslorentz/caddy-docker-proxy
- globular-toast 2y ago
  I used this for my homelab before I decided my life was too easy and switched to k8s+cert manager. I use traefik[0] to handle multiple docker-compose projects in development, but this is pretty much a drop in replacement and gets you HTTPS if you have a domain and your registrar has an API. I ran a single docker-compose file with everything in it behind a single reverse proxy for quite a while. [0] https://blog.gpkb.org/posts/multiple-web-projects-traefik/ https://blog.gpkb.org/posts/multiple-web-projects-traefik/
  - plagiarist 2y ago
    This will be interesting to read, thank you. This sounds like what I was struggling with a while ago. I found traefik to be a small nightmare in k8s. I struggled my way up to a working implementation years ago, then a k8s version change on my k8s hosting service forced me to start from scratch. The whole thing soured me on traefik and also k8s. I wanted to learn pods and autoscaling while having interservice networking resolved for me. I don't want to spend hours struggling with the ingress and load balancing tools (I thought) k8s is supposed to solve for me. If I ever try it again, I'd use a different ingress tool for sure.
    - globular-toast 2y ago
      I used traefik ingress for a while for k8s as it is included by default with k3s. But I very quickly switched to ingress-nginx. It's very easy to install and then it just takes care of itself letting you just declare Ingresses and forget about it.
      - plagiarist 2y ago
ulrischa 2y ago
I get sick when I think about migrating my htaccess and apache rules to this format
- francislavoie 2y ago
  Yeah, tech debt sucks a lot.
101008 2y ago
I couldn't find (using Google) a good tutorial to deploy Django with Caddy to a Digital Ocean droplet. Can anyone suggest me what I should look for? I could ask a LLM but I'd prefer the old way for this type of stuff...
- eriklaco 2y ago
  Do you necessary need to deploy it to DO droplet? I can help you with that but have you considered any PaaS solutions? I've built the platform: seenode. You can take a look, it might be useful. If you need any help or you have a question let me know.
rmm 2y ago
I love love caddy. I only use it for my homelab to get https everywhere, but it’s so much easier than traefik for me I honestly don’t know why everyone prefers it? What am I missing?
- lurking_swe 2y ago
  Traefik just integrates better with docker, especially docker compose. Depends on your use case honestly. nothing wrong with caddy.
sunaookami 2y ago
Love Caddy! Switched to it 2 years ago from NGINX/OpenResty and it made my config much less verbose and more simple. Previously used lua-resty-auto-ssl with OpenResty but it's kinda deprecated and I will never touch certbot but needed a "fire-and-forget" solution. Serving 70k visitors monthly very well :)
8n4vidtmkvmk 2y ago
A lot of positivity in this thread. I don't have anything bad to say about Caddy, but the only advantage I'm hearing over Nginx is easier cert setup. If you're struggling with that, I can see how that's a benefit. I configured my kubernetes cluster to automatically create and renew certs a few years ago. It's all done through Ingress now. I just point my Nginx load balancer to my new domain and it figures it out. I don't often need local https but when I do I also need outside access so Stripe or whatever can ping my dev server (testing webhooks). For that I have a server running Nginx which I use to proxy back to localhost, I just have to run 1 command to temporarily expose my machine under a fixed domain. Works for me. Maybe not everyone but I'll keep doing this since I don't have any reason to switch
- thomasfromcdnjs 2y ago
  - Single executable (you know where all the files are regardless of os) - Config so easy you can remember how to do it in a day
  - lynndotpy 2y ago
    This is it for me. I got frustrated trying to do something with Nginx, which I had ~five years of experience with at the time. Someone recommended I try Caddy, I was surprised I could just `chmod +x caddy; caddy start`, and I had replaced my laborious Nginx configuration + the new reverse proxy I wanted in ten minutes. If I already knew Nginx in-and-out, I'd not have had the impetus to use Caddy. If Nginx config is a daunting task or something that takes longer than two minutes, I'd recommend taking a few minutes to try out Caddy.
  - homebrewer 2y ago
    > Single executable (you know where all the files are regardless of os) This is your package manager's job, which even Windows has these days. Other operating systems solved this problem decades ago. https://winstall.app/apps/nginxinc.nginx https://winstall.app/apps/nginxinc.nginx
    - TeMPOraL 2y ago
engine_y 2y ago
A couple of years ago, we tried replacing nginx with Traefik. The main reason was its https integration with lets encrypt. Let's just say it takes a lot these days to choose something that is not nginx.
- __jonas 2y ago
  That’s a bit vague, could you share more about what caused you to stick with nginx / problems you faced with alternatives?
  - engine_y 2y ago
    Welp. We used it in prod for ~18 months or so but the experience was not something we'd repeat. The configuration of Traefik, in our case, embedded in the docker-compose file was not clear. What was supposed to be a 'auto-detection' of services ended up looking like a hodge-podge of configs between several files. The logging was sub-par - we couldn't properly debug issues. And then we ended up migrating terminating HTTPS on AWS's ELB so the let's encrypt integration became not relevant which catalyzed us going back to nginx.
    - __jonas 2y ago
      Gotcha, thanks! I've had similar problems with Traefik and docker compose actually, got it working well once, but then after changing some settings around it wasn't properly proxying to one of my containers anymore and I gave up trying to figure it out and switched to Caddy – since I'm not dynamically scaling services to run across many containers in a cluster or such, I don't think Traefik offers much of an advantage for me personally. I've never really looked back to nginx though, I quite like Caddy's sensible defaults.
inglor_cz 2y ago
I use Caddy within FrankenPHP and it is a very good server. Plus the community is really helpful. I wish it had more informative logs, though. Some subtle errors in Caddyfile may result in the server not communicating, and not telling you that something is wrong.
seaal 2y ago
After switching from nginx to caddy-docker-proxy a year ago I just recently made the move to Pangolin[0] and am really enjoying the experience. It's a frontend to traefik with built-in auth and ability to tunnel traffic through Wireguard. I needed the TCP forwarding for my Minecraft server and this made it very simple. Would recommend it for anyone wanting a better version of Nginx Proxy Manager. The documentation is a little lacking so far but the maintainers are very helpful in their Discord. [0] github.com/fosrl/pangolin
- aborsy 2y ago
  It sounds more like an alternative to Cloudflare Tunnels. Except, the Cloudflare access is secured by Cloudflare security team.
  - gloflo 2y ago
    And all your traffic would be watched and monitored by an US American company which already has access to vast amounts of your internet browsing behaviour.
    - aborsy 2y ago
      Yes, that’s the downside. But if you run Pangolin on a VPS, there is no downside in that respect: in both cases a cloud provider has access. Authentik behind Caddy does that too.
      - apitman 2y ago
        Not sure if Pangolin works this way, but in general it's possible to run tunnels end to end encrypted.
    - mococa 2y ago
      OP told that was already using Cloudflare.
  - deleted 2y ago
    [deleted]
p2detar 2y ago
I was reluctant to switch to Caddy because I couldn't understand if does or does not use Linux' sendfile sys call, which made a huge difference for me with Nginx. [0] Nevertheless, I used Caddy to front our internal Mattermost chat server and it works flawlessly to date. The configuration was really simple, I like it a lot. 0 - https://github.com/caddyserver/caddy/issues/4731 https://github.com/caddyserver/caddy/issues/4731
- commandersaki 2y ago
  My hunch is that sendfile isn't going to give any discernable improvement and looking at the benchmarks in the thread that seems to confirm this.
  - jsheard 2y ago
    IIRC Caddy uses sendfile on HTTP connections, but HTTPS connections are or were blocked by Go not supporting Kernel TLS yet. If the kernel is sending the file by itself then it also has to handle the crypto.
Levitating 2y ago
I am still looking for a dead simple webserver that can serve files, do CGI and reverse proxy. I have been using lighttpd for much of this. It's configuration is extremely simple although it has some quirks. It also has a few problems like not always correctly logging errors related to CGI, and not being able to proxy to a backend over SSL. I tried caddy because of its simple configuration syntax and plugin support. For caddy the sample webpage alone threw me off. It includes a bunch of CSS, custom fonts, and for whatever reason it has tilted text. I'd like a test webpage to fit on my terminal screen when I SSH to it. Or at least not require a modern browser to render. Anyway I just don't think Caddy fits my usecase. Are there no dead simple, lightweight alternatives to nginx and apache that actually work?
- orblivion 2y ago
  > I'd like a test webpage to fit on my terminal screen when I SSH to it. Or at least not require a modern browser to render. It sounds like it may be worth wading into it a little more if this is what threw you off. Or is there some other reason Caddy doesn't fit your use case? It has batteries included, so it'll have some things that are a little heavy handed or confusing. On balance I appreciate how simple it is for a user at the end of the day.
  - Levitating 2y ago
    I might give Caddy another go. I just felt like Caddy tried to be a bit more "modern" for my needs, I only need to execute simple CGI scripts and forward requests after all. And most "webpages" of mine are plain HTML. Or the CLI that I dont't see myself use much I just start/stop jobs with systemd anyway. The builtin ACME support I could maybe use but I already have some beautifully handcrafted cron jobs for renewing my certs :) I even managed to more or less hack ACME support into lighttpd using its config syntax. Caddy actually used to have a very minimal test page, I think they changed it with v2. I really though lighttpd was perfect for me, very simple unix-like daemon that just requires a config file to run. I wish lighttpd v2 was still in development. In any case I will probably give Caddy another go and otherwise switch back to nginx. Lighttpd has been giving me too much problems in production, like not correctly logging CGI errors, and crashing when the configuration mentions a hostname that cannot be resolved. Or even when testing simple CGI setups, getting errors to show in stdout requires setting /proc/fd/2 as the error log file...
aborsy 2y ago
I switched to Caddy from nginx and Traefik, and never looked back. Why do I need to write a lot of code to say map example.com to 1.2.3.4? I get there are headers etc, but in most cases, it should be just one line, with sane defaults. That’s what caddy does. Takes care of SSL automatically, and does the job with minimal code. If you have a special setup, there are options, and you can write more code to achieve that.
meander_water 2y ago
I'm surprised no-one has mentioned the admin API [0], which imo is one of the main differentiators of Caddy. I've used it to dynamically change the config without any downtime. [0] https://caddyserver.com/docs/api https://caddyserver.com/docs/api
- jsheard 2y ago
  Nginx does have something similar... but it's one of the features that is exclusive to the paid version. Likewise with other features like active healthchecks, which are supported by both, but paywalled in Nginx.
- homebrewer 2y ago
  Most nginx options can be applied on the fly by changing the config and running 'nginx -s reload' or 'systemctl reload nginx' (which runs the first command underneath). No downtime for most use cases (including switching backends).
samgranieri 2y ago
I'm using caddy as a proxy to various services running node, ruby, or elixir. It's replaced using mkcert and nginx, and I have just about everything i need proxied to ..localhost, with caddy's awesome Step-CA derived certiifcate libraries providing the fun
iloveitaly 2y ago
Caddy is really great. In prod, but most surprisingly for all environments. - There's a great tool, localias, which uses Caddy for a local dev server https://github.com/peterldowns/localias https://github.com/peterldowns/localias - I use it locally for dev https://github.com/iloveitaly/python-starter-template/blob/master/.localias.yaml https://github.com/iloveitaly/python-starter-template/blob/m... which aligns tricky bits of a web app like HTTP redirect, cookies, and CORS to work consistently across dev and prod. - Can be used on GHA for HTTPS as well https://github.com/iloveitaly/github-action-localias https://github.com/iloveitaly/github-action-localias
qwertox 2y ago
> With On-Demand TLS, only Caddy obtains, renews, and maintains certificates on-the-fly during TLS handshakes. Perfect for customer-owned domains. Does it allow to plug-in into this system so that post-renewal actions are possible, like distributing those certificates to other machines through Python scripts?
- francislavoie 2y ago
  Yes, it has events on cert issuance/renewal you can hook into with Go plugins (which can trigger your python script). But generally you want all Caddy instances to share storage via storage modules (e.g. Redis or Consul or a DB, or synced filesystem) and Caddy manages locks through the storage so they don't step on eachother's toes.
heraldgeezer 2y ago
Im old. Why would I trust this over Apache and NGINX? Ive never heard of this. Is this for local dev or to run actual bigger sites?
- francislavoie 2y ago
  Production ready, 10 year old project. It's not new, it's older than Kubernetes even.
braebo 2y ago
I love caddy! I use it to serve webapps and APIs on my hetzner boxes. I hate the config file though. It could be 10x safer / more discoverable / nicer to use by just using json with a schema that validates and shows docs in the tooltips similar to tsconfig. I suspect my typescript lsp addiction and relatively limited (though non-zero) backend experience has spoiled my tolerance for the primal nature of backend tooling.
- FjordWarden 2y ago
  But it does support json for config files, you can even upload them to and endpoint to change your config at runtime. Dunno if it has a schema.
jbverschoor 2y ago
Or just use orbstack and get https for free
- lurking_swe 2y ago
  i love orbstack for personal projects but it’s not free for commercial use. FYI.
- mikeshi42 2y ago
  Caddy isn't just for local docker-based mac development - I use it for any small project hosted on a linux VPS for example.
sebiw 2y ago
My two cents having a respectable amount of infrastructure ops experience: Use Caddy to get going quickly and to get a solid setup with minimal effort. Use Nginx if you know what you're doing and want full and deep control over the web server / proxy layer of your stack.
ej1 2y ago
[dead]
oriettaxx 2y ago
> Automatic HTTPS provisions TLS certificates for all your sites and keeps them renewed. It also redirects HTTP to HTTPS for you! When I add set the IP of a domain to point to caddy, do I have do tell it some how to Caddy, or the certificate is created on the fly on the first https call? It's really important for us https://news.ycombinator.com/item?id=43053955 https://news.ycombinator.com/item?id=43053955 due to our need to redirec apex domain to www ... which we can solve with the free (great) service provided by https://www.apextowww.com/#get-started https://www.apextowww.com/#get-started ... but, we are just curious since https://www.apextowww.com/#get-started https://www.apextowww.com/#get-started does use Caddy (I see it in their headers) so maybe we would just need Caddy :)
- timdev2 2y ago
  You can use Caddy's CertMagic library in your own server, if you want something super-lightweight.
justin_oaks 2y ago
I was checking into using Caddy for new projects instead of NGINX or Apache HTTPD, but my new projects require OAuth2/OIDC authentication. It seems there's not built-in support for that kind of thing. There's the caddy-security plugin, but people online have been saying it has disclosed security vulnerabilities that aren't being fixed. Are you using caddy-security? Or is there a better alternative?
- uriah 2y ago
  With nginx I'm assuming you would use something like Vouch or oauth2-proxy? Something like the architecture described here: https://github.com/vouch/vouch-proxy?tab=readme-ov-file#what-vouch-proxy-does https://github.com/vouch/vouch-proxy?tab=readme-ov-file#what... Can't speak for caddy-security, but the forward_auth feature is the caddy equivalent to nginx's auth_request
  - justin_oaks 2y ago
    Thanks. I've used oauth2-proxy with NGINX. So I could try to set up oauth2-proxy with Caddy in a similar way.
  - mdaniel 2y ago
    Just watch out when using oauth2-proxy because its default session storage using cookies can easily blow out the header size of nginx leading to the dreaded 400 header too large One fix is moving session storage to redis <https://oauth2-proxy.github.io/oauth2-proxy/configuration/session_storage https://oauth2-proxy.github.io/oauth2-proxy/configuration/se...> and the other (if you have control over the nginx config) is bumping its allowed header size "large_client_header_buffers 4 128k;" <https://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers https://nginx.org/en/docs/http/ngx_http_core_module.html#lar...> If you're using nginx as an ingress controller, the annotations support it: <https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet https://kubernetes.github.io/ingress-nginx/user-guide/nginx-...> and/or auth-snippet <https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication https://kubernetes.github.io/ingress-nginx/user-guide/nginx-...>
qudat 2y ago
Caddy made it possible for us at https://pico.sh https://pico.sh to provide on demand tls for user subdomains and custom domains. It really was pretty easy to setup and “just works”
- pomdtr 2y ago
  I'm a big fan of pico.sh (it's one of my main inspiration for smallweb.run). I'm sure you're aware of it, but it might be interesting to others: caddy exposes all of it's internal as library you can easily integrate to your projects: https://github.com/caddyserver/certmagic https://github.com/caddyserver/certmagic
Vaslo 2y ago
I moved off of NPM and tried Caddy since Traefik seemed complicated. The paradox was that when I tried to do more complex setups like authentik as a front end and some web books, I could never get them to work with Caddy. But with Traefik, albeit more complicated, had tons more examples to work from, and a little help with LLMs to clean up my configs when complete just made it much easier in the long run. I tried Caddy with caddy-docker-proxy and maybe that was my issue? I’m happy with Traefik but for a simple config I can definitely see the advantages of Caddy.
soheil 2y ago
massive flex by having an angled perspective view of the animated terminal when they could've much more easy stuck a flat gif in its place.
drunkpotato 2y ago
Caddy is beautifully simple, a joy to setup, configure & use for a simple home server with a few services. I love it! I used nginx before, and it’s great, but caddy makes things easier. I love how easy it makes SSL certificates & reverse proxies.
ivzhh 2y ago
One thing I did not get is: why both Caddy and Traefik changed the syntax of their configurations.
- francislavoie 2y ago
  Caddy v0/1 was just built up naturally bit by bit, never had a proper design/structure around its config. Caddy v2 was a complete rewrite from the ground up, including thinking a lot more about config design, so it had to be a breaking change for the project's future to thrive.
sam_goody 2y ago
Caddy is good, especially for super simple static sites. As soon as it gets somewhat complex, the configs start becoming messy and opaque, eg. Nginx: rewrite ^/old/((\w|-)+) /new/$1.php; Caddy: @oldPath { path_regexp old ^/old/([\w-]+) } rewrite @oldPath /new/{re.old.1}.php And many things are not even handled by Caddy, or fail silently (for example, we could not get NetData to reverse_proxy behind Caddy no matter what we tried, and the logs were completely useless.)
- francislavoie 2y ago
  You can shorten it: @oldPath path_regexp ^/old/([\w-]+) rewrite @oldPath /new/{re.oldPath.1}.php Having matching and handling be separate steps are a huge benefit to composability of config, you can have pluggable matchers and handlers. Re you issue with netdata, ask on the forums for help.
cmsj 2y ago
I really like Caddy, it used to do reverse proxying and file serving for my homelab, but more recently I've demoted it to just the file serving because of how awesome it is to be able to configure reverse proxying just using container labels, which is what Traefik allows me to do.
- aglione 2y ago
  Check https://github.com/lucaslorentz/caddy-docker-proxy https://github.com/lucaslorentz/caddy-docker-proxy it's a Caddy plugin that does exactly this and in a less verbose way of Traefik. Moreover if you have more of one caddy server deployed it handles TLS certification management in a shared environment, this thing it is not available in the Traefik open source edition (just with the enterprise solution).
RagnarD 2y ago
I recently found Caddy and now use it extensively. A much nicer, more modern setup experience than Nginx.
ImpostorKeanu 2y ago
I'm absolutely hooked on Caddy. Just developed an AITM phishing tool like EvilGinx2. Challenging project, but Caddy's modularity really brings it all together. Need encrypted landing pages? Just string together a few modules. Need conditional forward proxies to make sure requests originate from geographic regions? Placeholders to the rescue. Absolute stunner project.
mooreds 2y ago
We moved to caddy as a front end for our unlimited domains offering after some experimentation[0]. ALBs didn't work at the scale we needed them to, so we run our own caddy instances. Seems to work great. We did run into a rate limiting issue with letsencrypt when we tried to provision too many certs at one time. Ended up having to use wildcard certs to decrease the number of requests. Hardly caddy's fault, though. 0: https://fusionauth.io/blog/unlimited-domains-fusionauth https://fusionauth.io/blog/unlimited-domains-fusionauth

568 points by huang_chung 2y ago

i maintain both caddy and trafficserver. traffic sees dozen of security releases a year... and i always wonder if its less secure or is more secure because people do find the holes there.

daft_pink 2y ago

Super curious if I can easily put this in front of my localhost jupyter notebook server or other service to get https on my local network.

remram 2y ago
You'd still need a domain to get a certificate.
- triyambakam 2y ago
  Couldn't self signed certs work? You would still see a warning in the browser I think but can allow it
  - remram 2y ago
    You don't need Caddy then, use --certfile and --keyfile
    - triyambakam 2y ago
      Caddy is still useful as a reverse proxy. The https is just a nice benefit
      - remram 2y ago
        Somebody specifically asked about adding HTTPS to their jupyter notebook, and you are pointing out a solution that is not needed for jupyter, will show certificate errors, and is "useful" only in ways you only hint at. Thank you for your comments.
        triyambakam 2y ago
        Ah yeah, I see I got off course. Thanks for pointing that out

LAC-Tech 2y ago

I gave up on caddy when the documentation around storing logs assumed systemd. I'm just a basic bitch alpine linux user; nginx was easier there.

francislavoie 2y ago
Logs are just written out to stderr by default, and when you use systemd it ingests it automatically. If you run it with alpine, it's up to you to wire that up.

bradley_taunt 2y ago

Streamlined “tutorial” for those looking to easily get up and running with Caddy: https://caddy.ninja/ https://caddy.ninja/

therein 2y ago

I'd imagine most of everyone here knows about Caddy. Even mholt. :)

upghost 2y ago

Interesting. Is this supposed to be an NGINX/reverse-proxy replacement, or is it complementary?

geocrasher 2y ago
My understanding is that it is standalone.
vunderba 2y ago
It's a standalone replacement for NGINX / Apache. I swapped over to it years ago and it's been rock solid, handles HTTPS certificates via ZeroSSL, and config files are very simple to set up. The author of the project is also really responsive.

arccy 2y ago

despite knowing what caddy is, this site turns me off for all the marketing fluff. since when was hn for ads? there's nothing notably technical on the page

lolinder 2y ago
> By default, Caddy automatically obtains and renews TLS certificates for all your sites. This is pretty technical, and is an absolute game changer for local TLS setups. Three paragraphs under this quote go into more details. Then a third of the way down the page there's a way to try it out live by changing your DNS records. Right after that are a few config samples. Then there are links to three different white papers. Then more code samples. Then more more code samples. You get the idea. What exactly are you missing here as far as technical stuff? Is it just that they add exciting fonts and stuff on top of the technical stuff?
- arccy 2y ago
  it's all just marketing fluff
  - kupopuffs 2y ago
    r u sure you want the technical stuff?
    - arccy 2y ago
      it looks like any other marketing site, no talk of how or why anything in particular is implemented the way it is, doesn't admit to any tradeoffs or limitations, all positive spin designed to lure you in.
      - lolinder 2y ago
        Your comments are more devoid of technical details than the site is. People keep asking you to clarify what you mean and you seem unable to pin down exactly what is lacking.

geocrasher 2y ago

Last year a coworker mentioned Caddy, so I decided to set it up on a spare box just to see how well it worked with WordPress, PHP etc. It did okay. I didn't do any big tests with it but it seemed to work well enough, and was super simple to configure. It does seem quite niche however.

jasongill 2y ago
I have had "move our PHP infrastructure to FrankenPHP" on my todo list for the last year or two - it's Caddy combined with PHP in Go
- napkid 2y ago
  I did exactly this for my startup (https://easy.green https://easy.green). I'm very happy with this setup so far, with the code embedding feature for on premise delivery. I had to disable the worker mode though, it caused issues with uncommon features in the ORM.
- indigodaddy 2y ago
  Yep I've used franken a few times it's the easiest php setup one could imagine
- clementmas 2y ago
  Is FrankenPHP stable? It looks good but quite new
  - francislavoie 2y ago
    Yes, stable and production ready
DerSaidin 2y ago
> It did okay. I didn't do any big tests with it but it seemed to work well enough, and was super simple to configure. What issue/experience stop you from saying "it did great"?

samwillis 2y ago

One area we have found Caddy invaluable is for local testing of APIs with HTTP2 during development. Most dev servers are HTTP1 only, and so you are limited to max of 6 concurrent connections to localhost. HTTP2 requires SSL, which would normally make it a PITA to test/setup locally for development. Throw a Caddy reverse proxy in front of your normal dev server and you immediately get HTTP2 via the root certificate it installs in your OS trust store. (https://caddyserver.com/docs/automatic-https https://caddyserver.com/docs/automatic-https) We (ElectricSQL) recommend it for our users as our APIs do long polling, which with HTTP2 doesn't lock up those 6 concurrent connections. I've also found that placing it in front of Vite for normal development makes reloads much faster. Vite uses the JS module system for loading individual files in the browser with support for HMR (hot module replacement), this can result in a lot of concurrent requests for larger apps, creating a queue for those files on the six connections. Other bundlers/build tools bundle the code during development, reducing the number of files loaded into the browser, this created a bit of a debate last year on which is the better approach. With HTTP2 via Caddy in front of Vite you solve all those problems!

srameshc 2y ago
I assumed almost everyone (product, enterprise) uses ngork to expose development/localhost server to get HTTP2 now a days, but it's good to realize Caddy can do the job well.
jsheard 2y ago
> HTTP2 requires SSL Strictly speaking it doesn't, unencrypted HTTP2 is allowed per the spec (and Caddy supports that mode) but the browsers chose not to support it so it's only really useful when testing non-browser clients or routing requests between servers. HTTP3 does require encryption for reals though, there's no opting out anymore.
- samwillis 2y ago
  Yep, it's really disappointing they didn't decide to support it for localhost.

hollow-moe 2y ago

Caddy is already powerful as it is but with the L4 plugin it can also work on layer 4 and proxy other stuff. I made a cursed config proxying to a website on HTTP request and towards a Minecraft server all other TCP traffic.

gear54rus 2y ago
is there write up or code for that?
- therein 2y ago
  Here using `layer4.matchers.*` https://github.com/mholt/caddy-l4?tab=readme-ov-file#introduction https://github.com/mholt/caddy-l4?tab=readme-ov-file#introdu...

kstrauser 2y ago

I migrated all my Nginx hosts to use Caddy a while back. It doesn't do anything Nginx can't, but the default configuration is identical to the way I'd previously manually configured servers. It's so pleasant to get an HTTPS site up and running with 3 lines of setup.

sagolikasoppor 2y ago

I have used caddy for years as a reverse proxy for all my side projects. It is one of my favorite pieces of software. So easy to setup and performs very well.

satvikpendem 2y ago

Caddy is pretty nice, I believe Coolify uses it as part of their self-hosted open source PaaS model. Just out of curiosity, are there any alternatives in Rust? I think Pingora is one, as well as River which is built on top of it [0], but I'm not sure how widely used the latter is as a Caddy replacement. [0] https://github.com/memorysafety/river https://github.com/memorysafety/river

aquariusDue 2y ago
As far as I know only NGINX Unit[0] might be considered a viable-ish real alternative to Caddy. But other than that nothing comes close to Caddy's ease of use and versatility. You get a lot of stuff and there are heaps of community modules for it, the only downside last time I checked was increased memory usage compared to standard nginx and slower performance as a reverse proxy. Depending on your setup the fact that you have to choose between Caddyfiles (which are easier to reason about than nginx config files) or the REST API for configuration might be a downside to some people. There's a chance I might be wrong about this one though. But to answer your question directly there are no real alternatives in Rust as of now. [0] https://unit.nginx.org/ https://unit.nginx.org/
cycomanic 2y ago
AFAIK traefik is written in rust. I don't have any experiences with it though. I only had a brief look when setting up some personal project, but ended up going with caddy, because traefik seemed overkill for my requirements.
- satvikpendem 2y ago
  Traefik is also written in Go, actually.
  - cycomanic 2y ago
    Ah, I misremembered then. Thanks!
k_bx 2y ago

rand846633 2y ago

Reading the website top to bottom, I’m now unsure about the trustworthiness of a project that seems so full of itself. Passage after passage about how great it is leaves a bad aftertaste. Maybe it’s just me—unsure. I no longer trust the authors to be honest about known shortcomings, let alone be upfront, truthful, and transparent when dealing with security issues and reported vulnerabilities. I hope I’m wrong. Does anyone know how they’ve handled disclosures in the past?

CharlesW 2y ago
Caddy is nearly a decade old, and is very well-regarded. https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=false&query=caddy&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=fal... https://en.wikipedia.org/wiki/Caddy_(web_server) https://en.wikipedia.org/wiki/Caddy_(web_server)
deleted 2y ago
[deleted]
riffic 2y ago
[flagged]
jeroenhd 2y ago
I dislike this style of documentation as well, but Caddy is a proven piece of technology. It can easily replace nginx or any other reverse proxy unless you're using a real niche configuration. Not needing to deal with certbot is also pretty nice. Caddy's writing style isn't necessary big-enterprise-middle-management-friendly, but luckily for big enterprises that want lengthy, dry, and boring, there are plenty of alternatives.
Deukhoofd 2y ago
You're unsure about a product because the landing page is positive, and even go so far as to not trust the authors any more? That does sound like a strange expectation for a landing page, which is usually intended to make you want to use a project.

vFunct 2y ago

Another great web server to try is h2o: https://h2o.examp1e.net/ https://h2o.examp1e.net/ Especially for its HTTP/2 and HTTP/3 QUIC support.

shawnz 2y ago
Wow, this is exactly what I've been looking for: lightweight, supports CONNECT and CONNECT-UDP with all three HTTP versions, and supports encrypted client hello. Thanks for the recommendation!
assimpleaspossi 2y ago
Agree and have been using it for many years for web sites we develop for customers. H3 support has been available for quite some time. Support is also good and the developer is quite active.
pbowyer 2y ago
h2o is also one of the few servers to get resource prioritization correct for HTTP/2 and HTTP/3. If resource prioritisation is new, a few references: https://www.youtube.com/watch?v=MV034VqHv5Q https://www.youtube.com/watch?v=MV034VqHv5Q https://calendar.perfplanet.com/2022/http-3-prioritization-demystified/ https://calendar.perfplanet.com/2022/http-3-prioritization-d... https://github.com/andydavies/http2-prioritization-issues https://github.com/andydavies/http2-prioritization-issues

hagbard_c 2y ago

I prefer to keep certificate management separate from individual applications like web servers, mail servers, XMPP servers, database servers and all the other services I run. All of these need certificates so I have centralised certificate management and distribution. This comes down to running certbot in a container with some hook scripts to distribute new or updated certificates to services (running on different containers and machines) which need them, restarting those services when needed. Adding a new site to nginx comes down to copying a template configuration, changing the site name to the correct one, adding whatever configuration needed for the specific service and requesting a new certificate for it. The new certificate automatically gets copied to the container or machine running the service so it is available after reloading the nginx configuration. The same is true for most other services, several of which share certificates because they're running in the same domain. I used the same scheme back when I used lighttpd and will probably use it should I move to another web (or mail or XMPP or whatnot) server.

defanor 2y ago
Same here (not certbot and containers, but the part about reusing certificates for multiple services): it feels wrong to couple certificate acquisition with a web server. Apparently it is convenient when there is just a web server out of TLS-using services, or at least when it is in the center of the setup and HTTP-based certificate acquisition is used, which seems to be a common enough case to justify this, but still an odd coupling in general.
RadiozRadioz 2y ago
I also do this same thing, but my Nginx configs are templated out via automation. It gives me the best of both worlds: 95% of my sites and their certs are templated out from 3 lines of config each, then for the last special 5% I can insert literal Nginx config. For most uses I have the same experience as someone with Caddy, but for that last 5% I love the "access the full power of Nginx config from the same place" escape hatch.

wim 2y ago

I also find their library for Go (https://github.com/caddyserver/certmagic https://github.com/caddyserver/certmagic) a major timesaver! We're using it to make it easy for people to self-host our app and it takes care of all the TLS cert set up/renewal.

pierot 2y ago

A great alternative is Traefik. We have been using v1 and v2 for several years now in a setup that uses the docker labels for configuration of services.

therein 2y ago
When I had first heard of Caddy, I was experimenting with Traefik to replace an nginx setup I had for a long time. Traefik had good potential and momentum at the time. And then Caddy started to gain some momentum too. After that there was a brief moment Caddy made the mistake of taking an ad and including it in the `Server` response header and making it be an opt-out feature. Once that was walked back and the dust has settled, Caddy kept gaining more and more momentum and exposure. Traefik had a web panel that I thought was cool back then but it tried to be too tightly coupled with containers and insisted on making service discovery be an essential core component of its configuration model. At least this is what I remember. At this point I am very happy with caddy and it is what I use pretty much on all my services. Thank you mholt for such a nice project and sorry for being overly critical of the ad in the Server response header very many years ago. :)
- paulgb 2y ago
  In case anyone is (like me) unfamiliar with the server header ad: https://news.ycombinator.com/item?id=15237923 https://news.ycombinator.com/item?id=15237923 Glad they removed it. Caddy is a great piece of software.
qntmfred 2y ago
I also started using traefik a while back with docker labels. it was a bit more to set up than I thought it would be, but now that I've figured it all out it's not too bad. at the time I had seem a lot of people talking about caddy as well and considered using it instead, but traefik had better perf/latency benchmarks and caddy seemed a bit too much geared toward or at least better suited for dev environment scenarios.

gz5 2y ago

The friendly licensing (Apache v2) is important too, especially w/ Caddy's modular architecture (single, static binary compiled for any platform). Meaning ecosystems around Caddy to make it even simpler and more secure, e.g. keep your server private while serving Internet clients. So VPNs like Tailscale (1) or zero implicit trust like OpenZiti (also Apache v2; (2)). Similar to what we have seen with open source k8s ecosystem for example. (1) https://tailscale.com/blog/caddy https://tailscale.com/blog/caddy (and other VPNs but the proprietary bits in the commercial TS service make it easier to use) (2) https://github.com/openziti-test-kitchen/ziti-caddy https://github.com/openziti-test-kitchen/ziti-caddy (disclosure: maintainer...there may be other open source zero implicit trust options with these types of Caddy integrations)

trashburger 2y ago
> modular architecture > single, static binary compiled for any platform Huh? Aren't these exact opposites?
- mholt 2y ago
  Plugins (modules) are compiled in statically.
  - pjmlp 2y ago
    Just like in the 1980's.
    - infogulch 2y ago
      Build-time modularity is a great balance between flexibility, installation simplicity, startup reliability, and binary size. Look at all these comments put off at the idea that maybe the tiny annoyance of building the software to have the exact features you want is worth it for reducing deployment complexity. It's kinda sad actually, compiling software should not be so scary.
      - 2y ago

martinbaun 2y ago

I absolutely love Caddy. Used it for years. Very reliable and so easy to setup once you learn the basics. The documentation is a bit hard to get, but it saved me so much time and energy compared to trying to get letsencrypt working reliable ontop of NGINX.

codetrotter 2y ago
I used Caddy for a couple of years but eventually went back to Nginx. For the Let's Encrypt certs I use certbot and have my Nginx configs set up to point to the appropriate directories for the challenges for each domain. The only difficulty I sometimes have is the situation where I am setting up a new domain or subdomain, and Nginx refuses to start all together because I don’t have the cert yet. It’s probably not too complicated to get the setup right so that Nginx starts listening on port 80 only, instead of refusing to start just because it doesn’t have the cert for TLS needed to start up the listener on port 443. But for me it happens just rarely enough that I instead first make the config and outcomment the TLS/:443 parts and start it so that I can respond to the request from Let’s Encrypt for the /.well-known/blah blah stuff, and then I re-enable listening on with TLS and restart Nginx. I also used DNS verification for a while as well, so I’m already aware that’s an option too. But I kind of like the response on :80 method. Even if I’ve managed to make it a bit inconvenient for myself to do so.
throwaway94244 2y ago
I tried to setup Caddy last year as a reverse proxy for all paths matching "/backend", and serve the rest as static files from a directory. I had to give up, because the documentation was not good enough. I tried the JSON config format that seems to be the recommended format, but most examples on Google use the old format. To make it even more complicated the official documentation mentions configuration options, without informing that it requires plugins that is not necessarily installed on Ubuntu. Apparently they just assume that you will compile it from scratch with all options included. Lots of time was wasted before I found a casual mention of it in some discussion forum (maybe stack overflow, don't remember). I just wanted the path to be rewritten to remove the "/backend" path before proxying it to the service. I guess that is uncommon for a reverse proxy, and have to be placed in a separate module I may appear overly critical, but I really spent a lot of time and made an honest attempt I'll go back to nginx. Setting up let's encrypt requires some additional steps, but at least it's well documented and can be found in Google searches if necessary

rfurmani 2y ago

I'm serving AI models on Lambda Labs and after some trial and error I found having a single vllm server along with caddy, behind cloudflare dns, to work really well and really easy to set up vllm serve ${MODEL_REPO} --dtype auto --api-key $HF_TOKEN --guided-decoding-backend outlines --disable-fastapi-docs & sudo caddy reverse-proxy --from ${SUBDOMAIN}.sugaku.net --to localhost:8000 &

mococa 2y ago
You can use Cloudflare Tunnel, which is even better and simple than having an extra service.
homebrewer 2y ago
It's really best to avoid running web servers as root. It's easy to forward the port 80 with iptables, change the kernel knob to let unprivileged users use port 80 and above, or set the network capability on the binary. https://stackoverflow.com/questions/413807/ https://stackoverflow.com/questions/413807/

andrewstuart 2y ago

One day a number of years ago I decided I'd totally had anough of the arcane and difficult to debug Nginx configuration. I heard about how Caddy did automatic https, and given the searing pain of doing https on Nginx, decided to make the switch. Never regeretted it. Caddy it always up to the job even for sophisticated reverse proxying configs.

NetOpWibby 2y ago

I just launched a new site with Caddy today: https://uchu.style https://uchu.style Caddy is so awesome. I actually have a few other sites on the same server and updating my config is hella simple. I spent several years optimizing my nginx setup and I haven't touched it in years (I was obsessed about getting a perfect security score).

oliwary 2y ago

Caddy coupled with Caddy-Docker-Proxy [0] is a marvelous way to set up a server with multiple docker projects. I have it running on a couple of servers, and it just works! [0] https://github.com/lucaslorentz/caddy-docker-proxy https://github.com/lucaslorentz/caddy-docker-proxy

globular-toast 2y ago
I used this for my homelab before I decided my life was too easy and switched to k8s+cert manager. I use traefik[0] to handle multiple docker-compose projects in development, but this is pretty much a drop in replacement and gets you HTTPS if you have a domain and your registrar has an API. I ran a single docker-compose file with everything in it behind a single reverse proxy for quite a while. [0] https://blog.gpkb.org/posts/multiple-web-projects-traefik/ https://blog.gpkb.org/posts/multiple-web-projects-traefik/
- plagiarist 2y ago
  This will be interesting to read, thank you. This sounds like what I was struggling with a while ago. I found traefik to be a small nightmare in k8s. I struggled my way up to a working implementation years ago, then a k8s version change on my k8s hosting service forced me to start from scratch. The whole thing soured me on traefik and also k8s. I wanted to learn pods and autoscaling while having interservice networking resolved for me. I don't want to spend hours struggling with the ingress and load balancing tools (I thought) k8s is supposed to solve for me. If I ever try it again, I'd use a different ingress tool for sure.
  - globular-toast 2y ago
    I used traefik ingress for a while for k8s as it is included by default with k3s. But I very quickly switched to ingress-nginx. It's very easy to install and then it just takes care of itself letting you just declare Ingresses and forget about it.
    - plagiarist 2y ago

ulrischa 2y ago

I get sick when I think about migrating my htaccess and apache rules to this format

francislavoie 2y ago
Yeah, tech debt sucks a lot.

101008 2y ago

I couldn't find (using Google) a good tutorial to deploy Django with Caddy to a Digital Ocean droplet. Can anyone suggest me what I should look for? I could ask a LLM but I'd prefer the old way for this type of stuff...

eriklaco 2y ago
Do you necessary need to deploy it to DO droplet? I can help you with that but have you considered any PaaS solutions? I've built the platform: seenode. You can take a look, it might be useful. If you need any help or you have a question let me know.

rmm 2y ago

I love love caddy. I only use it for my homelab to get https everywhere, but it’s so much easier than traefik for me I honestly don’t know why everyone prefers it? What am I missing?

lurking_swe 2y ago
Traefik just integrates better with docker, especially docker compose. Depends on your use case honestly. nothing wrong with caddy.

sunaookami 2y ago

Love Caddy! Switched to it 2 years ago from NGINX/OpenResty and it made my config much less verbose and more simple. Previously used lua-resty-auto-ssl with OpenResty but it's kinda deprecated and I will never touch certbot but needed a "fire-and-forget" solution. Serving 70k visitors monthly very well :)

8n4vidtmkvmk 2y ago

A lot of positivity in this thread. I don't have anything bad to say about Caddy, but the only advantage I'm hearing over Nginx is easier cert setup. If you're struggling with that, I can see how that's a benefit. I configured my kubernetes cluster to automatically create and renew certs a few years ago. It's all done through Ingress now. I just point my Nginx load balancer to my new domain and it figures it out. I don't often need local https but when I do I also need outside access so Stripe or whatever can ping my dev server (testing webhooks). For that I have a server running Nginx which I use to proxy back to localhost, I just have to run 1 command to temporarily expose my machine under a fixed domain. Works for me. Maybe not everyone but I'll keep doing this since I don't have any reason to switch

thomasfromcdnjs 2y ago
- Single executable (you know where all the files are regardless of os) - Config so easy you can remember how to do it in a day
- lynndotpy 2y ago
  This is it for me. I got frustrated trying to do something with Nginx, which I had ~five years of experience with at the time. Someone recommended I try Caddy, I was surprised I could just `chmod +x caddy; caddy start`, and I had replaced my laborious Nginx configuration + the new reverse proxy I wanted in ten minutes. If I already knew Nginx in-and-out, I'd not have had the impetus to use Caddy. If Nginx config is a daunting task or something that takes longer than two minutes, I'd recommend taking a few minutes to try out Caddy.
- homebrewer 2y ago
  > Single executable (you know where all the files are regardless of os) This is your package manager's job, which even Windows has these days. Other operating systems solved this problem decades ago. https://winstall.app/apps/nginxinc.nginx https://winstall.app/apps/nginxinc.nginx
  - TeMPOraL 2y ago

engine_y 2y ago

A couple of years ago, we tried replacing nginx with Traefik. The main reason was its https integration with lets encrypt. Let's just say it takes a lot these days to choose something that is not nginx.

__jonas 2y ago
That’s a bit vague, could you share more about what caused you to stick with nginx / problems you faced with alternatives?
- engine_y 2y ago
  Welp. We used it in prod for ~18 months or so but the experience was not something we'd repeat. The configuration of Traefik, in our case, embedded in the docker-compose file was not clear. What was supposed to be a 'auto-detection' of services ended up looking like a hodge-podge of configs between several files. The logging was sub-par - we couldn't properly debug issues. And then we ended up migrating terminating HTTPS on AWS's ELB so the let's encrypt integration became not relevant which catalyzed us going back to nginx.
  - __jonas 2y ago
    Gotcha, thanks! I've had similar problems with Traefik and docker compose actually, got it working well once, but then after changing some settings around it wasn't properly proxying to one of my containers anymore and I gave up trying to figure it out and switched to Caddy – since I'm not dynamically scaling services to run across many containers in a cluster or such, I don't think Traefik offers much of an advantage for me personally. I've never really looked back to nginx though, I quite like Caddy's sensible defaults.

inglor_cz 2y ago

I use Caddy within FrankenPHP and it is a very good server. Plus the community is really helpful. I wish it had more informative logs, though. Some subtle errors in Caddyfile may result in the server not communicating, and not telling you that something is wrong.

seaal 2y ago

After switching from nginx to caddy-docker-proxy a year ago I just recently made the move to Pangolin[0] and am really enjoying the experience. It's a frontend to traefik with built-in auth and ability to tunnel traffic through Wireguard. I needed the TCP forwarding for my Minecraft server and this made it very simple. Would recommend it for anyone wanting a better version of Nginx Proxy Manager. The documentation is a little lacking so far but the maintainers are very helpful in their Discord. [0] github.com/fosrl/pangolin

aborsy 2y ago
It sounds more like an alternative to Cloudflare Tunnels. Except, the Cloudflare access is secured by Cloudflare security team.
- gloflo 2y ago
  And all your traffic would be watched and monitored by an US American company which already has access to vast amounts of your internet browsing behaviour.
  - aborsy 2y ago
    Yes, that’s the downside. But if you run Pangolin on a VPS, there is no downside in that respect: in both cases a cloud provider has access. Authentik behind Caddy does that too.
    - apitman 2y ago
      Not sure if Pangolin works this way, but in general it's possible to run tunnels end to end encrypted.
  - mococa 2y ago
    OP told that was already using Cloudflare.
- deleted 2y ago
  [deleted]

p2detar 2y ago

I was reluctant to switch to Caddy because I couldn't understand if does or does not use Linux' sendfile sys call, which made a huge difference for me with Nginx. [0] Nevertheless, I used Caddy to front our internal Mattermost chat server and it works flawlessly to date. The configuration was really simple, I like it a lot. 0 - https://github.com/caddyserver/caddy/issues/4731 https://github.com/caddyserver/caddy/issues/4731

commandersaki 2y ago
My hunch is that sendfile isn't going to give any discernable improvement and looking at the benchmarks in the thread that seems to confirm this.
- jsheard 2y ago
  IIRC Caddy uses sendfile on HTTP connections, but HTTPS connections are or were blocked by Go not supporting Kernel TLS yet. If the kernel is sending the file by itself then it also has to handle the crypto.

Levitating 2y ago

I am still looking for a dead simple webserver that can serve files, do CGI and reverse proxy. I have been using lighttpd for much of this. It's configuration is extremely simple although it has some quirks. It also has a few problems like not always correctly logging errors related to CGI, and not being able to proxy to a backend over SSL. I tried caddy because of its simple configuration syntax and plugin support. For caddy the sample webpage alone threw me off. It includes a bunch of CSS, custom fonts, and for whatever reason it has tilted text. I'd like a test webpage to fit on my terminal screen when I SSH to it. Or at least not require a modern browser to render. Anyway I just don't think Caddy fits my usecase. Are there no dead simple, lightweight alternatives to nginx and apache that actually work?

orblivion 2y ago
> I'd like a test webpage to fit on my terminal screen when I SSH to it. Or at least not require a modern browser to render. It sounds like it may be worth wading into it a little more if this is what threw you off. Or is there some other reason Caddy doesn't fit your use case? It has batteries included, so it'll have some things that are a little heavy handed or confusing. On balance I appreciate how simple it is for a user at the end of the day.
- Levitating 2y ago
  I might give Caddy another go. I just felt like Caddy tried to be a bit more "modern" for my needs, I only need to execute simple CGI scripts and forward requests after all. And most "webpages" of mine are plain HTML. Or the CLI that I dont't see myself use much I just start/stop jobs with systemd anyway. The builtin ACME support I could maybe use but I already have some beautifully handcrafted cron jobs for renewing my certs :) I even managed to more or less hack ACME support into lighttpd using its config syntax. Caddy actually used to have a very minimal test page, I think they changed it with v2. I really though lighttpd was perfect for me, very simple unix-like daemon that just requires a config file to run. I wish lighttpd v2 was still in development. In any case I will probably give Caddy another go and otherwise switch back to nginx. Lighttpd has been giving me too much problems in production, like not correctly logging CGI errors, and crashing when the configuration mentions a hostname that cannot be resolved. Or even when testing simple CGI setups, getting errors to show in stdout requires setting /proc/fd/2 as the error log file...

aborsy 2y ago

I switched to Caddy from nginx and Traefik, and never looked back. Why do I need to write a lot of code to say map example.com to 1.2.3.4? I get there are headers etc, but in most cases, it should be just one line, with sane defaults. That’s what caddy does. Takes care of SSL automatically, and does the job with minimal code. If you have a special setup, there are options, and you can write more code to achieve that.

meander_water 2y ago

I'm surprised no-one has mentioned the admin API [0], which imo is one of the main differentiators of Caddy. I've used it to dynamically change the config without any downtime. [0] https://caddyserver.com/docs/api https://caddyserver.com/docs/api

jsheard 2y ago
Nginx does have something similar... but it's one of the features that is exclusive to the paid version. Likewise with other features like active healthchecks, which are supported by both, but paywalled in Nginx.
homebrewer 2y ago
Most nginx options can be applied on the fly by changing the config and running 'nginx -s reload' or 'systemctl reload nginx' (which runs the first command underneath). No downtime for most use cases (including switching backends).

samgranieri 2y ago

I'm using caddy as a proxy to various services running node, ruby, or elixir. It's replaced using mkcert and nginx, and I have just about everything i need proxied to ..localhost, with caddy's awesome Step-CA derived certiifcate libraries providing the fun

iloveitaly 2y ago

Caddy is really great. In prod, but most surprisingly for all environments. - There's a great tool, localias, which uses Caddy for a local dev server https://github.com/peterldowns/localias https://github.com/peterldowns/localias - I use it locally for dev https://github.com/iloveitaly/python-starter-template/blob/master/.localias.yaml https://github.com/iloveitaly/python-starter-template/blob/m... which aligns tricky bits of a web app like HTTP redirect, cookies, and CORS to work consistently across dev and prod. - Can be used on GHA for HTTPS as well https://github.com/iloveitaly/github-action-localias https://github.com/iloveitaly/github-action-localias

qwertox 2y ago

> With On-Demand TLS, only Caddy obtains, renews, and maintains certificates on-the-fly during TLS handshakes. Perfect for customer-owned domains. Does it allow to plug-in into this system so that post-renewal actions are possible, like distributing those certificates to other machines through Python scripts?

francislavoie 2y ago
Yes, it has events on cert issuance/renewal you can hook into with Go plugins (which can trigger your python script). But generally you want all Caddy instances to share storage via storage modules (e.g. Redis or Consul or a DB, or synced filesystem) and Caddy manages locks through the storage so they don't step on eachother's toes.

heraldgeezer 2y ago

Im old. Why would I trust this over Apache and NGINX? Ive never heard of this. Is this for local dev or to run actual bigger sites?

francislavoie 2y ago
Production ready, 10 year old project. It's not new, it's older than Kubernetes even.

braebo 2y ago

I love caddy! I use it to serve webapps and APIs on my hetzner boxes. I hate the config file though. It could be 10x safer / more discoverable / nicer to use by just using json with a schema that validates and shows docs in the tooltips similar to tsconfig. I suspect my typescript lsp addiction and relatively limited (though non-zero) backend experience has spoiled my tolerance for the primal nature of backend tooling.

FjordWarden 2y ago
But it does support json for config files, you can even upload them to and endpoint to change your config at runtime. Dunno if it has a schema.

jbverschoor 2y ago

Or just use orbstack and get https for free

lurking_swe 2y ago
i love orbstack for personal projects but it’s not free for commercial use. FYI.
mikeshi42 2y ago
Caddy isn't just for local docker-based mac development - I use it for any small project hosted on a linux VPS for example.

sebiw 2y ago

My two cents having a respectable amount of infrastructure ops experience: Use Caddy to get going quickly and to get a solid setup with minimal effort. Use Nginx if you know what you're doing and want full and deep control over the web server / proxy layer of your stack.

ej1 2y ago

[dead]

oriettaxx 2y ago

> Automatic HTTPS provisions TLS certificates for all your sites and keeps them renewed. It also redirects HTTP to HTTPS for you! When I add set the IP of a domain to point to caddy, do I have do tell it some how to Caddy, or the certificate is created on the fly on the first https call? It's really important for us https://news.ycombinator.com/item?id=43053955 https://news.ycombinator.com/item?id=43053955 due to our need to redirec apex domain to www ... which we can solve with the free (great) service provided by https://www.apextowww.com/#get-started https://www.apextowww.com/#get-started ... but, we are just curious since https://www.apextowww.com/#get-started https://www.apextowww.com/#get-started does use Caddy (I see it in their headers) so maybe we would just need Caddy :)

timdev2 2y ago
You can use Caddy's CertMagic library in your own server, if you want something super-lightweight.

justin_oaks 2y ago

I was checking into using Caddy for new projects instead of NGINX or Apache HTTPD, but my new projects require OAuth2/OIDC authentication. It seems there's not built-in support for that kind of thing. There's the caddy-security plugin, but people online have been saying it has disclosed security vulnerabilities that aren't being fixed. Are you using caddy-security? Or is there a better alternative?

uriah 2y ago
With nginx I'm assuming you would use something like Vouch or oauth2-proxy? Something like the architecture described here: https://github.com/vouch/vouch-proxy?tab=readme-ov-file#what-vouch-proxy-does https://github.com/vouch/vouch-proxy?tab=readme-ov-file#what... Can't speak for caddy-security, but the forward_auth feature is the caddy equivalent to nginx's auth_request
- justin_oaks 2y ago
  Thanks. I've used oauth2-proxy with NGINX. So I could try to set up oauth2-proxy with Caddy in a similar way.
- mdaniel 2y ago
  Just watch out when using oauth2-proxy because its default session storage using cookies can easily blow out the header size of nginx leading to the dreaded 400 header too large One fix is moving session storage to redis <https://oauth2-proxy.github.io/oauth2-proxy/configuration/session_storage https://oauth2-proxy.github.io/oauth2-proxy/configuration/se...> and the other (if you have control over the nginx config) is bumping its allowed header size "large_client_header_buffers 4 128k;" <https://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers https://nginx.org/en/docs/http/ngx_http_core_module.html#lar...> If you're using nginx as an ingress controller, the annotations support it: <https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet https://kubernetes.github.io/ingress-nginx/user-guide/nginx-...> and/or auth-snippet <https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#external-authentication https://kubernetes.github.io/ingress-nginx/user-guide/nginx-...>

qudat 2y ago

Caddy made it possible for us at https://pico.sh https://pico.sh to provide on demand tls for user subdomains and custom domains. It really was pretty easy to setup and “just works”

pomdtr 2y ago
I'm a big fan of pico.sh (it's one of my main inspiration for smallweb.run). I'm sure you're aware of it, but it might be interesting to others: caddy exposes all of it's internal as library you can easily integrate to your projects: https://github.com/caddyserver/certmagic https://github.com/caddyserver/certmagic

Vaslo 2y ago

I moved off of NPM and tried Caddy since Traefik seemed complicated. The paradox was that when I tried to do more complex setups like authentik as a front end and some web books, I could never get them to work with Caddy. But with Traefik, albeit more complicated, had tons more examples to work from, and a little help with LLMs to clean up my configs when complete just made it much easier in the long run. I tried Caddy with caddy-docker-proxy and maybe that was my issue? I’m happy with Traefik but for a simple config I can definitely see the advantages of Caddy.

soheil 2y ago

massive flex by having an angled perspective view of the animated terminal when they could've much more easy stuck a flat gif in its place.

drunkpotato 2y ago

Caddy is beautifully simple, a joy to setup, configure & use for a simple home server with a few services. I love it! I used nginx before, and it’s great, but caddy makes things easier. I love how easy it makes SSL certificates & reverse proxies.

ivzhh 2y ago

One thing I did not get is: why both Caddy and Traefik changed the syntax of their configurations.

francislavoie 2y ago
Caddy v0/1 was just built up naturally bit by bit, never had a proper design/structure around its config. Caddy v2 was a complete rewrite from the ground up, including thinking a lot more about config design, so it had to be a breaking change for the project's future to thrive.

sam_goody 2y ago

Caddy is good, especially for super simple static sites. As soon as it gets somewhat complex, the configs start becoming messy and opaque, eg. Nginx: rewrite ^/old/((\w|-)+) /new/$1.php; Caddy: @oldPath { path_regexp old ^/old/([\w-]+) } rewrite @oldPath /new/{re.old.1}.php And many things are not even handled by Caddy, or fail silently (for example, we could not get NetData to reverse_proxy behind Caddy no matter what we tried, and the logs were completely useless.)

francislavoie 2y ago
You can shorten it: @oldPath path_regexp ^/old/([\w-]+) rewrite @oldPath /new/{re.oldPath.1}.php Having matching and handling be separate steps are a huge benefit to composability of config, you can have pluggable matchers and handlers. Re you issue with netdata, ask on the forums for help.

cmsj 2y ago

I really like Caddy, it used to do reverse proxying and file serving for my homelab, but more recently I've demoted it to just the file serving because of how awesome it is to be able to configure reverse proxying just using container labels, which is what Traefik allows me to do.

aglione 2y ago
Check https://github.com/lucaslorentz/caddy-docker-proxy https://github.com/lucaslorentz/caddy-docker-proxy it's a Caddy plugin that does exactly this and in a less verbose way of Traefik. Moreover if you have more of one caddy server deployed it handles TLS certification management in a shared environment, this thing it is not available in the Traefik open source edition (just with the enterprise solution).

RagnarD 2y ago

I recently found Caddy and now use it extensively. A much nicer, more modern setup experience than Nginx.

ImpostorKeanu 2y ago

I'm absolutely hooked on Caddy. Just developed an AITM phishing tool like EvilGinx2. Challenging project, but Caddy's modularity really brings it all together. Need encrypted landing pages? Just string together a few modules. Need conditional forward proxies to make sure requests originate from geographic regions? Placeholders to the rescue. Absolute stunner project.

mooreds 2y ago

We moved to caddy as a front end for our unlimited domains offering after some experimentation[0]. ALBs didn't work at the scale we needed them to, so we run our own caddy instances. Seems to work great. We did run into a rate limiting issue with letsencrypt when we tried to provision too many certs at one time. Ended up having to use wildcard certs to decrease the number of requests. Hardly caddy's fault, though. 0: https://fusionauth.io/blog/unlimited-domains-fusionauth https://fusionauth.io/blog/unlimited-domains-fusionauth