3 ms·

We use Caddy across hundreds of apps with 10s of millions of requests per day in production.

by selfmodruntime 1y ago

mholt 1y ago
Oooh. Can you tell me more about this?
- reactordev 1y ago
  In case people are wondering, this is the author of Caddy. He’s curious where it’s being used outside of home labs and in small shops. Matt, it’s fantastic software and will only get better as go improves. I used it in a proxy setup for ingress to kubernetes that’s overlayed across multiple clouds - for the government (prior admin, this admin killed it). I can’t tell you more information than that. Other than it goes WWW -> ALB -> Caddy Cluster * Other Cloud -> K8s Router -> K8s pod -> Fiber Golang service. :chefs kiss: When a pod is registered to the K8s router, we fire off a request to the caddy cluster to register the route. Bam, we got traffic, we got TLS, we got magic. No downtime.
  - reactordev 1y ago
    I almost forgot. Matt. We added a little sugar to Caddy for our cluster. Hashicorp's memberlist. So we can sync the records. It worked great. Sadly, I can't share it but it's rather trivial to implement.
    - mholt 1y ago
      Wonderful info, and feedback -- thank you so much. Happy that it works for you!
- selfmodruntime 1y ago
  Sure. University / Government sector. I know quite some unis/projects in that field that switched to caddy, since gigantic ip ranges and deep subdomains with stakeholders of many different classes have certain PKI requirements and caddy makes using ACME easy. We deploy a self serving tool where people can generate EAB-Ids and Hmac keys for a sub domain they own. Complex root domain routing and complex dynamic rewrite logic remains behind Apache/NginX/HaProxy, a lot of apps are then served in a container architecture with Caddy for easy cert renewal without relying on hacky certbot architectures. So we don't really serve that much traffic with just one instance. Also, a lot of our traffic is bots. More than one would think. The basic configuration being tiny makes it the perfect fit for people with varying capabilities and know how when it comes to devops. As a devops engineer, I enjoy the easy integration with tailscale.
  - mholt 1y ago
    Thank you, this is amazing feedback/info. Yeah, we think the Tailscale integration is pretty neat too!
    - selfmodruntime 1y ago
      Glad I could help! Not sure if you‘ll read this 7 days after the fact, but an easier/caddy native way to deal with bots, in the sense of caddy-defender or Anubis would be a godsend.
      - JsonCameron 1y ago
        Author of caddy-defender and one of the Anubis maintainers here. Definitely something that's important. An Anubis caddy plugin is in the works too! See https://github.com/TecharoHQ/anubis/issues/16 https://github.com/TecharoHQ/anubis/issues/16 However anything in caddy would likely still be a plugin and non native

We use Caddy across hundreds of apps with 10s of millions of requests per day in production.

mholt 1y ago

Oooh. Can you tell me more about this?

reactordev 1y ago
In case people are wondering, this is the author of Caddy. He’s curious where it’s being used outside of home labs and in small shops. Matt, it’s fantastic software and will only get better as go improves. I used it in a proxy setup for ingress to kubernetes that’s overlayed across multiple clouds - for the government (prior admin, this admin killed it). I can’t tell you more information than that. Other than it goes WWW -> ALB -> Caddy Cluster * Other Cloud -> K8s Router -> K8s pod -> Fiber Golang service. :chefs kiss: When a pod is registered to the K8s router, we fire off a request to the caddy cluster to register the route. Bam, we got traffic, we got TLS, we got magic. No downtime.
- reactordev 1y ago
  I almost forgot. Matt. We added a little sugar to Caddy for our cluster. Hashicorp's memberlist. So we can sync the records. It worked great. Sadly, I can't share it but it's rather trivial to implement.
  - mholt 1y ago
    Wonderful info, and feedback -- thank you so much. Happy that it works for you!
selfmodruntime 1y ago
Sure. University / Government sector. I know quite some unis/projects in that field that switched to caddy, since gigantic ip ranges and deep subdomains with stakeholders of many different classes have certain PKI requirements and caddy makes using ACME easy. We deploy a self serving tool where people can generate EAB-Ids and Hmac keys for a sub domain they own. Complex root domain routing and complex dynamic rewrite logic remains behind Apache/NginX/HaProxy, a lot of apps are then served in a container architecture with Caddy for easy cert renewal without relying on hacky certbot architectures. So we don't really serve that much traffic with just one instance. Also, a lot of our traffic is bots. More than one would think. The basic configuration being tiny makes it the perfect fit for people with varying capabilities and know how when it comes to devops. As a devops engineer, I enjoy the easy integration with tailscale.
- mholt 1y ago
  Thank you, this is amazing feedback/info. Yeah, we think the Tailscale integration is pretty neat too!
  - selfmodruntime 1y ago
    Glad I could help! Not sure if you‘ll read this 7 days after the fact, but an easier/caddy native way to deal with bots, in the sense of caddy-defender or Anubis would be a godsend.
    - JsonCameron 1y ago
      Author of caddy-defender and one of the Anubis maintainers here. Definitely something that's important. An Anubis caddy plugin is in the works too! See https://github.com/TecharoHQ/anubis/issues/16 https://github.com/TecharoHQ/anubis/issues/16 However anything in caddy would likely still be a plugin and non native