Caddy
A web server and reverse proxy with automatic HTTPS turned on by default
Caddy serves websites and proxies to your apps, and it gets and renews TLS certificates for every site you define without any extra step. It is a single Go binary under Apache-2.0, configured with a short Caddyfile or a JSON API.
Best for when
- you want HTTPS with the least possible configuration
- you like a config file you can read and keep in git
- you serve static sites as well as proxying to apps
Watch out for
- plugins require a custom build, which you then maintain yourself
- there is no built in web interface, so everything is text and the command line
- automatic certificates still depend on ports 80 and 443 or DNS being set up correctly
Small config, HTTPS included
A complete reverse proxy in Caddy can be two lines: the domain name, then reverse_proxy followed by the address of the app. Caddy sees the domain, requests a certificate, redirects HTTP to HTTPS and renews before expiry. For a static site, file_server does the same job.
It suits people who are comfortable with a text file and want something more readable than Nginx without a web interface in the way. The config fits in git, the defaults are modern, and it can also issue certificates from its own local authority for internal names.
What running it involves
Resource use is small and there is no database: a binary or a container, a Caddyfile and a data directory where certificates live. Back up that data directory, and make sure ports 80 and 443 are reachable for public sites so the certificate challenge can succeed.
Extra features such as DNS challenge providers or some authentication modules are plugins, and plugins mean building a custom binary with xcaddy or using a community image. That is one more thing to rebuild on each update. Any site you publish is public, so put private tools behind a VPN instead.
