Caddy: Modern Web Server with Automatic TLS & Reverse Proxy

What is Caddy?

Caddy is an open-source, enterprise-ready web server and reverse proxy written in Go. Its hallmark innovation is Automatic HTTPS: Caddy manages the complete certificate lifecycle (issuance, verification, renewal, OCSP stapling, and revocation checking) automatically via Let’s Encrypt and ZeroSSL without requiring external tools like Certbot or cron jobs.

It serves static files at blistering speeds, proxies dynamic applications over HTTP/1.1, HTTP/2, and HTTP/3, and features an expressive configuration format (Caddyfile) alongside a dynamic runtime REST API.

Core Architectural Strengths

• Automatic TLS Management: Zero-maintenance HTTPS by default. Certificates are renewed automatically before expiry.
• HTTP/3 (QUIC) Native: Out-of-the-box support for the fastest modern transport protocols with 0-RTT handshakes.
• Human-Readable Caddyfile: Clean, intuitive syntax replacing hundreds of lines of cryptic Nginx directives.
• Zero-Downtime Hot Reloads: Update routing rules via CLI (caddy reload) or direct JSON API without dropping a single active client connection.
• Single Static Binary: Self-contained executable with zero dynamic dependencies, making deployment effortless.

Instant One-Liner Recipes

1. Reverse Proxy with Free HTTPS

caddy reverse-proxy --from api.yourdomain.com --to localhost:8000

2. High-Performance Static File Server with Browsing

caddy file-server --browse --listen :8080

Production Caddyfile Example

Create a file named Caddyfile in your project root:

# Global settings
{
    email [email protected]
}

# Production Reverse Proxy with Modern Security
api.yourdomain.com {
    # Automatic compression
    encode gzip zstd

    # Security headers
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Referrer-Policy "strict-origin-when-cross-origin"
    }

    # Upstream backend proxy with health checks
    reverse_proxy localhost:8000 {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
    }
}