caddy

Caddy

Caddy is an enterprise-grade web server written in Go, featuring automatic TLS certificate provisioning by default, modern HTTP/3 support, and concise configuration syntax.

When to Use

• Automated TLS & Reverse Proxying: Instant HTTPS certificates issued via Let's Encrypt / ZeroSSL with zero manual setup.
• Modern Microservice Edge Proxy: HTTP/2 and HTTP/3 reverse proxying with clean, human-readable Caddyfiles.
• Local Development HTTPS: Issuing trusted local root certificates automatically for development environments.
• Zero-Downtime Hot Reloading: Updating configurations via REST API or caddy reload without dropping connections.

Quick Start

# Caddyfile
example.com {
    reverse_proxy localhost:3000
    encode zstd gzip
    file_server
}

Core Concepts

Production Reverse Proxy Caddyfile with Security Headers

Clean reverse proxy configuration with automatic HTTPS:

# /etc/caddy/Caddyfile
api.example.com {
    # Automatic TLS enabled by default!

    # Reverse proxy to backend application cluster
    reverse_proxy 127.0.0.1:8080 {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-Proto {scheme}

        # Health checks and failover
        lb_policy round_robin
        health_path /healthz
        health_interval 10s
    }

    # Security headers
    header {
        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        -Server # Remove server fingerprint header
    }

    # Structured JSON access logging
    log {
        output file /var/log/caddy/access.log {
            roll_size 50mb
            roll_keep 10
        }
        format json
    }
}

Static File Server with Gzip & Zstandard Compression

Serving high-performance frontends with fallback for Single Page Apps (SPAs):

app.example.com {
    root * /var/www/app/dist
    encode zstd gzip

    # SPA routing: try file, then fallback to index.html
    try_files {path} /index.html
    file_server
}