Skip to content
Back to Cloud Services

Caddy Server (Auto-HTTPS)

Modern web server with automatic HTTPS via Let's Encrypt, a simple Caddyfile config, and HTTP/3 support out of the box.

VPS & Self-HostedBeginner

Why

Caddy obtains and renews TLS certificates automatically — no certbot, no cron, no manual renewal. The Caddyfile is 5-10 lines for a reverse proxy with HTTPS.

It supports HTTP/3, reverse proxy, and static files with sensible defaults, making it ideal for simple self-hosted setups.

When

Use Caddy when you want zero-config HTTPS and a simple config — perfect for personal sites, small SaaS, and prototypes. Use nginx when you need complex routing, Lua (OpenResty), or have an existing nginx-based setup with many server blocks.

How

1. Install Caddy (official apt repo or download binary). 2. Write a Caddyfile with your domain and reverse_proxy or file_server. 3. caddy validate to check config. 4. caddy start (or use the systemd service). 5. Caddy auto-obtains a cert on first request to the domain. 6. For DNS-01 challenge (wildcard), use a DNS plugin. ```bash apt install -y debian-keyring debian-archive-keyring apt-transport-https curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list apt update && apt install caddy # edit /etc/caddy/Caddyfile, then: systemctl enable --now caddy ```

Example

A Caddyfile that serves a static site on the apex and proxies api.example.com to a Node app, all with auto-HTTPS: ```caddyfile example.com { root * /var/www/site file_server } api.example.com { reverse_proxy 127.0.0.1:3000 header { X-Frame-Options DENY Referrer-Policy no-referrer } } ``` Caddy handles cert acquisition, renewal, and HTTP→HTTPS redirect automatically. ```bash caddy validate --config /etc/caddy/Caddyfile caddy reload --config /etc/caddy/Caddyfile ```

Common Problems

  • ⚠Cert obtain fails — ports 80 and 443 must be open and the domain must resolve to the server; Caddy uses HTTP-01 by default which needs port 80.
  • ⚠Behind a CDN, Caddy can't obtain certs — the CDN terminates TLS; use Caddy's internal CA or set tls { on_demand } and disable auto-HTTPS with the 'tls' directive pointing to existing certs.
  • ⚠Config not reloading — use 'caddy reload' not 'systemctl restart' to avoid dropping active connections; validate first with 'caddy validate'.

Best Practices

  • ✓Use the Caddyfile (not JSON) for config — it is far more readable and supports 'caddy reload' for zero-downtime updates.
  • ✓For wildcard certs (*.example.com), use the DNS-01 challenge with a Caddy DNS plugin (caddy-dns/cloudflare) so you do not need port 80 exposed.
  • ✓Add security headers (X-Frame-Options, CSP, HSTS) in the header block — Caddy does not add them by default, unlike some hardened nginx configs.

FAQ

What is Caddy Server (Auto-HTTPS) and what problem does it solve?

Modern web server with automatic HTTPS via Let's Encrypt, a simple Caddyfile config, and HTTP/3 support out of the box. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Caddy Server (Auto-HTTPS) in 5 minutes?

Two steps to run it: (1) Install Caddy (official apt repo or download binary).; (2) Write a Caddyfile with your domain and reverse_proxy or file_server.. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Caddy Server (Auto-HTTPS)?

The most frequent issue is: Cert obtain fails — ports 80 and 443 must be open and the domain must resolve to the server; Caddy uses HTTP-01 by default which needs port 80.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Caddy Server (Auto-HTTPS)?

Best practices for Caddy Server (Auto-HTTPS) include: Use the Caddyfile (not JSON) for config — it is far more readable and supports 'caddy reload' for zero-downtime updates.; For wildcard certs (*.example.com), use the DNS-01 challenge with a Caddy DNS plugin (caddy-dns/cloudflare) so you do not need port 80 exposed.; Add security headers (X-Frame-Options, CSP, HSTS) in the header block — Caddy does not add them by default, unlike some hardened nginx configs.. The first one — "Use the Caddyfile (not JSON) for config — it is far more readable and supports 'caddy reload' for zero-downtime updates." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Caddy Server (Auto-HTTPS)?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Caddy Server (Auto-HTTPS) options offer a free tier — validate within free quota before scaling.