Caddy is a web server whose defining feature is what you do not configure: TLS certificates. It obtains them from Let's Encrypt at first request, renews them forever, and redirects HTTP to HTTPS — from a config file that fits in two lines.
The two-line website #
aospix.com {
root * /srv/aospix/public
file_server
}$ sudo systemctl enable --now caddy
$ curl -I https://aospix.com
HTTP/2 200That is the whole ceremony: DNS pointing at the machine, ports 80 and 443 reachable, and Caddy handles certificates, renewal, HTTP→HTTPS redirects, and modern TLS defaults with no further attention. Compare nginx plus certbot doing the same job and the trade-off becomes concrete: Caddy trades deep configurability for decisions already made well.
The reverse proxy, equally short #
app.aospix.com {
reverse_proxy 127.0.0.1:8080
}
api.aospix.com {
reverse_proxy 127.0.0.1:3000 {
header_up X-Real-IP {remote_host}
}
}Each block is a site; reverse_proxy forwards with the standard headers set. The concepts are identical to nginx's — one TLS termination point, many hidden backends — with the vocabulary compressed to essentials.
The features you meet in week two #
| Want | Directive |
|---|---|
| Static site | root * /path + file_server |
| Proxy | reverse_proxy upstream |
| Compression | encode zstd gzip |
| Basic auth | basic_auth block |
| Local dev HTTPS | localhost blocks — self-signed, automatic |
| Reload config | sudo systemctl reload caddy (validates first) |
The localhost case is underrated: Caddy serves development sites over HTTPS with a locally-trusted certificate, which catches mixed-content and secure-context bugs before production sees them.
Choosing Caddy or nginx #
| Priority | Choose |
|---|---|
| Fastest correct TLS for small sites | Caddy |
| Team already fluent, complex needs | nginx |
| Fine-grained tuning, large scale | nginx |
| One binary, few moving parts | Caddy |
Both sit behind the same DNS and firewall prerequisites — the certificate automation only works when Let's Encrypt can reach port 80/443, so UFW rules come first.
Log locations are the first surprise on a new install: Caddy writes JSON structured logs to the journal — journalctl -u caddy -f is the tail. caddy validate before every reload is the nginx -t habit, transplanted.
Certificates behind the scenes are Let's Encrypt; the proxy pattern is explained separately. The network series continues.