Caddy
By the Caddy project (ZeroSSL/Ardan Labs origin)
Caddy is an open-source web server and reverse proxy known for automatically obtaining and renewing HTTPS certificates without manual configuration. Written in Go, it serves static files, reverse proxies to backend applications, and…
Definition
Caddy is an open-source web server and reverse proxy known for automatically obtaining and renewing HTTPS certificates without manual configuration. Written in Go, it serves static files, reverse proxies to backend applications, and handles TLS termination, with sensible secure defaults that let simple sites run entirely encrypted with minimal setup and no separate certificate-management tooling, removing a common source of configuration mistakes and unexpected outages on other servers.
Overview
Caddy was created to reduce the friction of enabling HTTPS, which historically required administrators to manually obtain, install, and periodically renew TLS certificates on servers like Apache or Nginx. Its defining feature, automatic HTTPS, integrates certificate issuance and renewal from providers like Let's Encrypt directly into the server itself, so a site can serve encrypted traffic by default without the operator writing any certificate management logic. This removed one of the most common sources of outages on other web servers, where an expired certificate that nobody renewed in time takes a site offline. Mechanically, when Caddy starts serving a domain, it automatically requests a certificate from a configured certificate authority using the ACME protocol, stores and renews it before expiration, and handles the HTTPS handshake, all without requiring separate tooling like a standalone certbot process. Caddy's configuration can be written in its own readable Caddyfile format or as structured JSON, and it supports live configuration reloads through an API without dropping connections. Its core is built as a modular Go application, with much of its functionality, including specific protocol support and middleware, implemented as pluggable modules. Caddy is often compared to Nginx and Apache as a general-purpose web server and reverse proxy, but it differentiates itself through automatic certificate management as a default behavior rather than an add-on, and a configuration syntax designed to be readable without deep prior experience. Compared to Traefik, another modern proxy known for automatic HTTPS and native container-aware configuration, Caddy is somewhat more general-purpose as a standalone web server, while Traefik leans further into dynamic service discovery in containerized and orchestrated environments. In practice, Caddy is used to serve static websites and single-page applications with HTTPS enabled by default, as a reverse proxy in front of application backends where developers want secure defaults without manually scripting certificate renewal, and in small to medium deployments where the operational simplicity of automatic HTTPS outweighs the need for the extensive plugin ecosystems of older web servers. The trade-off is that Caddy's plugin and module ecosystem, while growing, is smaller than the decades-old ecosystems around Nginx and Apache, so some advanced or niche configurations may lack a prebuilt module and require custom development. Very large-scale deployments with highly specialized performance tuning needs sometimes still favor Nginx, given its long track record and extensive tuning documentation at scale. Caddy continues to close that gap, but teams evaluating it for demanding production traffic should weigh its comparatively younger ecosystem against their specific tuning requirements.
Key Features
- Automatic HTTPS certificate issuance and renewal via ACME
- Human-readable Caddyfile configuration format
- Reverse proxy support for backend application traffic
- Live configuration reloads through an administration API
- Modular architecture written in Go with pluggable components
- Built-in support for HTTP/2 and HTTP/3
- Sensible secure defaults requiring minimal manual setup