Caddy
Open-source web server and reverse proxy written in Go with automatic HTTPS.
HN commenters use it as a reverse proxy in front of self-hosted services and containers1234, value its automatic SSL handling567, and say it just works on small VPSes.8910 Complaints are few: one commenter says it misbehaves out of the box11, and another questions its history of vulnerabilities.12
Why people recommend it
Reverse proxy · 3
Commenters put it in front of self-hosted apps and Docker containers to route traffic to each service.
“I expose my services with a Caddy reverse proxy on a VPS, with Authelia in front, and so far it basically just works.”
“I've been running with Caddy in front of Docker (compose) for most of my personal/hobby usage.”
Show 1 more
“Caddy runs on the VPS with one proxy line per service.”
Automatic SSL · 3
Commenters say it handles certificates and TLS termination for them.
“One notable exception is caddy and automatic SSL.”
“Caddy handles the SSL and routes everything to the right containers.”
Show 1 more
“Caddy supports socket binding, and can handle SSL certs.”
Just works · 3
Several commenters report that it works with little effort.
“I expose my services with a Caddy reverse proxy on a VPS, with Authelia in front, and so far it basically just works.”
“the caddy package from pacman just works”
Show 1 more
“These days I’m just using Caddy to do ..localhost for my web dev and it works like a charm.”
Cheap VPS hosting · 3
Commenters run it on small, low-cost VPSes without problems.
“Fronted with Caddy, the whole thing runs flawlessly on a $5 VPS.”
“I use a Wireguard VPN to tunnel traffic to a tiny public facing Caddy server”
Show 1 more
“Run caddy for ssl termination and reverse proxying the other services running here.”
Private networks · 3
It pairs with Tailscale or WireGuard setups to keep services private or tunnel traffic home.
“I use Porkbun's API and the Caddy instance isn't reachable from the internet, only local and over tailscale”
“I use a Wireguard VPN to tunnel traffic to a tiny public facing Caddy server”
Show 1 more
“Caddy handles the SSL and routes everything to the right containers.”
Static sites · 2
Commenters use it to serve static websites directly.
“The static site is then served with Caddy.”
“I've been running with Caddy in front of Docker (compose) for most of my personal/hobby usage.”
Caveats and dissent
Default behavior · 1
One commenter says it misbehaves out of the box, in a discussion of static file server URL redirects.
“Caddy misbehaves out of the box”
Security history · 1
One commenter notes it seems to have a history of vulnerabilities, despite being written in Go.
“Caddy (written in Go) but they seem to have a history of vulnerabilities of other types”
DNS validation · 1
DNS-based certificate validation requires an extension and a DNS provider with an API.
“I use Porkbun's API and the Caddy instance isn't reachable from the internet, only local and over tailscale”
Often compared with
Who recommends it in their own words
Threads where it came up
- Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7? 3 mentions
- Ask HN: What are tools you have made for yourself since the advent of AI 2 mentions
- Removing Next.js Got My Blog to 100 on Every Lighthouse Category 1 mention
- Plex vulnerabilities being exploited in the wild to drop a cryptominer 1 mention
- "I'm Embarrassed on Behalf of the Tech Industry" 1 mention
- Ask HN: What self-hosted apps do you use daily? 1 mention
Data: caddy.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 35
“The static site is then served with Caddy.”
“So now it’s just a public URL served up with Caddy.”
“my caddy lxc has 2 IPs, one port forwarded one internal only”
“Caddy runs on the VPS with one proxy line per service.”
“Run caddy for ssl termination and reverse proxying the other services running here.”
“The Caddy container handling certificates and reverse proxies for everything.”
“I expose my services with a Caddy reverse proxy on a VPS, with Authelia in front, and so far it basically just works.”
“everything running on a Hetzner VPS behind Caddy”
“I use Porkbun's API and the Caddy instance isn't reachable from the internet, only local and over tailscale”
“Caddy route isolation”
“Most of the stuff I use is free and excellent.”
“I use a Wireguard VPN to tunnel traffic to a tiny public facing Caddy server”
“I built it using a DO VPS and Caddy in the backend.”
“I use NixOS with nginx + acme / caddy, coredns and no docker anywhere.”
“a caddy reverse proxy so I can also host a little starter app”
“deploy it either to my internal Caddy”
“It's using Caddy and running on a DO-VPS.”
“Caddy in front.”
“I've been running with Caddy in front of Docker (compose) for most of my personal/hobby usage.”
“Caddy (written in Go) but they seem to have a history of vulnerabilities of other types”
“Caddy misbehaves out of the box”
“i used Caddy to "output its own access log"”
“These days I’m just using Caddy to do ..localhost for my web dev and it works like a charm.”
“One notable exception is caddy and automatic SSL.”
“Caddy as the reverse proxy”
“caddy on the host proxies to the container 10.x address”
“Caddy handles the SSL and routes everything to the right containers.”
“use a reverse proxy like Caddy in front of it for SSL and actual domain.”
“I only expose the tracking js endpoint and /api/send via Caddy publically”
“the caddy package from pacman just works”
“Caddy as the reverse proxy”
“Caddy in front of Immich to get an nice url and https”
“Caddy supports socket binding, and can handle SSL certs.”
“Fronted with Caddy, the whole thing runs flawlessly on a $5 VPS.”
“Caddy as the reverse proxy”