Caddy Server: Automatic HTTPS Made Simple

Beginner

Caddy is a modern web server that challenges the complexity of Nginx and Apache with one radical premise: HTTPS should be automatic and configuration should be simple. Created by Matt Holt in 2015 and completely rewritten as Caddy v2 in 2020, Caddy is written in Go and compiles to a single binary with no external dependencies. Its most distinctive feature — automatic HTTPS with Let's Encrypt — eliminates the most common source of web server misconfiguration.

While Caddy may not match Nginx's raw throughput at extreme scale, it excels in developer productivity, operational simplicity, and correctness by default. For small-to-medium sites, API gateways, and containerized deployments, Caddy often represents the best balance of performance and maintainability.

How Does Caddy's Automatic HTTPS Work?

Caddy's automatic HTTPS is its defining feature. When you configure Caddy with a domain name, it automatically:

1. Obtains a TLS certificate from Let's Encrypt using the ACME protocol (HTTP-01 or TLS-ALPN-01 challenge)
2. Redirects HTTP to HTTPS — all HTTP requests get a 301 redirect to the HTTPS equivalent
3. Renews certificates before expiration (Let's Encrypt certificates expire every 90 days; Caddy renews at 30 days remaining)
4. Staples OCSP responses for faster TLS handshakes
5. Uses modern TLS defaults — TLS 1.2/1.3 only, strong cipher suites, HSTS headers

This means a complete, production-ready HTTPS server can be configured in a single line:

# Caddyfile — serves files with automatic HTTPS
example.com

root * /var/www/html
file_server

Compare this with the equivalent Nginx configuration, which requires SSL certificate paths, cipher suite configuration, OCSP stapling setup, redirect blocks, and security headers — typically 30-50 lines of configuration.

How Does Caddyfile Configuration Compare to Nginx?

Caddyfile uses a human-readable format that is significantly more concise than Nginx or Apache configuration:

# Caddy: Reverse proxy with HTTPS
example.com {
    reverse_proxy localhost:3000
    encode gzip
    log {
        output file /var/log/caddy/access.log
    }
}

# Caddy: Multiple sites
api.example.com {
    reverse_proxy localhost:8080
    header /api/* Cache-Control "no-cache"
}

static.example.com {
    root * /var/www/static
    file_server
    header Cache-Control "public, max-age=31536000"
}

Caddy also supports a JSON configuration API for dynamic, runtime configuration changes without restart — useful for service meshes and orchestration platforms.

What Are Caddy's Best Use Cases?

Development servers — Caddy generates a locally-trusted CA certificate for development, providing HTTPS on localhost without browser warnings. This is invaluable for testing features that require HTTPS (Service Workers, geolocation API, WebRTC).

Container deployments — Caddy's single-binary distribution and simple configuration make it ideal for Docker containers. A complete reverse proxy container can be configured with a 3-line Caddyfile.

API gateways — Caddy's reverse proxy with automatic HTTPS and rate limiting plugins provides a production-ready API gateway with minimal configuration.

Small-to-medium websites — for sites that do not require Nginx's extreme performance or Apache's module ecosystem, Caddy provides the best out-of-box experience with the least operational burden.

When Should You Not Use Caddy?

Very high traffic sites — while Caddy handles thousands of concurrent connections well, Nginx's optimized C codebase provides 10-30% higher throughput for static files at the extreme high end. For sites serving millions of requests per hour, the performance difference matters.

Complex configurations — Nginx's extensive directive set handles edge cases that Caddy's simpler configuration cannot express. If you need fine-grained control over proxy buffering, complex rewrite rules, or multi-level caching, Nginx provides more options.

Legacy environments — existing infrastructure with extensive Nginx or Apache configuration investment should not be migrated to Caddy without a compelling reason. The migration cost outweighs the simplicity benefit for established systems.