Caddy
A web server that gets and renews your TLS certificates for you, from a config file you can actually read.
What it is
Caddy is an HTTP server, reverse proxy and TLS terminator. Its headline behaviour is that it obtains and renews Let us Encrypt certificates on its own: you write your domain name in the config and HTTPS is simply working, with no certbot, no cron job and no renewal script.
The configuration format, called the Caddyfile, is short enough to fit on a screen. A working reverse proxy with automatic TLS is about three lines. Configuration can still be expressed as JSON for machine generation, but the Caddyfile is what most people use.
It handles HTTP/1.1, HTTP/2 and HTTP/3 out of the box, and can also serve static files, run PHP through FastCGI, and act as a load balancer. For anyone who has spent an afternoon assembling nginx and certbot, it removes the entire category of certificate-expiry incidents.
Why we recommend it
Certificate renewals stop being your problem
Certificates are issued and renewed automatically, including on first run. The classic failure mode of an expired certificate taking a site down simply does not occur unless the server itself is off.
The config is readable at a glance
Three lines describe a reverse proxy with HTTPS. That matters for review, for handover to another person, and for the confidence that what you wrote is what the server is doing.
Sensible defaults rather than required tuning
Modern TLS settings, HTTP/2 and HTTP/3, compression and sane timeouts are on unless you turn them off. You are not assembling a secure baseline from a wiki page.
One binary, easy to automate
It is a single Go binary with no dependencies, which makes container images small and makes it trivial to drop into a build pipeline or a minimal server.
How it scores
These are our editorial ratings, not benchmark results. We score on how the project behaves in practice — how long it takes to get running, how good the documentation is, how responsive the maintainers are, and how well it holds up over time. The licence and star count above are read from GitHub and are a snapshot.
Pros and cons
Strengths
- Automatic HTTPS with no separate certificate tooling
- A very small and legible configuration file
- HTTP/1.1, HTTP/2 and HTTP/3 supported without tuning
- Static file serving, reverse proxy and FastCGI in one binary
- Well-funded upstream and frequent releases
Trade-offs
- Fewer third-party tutorials and Stack Overflow answers than nginx, so unusual setups take longer to solve
- Advanced routing and plugin behaviour is not always obvious and a full guide can be hard to write
- Plugins require rebuilding the binary with a toolchain rather than dropping in a file
How to get it
Direct download
Clicking a button downloads the file straight from the project's release — you stay on this page.
One-line install
Prefer the terminal? Copy a command and you are done.
brew install caddy
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list && sudo apt update && sudo apt install caddy
choco install caddy
Source and documentation
At a glance
| Category | DevOps |
|---|---|
| Licence | Apache 2.0 |
| Written in | Go |
| GitHub stars | 75,606 |
| Repository | caddyserver/caddy |
Licence and star count were read from the GitHub API when this page was generated and are a snapshot. Check the repository for the current figure and the authoritative licence text.
Other DevOps tools
We are not affiliated with Caddy or its maintainers. We list it because it is genuinely useful and genuinely free. If you plan to build a commercial product on top of it, read the licence on the repository first.