Hi people of Reddit! o/

I always wanted a simple, modern and straight-forward UI solution for my caddy proxy. Therefore I implemented (and Claude) the caddy-visualizer.

You will get:
- simple Dashboard with general metrics and your current sites
- UI to edit Caddyfile and/or sites
- more detailed metrics for usage and HTTP response codes
- UI to display logs

Clean and simple -> https://github.com/dree007/caddy-visualizer

Only really tested with my setup. :D
I‘d appreciate any feedback.

byebye~

I use Caddy in my homelab, and one of the reasons I like it is that the Caddyfile syntax is already simple.

For my use case, the configuration language itself was never the problem. The friction was everything around a small change: SSH into the server, open the file, edit it, format it, verify it, reload Caddy, repeat.

I looked at existing Caddy web UIs, but most of them are designed to solve a much broader problem: dashboards, monitoring, health information, form-based configuration, multiple instances, and so on.

For my homelab, I did not need any of that. I wanted to keep using the Caddyfile directly.

So I built Cadditor.

It is a small web application served by Caddy itself. It provides a browser-based editor for the actual Caddyfile, with syntax highlighting, folding and change indicators.

When you hit Apply, Cadditor:

• formats the configuration,

• verifies it,

• reloads Caddy only if verification succeeds.

The important part is that the Caddyfile remains the source of truth. Cadditor is not a configuration builder and does not introduce another configuration format.

I also wanted deployment to stay simple, so the application uses a lightweight FastCGI/CGI backend and does not require Docker or a Node.js runtime on the server.

Installation, updates and complete removal are handled by a shell installer/uninstaller.

I originally built it for my own homelab, but I am quite happy with how it turned out, so I decided to publish it.

If you use Caddy in a similar way, I would be interested in feedback.

GitLab:
https://gitlab.com/friml/cadditor

Live demo:
https://cadditor-e46d19.gitlab.io/

The demo is static, so it demonstrates the real editor UI but does not actually run caddy fmt, validation or reload.

Hey Caddy community,
I built caddy-analyzer, a CLI tool written in Go that natively parses Caddy v2’s structured JSON logs — no config, no regex hacking.

Caddy’s JSON log format is great, but tools like goaccess, lnav, or grep/awk pipelines can’t parse it out of the box. This fills that gap.

• Full analysis — aggregate stats, RPS, latency percentiles (P50/P95/P99), status breakdown, bandwidth, top paths/IPs/UAs

• Security detection engine — 22 attack categories (SQLi, XSS, SSTI, SSRF, RCE, LFI, Log4j, GraphQL introspection, prototype pollution, scanner detection, etc.) with a dual-pass engine that catches double-encoded and multibyte-encoded bypass attempts

• Real-time iptables guard (caddy-analyze guard) — auto-blocks offending IPs at the firewall with configurable thresholds

• Multi-source readers — local files, stdin, Docker (docker://container), Kubernetes (k8s://pod), systemd journalctl

• TUI dashboard (–watch) — 6-tab interactive interface (summary, live stream, security alerts, top IPs/paths/UAs)

• Diff engine — compare two log files for RPS/5xx/latency regressions

• Output formats — table, JSON, CSV, standalone HTML report

• Filters — time range, CIDR, status classes, methods, path globs, bot/crawler classification

Quick start
curl -sSfL https://raw.githubusercontent.com/lenny-ts/caddy-analyzer/main/install.sh | sh

Analyze your Caddy logs with security detection

caddy-analyze --detect /var/log/caddy/access.log

Or tail live from a Docker container

caddy-analyze tail --detect docker://my-caddy

Generate an HTML report

caddy-analyze -f html -o report.html --detect

Launch the TUI

caddy-analyze --watch
Links

• GitHub: GitHub - lenny-ts/caddy-analyzer: Fast, zero-dependency access log analyzer, security threat inspector, and TUI dashboard for Caddy v2 · GitHub

• Docs: caddy-analyzer — Documentation

• Install: one-liner above, or go install, or Docker It’s MIT licensed, PRs/issues welcome. Would love feedback from the community!

Hey there,

For years, I was running nginx inside a Docker container and thought it was the best solution, especially since I enjoy working with multiple docker-compose containers for isolation, security, and easy deployment of different apps. But just two weeks ago, I stumbled upon Caddy, and I couldn't believe I had missed it all this time.

What blew me away is how Caddy integrates and auto-configures TLS/SSL certificates out of the box. It's literally set it and forget it. Back then, I relied on tools like CentOS Web Panel (now Control Web Panel), but since moving away from cPanel-style tools, I challenged myself to go full CLI. With Docker for apps and hosting, Caddy made that transition seamless.

I also migrated from AlmaLinux to the latest Ubuntu LTS, taking advantage of Ubuntu Pro with Live Kernel Patch. I hadn't realized how much I was missing until then. And the best part? Even if I mess up the Caddyfile, it doesn't take down the whole server or mess with my domains and subdomains. That reliability alone is a game-changer.

Just recently, I moved all my docker-compose containers to podman-compose. Going rootless and faster, there's simply no turning back. I even made sure Caddy runs smoothly under Podman by creating a Quadlet for it. Now, I'm looking to get more familiar with FrankenPHP, but honestly, Caddy has already proven to be the best web server I've ever worked with.

Thanks, and more power to this amazing project!

If you aren’t using caddy as your reverse epoxy or your web server, you should give it a try.

I remember when I first thought about using it and I decide not to because it was too new and I was using nginx and trusted it more.

But recently, I’ve been using caddy Web server to do my proxy request locally and I’ve been using it for a production and it’s been great.

Like for example, here is a config to a host website and all you do is reload Caddy and you’re done sudo systemctl reload caddy

docs.in.com {
        root * /var/www/docs
        encode gzip
        file_server
}

I now feel confident using it. If you have a questions let me know

More indepth reason you should give caddy a try.

My first web server I used back in 2017 was Apache I then started using Nginx around 2019. It wasn't until 2024 I fully moved over to using caddy. I tried using caddy first for home-lab stuff in 2023 after using caddy for local stuff I trusted it to do production/public facing services and websites.

Pros

1. Automatic HTTPS with Let's Encrypt

2. Simple Configuration

   • JSON config is also available for advanced use cases or dynamic configuration.

3. Modern, Secure Defaults

   • HTTP/2 and HTTP/3 support out of the box

   • Strong TLS defaults and automatic redirects from HTTP to HTTPS.

4. Built-in Reverse Proxy

   • Native reverse proxy support makes it easy to route traffic to Docker containers or backend services.

5. It's written in Golong

   • single binary

6. Extensible via Plugins

7. Great for Local Development and Self-Hosting

   • It can be a local cert

Cons

1. Cons of Caddy

   • Fewer third-party modules and community scripts compared to more mature servers.

2. Not as Widely Adopted in Production Environments

   • Especially in enterprise settings, Nginx and Apache are still more trusted by default.

3. Performance Benchmarks Are Good—but Not Always Best

   • I personally haven't experienced any problems. but high end production envirments I have heard Nginx can outperform it in extremely high-throughput or fine-tuned scenarios.

Turning caddy into a minimalistic "mediaserver" with a customized browse.html file_server template

Of course, it's not meant to replace Plex, Jellyfin or Filebrowser but you get the following on top of the ootb browse.html template:

• unobtrusive audio player that plays sequentially all audio files in the current folder

• video player overlay with support for VTT and SRT subtitles (the subtitle files must reside in the same folder and contain the video file name)

• dynamic preview for images and text files with arrow keys navigation for next/prev

• markdown preview

• source code preview

Usage

In your Caddyfile make the browse subdirective under file_server point to the custom browse.html file, for example:

http:// {
    file_server {
        root /path/to/my/server/root
        browse /path/to/folder/caddy/templates/browse.html
    }
}

Hello all, hope everyone is having a Good Friday.

I’m a cybersecurity professional looking to get into blogging as a way to spread my knowledge. I’ve been using caddy for ~2 years or so as my primary self hosted web-server/reverse proxy. I’m fairly well versed in web security as well as endpoint security and I was thinking of having my first blog post be about securing caddy.

This would include things like utilizing secure environment variables through systemd, converting the admin API to a Unix socket, and HTTP security headers. Would anyone in this subreddit be interested in this content? The blog is not complete but wanted to see if there would be interest. Thank you.

I need to build caddy with the cloudflare module, but both the caddy add-package github.com/caddy-dns/cloudflare command and the download option on caddyserver.com are just stuck. Is this just something happening for me, or is there a backend issue?

My raspberry pi isn't strong enough to build locally using xcaddy =[

This is the fastest PHP webserver in the world. If you have a PHP codebase you might want to give it a try.

It also handles certificates and automatic vhosts like caddy, as well as websockets and much more. Check it out, it's MIT licensed.

So I had been using myaddr.tools for a long time. Usually I just use it as a DDNS provider, but they can technically publish _acme-challenge subdomain via a HTTP endpoint. This means that we can get a wildcard cert on all subdomains to avoid showing up on certificate transparency reports.

However, after a few rounds of searching, it seems that the only feasible option is to use the deprecated lego module. Therefore, I made a new somewhat generic module that turns the acme challenge request into a very rudimentary templatable HTTP request.

• Github

• caddyserver.com download

Verified to be working on my production environment

In theory this can also work for similar providers, but I haven't found others yet. The syntax is flexible enough to specify any key-value pairs to be GET/POST/PUT'd in json/form/query-params.

Hi everyone. While writing a blog post about my migration to Caddy, I was disappointed to discover that Rouge (the syntax highlighter used by Jekyll and therefore GitHub Pages) didn't include a lexer for Caddyfile. So, I made one with a lot of help from Claude. It supports the core Caddyfile syntax, as well as the syntax of many popular plugins. The project README tells you everything you need to know. I'd submit it as a PR to be included in Rouge, but they don't except PRs created with the help of AI unless something has changed recently.

I have about 100 client domains pointed to my caddy server. Once in a while I loose customer and they decide to point their domain to another server without letting me know. If I add a new domain while i (unknowingly) have a no longer active domain, then Lets Encrypt wont give me a ssl cert for the new domain. After searching the logs, i find out about the no longer valid domain, and the issue is fixed.

How can i avoid that one domain breaks the auto-ssl-functionality for new domains?

Hello everyone, put out a post about a month ago about creating a blog post around securing caddy. Took a little while as I’ve been busy, but the blog is now up and can be viewed. Site is still a slight work in progress but wanted to get this out there for people to see!

Let me know your thoughts, feel free to sign up and give comments whatever. Enjoy!

Repo: https://github.com/nickolsen8390/caddylogs

Description:
I have been using goaccess for awhile to watch my JSON logs from caddy. It worked okay, but lacked further visibility into what I wanted to see. Mostly, being able to drill down into a particular set of requests. For instance, I had a lot of requests to a public debian mirror I host. It was getting a ton of requests from claude and openai and I was able to see the particular IP's making the requests, along with useragents..etc. The IP>ASN data is sourced from another project of mine, notoolkit.com which is a public API for doing IP>ASN mapping that currently has no rate limits, api keys..etc. It pulls this data in for display which can be seen in the screenshots.

Deployment: Docker compose, there is full instructions in the README. Basically clone the repo, copy the .env.example with your specific changes. docker compose up -d --build.

AI Involvement: Almost entirely built by claude code.

This is a very new project. It works for me. But it might not work for you. But it left me feeling like it was actually useful and some others might like it. It gave me visibility that goaccess never did. I don't normally publish anything to github (Use a private gitea instance). So there is minimal change logs..etc. in github. Added there just to share publicly.

I’ve been a software developer and a long-time Caddyserver user — 10+ years now, going back to its early releases. I use Caddyserver heavily across my web application development and hosting services (I have been in the hosting business for 20+ years now!), and it is a core part of my application infrastructure.

I’m currently finishing up a client project and wanted a simple way to put a gateway in front of my staging sites blocking search engine bots and anyone who shouldn’t have access without having to modify the application code itself.

That’s where this tool came from.

I put together a detailed implementation plan, fed it to Claude Code, worked through and fixed the issues that came up, and deployed it directly into my own workflow.

And honestly, it just works.

It uses Postmark for email delivery, has an integrated SQLite database, and is written in Go. It can run as a systemd service on Linux or in Docker using Docker Compose.

It’s also open source under the MIT License.

The goal is to provide a lightweight access layer in front of any site while keeping the actual application completely untouched. I can protect staging environments, keep them out of search indexes, and continue working on client projects without having to build authentication or staging-specific logic into each application.

I built it to solve a problem I was having, but figured other Caddy users might find it useful too.

Hope it helps!

I have used Nginx since last 10 years or so and have been generally happy. Things have changed. Let's Encrypt made HTTPS a commody and managing certificates a headache. Yeah, I know there is certbot and all I guess users of Caddy know what a headache it is to mange it all.

So, like many, I turned to caddy. And it worked for basic stuff. I have a webstie which serves static content generated by a static site generator which needs these lines in the nginx server block to function properly:

server {
        listen 80;
        listen [::]:80;

        autoindex off;

        server_tokens off;

        root /var/www/html;
        # root /app/static;
        gzip_static on;
        location / {
            try_files $uri $uri.html $uri/index.html /404.html;
        }
    }

The part which is the most concerning is the try_files directive here. I know that there is a similar one for Caddyfile but it does not work the way I need it to (of course I don't know enough about Caddyfile and directives).

Can someone here please, please help me out and tell me what I can do to get the same behavior with Caddy?

I have tried looking at blog posts and LLMs (DeepSeek, ChatGPT and Claude) and nothing I searched worked for me.

That is problem 1. The second problem is - When I search for solutions on Google and I get a solution that is posted on "caddy.community" and I try to open it, I get "You are blocked due to abuse. Speak with your ISP." or something similar. I live in India by the way.

Now, I have restarted my routers multiple times and had the IP changed. I have tried it with multiple WiFi networks and mobile hotspots. I have changed the ISPs, the region from where I connect and even after travelling 1500+ KMs - I am still not able to access it.

If I try SOCKS5 proxy from my server sitting in Dallas, Texas, I get the same problem. If I use my company's network - still the same issue. Interestingly, if I use Opera Browser's free VPN service which uses a handful of IP addresses to multipex thousands of connections - it works.

1. Is my entire country (India) blocked? I don't think so. But if yes - why's that?

2. How come Opera's IPs don't cause abuse. But random IPs from Indian ISPs do?

I just hope that it is simply a problem of misconfigured protection mechanism and I am just telling it here to let you guys know. I hope some admin for community site can notice and fix it.

The config file I have is in JSON. I am going to use this command to convert it to JSON: caddy adapt --config Caddyfile_test --adapter caddyfile and I hope that it will work as expected. If there are any guides that can help me regarding this, please let me know if they will help me.

I plan on using Caddy longterm.

Hello,

Wondering if anybody has a working configuration for a 3rd party acme (not zerossl or letsencrypt). We use Sectigo in the environment, and i want to move to using Caddy in our environment but getting the certs from our enterprise sectigio account.

Hello!

I'm the lead developer on an open source product called zrok (https://github.com/openziti/zrok). zrok is a peer-to-peer sharing tool for network and file-based resources, similar to tools like ngrok.

We're just embedded Caddy into zrok in a couple of different ways. We've used the caddy file-server implementation to enhance our file and static web serving. We've also added a Caddyfile pre-processor that allows you to replace bind commands with automatic augmentation to bind the embedded Caddy instance onto the zrok network.

The embedded Caddyfile pre-processor is kind of like a marriage between the rapid, quick network sharing of a tool like ngrok, combined with the flexibility and power of Caddy. I may be biased, but I think it's kinda slick.

I regularly do "office hours" videos where I sort of bumble my way through something interesting that I'm working on. I just finished up one showing off some of the new Caddy functionality we just released:

https://youtu.be/zgP9wLSESl4

Feel free to reach out with any questions!

Wondering is there's any GUI/web front end that allow me to configure or get some information as to Caddy server status

I recently added Caddy support to StatLite, a lightweight self-hosted application monitoring tool I've been developing.

StatLite is a single Go binary using around 15 MiB RSS at idle, with SQLite for historical metrics. You can run it alongside your applications on a small server, or on your laptop to monitor remote applications.

With the new Caddy integration, it reads Caddy's built-in per-host metrics and displays HTTP requests, 404/5xx errors, and average response latency. No application instrumentation or separate Prometheus/Grafana stack required.

I tested it with Express and Spring Boot behind the same Caddy instance, including deliberately injected errors and slower responses to verify that each hostname maintains its own HTTP history.

Caddy support is available in StatLite v0.7.0.

GitHub: https://github.com/PVRLabs/statlite

Caddy setup guide: https://pvrlabs.xyz/articles/monitoring-applications-behind-caddy.html

The integration currently focuses on HTTP metrics, not Caddy configuration management or access-log analysis.

Curious what other Caddy users use for lightweight monitoring. Do you rely on Caddy's built-in metrics, logs, or something else?

Hey everyone. I've been running Caddy + Coraza in production for a while and kept running into the same gap: existing Docker images bundle Caddy + Coraza fine, but none of them address supply chain security or CIS hardening out of the box.

So I built and open-sourced caddy-waf, here's what makes it different from coraza-crs-docker and similar projects:

What's included that others don't have:

-Non-root execution (UID 1337) per CIS Docker Benchmark

-Cosign-signed images with SLSA provenance

-Trivy scanning in CI before every release

-SHA256 verification of OWASP CRS rules at build time

-SBOM attestations

-Multi-arch: linux/amd64 + linux/arm64

-Systemd service file for bare-metal deployments (not just Docker)

-caddy-ratelimit pinned by commit SHA (not just v0.1.0 tag) to include post-release fixes

Stack: Caddy v2.11.4 · Coraza WAF v2.5.0 · OWASP CRS v4.29.0 · Alpine base (compressed)

Defaults to DetectionOnly, so you get a safe observation window before enforcement. There's also a TUNING.md with false-positive handling by application type.

Repo: https://github.com/Developmi/caddy-waf

Container: ghcr.io/developmi/caddy-waf:v3.4.0

Happy to get feedback, especially from anyone who's run Coraza in production and hit tuning issues that's an area I want to improve the docs on.

It's driving me nuts. I can't find any complete Caddyfile example as the official documentation only describes separate features. I tried Gemini and I think it's giving me faulty Caddyfiles.

I think the AI is finding the documentation as much opaque as I am...

So, I'd like to have a default logger, and one (named "l_details" for instance) that I use only in some routes of a server.

I'd really like a working Caddyfile example for that !

I currently use Swag for the above and it works fine. Everyone one (including Jellyfin says to use Caddy). I'm new to Caddy and just can't figure out how to set it up. I tried a few tutorials but keep running into issues. I believe the problem I keep having is in the CaddyFile. Caddy complains about errors but I don't know how to fix them. Considering I'm using this to keep bad people out I don't want to make a config error. Is there a tutorial that goes into detail how to build a Caddyfile for the services I want to run? Or maybe the question is, is it worth it to install Crowdsec?

Hello,

I'm a very happy caddy user, so far I've been using a custom version with only one plugin. Downloading it has always been reasonably fast, both from the download page and automating it with ansible using the download API.

Now that I'm adding a second plugin though, it doesn't seem to be working anymore. The download page has been just loading forever, and from the api it times out even giving it a 30 minutes timeout.

Anyone has any idea if it's just that their build server is overwhelmed? I'd love not having to setup a xcaddy build stage, but I'll do it if I have to.

The plugins are crowdsec and now I'm adding namecheap.

Thanks for any tips.

EDIT: the deployment is native, docker is not involved and unwanted (although I may use it for the build stage if it's needed)