ufw allow 80\/tcp && ufw allow 443\/tcp<\/code> if you use UFW.<\/li><\/ul>\n\n\n\nStep 1 \u2014 Install Caddy<\/h2>\n\n\n\n
Install from the official Caddy repository so you get automatic updates:<\/p>\n\n\n\n
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl\ncurl -1sLf 'https:\/\/dl.cloudsmith.io\/public\/caddy\/stable\/gpg.key' | sudo gpg --dearmor -o \/usr\/share\/keyrings\/caddy-stable-archive-keyring.gpg\ncurl -1sLf 'https:\/\/dl.cloudsmith.io\/public\/caddy\/stable\/debian.deb.txt' | sudo tee \/etc\/apt\/sources.list.d\/caddy-stable.list\nsudo apt update\nsudo apt install caddy<\/code><\/pre>\n\n\n\nVerify the service is running: systemctl status caddy<\/code> should show active (running)<\/code>, and caddy version<\/code> prints the installed build.<\/p>\n\n\n\nStep 2 \u2014 Understand the Caddyfile<\/h2>\n\n\n\n
Caddy’s config lives in \/etc\/caddy\/Caddyfile<\/code>. The core directive is reverse_proxy<\/code>, which forwards requests to a backend. The first line of a site block is the site address \u2014 Caddy automatically obtains and renews a Let’s Encrypt or ZeroSSL certificate for any hostname you put there, which is the feature that makes Caddy worth switching to:<\/p>\n\n\n\napp.example.com {\n reverse_proxy 127.0.0.1:8080\n}<\/code><\/pre>\n\n\n\nThat is the whole config for a single app. After editing, apply with sudo caddy reload --config \/etc\/caddy\/Caddyfile<\/code> \u2014 no restart, no downtime.<\/p>\n\n\n\nStep 3 \u2014 Real config examples<\/h2>\n\n\n\n
Multiple services on one domain, routed by path<\/strong> \u2014 an API on :3000<\/code> and a frontend on :8080<\/code>:<\/p>\n\n\n\nexample.com {\n handle \/api\/* {\n reverse_proxy 127.0.0.1:3000\n }\n handle {\n reverse_proxy 127.0.0.1:8080\n }\n encode zstd gzip\n}<\/code><\/pre>\n\n\n\nWebSocket support<\/strong> \u2014 Caddy detects the Upgrade<\/code> header and tunnels WebSocket connections automatically, so a Node.js socket server needs no special flags:<\/p>\n\n\n\nws.example.com {\n reverse_proxy 127.0.0.1:3001\n}<\/code><\/pre>\n\n\n\nSecurity headers<\/strong> \u2014 add a header<\/code> block for HSTS and clickjacking protection:<\/p>\n\n\n\napp.example.com {\n reverse_proxy 127.0.0.1:8080\n header {\n Strict-Transport-Security \"max-age=31536000\"\n X-Content-Type-Options \"nosniff\"\n }\n}<\/code><\/pre>\n\n\n\nStep 4 \u2014 Automatic HTTPS, explained<\/h2>\n\n\n\n
When Caddy starts (or reloads) with a new hostname, it asks Let’s Encrypt for a certificate using the HTTP-01 challenge: it briefly serves a token on port 80, the CA verifies it, and the certificate is issued \u2014 usually in under five seconds. Certificates are stored in \/var\/lib\/caddy\/.local\/share\/caddy<\/code>, and Caddy renews them automatically at 30 days before expiry. You never touch certbot or crontab. Confirm it worked: curl -I https:\/\/app.example.com<\/code> should return HTTP\/2 200<\/code> with a valid certificate<\/code> chain.<\/p>\n\n\n\n