Extensible server platform · TLS by default
Every site
on HTTPS.
Caddy is an extensible server platform that uses TLS by default.
The certificate work is the part you do not write: public names get certificates from ZeroSSL and Let’s Encrypt, internal names and IPs get a fully-managed local CA, and HTTP/1.1, HTTP/2 and HTTP/3 are all on by default.
Sheet A-1 · site configillustrative
1example.com {A
B# no tls directive — nothing to write here
2 reverse_proxy localhost:8080
3}
- A · site addressA public nameCertificate from ZeroSSL or Let’s Encrypt.
- B · the empty lineNo TLS blockHTTPS is the default, not a setting.
- C · the whole siteHTTP/1.1, 2 and 3All supported by default.
DrawingEvery site on HTTPS
Scaleillustrative
Sourceproject README
What the default already includes
from the README feature list01Public namesZeroSSL and Let’s Encrypt
02Internal names & IPsA fully-managed local CA
03ClustersCoordinates with other Caddy instances
04IssuersMulti-issuer fallback
05Encrypted ClientHelloECH support
06Certificate troubleStays up when other servers go down over TLS, OCSP or certificates
07ProtocolsHTTP/1.1, HTTP/2 and HTTP/3
08DependenciesNone — not even libc
“Nearly all of Caddy’s configuration is contained in a single config document … This makes managing your server config more straightforward and reduces hidden variables/factors.”— the README, on why the default can be trusted
JSON is the native config language; the Caddyfile, YAML, TOML, NGINX config and more arrive through config adapters. Two apps — tls and http — ship standard.