Setting up TLS the traditional way - obtain a certificate, configure the server, wire up a renewal cron, remember to reload - is a series of small steps that each fail quietly. Caddy makes HTTPS the default instead of a project. It's a single-binary web server that automatically obtains and renews certificates from Let's Encrypt (or ZeroSSL) for every site you define, redirects HTTP to HTTPS, and keeps the certs fresh forever without you thinking about it.
Automatic HTTPS, Genuinely Automatic
Name a site with a real domain and Caddy provisions a certificate on first request and renews it in the background for the life of the server. There's no certbot, no renewal timer, no manual reload - the secure path is the one you get by doing nothing extra.
A Caddyfile You Can Read
Caddy's config format is refreshingly small. A complete HTTPS reverse-proxy site is a few lines that a human can actually read and remember:
# Caddyfile - a full HTTPS reverse proxy
example.com {
reverse_proxy localhost:8080
}
# Run it
caddy run
Reverse Proxy in One Line
The most common real-world job - sit in front of an app and terminate TLS - is a single directive. Static file serving, headers, compression, and rewrites are equally terse, and there's a JSON API and modules for more advanced setups.
Rough Edges and Limitations
- Auto-cert needs reachability. Public certificate issuance requires a resolvable domain and open ports; local-only setups use its internal CA instead.
- Different mental model. If you know nginx deeply, Caddy's abstractions take a short adjustment.
- Fewer third-party recipes. The ecosystem is smaller than nginx's decades of copy-paste configs.
- Advanced config gets verbose. Past the Caddyfile, the full JSON config is powerful but less friendly.
For standing up a secure site or putting HTTPS in front of a service without the usual TLS chores, Caddy is the fastest path from nothing to a properly-secured endpoint.
Internal link suggestion: link "put HTTPS in front of a service" to the Ollama or Tabby post, both of which are local services worth fronting with TLS.