77,827 stars · Apache-2.0, read from /blob/master/LICENSE, standard and unmodified, and THE COPYRIGHT HOLDER PLACEHOLDER IS UNFILLED — 'Copyright [yyyy] [name of copyright owner]' is the only copyright line in the file. No second licence file; the root holds LICENSE and AUTHORS only. · v2.11.7, the release page reading '03 Oct 05:58' with no year and settled as 2026-10-03 by pkg.go.dev. ungh's /releases sub-path refused this repository on two attempts and could not corroborate. · Track this in Scout
A web server that obtains and renews its own HTTPS certificates, including private ones for internal names.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It serves HTTP/1.1, HTTP/2 and HTTP/3, the three versions of the protocol browsers use. On startup it reads a configuration file and, for every public name it finds, asks a certificate authority for a certificate; it supports two of them, ZeroSSL and Let's Encrypt, and falls back from one to the other. For internal names and bare IP addresses it runs a small certificate authority of its own, so a private service can speak HTTPS too. Renewal happens on its own in the background. The configuration can be a short Caddyfile, a JSON document, or a live change pushed to a running server over a local management interface. It also works as a reverse proxy, which is the job of standing in front of other programs and passing requests to them. What it does not publish is any figure for memory or processor use; the only numbers in the README are adoption claims, such as "millions of TLS certificates" managed.
Why it matters
Who it suits. Anyone running one or several small sites or services on a machine they rent, who does not want certificate renewal to be a thing that can fail at three in the morning. It is also the shortest path to HTTPS on an internal network, because the built-in private certificate authority covers names that no public authority will sign. Skip it if a proxy setup is already in place and understood, and its renewal process has never surprised anyone; the gain here is in a job that stops existing, so there is nothing to gain if that job never broke.
Verdict. The clearest win on this page, and twenty minutes is an honest estimate for a first site. traefik/traefik at 65,177 stars is the closer comparison if your services run in containers and appear and disappear on their own, because it discovers them rather than being told about them; Caddy is simpler when the list of sites is written down and stable. envoyproxy/envoy is the heavier choice for large internal networks and is the wrong tool for one machine. One thing to know before exposing anything: the management interface listens on port 2019 and is not password-protected, which is safe only because it is bound to the local machine by default. If you ever change that address, you have handed full control of the server to whoever can reach it.
- Certificates are obtained and renewed with no action from anyone, including for internal names.
- One static file with no dependencies, so installing it is copying a file.
- Configuration can be a six-line Caddyfile, and the same server also accepts JSON and live changes.
- The management interface on port 2019 has no authentication and is protected only by being bound to the local machine; moving it to a public address is dangerous and easy to do by accident.
- Adding a plugin means rebuilding the binary with a separate tool, not dropping a file into a folder.
- Its own licence file never names a copyright holder — the template line "Copyright [yyyy] [name of copyright owner]" is still unfilled.
- traefik/traefik
The same job with automatic discovery of containers, at 65,177 stars, with code on 12 October 2026; better when services come and go, heavier when they do not.
Track this in Scout - Kong/kong
An API gateway rather than a web server, at 44,262 stars, aimed at managing many internal services with authentication and rate limits.
Track this in Scout - envoyproxy/envoy
The proxy large internal networks are built on, at 29,038 stars, far more capable and far more work to configure.
Track this in Scout
git clone https://github.com/caddyserver/caddy.git cd caddy/cmd/caddy/ go build
