caddy: Open Source Networking & Connectivity

What is caddy?

Caddy is a Go-based, Apache-2.0 licensed HTTP/1.1, HTTP/2, and HTTP/3 web server and reverse proxy that obtains and renews TLS certificates automatically by default, built for operators and teams who want every site on HTTPS without maintaining a separate certificate workflow.

What it is

Caddy is an extensible server platform written in Go, living in the Infrastructure & Operations / Networking & Connectivity space of this registry. It serves HTTP traffic and terminates TLS by default rather than as an opt-in step, and it presents a single static binary with no external dependencies, not even libc. Configuration can be written in the Caddyfile for readability or in the native JSON config format for full control, and a JSON API allows configuration to change dynamically. Caddy is developed in the open on GitHub under Apache-2.0, with the project homepage and full documentation hosted at caddyserver.com.

The concrete problem it solves is certificate management. A conventional deployment pairs an HTTP server with a separate ACME client and a renewal schedule, and a lapse in that schedule takes the site down. Caddy provisions certificates for public names through ZeroSSL and Let's Encrypt, runs a fully managed local CA for internal names and IP addresses, and supports multi-issuer fallback. It also keeps serving when other servers would fail due to TLS, OCSP, or certificate-related issues, which is the specific failure mode it removes from the operator's plate.

Key capabilities

Easy configuration through the Caddyfile, with config adapters available for operators who do not want to write JSON directly.
Powerful configuration through the native JSON config, plus dynamic configuration through the JSON API.
Automatic HTTPS by default, using ZeroSSL and Let's Encrypt for public names and a fully managed local CA for internal names and IPs.
Encrypted ClientHello (ECH) support and multi-issuer fallback.
HTTP/1.1, HTTP/2, and HTTP/3 all supported by default.
Coordination with other Caddy instances in a cluster.
A modular architecture extensible through plugins, with the xcaddy builder tool producing custom builds.

Who uses it and how

Large sites: the project reports scaling to hundreds of thousands of sites in production, having served trillions of requests and managed millions of TLS certificates.
Reverse proxy deployments, one of the project's declared topics, where Caddy fronts backend services.
Internal service meshes that need trusted certificates for internal names and IP addresses without public DNS, using the local CA.
Clustered deployments where multiple Caddy instances coordinate certificate issuance and renewal.
Minimal container and bare-metal environments, since the binary needs no external dependencies, not even libc.

Getting started

The simplest cross-platform route is to download Caddy from GitHub Releases and place the executable file in your PATH; other install instructions live at caddyserver.com/docs/install. Custom builds with plugins use xcaddy build, and source builds require Go 1.25.0 or newer.

How it compares

No competing product is named in the facts for this entry, so Caddy stands alone in this registry on the axes available. Any comparison against commercial load balancers, CDNs, or managed certificate services would have to be made from outside this listing.

When to use it — and when not to

A self-hoster runs the binary directly and must grant it permission to bind low ports, for example sudo setcap cap_net_bind_service=+ep ./caddy on Linux; building from source adds a Go 1.25.0+ toolchain requirement. The project carries 286 open issues, and the README is largely a feature list and build guide rather than a deployment manual, so operators wanting hand-holding or a managed control plane should look elsewhere. Teams that want someone else to run and upgrade the server are not the intended audience.

project readme (upstream, from github) — read inline

</a>

a project

Every site on HTTPS

Caddy is an extensible server platform that uses TLS by default.

Releases · Documentation · Get Help

Powered by

</a>

^{Special thanks to:}

Warp, built for coding with multiple AI agents

Available for MacOS, Linux, & Windows

Features

Easy configuration with the Caddyfile
Powerful configuration with its native JSON config
Dynamic configuration with the JSON API
Config adapters if you don't like JSON
Automatic HTTPS by default
- ZeroSSL and Let's Encrypt for public names
- Fully-managed local CA for internal names & IPs
- Can coordinate with other Caddy instances in a cluster
- Multi-issuer fallback
- Encrypted ClientHello (ECH) support
Stays up when other servers go down due to TLS/OCSP/certificate-related issues
Production-ready after serving trillions of requests and managing millions of TLS certificates
Scales to hundreds of thousands of sites as proven in production
HTTP/1.1, HTTP/2, and HTTP/3 all supported by default
Highly extensible modular architecture lets Caddy do anything without bloat
Runs anywhere with no external dependencies (not even libc)
Written in Go, a language with higher memory safety guarantees than other servers
Actually fun to use
So much more to discover

Install

The simplest, cross-platform way to get started is to download Caddy from GitHub Releases and place the executable file in your PATH.

See our online documentation for other install instructions.

Build from source

Requirements:

Go 1.25.0 or newer

For development

Note: These steps will not embed proper version information. For that, please follow the instructions in the next section.

$ git clone "https://github.com/caddyserver/caddy.git"
$ cd caddy/cmd/caddy/
$ go build

When you run Caddy, it may try to bind to low ports unless otherwise specified in your config. If your OS requires elevated privileges for this, you will need to give your new binary permission to do so. On Linux, this can be done easily with: sudo setcap cap_net_bind_service=+ep ./caddy

If you prefer to use go run which only creates temporary binaries, you can still do this with the included setcap.sh like so:

$ go run -exec ./setcap.sh main.go

If you don't want to type your password for setcap, use sudo visudo to edit your sudoers file and allow your user account to run that command without a password, for example:

username ALL=(ALL:ALL) NOPASSWD: /usr/sbin/setcap

replacing username with your actual username. Please be careful and only do this if you know what you are doing! We are only qualified to document how to use Caddy, not Go tooling or your computer, and we are providing these instructions for convenience only; please learn how to use your own computer at your own risk and make any needful adjustments.

Then you can run the tests in all modules or a specific one:

$ go test ./...
$ go test ./modules/caddyhttp/tracing/

With version information and/or plugins

Using our builder tool, xcaddy...

$ xcaddy build

...the following steps are automated:

Create a new folder: mkdir caddy
Change into it: cd caddy
Copy Caddy's main.go into the empty folder. Add imports for any custom plugins you want to add.
Initialize a Go module: go mod init caddy
(Optional) Pin Caddy version: go get github.com/caddyserver/caddy/v2@version replacing version with a git tag, commit, or branch name.
(Optional) Add plugins by adding their import: _ "import/path/here"
Compile: go build -tags=nobadger,nomysql,nopgx

Quick start

The Caddy website has documentation that includes tutorials, quick-start guides, reference, and more.

We recommend that all users -- regardless of experience level -- do our Getting Started guide to become familiar with using Caddy.

If you've only got a minute, the website has several quick-start tutorials to choose from! However, after finishing a quick-start tutorial, please read more documentation to understand how the software works. 🙂

Overview

Caddy is most often used as an HTTPS server, but it is suitable for any long-running Go program. First and foremost, it is a platform to run Go applications. Caddy "apps" are just Go programs that are implemented as Caddy modules. Two apps -- tls and http -- ship standard with Caddy.

Caddy apps instantly benefit from automated documentation, graceful on-line config changes via API, and unification with other Caddy apps.

Although JSON is Caddy's native config language, Caddy can accept input from config adapters which can es

Frequently asked questions

Is caddy free to use?

caddy is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does caddy do?

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

What is caddy written in?

caddy is primarily written in Go. Its source is publicly available at https://github.com/caddyserver/caddy, and it has 75,840 GitHub stars.