Caddy vs Nginx: Automated HTTPS and Reverse Proxy Setup

Why Caddy is Better Than Nginx for HTTPS?

Configuring HTTPS and reverse proxy in Nginx requires many manual operations, especially when adding new domains. Caddy is a next-generation web server that solves these problems automatically: it obtains and renews SSL certificates via Let's Encrypt without extra steps. We have been deploying Caddy for clients for years—the server runs without failures, and deployment time is cut by three times compared to Nginx + certbot. According to the official Caddy documentation, automatic certificate renewal occurs 30 days before expiration.

Caddy eliminates routine: a 10-line configuration replaces dozens of Nginx directives. Automatic HTTPS works out of the box—no need to open ports for ACME or write cron jobs for renewal. The built-in reverse proxy with load balancing is suitable for microservices and Node.js applications. Additionally, Caddy supports HTTP/3 out of the box, providing speed gains on mobile networks. Caddy consumes 2 times less memory than Apache under the same load, as confirmed by performance tests.

How Caddy Simplifies SSL Management

Caddy automatically obtains and renews SSL certificates for all domains specified in the Caddyfile. The server itself checks the expiration date and renews certificates 30 days before expiry. This eliminates the "SSL expired" error and associated downtime. For wildcard certificates, simply add a DNS provider in the tls block. Over 50 providers are supported: Cloudflare, AWS Route53, DigitalOcean, and others.

Installation and Configuration of Caddy

How to Install Caddy on a Server?

We support Debian/Ubuntu, CentOS, Alpine. Installation on Debian takes a few steps:

1. Add the Caddy repository.
2. Install the caddy package.
3. Start the service and check the status.

apt install -y debian-keyring debian-archive-keyring apt-transport-https curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/caddy-stable-archive-keyring.gpg] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main" | tee /etc/apt/sources.list.d/caddy-stable.list apt update && apt install caddy 

After installation, Caddy runs as a systemd service. Check the status: systemctl status caddy.

Example Caddyfile

# /etc/caddy/Caddyfile example.com { root * /var/www/myapp/public php_fastcgi unix//var/run/php/php8.3-fpm.sock try_files {path} /index.php?{query} encode gzip header { Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" X-Frame-Options "DENY" X-Content-Type-Options "nosniff" Referrer-Policy "strict-origin-when-cross-origin" -Server } @static { path *.css *.js *.jpg *.png *.gif *.ico *.svg *.woff2 } header @static Cache-Control "public, max-age=31536000, immutable" @dotfiles { path /.* } respond @dotfiles 403 log { output file /var/log/caddy/access.log format json } } api.example.com { reverse_proxy localhost:3000 { header_up X-Real-IP {remote_host} header_up X-Forwarded-Proto {scheme} } } www.example.com { redir https://example.com{uri} permanent } 

This Caddyfile serves a PHP application, proxies API to Node.js, configures security headers and static caching. For multiple sites, simply add new blocks.

Docker Integration

Use the official image caddy:2-alpine. Mount the Caddyfile and volumes for certificates:

# docker-compose.yml services: caddy: image: caddy:2-alpine ports: - "80:80" - "443:443" volumes: - ./Caddyfile:/etc/caddy/Caddyfile - caddy_data:/data - caddy_config:/config restart: unless-stopped volumes: caddy_data: caddy_config: 

This approach simplifies deployment and updates. Caddy automatically picks up Caddyfile changes without restarting the container.

Comparison with Alternatives

Caddy vs Nginx

Caddy wins in simplicity and security, cutting SSL setup time by three times compared to Nginx + certbot. However, for fine-tuning under specific scenarios, Nginx remains more flexible.

Caddy vs Apache

Caddy is significantly simpler to configure, especially for HTTPS. Apache requires more resources for configuration and maintenance.

What Our Caddy Setup Includes

• Diagnostics of your current infrastructure and selection of the optimal Caddy configuration.
• Installation and configuration of Caddy with automatic HTTPS and reverse proxy.
• Development of a Caddyfile tailored to your stack: PHP, Node.js, static files.
• Docker integration for containerization.
• Security configuration: headers, access restrictions, logging.
• Performance testing and optimization.
• Configuration documentation and maintenance instructions.
• Team training on the basics of Caddy.
• Guaranteed support after deployment (2 weeks).

Process and Timelines

We don't just configure Caddy—we integrate it into your infrastructure with a guarantee of stability.

• Basic configuration for a single site: 1 day.
• Complex project (multiple sites, Docker, monitoring): 3–5 days.

Assessment is free. Contact us to discuss your project. Get a consultation on Caddy setup for your stack.

Over years of work, we have deployed Caddy on hundreds of projects and are ready to share our experience.

*.example.com { tls { dns cloudflare {env.CF_API_TOKEN} } reverse_proxy localhost:8080 }