For over two decades, Nginx has reigned as the default reverse proxy and web server. However, configuring modern TLS security in Nginx involves managing fragile external Certbot cron tasks, manually stitching Diffie-Hellman parameter files, and navigating verbose configuration directives.

Caddy is a modern HTTP/3 reverse proxy written in Go with memory safety and automatic HTTPS built into its core. By default, Caddy provisions, renews, and rotates TLS certificates via Let's Encrypt and ZeroSSL with zero manual intervention.

The Minimalist Production Caddyfile

Here is a complete, production-grade reverse proxy configuration handling multiple subdomains, WebSocket streams, and security headers:

caddy
# Global configuration options
{
    email admin@aebibtech.com
    admin off
    servers {
        trusted_proxies static 10.0.0.0/8
    }
}

# Production App Reverse Proxy
api.aebibtech.com {
    # Automatic HTTP to HTTPS redirect is handled by default
    
    # Reverse proxy to local application container
    reverse_proxy localhost:3000 {
        # WebSocket headers (Upgrade, Connection) are proxied automatically
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-Proto {scheme}
    }

    # Security Headers
    header {
        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Referrer-Policy "strict-origin-when-cross-origin"
        Permissions-Policy "camera=(), microphone=(), geolocation=()"
        -Server
    }

    # Enable modern HTTP/3 and zstandard/gzip compression
    encode zstd gzip

    # Structured JSON access logging
    log {
        output file /var/log/caddy/api_access.log {
            roll_size 50mb
            roll_keep 5
        }
        format json
    }
}

Advantages Over Traditional Nginx Deployments

  • Self-Healing Certificate Rotation: If Let's Encrypt encounters an outage or rate limit, Caddy automatically falls back to ZeroSSL without downtime.
  • On-Demand TLS: For SaaS platforms that support custom client domains (e.g., store.clientdomain.com), Caddy can dynamically issue certificates on the fly during the initial TLS handshake, verified against an internal authorization webhook.
  • HTTP/3 (QUIC) Out of the Box: UDP-based HTTP/3 eliminates TCP head-of-line blocking on lossy mobile connections, significantly speeding up mobile web performance.

    • Migrating legacy Nginx setups to Caddy reduces operational overhead, eliminates SSL expiration outages, and provides modern transport encryption across your digital infrastructure.