Caddy
Automatic HTTPS reverse proxy for self-hosted apps
Review status: Evaluated. Read the evidence and pilot limits below before choosing.
Official Website · Source Code
oss-osi-approved full guide featuredOverview
Caddy simplifies TLS termination and reverse proxying. Almost every self-hosted coworking stack benefits from a hardened reverse proxy in front of apps.
At a glance
| Field | Value |
|---|---|
| Categories | developer-platform, security-compliance |
| Deployment | self-hosted |
| License class | oss-osi-approved (Apache-2.0) |
| Cost model | free-self-hosted |
| Implementation difficulty | moderate |
| Maintenance burden | medium |
| Maturity | stable |
| Freshness status | partially-verified (2026-07-17) |
| Completeness | editorially-reviewed |
| Confidence | medium |
| Directory tier | evaluated |
Cost reality
Free software; optional commercial support/licenses for some advanced features historically—verify current.
Pricing and free-tier limits change frequently; re-check official pricing before budget decisions.
Tasks reduced or augmented
Software does not replace community or ops staff. It may reduce or augment:
- TLS termination
- Routing multiple apps on one host
Human oversight still needed
- Config reviews
- HTTP security headers
Manual process this can replace
triage-network-connectivity
- Relationship: infrastructure
- Automation level: assisted
- Manual process this can replace: Manual process reduced is checking separate proxy and TLS endpoints for each approved web application during initial connectivity triage.
- Tasks it can reduce: Human work reduced is repetitive inspection of routing, HTTPS, and proxy evidence at multiple application front doors.
- Role it assists: it-security-administrator
- What still requires a person: A human must identify the affected scope, interpret device, upstream, and security signals, and approve configuration changes. Prohibited isolation, security-response, and service-restoration decisions can never be fully automated.
- What happens if it fails: Failure can misroute traffic, hide an upstream fault, or interrupt every application behind the proxy; the operator must use the tested rollback and escalation path.
- How to measure the pilot: Metric is the share of synthetic proxy or TLS faults correctly scoped before a configuration change, plus median time to a human-approved next step.
- Confidence: low
Data held
-
access logs if enabled
-
certificates
-
Personal data: no / limited
-
Payment data: no / not primary
Risks
| Area | Notes |
|---|---|
| Vendor lock-in | Evaluate export formats and API completeness before deep customization. |
| Security | Apply updates promptly; restrict admin access; enable TLS. |
| Compliance | Operator remains responsible for privacy and local regulatory obligations. |
| Licensing | Confirm license fits commercial coworking use. |
| Operational | Plan backups, monitoring, and a restore drill before production use. |
Coworking fit
Roles: technical-operator
Workflows: multi-site-rollout, incident-response
Problems: self-host-for-data-control, privacy-compliance
Smallest useful experiment
Put Caddy in front of one staging app with automatic HTTPS and access logs disabled or rotated.
Initial planning estimate (unverified): 1–3 days
Links
Implementation guide
See the human-written implementation guide.
Verification
- Status:
partially-verified - Completeness:
editorially-reviewed - Confidence:
medium - Tier:
evaluated - Last reviewed:
2026-07-17 - Sources:
Seed entry compiled from official project sites and repositories. Re-verify pricing, license text, and feature claims before production decisions. Star counts and free-tier numeric limits intentionally omitted unless verified at review time.