Tool
Caddy
A Go web server and reverse proxy that turns on HTTPS by default — certificates from public ACME CAs for public names, and a local CA for internal hosts — so you are not wiring Certbot beside Nginx for every homelab site.
What it is
Caddy is an extensible HTTP server platform (HTTP/1.1, HTTP/2, HTTP/3) used most often as a web server or reverse proxy. Configuration is usually a Caddyfile or native JSON; there is also a config API. Official docs describe automatic HTTPS as on by default when Caddy knows a hostname: public names via ACME (Let's Encrypt / ZeroSSL by default), local/internal names via Caddy’s own CA. No separate Certbot process is required for the common case.
What it replaces
It replaces hand-maintained Nginx/Apache reverse-proxy + Certbot stacks for many self-hosted sites, and replaces GUI proxy managers when you prefer a short Caddyfile over a Docker admin panel. It can also replace “HTTP forever” on a VPS when DNS and ports 80/443 are correct.
It does not replace thinking about what you expose. Automatic HTTPS does not mean the upstream app is authenticated. It also does not replace a mesh VPN (Tailscale, etc.) when the honest answer is “this should never be on the public internet.”
License
Caddy (source and current official project) is released under the Apache License 2.0, verified from the project’s LICENSE on GitHub (caddyserver/caddy). Commercial use under Apache-2.0 terms is allowed; keep attribution / NOTICE obligations if you redistribute.
Historical caveat (do not confuse with v2): older Caddy 1–era downloads from caddyserver.com once used separate proprietary binary licenses. That is not the Caddy 2 story — treat Apache-2.0 on the current repo as authoritative, not decade-old forum posts.
Where it falls over
- ACME still needs correct DNS A/AAAA, open 80/443 (or DNS challenge config), and persistent writable storage — rate limits punish “reload and pray” experiments on production domains.
- Wildcard certs need the DNS challenge and a DNS provider module; the happy path is not every provider.
- Plugins and custom builds (xcaddy) are powerful and easy to get wrong version-wise.
- On-demand TLS is for scale cases and needs abuse restrictions; leaving it open is an ACME bill / abuse story.
- A short Caddyfile can still forward a public hostname to an unauthenticated AI UI. Certs ≠ access control.
Who it's for
People self-hosting sites or reverse-proxying containers who want automatic HTTPS without a separate cert tool. Homelabs and small production edges that are comfortable with text config. Teams that need a GUI-only proxy may prefer Nginx Proxy Manager instead — different tradeoff, not a ranking.
Verdict
Use Caddy when Apache-2.0 automatic HTTPS and a Caddyfile beat Certbot + Nginx for your setup. Keep Tailscale (or similar) for private services. Read current docs for ACME and storage — automatic is not magic.