Hacker News Reader

Comment by francislavoie | Hacker News Reader

You can probably shrink it even more. The Caddy alpine image is 14MB compressed.

https://hub.docker.com/_/caddy/

You also get automatic TLS certificate management and tons of other goodies that nginx doesn't offer out of the box.

all of my docker containers are placed behind traefik which handles TLS certifactes, HTTPS redirect, compression, and routing to the correct container

This post talks about a single-container setup though, with the static site bundled with Nginx. That's what I'm replying to, not the usecase where you have many containers you need to proxy to.

So, if you want to host multiple sites on the same port of your server, from the same process, then you can also have Caddy behind Traefik, but then why would you need Caddy ? Traefik got docker load balancing right: watch docker.sock and self configure on the fly.

I missed the whole Caddy thing anyway because the source code was not completely open back in the days I was looking for nginx alternatives that provided with LetsEncrypt automatically.

However, it seems Caddy can be used as an alternative to Traefik if you use a plugin: https://caddyserver.com/v1/docs/docker Apparently it requires swarm though, which I don't need anyway, so, still no reason for me to try Caddy unfortunately because it does look pretty cool now.

> the source code was not open back in the days

The Caddy source code has always been open source (Apache 2.0 licensed) from day one all the way to today, and will continue to be in the future.

Beware when using other Let's Encrypt integrations. Caddy will keep your site online when other servers don't. (We saw this recently when Let's Encrypt had a revocation incident and when OCSP responders / other network infrastructure went down. Caddy kept the sites up, where other sites went down or left sysadmins scrambling to renew their certs.)

Interesting, I thought they only solved these issues last October, I guess I'm just part of the people that were confused by the situation back then. Sorry about that !

https://github.com/caddyserver/caddy/issues/2786

We distributed commercial binaries to businesses for a time and considered making various plugins paid-only to fund its development. But the source code has always been open and Apache-licensed, and there was never any requirement that you had to use the commercial binaries. Caddy has always been an open source project. Arguably more open than nginx, which hides many features behind paid versions, enterprise support, and expensive licensing restrictions. Several of nginx's paid features are free in Caddy, for example NTLM proxying and a config API.

> Caddy will keep your site online when other servers don't.

Interestingly, the LetsEncrypt incident you mentioned went completely under my radar, none of my traefik instances in production or else were affected at all, or it wasn't caught by my uptimerobot, so I'm really not sure what you were talking about then. Maybe the 2017 incident, but I was still using nginx at the time. Pretty concerning, going to check it out.

Honestly I didn't require any of the nginx paid features ever nor did I with traefik, which also has an EE edition that I just found about, I suppose needing those would be a "problem I want to have" kind of problem (meaning the project I'm taking care of is growing). I'm more into software that will generate configuration by introspecting my systems but configuration APIs are also nice to have otherwise.

Nonetheless, Caddy is a great alternative in a domain where innovation had been stalling for a while. I would like to send over a one-time donation to help Caddy development if possible to support development.

> none of my traefik instances in production or else were affected at all

It didn't affect every site. But it did affect millions of them. You're lucky!

(Not the one you replied to, but) I was actually affected — but my nginx setup as ingress controller in kubernetes worked just fine, and automatically handled everything. I actually read in the news about it later, but my systems never went down.

And in contrast to caddy, my setup actually follows the DNS and URL standards, and actually handles Absolute URIs correctly, in contrast to e.g. http://caddyserver.com./, which doesn’t even set HSTS on caddyserver.com., while even browsers consider caddyserver.com. the same origin for the purpose of TLS and HSTS.

Do you have a practical example where that matters? Because I've never seen anyone link to a page with a trailing . in the domain.

If you have a situation where due to your search domain, e.g. corp.com, both exampleA.tld and exampleA.tld.corp.com would be valid DNS resolutions.

If you’re already using something like kubernetes, which does such resolutions, this can actually become an issue. e.g. in the cluster ServiceA can call ServiceB by navigating to http://serviceb/, and if the name of serviceb overlaps with an actual real-world domain, you need to use http://serviceb./ to ensure you call the outside-world site.

Okay. As far as I can tell, Caddy can be configured to handle that, you just need to tell it to. Have you tried to configure Caddy to accept requests to hostnames with a trailing dot recently?

Well that’s the issue. I need to access external websites that way. You could imagine it as a user entering a URL, and a service fetching that URL. To ensure this service doesn’t accidentally fetch an internal site, it transforms the URL to one with a . at the end.

So, I need all websites intended to be fetched this way to support the proper DNS RFCs.

Ever since Caddy and Traefik became a thing my tool has stopped working for more and more non-standard webpages.

Even caddyserver.com itself is broken.

In the end, I’ve simply chosen not to use caddy or traefik based websites.

Reply on news.ycombinator.com