Hacker News Reader

Comment by codetrotter | Hacker News Reader

I used to use Nginx for a long while, but for the past several years I’ve been using Caddy instead and it’s been serving me well. Caddy, like Nginx, is open source.

What originally made me switch is how dead simple it was to set up Caddy to use Let’s Encrypt with renewal via DNS records using the Caddy Cloudflare plugin. It’s basically just download Caddy with the plugin (or build from source if you prefer), generate token for domain in Cloudflare, paste token into Caddy config file and never worry about it again.

The reason that DNS based Let’s Encrypt renewal is superior is that you can even use it on servers that are not serving the site to the Internet. And aside from that just how simple, reliable and free of worry the setup is with Caddy and the Caddy Cloudflare plugin.

View on HN

Frustratingly, the problem with automated DNS-based is that it doesn't work with all domain registrars, which is a showstopper when you are not allowed to change a customer's existing registrar nor move its NS records.

Its one of those problems blockchain is actually a good solution for but theres no money you can tokenize to sell to others on this idea.

One workaround can be picking up a cheap domain and CNAMEing _acme-challenge.unsupported-provider.com to _acme-challenge.supported-provider-cheap-domain.com. The rest of the records can be left alone.

This is listed on LetsEncrypt as a "delegate" subdomain [1] and on an EFF article as a "throwaway" domain [2]. Some clients just call it "CNAME support" [3].

All the different names muddle search results. I've used a Reddit guide [4] for Cloudflare + goacme/lego.

[1] https://letsencrypt.org/docs/challenge-types/#dns-01-challen...

[2] https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...

[3] https://go-acme.github.io/lego/dns/#experimental-features

[4] https://old.reddit.com/r/selfhosted/comments/je2041/how_do_y...

> automated DNS-based is that it doesn't work with all domain registrars

https://acme.sh automates dns01 challenges with support for over 100+ registrars: https://github.com/acmesh-official/acme.sh/wiki/dnsapi.

Another good thing is that one can move their registrations and change their nameservers, at will.

For my self hosted setup I've shifted to Caddy and not bother about setting up crons etc for SSL. It's just so much nicer to have the Reverse Proxy handle that for you automagically.

And the config file is just 2 lines to reverse proxy instead of 20+ equivalent in NGINX.

Nginx is making the same mistakes that dethroned Apache. No one wants to fiddle with a web server. Default to $currentIndustryStandard, make it work, forward to my application.

The Let's Encrypt Certbot does this automatically for nginx and apache as well, just with a bit of extra config: https://certbot-dns-cloudflare.readthedocs.io/en/stable/

Reply on news.ycombinator.com