Host a website with HTTPS using Caddy

Caddy is a web server that sets up HTTPS for you: give it a domain and it gets a Let's Encrypt certificate, renews it, and sends http:// visitors to https://.

Before you start#

• The domain must already point at your server: dig +short example.com should answer its address. See Point a domain at your server.
• Ports 80 and 443 must be open in both firewalls, the server's and the portal's.
• Nothing else may be using ports 80 and 443. Stop Apache or nginx first.

Open the ports on the server:

sudo ufw allow 80/tcp && sudo ufw allow 443/tcp

sudo firewall-cmd --permanent --add-service=http --add-service=https && sudo firewall-cmd --reload

On a VPS, add HTTP and HTTPS rules on the Networking tab too, if the portal firewall is on: see Set up the firewall.

Install Caddy#

Install it from Caddy's own repository, which is current.

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl gnupg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo chmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg /etc/apt/sources.list.d/caddy-stable.list

sudo apt update && sudo apt install -y caddy

sudo dnf install -y 'dnf-command(copr)' && sudo dnf copr enable -y @caddy/caddy

sudo dnf install -y caddy && sudo systemctl enable --now caddy

Visit http://203.0.113.10 in your browser, with your server's address. You should see Caddy's welcome page.

Serve a website#

Make a folder for the site, with a page in it:

sudo mkdir -p /var/www/example.com

echo '<h1>Hello from example.com</h1>' | sudo tee /var/www/example.com/index.html

Caddy's settings live in the Caddyfile. Replace what's there with your site:

sudo tee /etc/caddy/Caddyfile <<'EOF'
example.com {
	root * /var/www/example.com
	file_server
	encode zstd gzip
}

www.example.com {
	redir https://example.com{uri} permanent
}
EOF

Check the file, then load it. A reload doesn't drop visitors:

caddy validate --config /etc/caddy/Caddyfile

sudo systemctl reload caddy

Visit https://example.com. The first visit can take a few seconds while the certificate is fetched.

To update the site, copy new files into /var/www/example.com: see Move files to and from your server.

Put an app behind it#

An app listening on a local port like 3000 can sit behind Caddy, which handles HTTPS:

app.example.com {
	reverse_proxy 127.0.0.1:3000
}

Reload Caddy. Keep the app on 127.0.0.1, so the only way in is through Caddy. One Caddyfile holds as many sites as you like. See Install Docker and Run a Node.js app.

If something's wrong#

Caddy's log says why, usually in plain words:

sudo journalctl -u caddy --no-pager -n 50

To find what's on ports 80 and 443:

sudo ss -ltnp | grep -E ':(80|443) '