I don't know what you're on about. Just run Caddy and it does it all for you.

That is exactly what I am talking about.

You say caddy. The next person will say nginx-proxy-manager. The next will say DNS challenge let's encrypt behind wireguard VPN. The next will say Traefik. The next will say CloudFlare tunnels.

Everyone has their preferred solution and its always the best and simplest.

▲

dpoloncsak 2 days ago | parent | next [-]

Just commenting to represent the NPM referrers that you mentioned, since it seems most HN users are Caddy enjoyers

▲

dsvf 2 days ago | parent | prev | next [-]

As a one-person-scale selfhoster that has wrangled Apache and nginx before, I'm also saying go for caddy straight away.

▲

smithniels 2 days ago | parent | prev | next [-]

As the next person on this post, I second Caddy

▲

smashed 2 days ago | parent [-]

Ok I'll bite again.

Do you want a caddy service embedded with every web app you self host or are you running a single one serving all your apps?

From my understanding if you want acme http challenges to just work with let's encrypt you probably need to use a single, separated caddy to front all your apps.

In that case if I ship a caddy service pre configured to do TLS termination with my app it's just more trouble for you no?

▲

dsvf 2 days ago | parent | next [-]

Fair enough, http is enough - I anyways have one caddy to rule them all. However, if your app is picky about reverse proxying, e.g. headers, please add a sample caddy config. It's often the first thing I'm looking for if I'm trying out a tool and want to host it under a subdirectory before configuring a subdomain.

▲

sam_lowry_ 2 days ago | parent [-]

No, HTTP is not enough, I submitted a couple HTTP-only links to HN lately, they got flagged within half an hour, even HN crowd can not open HTTP links anymore ;-)

▲

smashed a day ago | parent [-]

That's not really HN's fault but all modern browsers will warn the user before accessing an http site with a security warning.

My point was not to use http only as a finished solution, but to let the admin front the http-only service with their TLS termination solution of choice.

	▲	sam_lowry_ a day ago \| parent \| next [-]
		We are talking about hobbyists here.
	▲	dsvf 9 hours ago \| parent \| prev [-]
		... Of which (TLS terminators) caddy is IMO the easiest for hobbyists, as was the starting point of this subthread

▲

sam_lowry_ 2 days ago | parent | prev | next [-]

I posted this in a sibling thread, but it's also appropriate here.

I self-host Immich with Caddy, and it's complex, really.

Caddy runs in podman compose next to Immich, there are firewall rules to allow traffic in and out and proper dependencies in custom systemd units in case podman networking goes bust after firewall rules are reloaded and a readme that covers all that.

Exactly the point OP is making.

▲

chillfox 2 days ago | parent | prev [-]

Just provide a docker compose file.

▲

greatgib 2 days ago | parent | prev [-]

What it shows is that there are a big number ofeasy options if you want to.

▲

horsawlarway 2 days ago | parent | prev [-]

Nah he's entirely right. Serve http, let the user do https.

If you want to put caddy in front of yours? Great it works.

For me, running a much larger setup? Great, it also works.

For users who never expose it beyond an IP address on lan? Great it also works.