[{"data":1,"prerenderedAt":206},["ShallowReactive",2],{"seo-verification":3,"blog-caddy-traefik-or-nginx-proxy-manager-which-to-choose-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":23,"featuredImage":25,"bgImage":26,"posterImage":27,"relatedSolution":25,"intro":28,"sections":29,"ctaTitle":155,"ctaBody":156,"ctaButton":157,"ctaUrl":158,"relatedPosts":159},227,"caddy-traefik-or-nginx-proxy-manager-which-to-choose",{"fr":10,"en":8,"ar":11},"choisir-reverse-proxy-vps-caddy-traefik-nginx","caddy-أم-traefik-أم-nginx-proxy-manager-أيهما-تختار","Caddy, Traefik or Nginx Proxy Manager: which to choose?","Caddy, Traefik or Nginx Proxy Manager for your VPS? A practical comparison to choose the right reverse proxy for your Docker stack.",10,0,false,"2026-08-06T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},5,"Comparison","comparatif","bg-info\u002F10 text-info",[24],{"id":19,"name":20,"slug":21,"color":22,"icon":21},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fchoisir-reverse-proxy-vps-caddy-traefik-nginx-poster.svg","You host several Docker applications on a VPS and need to expose each one over HTTPS with a separate domain name. A reverse proxy is the central piece of this architecture: it receives all incoming traffic on ports 80 and 443, handles TLS certificates and routes requests to the right container. Caddy, Traefik and Nginx Proxy Manager are the three most popular solutions — this guide helps you choose the one that matches your profile.",[30,34,43,46,92,95,117,120,135,138,141,144,152],{"type":31,"title":32,"body":33},"h2","Why a reverse proxy is essential with Docker","By default, each Docker container listens on an arbitrary port: your Nextcloud is on port 8080, your Gitea on 3000, your Vaultwarden on 8200. You cannot directly expose a dozen ports in production — browsers do not accept URLs with port numbers, TLS certificates cover domain names not ports, and your firewall must stay closed on everything except 80 and 443. A reverse proxy solves all three problems at once: it becomes the single public entry point, routes traffic based on hostname or path, and handles TLS termination. The result is that `app1.your-domain.com` and `app2.your-domain.com` both point to port 443 of your VPS, and the proxy knows which container to forward each request to.",{"type":35,"title":36,"items":37},"ul","What a reverse proxy gives you in practice",[38,39,40,41,42],"**Centralized TLS termination** — a single tool obtains and renews Let's Encrypt certificates for all your domains automatically without any manual steps","**Hostname-based routing** — `git.your-domain.com` goes to Gitea, `cloud.your-domain.com` goes to Nextcloud with no port conflicts whatsoever","**Simplified firewall** — only ports 80 and 443 are open to the public, all internal Docker ports remain inaccessible from the outside","**Automatic HTTP → HTTPS redirect** — all unencrypted traffic is redirected with a 301 without manual configuration inside each application","**Centralized observability** — access and error logs from all your applications are aggregated in one place to simplify debugging",{"type":31,"title":44,"body":45},"Common prerequisites for all three solutions","Before choosing and installing one of these three proxies, make sure your VPS meets a few basic requirements. Docker and Docker Compose must be installed (Compose V2 recommended, meaning the `docker compose` command without a hyphen). Your DNS records must point to your VPS public IP before requesting a certificate — Let's Encrypt verifies DNS during HTTP-01 validation, and an error at this stage can trigger a rate limit. Ports 80 and 443 on your VPS must be free: check with `ss -tlnp | grep -E ':80|:443'`. Finally, create a dedicated Docker network — `docker network create proxy`.",{"type":47,"title":48,"headers":49,"rows":54},"comparison","Comparison table: Caddy vs Traefik vs Nginx Proxy Manager",[50,51,52,53],"Criterion","Caddy","Traefik","Nginx Proxy Manager",[55,59,64,69,74,77,82,87],[56,57,58,57],"Setup ease","⭐⭐⭐⭐⭐ Very simple","⭐⭐⭐ Medium",[60,61,62,63],"Automatic TLS (Let's Encrypt)","✅ Native, zero config","✅ Via ACME","✅ Via web interface",[65,66,67,68],"Docker integration","Manual (labels or config)","✅ Native labels","✅ Via GUI",[70,71,72,73],"Configuration method","Readable Caddyfile","Docker labels + YAML","Graphical web interface",[75,76,76,76],"Zero-downtime reload","✅ Automatic",[78,79,80,81],"Web interface\u002Fdashboard","❌ No","✅ Dashboard included","✅ Full interface",[83,84,85,86],"Memory usage","~30 MB","~50 MB","~100 MB (MariaDB included)",[88,89,90,91],"Best for","Solo projects\u002Fsmall teams","Microservices, CI\u002FCD","Beginners, mixed teams",{"type":31,"title":93,"body":94},"Caddy: the default choice for most use cases","Caddy has established itself as the simplest choice for developers hosting between two and ten applications on a VPS. Its philosophy is radical: TLS is enabled by default for any valid domain, with no option to tick and no variable to set. The `Caddyfile` configuration file is intentionally readable, close to natural language, and can fit in about ten lines for a typical use case. Caddy is written in Go and embeds its own ACME client: it contacts Let's Encrypt directly, stores certificates in its data directory and renews them automatically before expiry. Its memory footprint stays around 30 MB at rest, making it perfectly suited to entry-level VPS instances.",{"type":96,"title":97,"steps":98},"steps","Deploy Caddy as a Docker reverse proxy",[99,102,105,108,111,114],{"title":100,"body":101},"Create the shared Docker network","First, create the network that Caddy and your applications will share: `docker network create proxy`. This isolated network lets Caddy reach your containers by name without exposing their ports on the host.",{"title":103,"body":104},"Write the Caddyfile","Create a `Caddyfile` at the root of your project. To expose an application at `app.your-domain.com` to a container named `myapp` listening on port 3000: `app.your-domain.com { reverse_proxy myapp:3000 }`. Caddy obtains the certificate automatically on first start.",{"title":106,"body":107},"Write the docker-compose.yml for Caddy","Create a `docker-compose.yml` with the Caddy service: mount the `Caddyfile` read-only (`.\u002FCaddyfile:\u002Fetc\u002Fcaddy\u002FCaddyfile:ro`), persist TLS data in a named volume (`caddy_data:\u002Fdata`), publish ports 80 and 443, and attach Caddy to the `proxy` network declared as external.",{"title":109,"body":110},"Attach your applications to the proxy network","In each application's `docker-compose.yml`, add the `proxy` network as an external network and stop exposing ports on the host (use `expose` instead of `ports`). Caddy will reach the container via the internal Docker network.",{"title":112,"body":113},"Start and verify","Launch Caddy with `docker compose up -d`, then follow logs with `docker compose logs -f caddy`. You should see `certificate obtained successfully` for each domain. Test with `curl -I https:\u002F\u002Fapp.your-domain.com`.",{"title":115,"body":116},"Add a new application","For each new application, add a block to the `Caddyfile`, reload Caddy without downtime with `docker exec caddy caddy reload --config \u002Fetc\u002Fcaddy\u002FCaddyfile`, and attach the new container to the `proxy` network.",{"type":31,"title":118,"body":119},"Traefik: when to choose automatic service discovery","Traefik shines in contexts where the number of services changes frequently: CI\u002FCD environments that create and destroy containers on each deployment, microservice architectures with more than five independent services, or teams where each developer deploys their own stacks without touching a centralized configuration. Its automatic discovery mechanism via Docker labels is its main strength: when you start a container with the right labels, Traefik detects it instantly and creates the route without you touching Traefik's own configuration. Traefik also includes a web dashboard that visualizes all active routers, services and middlewares in real time.",{"type":96,"title":121,"steps":122},"Deploy Traefik with automatic Docker discovery",[123,126,129,132],{"title":124,"body":125},"Create the static configuration file","Create `traefik.yml` with entrypoints (`web` on port 80, `websecure` on 443), enable the Docker provider (`docker: { exposedByDefault: false }`), configure the ACME resolver with your email for Let's Encrypt, and enable the dashboard in secure mode.",{"title":127,"body":128},"Launch Traefik with Docker Compose","In Traefik's `docker-compose.yml`, mount the Docker socket read-only (`\u002Fvar\u002Frun\u002Fdocker.sock:\u002Fvar\u002Frun\u002Fdocker.sock:ro`), mount `traefik.yml`, persist certificates in a volume, and publish ports 80 and 443. Start with `docker compose up -d`.",{"title":130,"body":131},"Annotate your containers with labels","On each service to expose, add Traefik labels: `traefik.enable=true`, the router rule (`traefik.http.routers.myapp.rule=Host('app.your-domain.com')`), the entrypoint (`websecure`), the TLS resolver and the internal service port.",{"title":133,"body":134},"Verify in the dashboard","Access the Traefik dashboard and verify that your router appears in green with `Enabled` status. If the router is missing, check that the `traefik.enable=true` label is present and the container is attached to the network Traefik is watching.",{"type":136,"body":137},"tip","Critical security: never mount the Docker socket (`\u002Fvar\u002Frun\u002Fdocker.sock`) without restriction in a multi-user environment — anyone who can write to this socket can take full control of the host. In production, prefer the socket read-only (`ro`) or use a socket proxy such as `docker-socket-proxy`. Also apply a basic authentication middleware to the Traefik dashboard before exposing it publicly.",{"type":31,"title":139,"body":140},"Nginx Proxy Manager: the no-config-file option","Nginx Proxy Manager (NPM) is the obvious choice for anyone uncomfortable with command-line configuration files. Its web interface allows you to create a proxy host in a few clicks: enter the domain name, the target container address, check 'Force SSL' and 'HTTP\u002F2 Support', click 'Save' — that is it. NPM handles the rest, including the Let's Encrypt certificate request. However, NPM embeds a MariaDB database to store its configuration, which pushes its memory footprint to around 100 MB — nearly triple that of Caddy.",{"type":31,"title":142,"body":143},"Troubleshooting: the most common errors","The vast majority of problems fall into four categories. First, Let's Encrypt rate limits: if you restart your stack several times in testing with the same domain, you can exhaust the limit of five certificates per domain over seven days. Solution: use the Let's Encrypt staging environment for your tests. Second, port conflicts: if port 80 or 443 is already occupied by the host's Apache or Nginx, the Docker proxy will not start. Identify the process with `ss -tlnp | grep :80`. Third, Docker network errors: verify both containers are on the same Docker network with `docker network inspect proxy`. Fourth, for Traefik, typos in labels are the most common cause of silently missing routes — enable debug logging with `--log.level=DEBUG`.",{"type":35,"title":145,"items":146},"Summary: which proxy for which profile",[147,148,149,150,151],"**Solo developer, 2 to 5 apps** — Caddy: minimal configuration, automatic TLS, up and running in under ten minutes with a fifteen-line Caddyfile","**DevOps team, microservices, CI\u002FCD** — Traefik: automatic discovery via labels, monitoring dashboard, perfect when the number of services varies dynamically","**Non-technical user or mixed team** — Nginx Proxy Manager: intuitive graphical interface, no files to edit, built-in multi-user management","**VPS with limited RAM (512 MB to 1 GB)** — Caddy or Traefik: avoid NPM which bundles MariaDB and consumes significantly more memory","**Progressive migration from Nginx** — Caddy: its syntax can be learned in an hour, and it can temporarily coexist with Nginx on different ports",{"type":31,"title":153,"body":154},"Conclusion: start with Caddy, evolve if needed","For the vast majority of self-hosters managing a few Docker applications on a VPS, Caddy is an excellent starting point: it is simple, lightweight, opinionated in the right way and handles TLS better than any alternative without extra configuration. If your infrastructure grows beyond five services with frequent automated deployments, Traefik becomes more appropriate thanks to its dynamic discovery. If you need to delegate domain management to non-technical people, Nginx Proxy Manager is the only truly accessible option.","Your Docker-ready VPS in under 5 minutes","ServOrbit VPS are delivered with Docker pre-installed, a dedicated public IP and a 1 Gbps network. Deploy Caddy, Traefik or Nginx Proxy Manager immediately after delivery, with no additional network configuration.","Discover ServOrbit VPS","\u002Fsolutions\u002Fdeveloppeurs",[160,180,193],{"id":161,"slug":162,"slugs":163,"title":166,"excerpt":167,"readTime":168,"views":15,"isPinned":16,"publishedAt":169,"category":170,"categories":174,"featuredImage":25,"bgImage":26,"posterImage":176,"relatedSolution":177},39,"deploy-your-applications-with-caddy-on-a-vps",{"fr":164,"en":162,"ar":165},"deployer-avec-caddy","انشر-تطبيقاتك-باستخدام-caddy-على-خادم-vps","Deploy your applications with Caddy on a VPS","Deploy Caddy on your VPS: web server and reverse proxy with automatic HTTPS. A Caddyfile of a few lines is enough to go into production.",3,"2026-05-12T00:00:00+00:00",{"id":168,"name":171,"slug":172,"color":173,"icon":172},"Deployment","deploiement","bg-success\u002F10 text-success",[175],{"id":168,"name":171,"slug":172,"color":173,"icon":172},"\u002Fblog\u002Fcovers\u002Fdeployer-avec-caddy-poster.svg",{"categorySlug":178,"appSlug":179},"application-deployment-devops","caddy",{"id":181,"slug":182,"slugs":183,"title":186,"excerpt":187,"readTime":168,"views":15,"isPinned":16,"publishedAt":188,"category":189,"categories":190,"featuredImage":25,"bgImage":26,"posterImage":192,"relatedSolution":25},38,"deploy-your-applications-with-traefik-on-a-vps",{"fr":184,"en":182,"ar":185},"deployer-avec-traefik","انشر-تطبيقاتك-باستخدام-traefik-على-خادم-vps","Deploy your applications with Traefik on a VPS","Deploy Traefik as a reverse proxy on your VPS: automatic routing of Docker containers, Let's Encrypt SSL certificates and load balancing.","2026-05-13T00:00:00+00:00",{"id":168,"name":171,"slug":172,"color":173,"icon":172},[191],{"id":168,"name":171,"slug":172,"color":173,"icon":172},"\u002Fblog\u002Fcovers\u002Fdeployer-avec-traefik-poster.svg",{"id":194,"slug":195,"slugs":196,"title":199,"excerpt":200,"readTime":14,"views":15,"isPinned":16,"publishedAt":201,"category":202,"categories":203,"featuredImage":25,"bgImage":26,"posterImage":205,"relatedSolution":25},37,"deploy-your-applications-with-nginx-proxy-manager-on-a-vps",{"fr":197,"en":195,"ar":198},"deployer-avec-nginx-proxy-manager","انشر-تطبيقاتك-باستخدام-nginx-proxy-manager-على-خادم-vps","Deploy your applications with Nginx Proxy Manager on a VPS","Manage domains, SSL and reverse proxy for several services on a VPS with Nginx Proxy Manager: installation, Docker networks, 502 troubleshooting and configuration.","2026-05-14T00:00:00+00:00",{"id":168,"name":171,"slug":172,"color":173,"icon":172},[204],{"id":168,"name":171,"slug":172,"color":173,"icon":172},"\u002Fblog\u002Fcovers\u002Fdeployer-avec-nginx-proxy-manager-poster.svg",1787580993478]