Caddy as a reverse proxy on VPS: complete guide

Why choose Caddy as a reverse proxy on your VPS?

What Caddy brings to production

• Automatic HTTPS: Let's Encrypt ACME HTTP-01 activated as soon as a domain name is declared — no cron, no plugin to install
• Concise syntax: a five-line block replaces a forty-line Nginx vhost with its Certbot configuration file
• Zero cold reload: caddy reload applies the new Caddyfile without dropping in-flight connections
• HTTP/2 and HTTP/3 (QUIC) by default: enabled without additional configuration on all 2.x versions
• JSON API: configuration can be updated live via a REST API, useful for dynamic or containerised environments
• Lightweight official Docker image: caddy:2-alpine weighs under 20 MB and covers most production cases

Prerequisites

ss -tlnp | grep -E ':80|:443'

Deploying Caddy as a reverse proxy

1. 01

   Method 1 — Installation via the official APT repository

   Caddy provides a signed APT repository. Add it, then install the package:

   apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
   curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
     | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
   curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
     | tee /etc/apt/sources.list.d/caddy-stable.list
   apt update && apt install caddy

   Verify the installed version: caddy version should display v2.9.x or higher.

2. 02

   Method 2 — Deployment with Docker Compose

   If your applications already run under Docker, a Caddy service in the same compose.yml is the simplest approach. Create a compose.yml file at the root of your project:

   services:
     caddy:
       image: caddy:2-alpine
       restart: unless-stopped
       ports:
         - "80:80"
         - "443:443"
         - "443:443/udp"
       volumes:
         - ./Caddyfile:/etc/caddy/Caddyfile
         - caddy_data:/data
         - caddy_config:/config
       networks:
         - proxy
   
   volumes:
     caddy_data:
     caddy_config:
   
   networks:
     proxy:
       external: true

   Create the shared network once: docker network create proxy. Your other services join this network to be accessible by Caddy.

3. 03

   Create the basic Caddyfile

   The Caddyfile is the central configuration file. For an APT installation, it lives at /etc/caddy/Caddyfile. For Docker, place it next to your compose.yml.

   Here is a minimal example that exposes an application on port 3000:

   myapp.com {
       reverse_proxy localhost:3000
   }

   That's it. Caddy detects that myapp.com is a domain name, contacts Let's Encrypt via ACME HTTP-01, obtains a certificate and automatically redirects all HTTP traffic to HTTPS. Certificates are stored in ~/.local/share/caddy/ (APT) or in the caddy_data volume (Docker).

4. 04

   Multi-application configuration (multi-vhost)

   Hosting multiple applications on the same VPS only requires additional blocks in the same file:

   app1.yourdomain.com {
       reverse_proxy localhost:3000
   }
   
   app2.yourdomain.com {
       reverse_proxy localhost:4000
   }
   
   blog.yourdomain.com {
       reverse_proxy localhost:8080
   }

   Each block gets its own Let's Encrypt certificate. Caddy manages renewals independently for each domain, in parallel, without service interruption.

5. 05

   Apply the Caddyfile without interruption

   For APT, reload the configuration without dropping connections:

   systemctl reload caddy
   # or, if you modified the file outside /etc/caddy/:
   caddy reload --config /path/to/Caddyfile

   For Docker:

   docker compose exec caddy caddy reload --config /etc/caddy/Caddyfile

   Verify that the syntax is correct before reloading: caddy validate --config /etc/caddy/Caddyfile.

6. 06

   Add security headers and rate limiting

   Caddy supports native security headers via the header directive. Here is a hardened block for a production application:

   myapp.com {
       reverse_proxy localhost:3000
   
       header {
           Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
           X-Content-Type-Options "nosniff"
           X-Frame-Options "SAMEORIGIN"
           Referrer-Policy "strict-origin-when-cross-origin"
           -Server
       }
   
       log {
           output file /var/log/caddy/myapp.log {
               roll_size 10mb
               roll_keep 5
           }
       }
   }

   For rate limiting, the caddy-ratelimit module is installed via xcaddy build and used with the rate_limit directive. The official Docker image does not include it — build your own image or use an upstream application firewall if the need is critical.

7. 07

   Enable and verify the systemd service (APT)

   After installation via APT, the service is enabled automatically. Check its status and logs:

   systemctl status caddy
   journalctl -u caddy -f

   To ensure Caddy starts at reboot: systemctl enable caddy (already done by the package). Test that the Let's Encrypt certificate was successfully issued:

   curl -sv https://myapp.com 2>&1 | grep -E 'subject|issuer|expire'

How Caddy's automatic HTTPS works

Caddy vs Nginx: when to choose which

Scroll the table

Troubleshooting: common errors