[{"data":1,"prerenderedAt":212},["ShallowReactive",2],{"seo-verification":3,"blog-caddy-vs-nginx-which-web-server-reverse-proxy-for-your-vps-ma-en":6,"promo-bar-likely":211},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-caddy-vs-nginx-which-web-server-reverse-proxy-for-your-vps-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":32,"intro":35,"sections":36,"ctaTitle":149,"ctaBody":150,"ctaButton":151,"ctaUrl":152,"relatedPosts":153},103,"caddy-vs-nginx-which-web-server-reverse-proxy-for-your-vps",{"fr":12,"en":10,"ar":13,"es":14},"caddy-vs-nginx","caddy-مقابل-nginx-أي-خادم-ويب-ووكيل-عكسي-لـ-vps","caddy-vs-nginx-servidor-web-reverse-proxy-vps","Caddy vs Nginx: Which Web Server \u002F Reverse Proxy for Your VPS?","Caddy vs Nginx on a VPS: full comparison — automatic HTTPS, configuration, HTTP\u002F3, rate limiting, troubleshooting and when to choose Traefik.",9,1,false,"2026-03-09T00:00:00+00:00","2026-11-08T01:13:13+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},5,"Comparison","comparatif","bg-info\u002F10 text-info",[28],{"id":23,"name":24,"slug":25,"color":26,"icon":25},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fcaddy-vs-nginx-poster.svg",{"categorySlug":33,"appSlug":34},"application-deployment-devops","caddy","On a VPS that serves HTTP traffic, the reverse proxy is not a configuration detail: it is the piece that handles TLS, distributes requests to your containers, and sets the security headers seen by every visitor. Caddy fully automates the issuance and renewal of Let's Encrypt certificates; Nginx offers the most proven fine-tuning on the market. This guide compares both in depth — advanced configuration, troubleshooting, HTTP\u002F3 — and explains when a third choice, Traefik, is the right call.",[37,41,52,55,83,86,89,137,139,142,146],{"type":38,"title":39,"body":40},"h2","Why Take Care of Your Reverse Proxy on a VPS","On a VPS, the front-end web server is the piece that orchestrates everything: it terminates TLS, distributes traffic to your containers (app, forge, media server, LLM), serves static files, and applies security headers. Well chosen, it radically simplifies enabling HTTPS on all your subdomains. Caddy obtains and renews Let's Encrypt certificates automatically, with no configuration, using a readable `Caddyfile` of a few lines. Nginx, the market reference, offers extremely fine control (cache, rewrite rules, load balancing, rate limiting) but requires manual certificate management or management via Certbot. The choice pits modern automation against proven, total control.",{"type":42,"title":43,"items":44},"ul","What a Good Front End Brings to Your VPS",[45,46,47,48,49,50,51],"Centralized TLS termination for all your subdomains","A single reverse proxy to multiple Docker containers","Fast static file serving and compression (gzip\u002Fbrotli)","Security headers (HSTS, CSP, X-Content-Type-Options) applied in the same place","With Caddy: Let's Encrypt certificates obtained and renewed automatically","With Nginx: cache, rate limiting, and load balancing finely tuned","HTTP\u002F3 and QUIC to reduce latency on degraded connections",{"type":38,"title":53,"body":54},"Prerequisites: A Frugal Front End","A reverse proxy is very lightweight: both Caddy and Nginx run comfortably on 1 vCPU and 512 MB to 1 GB of RAM, even in front of several services. The resource to watch is rather the bandwidth and the number of simultaneous connections. You need a domain and its subdomains pointing to the VPS IP (A\u002FAAAA records), ports 80 and 443 open on the firewall (port 80 is required for certificate validation), and Docker if you containerize the proxy. No GPU or large storage: here, it is the configuration that makes the difference, not raw power.",{"type":56,"title":57,"steps":58},"steps","Set Up Caddy (or Nginx) as a Reverse Proxy",[59,62,65,68,71,74,77,80],{"title":60,"body":61},"Point the DNS","Create the A records (and AAAA if IPv6) for each subdomain (app, git, media) pointing to the VPS IP. Let's Encrypt validation will fail as long as DNS resolution is not effective, so verify it first with `dig app.yourdomain.com` or an online tool.",{"title":63,"body":64},"Open Ports 80 and 443","Allow only 80 and 443 on the firewall (`ufw allow 80\u002Ftcp && ufw allow 443\u002Ftcp`). Port 80 remains essential for the Let's Encrypt HTTP challenge and to automatically redirect traffic to HTTPS.",{"title":66,"body":67},"Write the Base Configuration","With Caddy, one block is enough: `app.yourdomain.com { reverse_proxy 127.0.0.1:3000 }` and HTTPS is automatic. With Nginx, write one `server` block per subdomain with `proxy_pass` and the `X-Forwarded-*` headers, then obtain the certificate via Certbot: `certbot --nginx -d app.yourdomain.com`.",{"title":69,"body":70},"Configure Multiple Subdomains","With Caddy, list each block in the same `Caddyfile`: `git.yourdomain.com { reverse_proxy 127.0.0.1:3001 }`. With Nginx, create one file per subdomain in `\u002Fetc\u002Fnginx\u002Fconf.d\u002F` or `\u002Fetc\u002Fnginx\u002Fsites-available\u002F`, then enable it with `ln -s`. Both approaches let you manage dozens of services without repetition.",{"title":72,"body":73},"Enable Compression","Caddy does not compress by default: add `encode zstd gzip` in the site block (brotli is not in the standard build and requires a third-party module compiled with xcaddy). Under Nginx, add to `nginx.conf`: `gzip on; gzip_types text\u002Fplain text\u002Fcss application\u002Fjson application\u002Fjavascript; gzip_min_length 256;`. Compression greatly reduces the size of text responses (HTML, CSS, JSON, JavaScript).",{"title":75,"body":76},"Launch and Reload Without Downtime","Start the service (`docker compose up -d` or `systemctl start caddy`). After each change, validate the config (`nginx -t` or `caddy validate`) and then hot-reload (`nginx -s reload` \u002F `caddy reload`) to never interrupt traffic.",{"title":78,"body":79},"Verify Certificates","With Caddy, run `caddy validate --config \u002Fetc\u002Fcaddy\u002FCaddyfile` to catch errors before reloading, and check logs (`journalctl -u caddy -f`) to confirm certificate issuance. With Nginx + Certbot, `certbot certificates` lists expiry dates and `certbot renew --dry-run` simulates renewal.",{"title":81,"body":82},"Harden Security and Set Up Logs","Enable HSTS, hide the server version (`server_tokens off` under Nginx, automatic under Caddy), enforce TLS 1.2+, and add basic rate limiting. Enable access and error logs, and watch for 502\u002F504 codes that reveal an unreachable downstream container.",{"type":84,"body":85},"p","Once the proxy is operational and certificates have been issued, two complementary steps strengthen security and performance: advanced header and rate limiting configuration, and monitoring setup. Order matters: validate that basic routing works first (`curl -I https:\u002F\u002Fapp.yourdomain.com`) before stacking configuration layers.",{"type":38,"title":87,"body":88},"Advanced Configuration: Security, Compression and HTTP\u002F3","Once the basics are in place, three areas concretely improve your reverse proxy's posture.\n\n**Security headers.** Apply at the proxy level the headers that each downstream service will forget: `Strict-Transport-Security: max-age=31536000; includeSubDomains` (HSTS), `X-Content-Type-Options: nosniff`, `X-Frame-Options: SAMEORIGIN`, and a `Content-Security-Policy` tailored to your application. Centralizing these headers at the proxy level ensures they cover all your subdomains in one move.\n\n**Rate limiting.** Under Caddy, the `rate_limit` module (available via `xcaddy build`) lets you cap requests per IP. Under Nginx, the directive `limit_req_zone $binary_remote_addr zone=api:10m rate=30r\u002Fm;` in `http {}` then `limit_req zone=api burst=10 nodelay;` in the relevant `location` is enough to protect an API against abuse without external dependencies.\n\n**HTTP\u002F3 and QUIC.** Caddy enables HTTP\u002F3 by default as soon as UDP port 443 is open. Nginx has supported QUIC and HTTP\u002F3 since version 1.25.0 (`quic` parameter in the `listen` block, `ngx_http_v3_module` included in the nginx.org Linux packages); check the installed version and its modules with `nginx -V` before enabling the directive. HTTP\u002F3 reduces perceived latency on mobile connections and high packet-loss networks, without any change in behavior for clients that do not support it.",{"type":90,"title":91,"headers":92,"rows":96},"comparison","Caddy vs Nginx — Comparison Table",[93,94,95],"Criterion","Caddy","Nginx",[97,101,105,109,113,117,121,125,129,133],[98,99,100],"HTTPS \u002F certificates","Automatic, zero config","Manual or via Certbot",[102,103,104],"Configuration syntax","Caddyfile, very concise","More verbose, very expressive",[106,107,108],"Learning curve","Low","Moderate to high",[110,111,112],"Fine-grained control (cache, rewrite, LB)","Good, sometimes via plugins","Very complete and proven",[114,115,116],"HTTP\u002F3 \u002F QUIC","Enabled by default","Supported since 1.25.0",[118,119,120],"Native rate limiting","Via xcaddy module","Built-in (`limit_req`)",[122,123,124],"Dynamic modules","Compilation via xcaddy","Dynamic modules (.so)",[126,127,128],"RAM footprint at rest","Low (single Go binary)","Low (lightweight workers)",[130,131,132],"Log format","Structured JSON by default","Text, configurable",[134,135,136],"Ideal for","Quick HTTPS setup, multi-subdomain","Advanced tuning, high traffic",{"type":84,"body":138},"The deployment steps cover the ideal configuration. In practice, several types of errors come up regularly: a certificate blocked by an intermediate network, a downstream service that is not yet responding, or a Docker container unreachable from the proxy because the two are on separate networks. The most useful dashboard in these situations is the proxy log (`journalctl -u caddy -f` or `tail -f \u002Fvar\u002Flog\u002Fnginx\u002Ferror.log`), combined with `curl` locally to isolate the problem.",{"type":38,"title":140,"body":141},"Troubleshooting: The Most Common Errors","Even a well-configured proxy produces errors at startup or under load. Here are the five cases that come up most often.\n\n**Caddy — \"no certificate\" behind a load balancer.** When Caddy sits behind a load balancer that already terminates TLS, it cannot receive the Let's Encrypt HTTP-01 challenge and fails to issue the certificate. Solution: use the DNS-01 challenge via your registrar's plugin (e.g. `tls { dns cloudflare {env.CF_API_TOKEN} }`), or delegate TLS management entirely to the load balancer and force Caddy to `http:\u002F\u002F` internally.\n\n**Nginx — 502 Bad Gateway (upstream timeout).** A persistent 502 after startup means the downstream service is not listening yet or has crashed. Check with `curl -v http:\u002F\u002F127.0.0.1:\u003Cport>` from the server. If the service starts slowly, increase `proxy_read_timeout` and `proxy_connect_timeout`. An intermittent 502 under load points to a lack of keepalive connections: add `keepalive 32;` in the `upstream` block.\n\n**Caddy with Docker — container unreachable.** When Caddy and the target service run on separate Docker networks, `reverse_proxy 127.0.0.1:3000` does not work: `127.0.0.1` is the loopback address of the Caddy container, not the host. Solution: connect both containers to the same named Docker bridge network and use the service name as the target address: `reverse_proxy service-name:3000`.\n\n**Nginx — \"too many open files\" under load.** The error `worker_connections are not enough` or `open() failed (24: Too many open files)` appears when the VPS receives a traffic spike. Increase the system limit (`ulimit -n 65535` or `LimitNOFILE=65535` in the systemd unit) and align `worker_connections 4096;` in `nginx.conf`. The maximum simultaneous connections is `worker_processes * worker_connections`.\n\n**Caddy — silently blocked renewal.** Caddy renews in the background, but if port 80 or TCP port 443 is closed by the firewall, the HTTP-01 and TLS-ALPN-01 challenges fail and only the logs show it. Monitor `journalctl -u caddy -f` around renewal dates (when about a third of the validity remains, i.e. around day 60 for a 90-day certificate) and test the challenge with `caddy run --config \u002Fetc\u002Fcaddy\u002FCaddyfile --watch` in the foreground to see errors in real time.",{"type":143,"title":144,"body":145},"tip","Caddy, Nginx or Traefik: The Third Choice","For infrastructure with **many Docker microservices** with automatic container discovery, Traefik emerges as a third option: it reads Docker labels (`traefik.http.routers.myapp.rule=Host(\"app.yourdomain.com\")`) and configures routes on the fly without manual reloading. The downside is its more complex configuration and denser documentation. Caddy and Nginx remain the natural choices for a reasonably-sized VPS (1 to 20 services); Traefik takes over beyond that, especially in a Kubernetes or Docker Swarm context. For a full comparison of all three, see the article \u003Ca href=\"\u002Fblog\u002Fchoisir-reverse-proxy-vps-caddy-traefik-nginx\">choosing your VPS reverse proxy: Caddy, Traefik or Nginx\u003C\u002Fa>.",{"type":143,"title":147,"body":148},"Combining Both Rather Than Choosing","If you are still hesitating, know that Caddy and Nginx are not mutually exclusive. A common pattern places Caddy as the very first front end to automatically manage TLS for all your subdomains, then leaves Nginx downstream for fine caching and rewrite rules of a specific service. This way you combine automatic certificates with tuning control, without picking a side for good.","An HTTPS Front End Ready in a Few Lines","The ServOrbit Cloud VPS with a Docker template lets you deploy Caddy or Nginx as a reverse proxy, with automatic SSL for all your subdomains and services.","Configure My Reverse Proxy","\u002Fvps-cloud",[154,173,191],{"id":155,"slug":156,"slugs":157,"title":161,"excerpt":162,"readTime":163,"views":164,"isPinned":19,"noindex":19,"publishedAt":165,"updatedAt":166,"category":167,"categories":168,"featuredImage":29,"bgImage":30,"posterImage":170,"relatedSolution":171},4,"coolify-vs-dokploy-which-tool-to-deploy-on-a-vps",{"fr":158,"en":156,"ar":159,"es":160},"coolify-vs-dokploy","coolify-مقابل-dokploy-أي-أداة-للنشر-على-vps","coolify-vs-dokploy-que-herramienta-elegir-para-su-vps","Coolify vs Dokploy: which tool to deploy on a VPS?","Coolify or Dokploy for your VPS? A binary comparison on idle RAM, license, templates and multi-node support to make the right choice once and for all.",7,3,"2026-06-07T00:00:00+00:00","2026-09-18T02:05:20+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[169],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fcoolify-vs-dokploy-poster.svg",{"categorySlug":33,"appSlug":172},"coolify",{"id":174,"slug":175,"slugs":176,"title":180,"excerpt":181,"readTime":17,"views":164,"isPinned":19,"noindex":19,"publishedAt":182,"updatedAt":183,"category":184,"categories":185,"featuredImage":29,"bgImage":30,"posterImage":187,"relatedSolution":188},93,"n8n-vs-node-red-which-self-hosted-automation-tool-to-choose",{"fr":177,"en":175,"ar":178,"es":179},"n8n-vs-node-red","n8n-مقابل-node-red-أي-أداة-أتمتة-مستضافة-ذاتيا-تختار","n8n-vs-node-red-que-automatizacion-self-hosted-elegir","n8n vs Node-RED: which self-hosted automation tool to choose?","n8n or Node-RED for your VPS workflows? Complete technical comparison: license, server resources, IoT vs SaaS use cases, migration steps, and Docker deployment.","2026-03-19T00:00:00+00:00","2026-11-08T01:13:15+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[186],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fn8n-vs-node-red-poster.svg",{"categorySlug":189,"appSlug":190},"automation-workflows","n8n",{"id":192,"slug":193,"slugs":194,"title":198,"excerpt":199,"readTime":200,"views":201,"isPinned":19,"noindex":19,"publishedAt":202,"updatedAt":203,"category":204,"categories":205,"featuredImage":29,"bgImage":30,"posterImage":207,"relatedSolution":208},94,"supabase-vs-appwrite-which-self-hosted-backend-for-your-vps",{"fr":195,"en":193,"ar":196,"es":197},"supabase-vs-appwrite","supabase-مقابل-appwrite-أي-خلفية-مستضافة-ذاتيا-لـ-vps","supabase-vs-appwrite-que-backend-self-hosted-para-vps","Supabase vs Appwrite: Choosing Your Open-Source BaaS on a VPS","Full comparison of Supabase vs Appwrite: Docker deployment, RAM requirements, auth, serverless functions, realtime, and a decision guide for your VPS.",14,0,"2026-03-18T00:00:00+00:00","2026-11-08T01:13:16+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[206],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fsupabase-vs-appwrite-poster.svg",{"categorySlug":209,"appSlug":210},"databases","supabase",true,1794270371374]