Caddy
FreeTwo lines of config, and HTTPS certificates obtain and renew themselves
A web server and reverse proxy written in Go that obtains and renews TLS certificates from Let's Encrypt automatically, with no certbot setup or cron job. The configuration syntax is minimal — a domain and a backend address is a working site — and it supports HTTP/3, static hosting and plugins.
Why we picked it
Apache-2.0, 75,800 stars.
HTTPS is where a lot of self-hosting stalls: write the Nginx config, install certbot, configure renewal, handle the reload after renewal — and if any link in that chain is wrong, the site turns red three months later. Caddy makes the whole sequence the default: put the domain in the config and it requests, renews and reloads on its own.
The config is short enough to quote in full:
example.com {
reverse_proxy localhost:8080
}
That is a complete HTTPS reverse proxy.
Gitea, Uptime Kuma, Vaultwarden and Immich — all listed here — usually want a proxy layer in front for domains and certificates, and Caddy is the least troublesome way to provide it.
To be clear about:
- Automatic certificates require DNS already pointing at the machine and ports 80 and 443 reachable. Private-network use needs the DNS challenge instead, which is more configuration.
- Nginx still wins on raw throughput for very high-concurrency static serving. At personal self-hosting scale the difference is not perceptible.
- Plugins are compiled into the binary — the site offers an online builder — rather than loaded dynamically as in Nginx.