Caddy
Modern, open-source web server written in Go with automatic HTTPS enabled by default. Caddy handles TLS certificate provisioning and renewal via Let's Encrypt automatically, with zero-downtime reloads and a JSON/Caddyfile configuration. Used as a reverse proxy for agent backends, handling TLS termination, load balancing, and request routing without manual certificate management.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Automatic HTTPS is the best feature — no manual TLS management reduces certificate errors. Admin API must be secured. Modern TLS defaults (TLS 1.2+) out of the box.
⚡ Reliability
Best When
You want automatic HTTPS with zero certificate management overhead for agent backends — Caddy's automatic Let's Encrypt integration is unmatched.
Avoid When
You have deep nginx expertise and need maximum performance, complex WAF rules, or very specific nginx module requirements.
Use Cases
- • Serve agent API backends with automatic HTTPS and zero-configuration TLS certificate management
- • Reverse proxy agent microservices with load balancing, health checks, and SSL termination
- • Serve agent web UIs with static file serving and backend API proxying in a single config
- • Use Caddy's admin API to dynamically configure routes for agent service discovery
- • Deploy agent services with HTTP/2 and HTTP/3 support without additional configuration
Not For
- • High-performance static file serving at extreme scale — nginx is more battle-tested for multi-terabyte CDN workloads
- • Complex ModSecurity WAF rules — use nginx + ModSecurity for advanced WAF requirements
- • Environments where automatic TLS is not desired (internal only) — additional config needed to disable
Interface
Authentication
Caddy Admin API is unauthenticated by default (localhost only). Production deployments can use HMAC auth for Admin API.
Pricing
Completely free and open source. Commercial support available separately.
Agent Metadata
Known Gotchas
- ⚠ Automatic HTTPS requires public DNS pointing to the server — development/internal domains need manual certificate configuration or ACME DNS challenge
- ⚠ Caddy Admin API runs on localhost:2019 by default — securing it for remote access requires explicit bind address and auth configuration
- ⚠ Caddyfile format vs JSON API: Caddyfile is for static config, JSON API for dynamic; mixing both requires understanding which takes precedence on reload
- ⚠ Rate limiting requires xcaddy (custom builds) with caddy-ratelimit module — not built into default Caddy binary
- ⚠ File descriptor limits: Caddy opens a connection for each TLS certificate renewal and site — increase OS fd limits for deployments with many virtual hosts
- ⚠ ACME challenge ports: Caddy needs port 80 for HTTP-01 challenge or DNS API credentials for DNS-01 — firewall rules blocking port 80 break automatic TLS
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Caddy.
Scores are editorial opinions as of 2026-03-06.