🩺 Vitals
- 🟢 Last active: 2026-09-11
- 📦 Latest release: v2.11.4 (2026-06-03)
- 🐞 Open issues: 276
- 🌟 Stars: 75.6k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: caddyserver.com
- Source: github.com/caddyserver/caddy
- License: Apache 2.0
- Deployment: Docker | Native
- Data Model: Stateless (Caddyfile or JSON config; certificates on local disk)
- Jurisdiction: USA 🇺🇸 (Individual Maintainer / Community)
- Compliance (SaaS): N/A
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Low (1/5) - Single binary, automatic HTTPS, minimal config
- Maintenance: Low (1/5) - Certificates renew themselves; rebuild only to add modules
- Enterprise Ready: Medium (3/5) - Every feature is free, but enterprise auth, RBAC and WAF come via third-party modules, not the core
1. The Executive Summary
What is it? Caddy is a web server and reverse proxy delivered as a single, statically compiled Go binary. Its defining trait is automatic HTTPS: on first run it obtains and thereafter renews TLS certificates for your domains without a certbot cron job or a manual renewal step. It serves static sites, proxies traffic to backend services, and terminates TLS, all from one process configured by a short Caddyfile or a JSON document.
The Strategic Verdict:
- 🟢 For small-to-mid self-hosted estates: Strong Buy. The automatic certificate handling and single-file config remove the two chores that make a manual proxy setup fragile, and every capability is in the free Apache-licensed build with nothing held back.
- 🔴 For large dynamic Kubernetes fleets: Consider the alternative. Caddy runs on Kubernetes, but service-discovery-driven ingress at cluster scale is Traefik's home ground; Caddy is happiest in front of a fixed set of sites and services.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | NGINX Plus (Commercial) | Caddy (Self-Hosted) |
|---|---|---|
| Licensing | Annual per-instance subscription | None (Apache 2.0, no tiers) |
| TLS Certificate Management | Manual or scripted renewal | Issued and renewed automatically |
| Config Maintenance | Hand-managed server blocks | One Caddyfile, sane defaults |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: A single Native binary with no runtime dependencies, or a lightweight Docker image. There is no separate certificate tool, database or agent to run.
- Extending it means rebuilding: Caddy's plugins (extra DNS providers, authentication, rate limiting) are compiled into the binary with the
xcaddybuilder rather than loaded at runtime. Adding a module is a rebuild, not a config toggle, which is the main operational quirk to plan for. - Automatic HTTPS calls an external CA: By default certificates come from a public ACME authority (Let's Encrypt, with ZeroSSL as fallback). Air-gapped or internal-only deployments must point Caddy at an internal CA or supply their own certificates.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Stewardship: Development is led by the original creator, a US-based individual, with several hundred community contributors under a permissive Apache 2.0 licence. The Caddy trademark and commercial support sit with a separate European entity (Stack Holdings, via ZeroSSL), but because the licence is permissive and no feature is paywalled, that commercial steward holds no lever over the software you run. The genuine governance question is bus factor: the project's direction remains closely tied to its founder.
- The Compliance Shift: Caddy stores no user data and offers no hosted service, so there is no vendor certification to inherit. Its automatic TLS satisfies the encryption-in-transit control that frameworks such as ISO 27001 and SOC 2 expect, which removes a common source of misconfiguration, but automating a control is not the same as certifying the deployment. Host security, access control and audit evidence remain yours to produce.
- License is Clean and Complete: Apache 2.0 carries no copyleft or network clause, and there is no open-core edition, so unlike many proxies there is no feature gated behind a paid tier. The trade-off is scope: the core is a lean web server, so enterprise authentication, RBAC and a web application firewall are assembled from community modules rather than shipped and supported as first-party features.
4. Market Landscape
🏢 Proprietary Incumbents
- NGINX Plus (F5): The commercial edition of NGINX, adding dynamic reconfiguration, active health checks and vendor support under an annual per-instance subscription.
- Cloudflare: The managed way to get automatic HTTPS and a reverse proxy, delivered as an edge service. Operationally simple, but it terminates your TLS on a third-party US network rather than on infrastructure you control.
🤝 Open Source Ecosystem
- Traefik: The dynamic-ingress peer. Where Caddy suits a fixed set of sites configured by hand, Traefik auto-configures from container and Kubernetes service discovery, at the cost of a steeper model.
- nginx: The ubiquitous open-source proxy and web server. Faster for heavy static workloads and battle-tested at scale, but TLS and configuration are manual where Caddy automates them.