caddy gets you free https in three lines

why your homelab probably has an expired cert right now

be honest. you set up nginx and certbot two years ago, it worked, and you have not thought about it since. then one day a browser throws a scary red warning at you and you remember that certs expire every 90 days and renewal jobs fail silently more often than anyone admits. this is not a you problem, it's a certbot-plus-cron problem, and it's exactly the kind of small neglected thing that turns into a real exposure. an expired cert trains you and your users to click "proceed anyway," and that habit is how phishing pages with fake certs stop looking suspicious.

caddy fixes this by making https the default instead of a chore you bolt on. here's the whole config from the reel and what's actually happening under the hood.

the three lines, actually explained

# /etc/caddy/Caddyfile
app.example.com {
    reverse_proxy localhost:8080
}

line one is your domain. that's it, no separate ssl block, no listen directive, no protocol prefix. caddy sees a bare domain name and assumes you want https, because in 2024 that should just be the default assumption for everything.

line two is the reverse proxy target, your actual app running on localhost:8080 (could be a docker container, a flask app, whatever). caddy sits in front of it and handles all the tls termination so your backend app never has to think about certificates at all.

the closing brace just ends the site block. that's the entire config. no cert paths, no key paths, no renewal cron entry.

what happens when you reload

systemctl reload caddy

this tells caddy to re-read the caddyfile without dropping existing connections. the first time it sees app.example.com, caddy automatically talks to let's encrypt using the acme protocol, proves it controls the domain (usually via an http challenge on port 80), and gets a real trusted certificate. no certbot install, no plugin for your webserver, no manual acme client setup.

then caddy stores that cert, sets up automatic renewal on its own internal timer well before the 90 day expiration, and keeps doing this forever in the background as part of the caddy process itself. there's no separate cron job to forget about, no renewal script that silently fails because a path changed or a hook broke. if caddy is running, your cert situation is being handled.

what this means defensively

the biggest security win here isn't the encryption itself, it's the removal of a failure point that humans consistently mess up. renewal automation that lives outside your webserver (like a cron job calling certbot) is one more thing that can break without anyone noticing until a user hits a warning page. caddy folding cert lifecycle into the same process that's already serving traffic means there's one less moving part to audit, monitor, and eventually forget exists.

it also nudges you toward good defaults you might otherwise skip. caddy serves http/2 automatically, redirects plain http to https automatically, and uses reasonably modern tls settings out of the box without you having to hand tune a cipher suite list you don't fully understand. fewer manual settings means fewer chances to leave something misconfigured and exposed.

checking your own setup

if you're already running caddy, don't just trust that it's working, verify it:

curl -vI https://app.example.com 2>&1 | grep -i expire
systemctl status caddy
journalctl -u caddy --since "24 hours ago"

the curl command shows you the actual cert expiration date being served. the status and journal commands let you confirm caddy is healthy and not silently erroring on renewal attempts (it does happen if dns is misconfigured or port 80 is blocked by a firewall rule you forgot about). check that your firewall actually allows inbound 80 and 443, since the acme http challenge needs port 80 open even if you never plan to serve real traffic on it.

the takeaway

free automatic https isn't a nice-to-have anymore, it's table stakes for anything you expose to the internet, even a homelab dashboard nobody else knows exists. the fewer manual steps between "i set this up" and "this stays secure," the fewer chances you have to accidentally leave a door open. caddy just removes one entire category of self-inflicted exposure. go check your certs today, not at 2am when someone else notices first.