Caddy
Caddy is an efficient, HTTP/2 capable web server that can serve static and dynamic web pages. It can also be a reverse proxy to serve multiple web services under one server. Its main features are its simple config setup and automatic HTTPS: It will automatically request and renew a LetsEncrypt certificate so that users of your service get a Browser-trusted and secure connection.
Installation
To try out Caddy add the following minimal example to your NixOS module:
services.caddy = {
enable = true;
virtualHosts."localhost:80".extraConfig = ''
respond "Hello, world!"
'';
};
The snippet above will run Caddy on http://localhost and respond with a dummy text "Hello world!".
A similar example with serving a dummy "http://localhost/example.html" page is:
services.caddy = {
enable = true;
virtualHosts."localhost".extraConfig = ''
encode gzip
file_server
root * ${
pkgs.runCommand "testdir" {} ''
mkdir "$out"
echo hello world > "$out/example.html"
''
}
'';
};
Configuration examples
SSL
Caddy will automatically try to acquire SSL certificates for the specified domain, in this example example.org. This requires you to configure the DNS records of your domain correctly, which should point to the address of your Caddy server. The firewall ports 80 and 443 needs to be opened.
services.caddy = {
enable = true;
virtualHosts."example.org".extraConfig = ''
encode gzip
file_server
root * ${
pkgs.runCommand "testdir" {} ''
mkdir "$out"
echo hello world > "$out/example.html"
''
}
'';
};
networking.firewall.allowedTCPPorts = [ 80 443];
Reverse proxy
The following snippet creates a reverse proxy for the domain example.org, redirecting all requests to http://10.25.40.6
services.caddy = {
enable = true;
virtualHosts."example.org".extraConfig = ''
reverse_proxy http://10.25.40.6
'';
};
Redirect
Redirecting example.org and old.example.org to www.example.org
services.caddy = {
enable = true;
virtualHosts."example.org" = {
extraConfig = ''
redir https://www.example.org
'';
serverAlias = [ "old.example.org" ];
};
PHP FastCGI
Serving a PHP application in /var/www on http://localhost .
services.caddy = {
enable = true;
virtualHosts."http://localhost" = {
extraConfig = ''
root * /var/www
file_server
php_fastcgi unix/var/run/phpfpm/localhost.sock
'';
};
};
You'll need a PHP-FPM socket listening on Unix socket path /var/run/phpfpm/localhost.sock.
Debugging
Check used ports
To check if Caddy is running and listening as configured you can run netstat:
$ netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:2019 0.0.0.0:* LISTEN 1202/caddy
tcp6 0 0 :::80 :::* LISTEN 1202/caddy
tcp6 0 0 :::443 :::* LISTEN 1202/caddy
udp6 0 0 :::443 :::* 1202/caddy
The tcp (ipv4) socket port 2019 is Caddy's management endpoint, for when you want manage its config via web REST calls instead of Nix (ignore). The tcp6 (an ipv6 socket that also listens on ipv4) socket on port 80 (HTTP) and 443 (HTTPS) indicate that a virtualhost config was used.
Check connections
You can also use curl to test http(s) calls. However, you must set the "Host" header correctly when testing locally:
$ curl localhost -H "Host: example.org"
for an virtualhost config like
services.caddy = {
enable = true;
virtualHosts."example.org".extraConfig = ''
respond "Hello, world!"
'';
};
If the response is empty, try setting a port number like 80 and/or try a local TLS security certificate instead of global LetsEncrypt:
services.caddy = {
enable = true;
virtualHosts."example.org:80".extraConfig = ''
respond "Hello, world!"
tls internal
'';
};
With "tls internal" Caddy will generate a local certificate, which is good when testing locally and/or you don't have internet access (e.g. inside a nixos-container).