Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Caddy 0.10 Released

caddyserver.com

Post reply on HN
Print view View original

71–80 of 128 posts

Re: Caddy 0.10 Released

#71

Post by pbreit »

sergiotapia wrote: post #36

Caddy is a web server written entirely in Go. Features: - Easy configuration with Caddyfile - Automatic HTTPS via Let's Encrypt; Caddy obtains and manages all cryptographic assets for you - HTTP/2 enabled by default (powered by Go standard library) - Virtual hosting for hundreds of sites per server instance, including TLS SNI - Experimental QUIC support for those that like speed TLS session ticket key rotation for mo…

So is it ready for "prime time"? Should I be considering it over Nginx for side projects or real projects?

Re: Caddy 0.10 Released

#72

Post by zzzcpan »

mholt wrote: post #58
haarts wrote: post #34

They mention that 'Default Timeouts' have been disabled. Urging users to 'Act according to your threat model!'. I'm not sure I understand. How is not having these timeouts a security thread? Someone could potentially open up enough HTTP connections to starve others from having the opportunity to do so?

This is true; but slowloris attacks don't require opening as many connections. We've seen one or two instances where buggy (or malicious?) clients were slowlorising Caddy instances; but we were too eager to enable timeouts by default I think.

No, not having timeouts is rather bad practice. There are a lot of clients out there that never close connections for various reasons. And since TCP doesn't use healthchecks and most systems by default have limits on the number of descriptors per process, your web server in default configuration will simply leak descriptors and memory over time until the whole thing stops working. The only sane choice here is to have timeouts enabled everywhere and explicitly allow them to be disabled, not the other way around.

Re: Caddy 0.10 Released

#73

Post by [deleted] »

tyingq wrote: post #67
nzjrs wrote: post #45

Anyone with experience using this as a dynamic reverse proxy - I need to proxy certain requests to private container (ports) where the port isn't known until the container is booted, and containers come up and down as users require them.

Depending on what that private container is serving up, an API gateway might work better. Tyk is one that's written in golang. It has a rest API and hot reload, so it should be able to handle your use case of dynamically allocated ports. http://tyk.io

[deleted]

Re: Caddy 0.10 Released

#74

Post by LeonidBugaev »

nzjrs wrote: post #45

Anyone with experience using this as a dynamic reverse proxy - I need to proxy certain requests to private container (ports) where the port isn't known until the container is booted, and containers come up and down as users require them.

You can use service discovery tools like Consul or Etcd. Basic idea that on container/app boot, you register your app to service discovery service (you give it IP and current port), and it stores information about your all running apps.

After you can use consul Nginx integration (it will dynamically generate Nginx config on all updates, and will restart it).

Tyk mentioned here also have Consul service integration and much more.

Re: Caddy 0.10 Released

#75

Post by shawabawa3 »

coldtea wrote: post #22
shawabawa3 wrote: post #11

Earlier quoted context omitted.

I use it exclusively as a proxy server. I've never noticed any performance issues, I think I saw a benchmark where it said caddy can handle 2000req/s, which is at least an order of magnitude or 2 faster than any upstream service I've used it in front of.

> I think I saw a benchmark where it said caddy can handle 2000req/s Those are application level numbers (e.g. with logic and all). Caddy should be able to handle an order of magnitude more req/s than that easily.

yeah, I clearly misremembered the benchmark

It was slightly slower than nginx, but not enough to impact typical applications

Re: Caddy 0.10 Released

#76

Post by xrstf »

snowpalmer wrote: post #54

Any benefit in using this inside a docker container instead of nginx? No need for SSL or many of the other features I'm seeing listed here since it's all behind an Amazon ELB.

We are using Caddy as a simple reverse proxy in Docker environments. The configuration is a bit simpler than nginx and we love the tiny Docker images we can create (not sure how large an nginx-full installation is).

That being said, we did run into a few issues that forced us to go back to older Caddy versions, like broken websocket support or the timeout issue in 0.9.5. Also, sometimes the documentation is a bit lacking and unclear. DNS resolution seems to be flaky sometimes (we're using alpine-based containers and sometimes Caddy just won't resolve names of other containers, even though a curl inside the container can resolve the names just fine).

So if you've got a working nginx setup, I'd say stick with it. For new projects it is worth to check out Caddy. The issues we ran into occured early in our development process, they didn't just suddenly happen in production, so once you've tested everything, Caddy just works.

Re: Caddy 0.10 Released

#77

Post by zzzcpan »

nzjrs wrote: post #45

Anyone with experience using this as a dynamic reverse proxy - I need to proxy certain requests to private container (ports) where the port isn't known until the container is booted, and containers come up and down as users require them.

Nginx can proxy to a server specified in a variable. All you have to do is define that variable though perl or lua to get port dynamically from somewhere, like a file.

Re: Caddy 0.10 Released

#78

Post by joshuata »

pbreit wrote: post #71
sergiotapia wrote: post #36

Caddy is a web server written entirely in Go. Features: - Easy configuration with Caddyfile - Automatic HTTPS via Let's Encrypt; Caddy obtains and manages all cryptographic assets for you - HTTP/2 enabled by default (powered by Go standard library) - Virtual hosting for hundreds of sites per server instance, including TLS SNI - Experimental QUIC support for those that like speed TLS session ticket key rotation for mo…

So is it ready for "prime time"? Should I be considering it over Nginx for side projects or real projects?

Absolutely use it for side projects! I have used it for a lot of small throw-away sites and loved every minute.

It's up to you whether you trust it for large products, but so far it has been fairly magical for me.

Re: Caddy 0.10 Released

#80

Post by zenlikethat »

doublerebel wrote: post #55
bpierre wrote: post #41

How does it compare with https://traefik.io/ (reverse proxy, written in Go, automatic HTTPS / letsencrypt) ?

Yep, I use the similar eBay/fabio which pulls my LE certs from hashicorp/vault, much better than leaving them in a filesystem. Can't imagine using a proxy/ingress/LB without automatic reactive routing these days. All I have to tell Fabio is what interface to listen to.

Why do you say it's better to pull them from Vault? Unless MTLS is set up talking to Vault, you are pulling secrets unencrypted (and maybe unauthenticated) over the network... a local file system is not bad for small scale deployments if setup with the proper permissions.
Post reply on HN