Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Caddy 0.10 Released

caddyserver.com

Post reply on HN
Print view View original

91–100 of 128 posts

Re: Caddy 0.10 Released

#91

Post by zzzcpan »

mholt wrote: post #85
zzzcpan wrote: post #72

Earlier quoted context omitted.

No, not having timeouts is rather bad practice. There are a lot of clients out there that never close connections for various reasons. And since TCP doesn't use healthchecks and most systems by default have limits on the number of descriptors per process, your web server in default configuration will simply leak descriptors and memory over time until the whole thing stops working. The only sane choice here is to have…

Believe me, we wanted to do this, but it broke a lot of WebSocket connections and other legitimate, long-lived connections. It confused many users. It's hard to know what is legitimate and what is not. I wish we could configure timeouts on a per-request basis but not without some serious hacking around the net/http lib for now. I do encourage setting timeouts when you are able to. It's easy, for example: timeouts 30s…

If I remember correctly, websockets have ping/pong support on both ends for that. So to handle them properly you have to detect connection upgrades and then start issuing ping requests to clients periodically, closing their connections if they fail to respond in time, but still using timeouts everywhere.

Re: Caddy 0.10 Released

#92

Post by andmarios »

camus2 wrote: post #86
mholt wrote: post #82

Earlier quoted context omitted.

I asked this question yesterday. People ask if it's "production ready" but that's like asking if something is "secure" -- I don't really know what that means. Many people use Caddy in production; it's also great for local development. People use it for "real" projects. (I do.) If it is a good match for your needs, give it a try! Start small if you're nervous, but you'll probably like it.

> but that's like asking if something is "secure" no, that's asking if an enterprise grade project is fronted with Caddy. > People use it for "real" projects. (I do.) Sure, but you're not Facebook, Google or Oracle, or big brand X or Z. If you can get Coca Cola, or Nike website run on Caddy, it will change that perception.

Caddy uses go's standard libraries for most of its web serving parts, so you know at least that the http server code is used by google, cloudflare etc. Same goes for SSL and many other parts.

However most companies out there aren't Facebook, Google, Oracle, Coca Cola or Nike anyway.

Re: Caddy 0.10 Released

#93

Post by tlrobinson »

Random question: is there a way to start Caddy as root so it can bind to port 80 (for example) then change the user so a non-root user can send a `USR1` signal to Caddy to get it to reload the configuration?

Re: Caddy 0.10 Released

#95

Post by indeyets »

blowski wrote: post #7
shawabawa3 wrote: post #5

Earlier quoted context omitted.

Why would I use nginx and go through the hassle of configuring let's encrypt and sane SSL settings when I could just use caddy? But seriously, for all "hobby" projects I've started recently, and even some production services now, I go straight to caddy. My config consists of a 1 line global config file: import sites-enabled/* And 90% of the individual services have this config: example.com { proxy / http://localhost:…

What's the performance like? Can you use it as a proxy server?

Proxy-server performance is fine.

File-serving performance — not so good.

Re: Caddy 0.10 Released

#96

Post by andmarios »

knrz wrote: post #3
blowski wrote: post #2

When would I use Caddy, rather than using nginx and configuring Let's Encrypt for myself? Honest question.

I feel like the niche Caddy's trying to fill is for people who don't want to bother with that, or don't want to learn. If you already know how to set up nginx and LE (like you and I do), its only appeal is relatively minor: potentially saving a quarter or half hour.

It all depends on how complex your setup is. Caddy isn't just easy to setup, it is easy to setup every part of it until you reach the end of its functionality.

I can set up both nginx and apache (and get paid for it), I've automated LE for new sites via ansible, etc. Nowadays if I can do with caddy, I just use that and proceed to the next task. Also remember that easy (and short) configuration means easier maintenance.

Devs also love it, they can develop locally using advanced functionality (e.g proxying an API that doesn't provide CORS).

Re: Caddy 0.10 Released

#97

Post by lol768 »

vosper wrote: post #30
lol768 wrote: post #8

The MitM detection is interesting. How long until these appliances start altering the HTTP request's User-Agent header to avoid detection (or adding logic such that the handshaking process mimics that of the browser), though? To me, HPKP with preloading seems like a more reliable approach (and browsers shouldn't allow this to be overridden [1]). [1] If this breaks corporate MitM attacks, great. This practice always s…

I'd also be concerned if an employer was doing it, unless there was a good reason - and I can think of a few of those. For example, companies that deal with sensitive health, financial or legal information. They may need assurances (or at least a paper trail) that's a lot stronger than "we don't MITM and we trust our employees to do the right thing".

> For example, companies that deal with sensitive health [..] information

I can understand this motivation but I'm not sure in practice the SSL interception really gives you more than the traffic metadata I already described. I think this is interesting though, so I've sent an FoI request to NHS England out of curiosity to see if they're doing anything like this.

Re: Caddy 0.10 Released

#98

Post by zufallsheld »

tlrobinson wrote: post #93

Random question: is there a way to start Caddy as root so it can bind to port 80 (for example) then change the user so a non-root user can send a `USR1` signal to Caddy to get it to reload the configuration?

At least with systemd caddy starts as a non-root user, if you use the provided unit-file: https://github.com/mholt/caddy/tree/master/dist/init/linux-s...

Re: Caddy 0.10 Released

#99

Post by drdaeman »

andmarios wrote: post #92
camus2 wrote: post #86

Earlier quoted context omitted.

> but that's like asking if something is "secure" no, that's asking if an enterprise grade project is fronted with Caddy. > People use it for "real" projects. (I do.) Sure, but you're not Facebook, Google or Oracle, or big brand X or Z. If you can get Coca Cola, or Nike website run on Caddy, it will change that perception.

Caddy uses go's standard libraries for most of its web serving parts, so you know at least that the http server code is used by google, cloudflare etc. Same goes for SSL and many other parts. However most companies out there aren't Facebook, Google, Oracle, Coca Cola or Nike anyway.

Using Go standard HTTP libraries doesn't guarantee things are stable.

Here's an example how a missing option (that is Go 1.8+ - which is a recent release) can lead to a DoS: https://github.com/containous/traefik/issues/1322

Re: Caddy 0.10 Released

#100

Post by andmarios »

drdaeman wrote: post #99
andmarios wrote: post #92

Earlier quoted context omitted.

Caddy uses go's standard libraries for most of its web serving parts, so you know at least that the http server code is used by google, cloudflare etc. Same goes for SSL and many other parts. However most companies out there aren't Facebook, Google, Oracle, Coca Cola or Nike anyway.

Using Go standard HTTP libraries doesn't guarantee things are stable. Here's an example how a missing option (that is Go 1.8+ - which is a recent release) can lead to a DoS: https://github.com/containous/traefik/issues/1322

Yeah, as it happens in software in general there aren't any guarantees. I could too give you a link to heartbleed. Caddy wasn't affected.
Post reply on HN