Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Caddy 2

caddyserver.com

Post reply on HN
Print view View original

181–190 of 247 posts

Re: Show HN: Caddy 2

#181

Post by mholt »

Silhouette wrote: post #174
mholt wrote: post #172

Earlier quoted context omitted.

Thanks -- honestly, the website was the least of my concerns up to this point, but it'll get more attention now that the software is actually released.

In that case, having a smart and informative site already is even more of an impressive achievement. :-) I don't personally think much needs to change dramatically. It's already useful and seems reasonably well organised. As someone who hadn't previously heard of Caddy other than incidentally and who is currently setting up some new projects for which Caddy is a very interesting find this evening, that production-rea…

Please do try to mount an attack on your server's admin endpoint; let me know if you're able to break into it.

Keep in mind that if your system runs untrusted code, all bets are off: there's not really anything we can do as a single user space process to protect it. If your system runs untrusted code, you'll need to make sure your system is locked down properly... maybe you can use a permissioned unix socket for the admin endpoint, or just disable it entirely... it's really up to you. I think our defaults are safe though. Let me know if they aren't.

Re: Show HN: Caddy 2

#182

Post by mholt »

Silhouette wrote: post #178
francislavoie wrote: post #135

Earlier quoted context omitted.

It's the second link in the top-left of the docs sidebar! I'm surprised you found that difficult to find.

That sidebar doesn't show on major landing pages, so it's not as silly a mistake as it might seem. I missed it for several minutes while looking around myself, as I started by following the prominent links on those landing pages. I only found the separate installation information page when someone else here helpfully linked to it.

Have you tried our site search? It's the same service that powers the HN search.

Re: Show HN: Caddy 2

#183

Post by interfixus »

mholt wrote: post #93
madmax108 wrote: post #91

I know that HN is usually the first to outrage when a project website is too verbose or does not explain the product, but I just want to take a moment to say WHAT A GREAT WEBSITE Caddy has! - The first screen tells me everything I need to know about what Caddy is and why it stands out - Scroll down on how to setup (hattip to whoever did the angled asciinema embed. Looks so cool) - Every page worth of scroll is exactl…

D'aww, thank you! I was really nervous to post this on HN because HN has also been the source of great misery for me in the past, frankly. But I'm relieved at the overall positivity today. Maybe because it's Star Wars Day we're all in a good mood? I'm glad you like the landing page. Took me a couple weeks of trying and throwing designs away, then a few days of concerted effort, just standing in front of my text edito…

Forget the misery. Caddy has been sheer wonder to work with since more or less the beginning. 2.0 in beta and RC has been looking swell for a long time. Well done and congratulations to you.

It's a one-way street, though. Once I'd set up my first Caddy site, there really wasn't any way I was ever going back to the legacy stacks.

Re: Show HN: Caddy 2

#184

Post by Silhouette »

mholt wrote: post #181
Silhouette wrote: post #174

Earlier quoted context omitted.

In that case, having a smart and informative site already is even more of an impressive achievement. :-) I don't personally think much needs to change dramatically. It's already useful and seems reasonably well organised. As someone who hadn't previously heard of Caddy other than incidentally and who is currently setting up some new projects for which Caddy is a very interesting find this evening, that production-rea…

Please do try to mount an attack on your server's admin endpoint; let me know if you're able to break into it. Keep in mind that if your system runs untrusted code, all bets are off: there's not really anything we can do as a single user space process to protect it. If your system runs untrusted code, you'll need to make sure your system is locked down properly... maybe you can use a permissioned unix socket for the…

Sorry, maybe I wasn't clear.

I was trying to explain that during my initial browsing of the Caddy site, I found several references to using the API endpoints to configure Caddy, but nothing in the same places to say how to secure it or whether it was enabled by default. I wasn't talking about any sort of cunning attack, simply the issue of having such functionality accessible to anyone who could visit /config/ and knew anything about HTTP.

I did later discover the relevant configuration in the JSON config structure documentation, including the flag to disable it that is what I really wanted to know about. It just seemed like the kind of important detail that would be worth linking from places that introduce the REST API, such as the section about it on your v2 landing page, if you're refining the site.

Re: Show HN: Caddy 2

#185

Post by Silhouette »

mholt wrote: post #182
Silhouette wrote: post #178

Earlier quoted context omitted.

That sidebar doesn't show on major landing pages, so it's not as silly a mistake as it might seem. I missed it for several minutes while looking around myself, as I started by following the prominent links on those landing pages. I only found the separate installation information page when someone else here helpfully linked to it.

Have you tried our site search? It's the same service that powers the HN search.

Honestly, I hadn't even noticed the search box. It appears in a slightly unusual place and styled sufficiently subtly that I totally overlooked it throughout my entire browsing session. (FWIW, this is on a very large and colour-calibrated monitor on my PC, so my experience here may not be typical.)

In case it's of interest, as a new visitor, I started browsing from your main v2 landing page, scanning down most of that information. Then I followed the prominent download and get started links near the top. I think I next went to the documentation area, and started browsing the links on the left, though I totally missed the "Install" link just under "Welcome" because my eye was drawn first to the Tutorials section and its getting started link, and then I went exploring from there on down.

I suppose that was an unfortunate combination of two things to miss. :-)

Re: Show HN: Caddy 2

#186

Post by rubyn00bie »

How fast is this bad boi? Or are there any benchmarks I can look at? I can tell the sell here, isn't "fastest EVAR" but how fast is it? Or where is fucking righteous, and where is it horrible? I'm guessing it's doing okay since it's

Regardless, looks super cool, and excited to give this a try. One last thing... great job on the website, seriously 11/10 for a developer/command-line tool. Clearly says it does, shows some neat shit it does, and even looks pretty darn good doing it :)

Re: Show HN: Caddy 2

#187

Post by guggle »

mholt wrote: post #121
jbverschoor wrote: post #112

Earlier quoted context omitted.

Adoption for me would be to have an official apt repo :)

I mean, we want one too, but it's ridiculously hard: https://news.ycombinator.com/item?id=23072385 Help? :D

Talk about a bummer... Golang makes it easy to make static binaries. Way too easy for the distro apparently.

Deb files will be just fine.

Re: Show HN: Caddy 2

#188

Post by rubyn00bie »

lenkite wrote: post #169

For all the criticism of golang, the fact that it can be used to craft superb software like this is a testament to its real-world efficacy.

Sooo... you bring up something I could use some "learn me somes" on... golang. Recently, in my personal life when choosing a "next language" to learn I chose Rust over Go because it seemed to offer everything Go does, and then some (like them systems level programmings). However, at my current employer, Go has a solid following and I'm unlikely to sell Rust (or even want to[1]): could you please speak to that real-world efficacy or what things you think it does superbly well to enable software like this?

I tried briefly to find some guides on go over the weekend, but an awful amount of them are targeted to using "X web framework," which seems utterly worthless (or boring) to me. I guess, to your point, I could go read through the Caddy source code and see what I find since this seems like a nice and useful application using Go.

[1]: There's almost no reason to sell a team on any new technology if there isn't a substantial gain from it. For the org I am at, I don't believe, Rust offers much over Go for most of the use cases. Sure, it certainly can be _faster_ but who fucking cares? Most of what we do isn't bound by machine time, it's bound by developer time. Thus, I seek to learn me some golang and what virtues it offers.

Post reply on HN