Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Caddy 2

caddyserver.com

Post reply on HN
Print view View original

201–210 of 247 posts

Re: Show HN: Caddy 2

#201

Post by tobya »

Silhouette wrote: post #184
mholt wrote: post #181

Earlier quoted context omitted.

Please do try to mount an attack on your server's admin endpoint; let me know if you're able to break into it. Keep in mind that if your system runs untrusted code, all bets are off: there's not really anything we can do as a single user space process to protect it. If your system runs untrusted code, you'll need to make sure your system is locked down properly... maybe you can use a permissioned unix socket for the…

Sorry, maybe I wasn't clear. I was trying to explain that during my initial browsing of the Caddy site, I found several references to using the API endpoints to configure Caddy, but nothing in the same places to say how to secure it or whether it was enabled by default. I wasn't talking about any sort of cunning attack, simply the issue of having such functionality accessible to anyone who could visit /config/ and kn…

My understanding is that the config is available via localhost only. It most instances it does not need to be disabled. I think the hope is that it will be left enabled in production, not disabled.

Re: Show HN: Caddy 2

#202

Post by max23_ »

Found out about Caddy 1 when I was trying to enable https using Let's Encrypt cert years ago, it was easy to setup and it just work.

Well done on Caddy 2 and thank you!

Re: Show HN: Caddy 2

#203

Post by petre »

mholt wrote: post #40
petre wrote: post #31

Earlier quoted context omitted.

Why did you do it? What have you sought to achieve with it? It's always a head scratcher for me why people building open source tools would put time and effort towards telemetry. Advertisments in HTTP headers? That's a new one. Advertise to whom, devs looking at a browser debug console?

It was for a class during my grad program. It was an academic interest in understanding client behavior on the Internet that wasn't limited to proprietary networks like Cloudflare or Google. We collected some good measurement data -- anonymous, technical, non-personal, etc -- but the terabytes added up and the academic community didn't seem particularly responsive to it in the end. The "opt-in" / "opt-out" depended o…

> Windows, Chrome, Ubuntu, Firefox, VS Code, macOS

Those are projects funded by 800-pound gorilla companies/foundations. It's either their way or the highway and people complain all the time, some have even forked the code and ripped out telemetry (Vscodium). Homebrew got a response comparable to Caddy but they screwed up even worse because they use Google Analytics.

Re: Show HN: Caddy 2

#204

Post by lmeyerov »

The pairing of Caddy & LetsEncrypt have been spectacular for shipping TLS software with way less pain.

We're currently on a funny (Caddy docker external reverse proxy -> Nginx docker internal reverse proxy -> docker app) config. Our user admins can do custom TLS via Caddy, and thereby end the years of Nginx TLS pain. Meanwhile, we get to keep doing most of the fun Nginx tricks internally to make sure our GPU graph visual analytics streaming tech does cool things. It's been a breath of fresh air.

We've been watching Caddy 2. Project history like phoning home for a school project (this might have gotten people sued and endangered others!) taught us to be especially careful w/ upgrades, but w/ Nginx going open core startup and now being part of F5, I've gone pretty down on Nginx and up on Caddy over the last few years. The more we want to do more w/ Nginx, the more we want to get off Nginx for the internal proxy, so looking forward to Caddy continuing to improve!

Re: Show HN: Caddy 2

#206

Post by 112 »

mholt wrote: post #14

Hi HN -- this is what I've been working on for the last 14 months, with the help of many contributors and the backing of several sponsors. (Thank You!) Caddy 2 is a fresh new server experience. Some things might take getting used to, like having every site served over HTTPS unless you specify http:// explicitly in your config. But in general, it will feel familiar to v1 in a lot of ways. If you've used v1 before, I r…

Thank you for Caddy, it has saved me a lot of time and it's a joy to work with. Running it on about 8 boxes.

Is there an admin UI for v2? Seeing the configuration changes, it was the first idea that popped, would be great for the selfhosted community - maybe someone picks it up as a side project if it's not in scope.

Re: Show HN: Caddy 2

#207

Post by Ndymium »

petre wrote: post #31
mholt wrote: post #15

Earlier quoted context omitted.

The headers was one of the worst days of my life, believe me. I heard your feedback loud and clear and they were removed shortly thereafter... now about 3 years ago: https://caddy.community/t/the-realities-of-being-a-foss-main... The telemetry server was shut down months ago and v2 has no telemetry client. Although, the counts we gathered were informative. We learned a lot about MITM activity on the Internet, the hea…

Why did you do it? What have you sought to achieve with it? It's always a head scratcher for me why people building open source tools would put time and effort towards telemetry. Advertisments in HTTP headers? That's a new one. Advertise to whom, devs looking at a browser debug console?

> It's always a head scratcher for me why people building open source tools would put time and effort towards telemetry.

It's not completely the same as telemetry, but as an administrator of a free open source web service, I have to say that web page analytics (1st party for us) are a huge motivator, when you see how many people from all around the world are using it.

Re: Show HN: Caddy 2

#208

Post by networked »

mholt wrote: post #14

Hi HN -- this is what I've been working on for the last 14 months, with the help of many contributors and the backing of several sponsors. (Thank You!) Caddy 2 is a fresh new server experience. Some things might take getting used to, like having every site served over HTTPS unless you specify http:// explicitly in your config. But in general, it will feel familiar to v1 in a lot of ways. If you've used v1 before, I r…

Thank you for your work on Caddy! After a false start during the beta (mainly because of the missing documentation) I upgraded my personal websites from v1 to v2 RC1, and since then I have been a fan of the new version. Caddy 2 makes somewhat complex configuration more consistent and easier to express in the Caddyfile. The only thing I miss from v1 is the default handling of when static files are not found.

I am very interested in the prospects of Starlark in Caddy 2. With an integrated scripting language Caddy could on its own be a replacement for OpenResty or Apache with mod_mruby. The preliminary implementation was removed in the beta phase with a note saying it would have to wait for when the project was financially stable [1]. Do you still plan to integrate Starlark if the project is a financial success?

[1] https://github.com/caddyserver/caddy/commit/8b28c36d480070c8...

Re: Show HN: Caddy 2

#209

Post by Sphax »

mholt wrote: post #14

Hi HN -- this is what I've been working on for the last 14 months, with the help of many contributors and the backing of several sponsors. (Thank You!) Caddy 2 is a fresh new server experience. Some things might take getting used to, like having every site served over HTTPS unless you specify http:// explicitly in your config. But in general, it will feel familiar to v1 in a lot of ways. If you've used v1 before, I r…

Thanks for your work on Caddy. I've been using it since 2016 and it's served me well over the years.

Re: Show HN: Caddy 2

#210

Post by stonogo »

francislavoie wrote: post #132
stonogo wrote: post #124

Earlier quoted context omitted.

>Yet nobody cares. People care about each and every one of those. It's disingenuous to pretend that Caddy was singled out.

Look at the amount of vitriol Caddy got when it originally announced telemetry: https://news.ycombinator.com/item?id=16958674 It's not a stretch to say that other projects didn't get as much hate for it. It really hurt the project's momentum when there was such a strong reaction against it.

It is absolutely a stretch. Mozilla is still catching hell for it. People have switched operating systems over this. Caddy is no different in that regard... except that its creator did the right thing and got rid of it. Mozilla and Microsoft haven't.
Post reply on HN