Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Caddy 2

caddyserver.com

Post reply on HN
Print view View original

231–240 of 247 posts

Re: Show HN: Caddy 2

#231

Post by purerandomness »

Tomte wrote: post #230
purerandomness wrote: post #229

Earlier quoted context omitted.

No no, you should totally use separate certificates (for our SaaS that's crucial, otherwise we would let our competitors know who our entire client base is, if all the domains would be included in one certificate) I don't know too much about certbot's nginx plugin, I don't use it and don't see the benefit to be honest, we ran into problems with it (it didn't work for us because our clients have to set up a CNAME DNS…

Thanks for the advice! I'll look at it all on the weekend.

Good luck! I'd also recommend splitting the config into multiple files, like it has been best practice for the last decades [1] (link goes to Arch (which I also recommend using) but the advice is not Arch specific)

[1] https://wiki.archlinux.org/index.php/Nginx#Managing_server_e...

Re: Show HN: Caddy 2

#232

Post by scobiehague »

francislavoie wrote: post #153
rcarmo wrote: post #137

Looks great. I have fond memories of Caddy 1.x, but I keep looking for a reverse proxy that can do social auth to protect selected endpoints (I was betting on Traefik having an easy to setup extension for that, but 2.x has been a challenge in other ways...). Anyone know if Caddy 2 has any such extension beyond the basic auth provider I see in the docs?

Yep! greenpau has been doing a ton of work on authentication modules recently. See here for a list of some of the plugins we have available so far for Caddy v2: https://caddy.community/t/list-of-caddy-2-modules/7839 A user has been working on an OAuth2 plugin recently: https://caddy.community/t/caddy2-redirect-from-within-caddya...

Is the JWT plugin usable yet? There are no instructions.

Re: Show HN: Caddy 2

#234

Post by BrandoElFollito »

I used caddy on and off for many years and finally went back for good.

For one, the community support is fantastic. Matt, Francis, you will not recognize me from my name here but you were first class helpers (and still are).

The fact that caddy has an API is a breakthrough. Automating config provisioning is a godsend

I belive that you child easily take over Traefik in the edge router space if configuration was a bit more modular (today is is Caddyfile, or API and no external sources of data such as the docker daemon (there was some discussion about that with the owner of Lucas Lorentz @lucaslorentz but it is I think dead-ish).

I moved yesterday all my prod from Traefik to caddy and it works just great.

Thanks a lot for caddy!

Re: Show HN: Caddy 2

#235

Post by francislavoie »

Silhouette wrote: post #216
tobya wrote: post #201

Earlier quoted context omitted.

My understanding is that the config is available via localhost only. It most instances it does not need to be disabled. I think the hope is that it will be left enabled in production, not disabled.

You mean because it's on a different port that typically wouldn't be opened in the firewall to allow remote access?

The default listen address is "localhost:2019", which means it'll only accept requests from apps running on the same machine. If you're running untrusted code on the same machine, then that might be problematic for you. You can also change the admin endpoint to be a unix socket instead of a TCP endpoint which allows you to use linux file permissions to protect it.

Re: Show HN: Caddy 2

#236

Post by atonse »

mholt wrote: post #161
atonse wrote: post #157

Earlier quoted context omitted.

But what is the value add for Caddy here? Like how the out of box and auto SSL defaults with HTTP. Apart from memory safety, can the SSH version of caddy impose better defaults that OpenSSH doesn’t right now? Maybe TLS certs, security key support, etc?

Absolutely. And Caddy adds its on-line config API and simpler configuration experience for an all-around more secure, easier-to-maintain, harder-to-get-wrong system.

Right, I suppose I'm asking what an elegant SSH config would look like, having almost only ever touched my sshd config less than 10 times in the 15+ years I've managed servers.

I know I'd ideally like easier SSO integration, for example. Or provisioning of users.

Re: Show HN: Caddy 2

#237

Post by francislavoie »

BrandoElFollito wrote: post #234

I used caddy on and off for many years and finally went back for good. For one, the community support is fantastic. Matt, Francis, you will not recognize me from my name here but you were first class helpers (and still are). The fact that caddy has an API is a breakthrough. Automating config provisioning is a godsend I belive that you child easily take over Traefik in the edge router space if configuration was a bit…

Thanks for the kind words! It's appreciated :)

Re: Show HN: Caddy 2

#238

Post by francislavoie »

scobiehague wrote: post #232
francislavoie wrote: post #153

Earlier quoted context omitted.

Yep! greenpau has been doing a ton of work on authentication modules recently. See here for a list of some of the plugins we have available so far for Caddy v2: https://caddy.community/t/list-of-caddy-2-modules/7839 A user has been working on an OAuth2 plugin recently: https://caddy.community/t/caddy2-redirect-from-within-caddya...

Is the JWT plugin usable yet? There are no instructions.

I just contacted the maintainer and he let me know it should be ready to use in the coming days. Check back in a few days! :)

Re: Show HN: Caddy 2

#239

Post by scobiehague »

francislavoie wrote: post #238
scobiehague wrote: post #232

Earlier quoted context omitted.

Is the JWT plugin usable yet? There are no instructions.

I just contacted the maintainer and he let me know it should be ready to use in the coming days. Check back in a few days! :)

Thanks for asking. It's the only thing keeping me from switching over really.

Re: Show HN: Caddy 2

#240

Post by mintplant »

mholt wrote: post #150
mintplant wrote: post #141

Earlier quoted context omitted.

Is there a list of those sponsors somewhere?

See the big "Thank you" note on the landing page; also GitHub sponsors: https://github.com/sponsors/mholt

Somehow I missed that "Thank you" section despite scrolling up and down the page a few times. Thanks!
Post reply on HN