Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Caddy – Open-source web server with automatic HTTPS

caddyserver.com

Post reply on HN
Print view View original

121–130 of 132 posts

Re: Caddy – Open-source web server with automatic HTTPS

#121

Post by itsjloh »

I really like Caddy and use it on a few projects. Its a good piece of software that generally just works.

Their latest security incident leaves me feeling somewhat uneasy though. The only announcement for it was on twitter[1] and a footnote on one of the releases[2]. I don't believe there was ever a mention of the incident on the official forum so if you weren't following them on Twitter you'd never find out.

The general messaging around it was "a GitHub bug caused it" and its never really been followed up on publicly :\

[1]: https://twitter.com/caddyserver/status/1338324878441603073 [2]: https://github.com/caddyserver/caddy/releases/tag/v2.2.1

Re: Caddy – Open-source web server with automatic HTTPS

#122

Post by francislavoie »

itsjloh wrote: post #121

I really like Caddy and use it on a few projects. Its a good piece of software that generally just works. Their latest security incident leaves me feeling somewhat uneasy though. The only announcement for it was on twitter[1] and a footnote on one of the releases[2]. I don't believe there was ever a mention of the incident on the official forum so if you weren't following them on Twitter you'd never find out. The gen…

It wasn't a security incident, actually. It's true that "a GitHub bug caused it". It wasn't malicious.

TLDR, a contributor made a tag on their own fork of Caddy, and for some reason our next release used their tag, because it turns out forks in GitHub aren't actual separate repos, but rather "still technically the same repo". It's really strange. Wasn't that contributor's fault either, they had no idea that would happen.

All that happened is that the v2.2.2 git tag wasn't properly signed with Matt's signing key. There was no problem with the code at all.

We've put in place checks during our CI actions to ensure that releases are always verified to be signed by Matt's key. See https://github.com/caddyserver/caddy/pull/3932

Specifically, commit https://github.com/caddyserver/caddy/commit/1d473ae924f0d52c... (which you'll notice is _not_ part of the Caddy repo, it was actually from a fork which was later deleted) triggered this GitHub Actions job for the release https://github.com/caddyserver/caddy/actions/runs/392345801 which we cancelled when we noticed it was happening. But we can't remove the tag from Go's caching server https://pkg.go.dev/github.com/caddyserver/caddy/v2@v2.2.2 so it's kinda there forever.

More context: https://twitter.com/mholt6/status/1337879764317564928, https://twitter.com/danlsgiga/status/1338859470227529732, that whole twitter thread has many branches, so click around to get the whole conversation.

Re: Caddy – Open-source web server with automatic HTTPS

#123

Post by itsjloh »

francislavoie wrote: post #122
itsjloh wrote: post #121

I really like Caddy and use it on a few projects. Its a good piece of software that generally just works. Their latest security incident leaves me feeling somewhat uneasy though. The only announcement for it was on twitter[1] and a footnote on one of the releases[2]. I don't believe there was ever a mention of the incident on the official forum so if you weren't following them on Twitter you'd never find out. The gen…

It wasn't a security incident, actually. It's true that "a GitHub bug caused it". It wasn't malicious. TLDR, a contributor made a tag on their own fork of Caddy, and for some reason our next release used their tag, because it turns out forks in GitHub aren't actual separate repos, but rather "still technically the same repo". It's really strange. Wasn't that contributor's fault either, they had no idea that would hap…

It’s great you’ve got some protections in place to prevent it from happening again. That inspires some confidence.

Thanks for all the work yourself and Matt do on Caddy.

Re: Caddy – Open-source web server with automatic HTTPS

#124

Post by francislavoie »

itsjloh wrote: post #123
francislavoie wrote: post #122

Earlier quoted context omitted.

It wasn't a security incident, actually. It's true that "a GitHub bug caused it". It wasn't malicious. TLDR, a contributor made a tag on their own fork of Caddy, and for some reason our next release used their tag, because it turns out forks in GitHub aren't actual separate repos, but rather "still technically the same repo". It's really strange. Wasn't that contributor's fault either, they had no idea that would hap…

It’s great you’ve got some protections in place to prevent it from happening again. That inspires some confidence. Thanks for all the work yourself and Matt do on Caddy.

Thanks for the kind words :)

Shoutout to https://github.com/mohammed90 who's been a huge part of our CI/CD efforts on Caddy (among many other things), including that tag verification PR linked above.

Re: Caddy – Open-source web server with automatic HTTPS

#125

Post by ViViDboarder »

KronisLV wrote: post #96
Tomte wrote: post #9

I learned only recently that Apache can do automatic Letsencrypt certificate management, not with some third-party module, but with the bundled mod_md.

This is super interesting! Of course, it's still experimental: https://httpd.apache.org/docs/trunk/mod/module-dict.html#Sta... "Experimental" status indicates that the module is available as part of the Apache kit, but you are on your own if you try to use it. The module is being documented for completeness, and is not necessarily supported. Nonetheless, it would certainly be something to make Apache competitive with…

> and Nginx

Does nginx now have this too? I know Caddy and Traefik do.

Re: Caddy – Open-source web server with automatic HTTPS

#126

Post by mekster »

Bayart wrote: post #55
pachico wrote: post #39

Earlier quoted context omitted.

Can't think of any situations I was involved where the bottleneck was the http server app rather than the application behind it. Am I the only one?

As the other person that answered to you pointed out, there's a point where your HTTP server becomes the bottleneck, ie your backend being more concurrent and faster at producing content than your server is at delivering it. But I feel the real bottleneck is developer pain. I switched to nginx from Apache like everyone else because nginx was nice to use and Apache wasn't . The performance aspect was only a rationaliz…

What was not so nice about Apache?

Mentioning without context sounds like an emotional one.

Re: Caddy – Open-source web server with automatic HTTPS

#127

Post by doteka »

mholt wrote: post #115
doteka wrote: post #113

Caddy is the best. I use it as the static file server and reverse proxy for several side projects running in docker-compose. What I like most about it is how little config you need for reasonable defaults that would require 300 lines of nginx boilerplate. If I could wish for one thing though, I’d really like the functionality to get let’s encrypt certs while being proxied through cloudflare to be built in. Right now…

Thanks for your feedback. We try to avoid tight integration with specific, third-party providers as much as possible to keep Caddy light and flexible. Cloudflare is popular, but is also not a majority use case for Caddy users, in our experience. The Cloudflare plugin has only 16,000 downloads (and Route53 has 10,000)... out of over a million custom builds (not to mention 100M+ Docker pulls, or other ways of installin…

Thanks for the reply, mholt!

I would have expected way higher numbers there, but going by that ratio you’re absolutely right. Regardless, thanks for the great work on Caddy, it’s rock solid.

Re: Caddy – Open-source web server with automatic HTTPS

#128

Post by KronisLV »

ViViDboarder wrote: post #125
KronisLV wrote: post #96

Earlier quoted context omitted.

This is super interesting! Of course, it's still experimental: https://httpd.apache.org/docs/trunk/mod/module-dict.html#Sta... "Experimental" status indicates that the module is available as part of the Apache kit, but you are on your own if you try to use it. The module is being documented for completeness, and is not necessarily supported. Nonetheless, it would certainly be something to make Apache competitive with…

> and Nginx Does nginx now have this too? I know Caddy and Traefik do.

Only though Certbot, as far as i know: https://certbot.eff.org/

That said, Nginx still blows most other web servers out of the water: it has excellent performance and the configuration file format is easier to grok than that of Apache2/httpd and can let you get more done in less time. Perhaps this is why it's often chosen as the default solution for implementing an ingress, e.g. in Kubernetes.

And in my eyes that's a shame, since Apache2/httpd has served me faithfully for years and is a decent web server on its own, hence the addition of this new functionality has the potential to either make Nginx adopt it as well (which would be a net positive for everyone), or simply make more people consider Apache2/httpd for their deployments (which is good, because then its decline will be slower).

Re: Caddy – Open-source web server with automatic HTTPS

#129

Post by withinboredom »

yjftsjthsd-h wrote: post #65
qbasic_forever wrote: post #60

Earlier quoted context omitted.

This shouldn't be downvoted--it's very true, what performance are you trying to optimize? Throughput of long connections? Time from connection to first bytes? There are dozens of dimensions to web performance.

That's totally reasonable. Does Caddy actually win on any of those dimensions?

There are millions of configurations for Caddy (which modules you compile into the binary) so this is literally impossible to know unless your benchmark your particular configuration for your particular use case.

Re: Caddy – Open-source web server with automatic HTTPS

#130

Post by Bayart »

mekster wrote: post #126
Bayart wrote: post #55

Earlier quoted context omitted.

As the other person that answered to you pointed out, there's a point where your HTTP server becomes the bottleneck, ie your backend being more concurrent and faster at producing content than your server is at delivering it. But I feel the real bottleneck is developer pain. I switched to nginx from Apache like everyone else because nginx was nice to use and Apache wasn't . The performance aspect was only a rationaliz…

What was not so nice about Apache? Mentioning without context sounds like an emotional one.

I found Apache configuration to be cumbersome and hard to read, with nginx being comparatively clean and making reverse-proxying and caching easy. Keep in mind that was other a decade ago. I don't know where Apache is now, it's not something I have reassessed and I don't know if I would make the same choices with my current experience.
Post reply on HN