certmagic VS ingress

Now, I serve TLS directly from the application and was able to make it all work with Certmagic.

For deployment, you may not need a reverse proxy with Nginx or the likes. Certmagic will make HTTPS a breeze. Also makes it possible to handle multi-tenant SaaS domains SSL provisioning. While not the easiest, it was much easier than trying to do it at the reverse proxy and cheaper than doing it with Cloudflare's SaaS service.

If you don't want to move certificate management to a different service, use CertMagic in your app.

With certmagic its done completly automatic using letsencrypt: https://github.com/caddyserver/certmagic

The project is also a boon for devs. The certmagic library0 makes it trivial to add Let's Encrypt support to any Golang web server code.

Because Lego maintainers wouldn't budge when Caddy needed changes made to increase ACME reliability. Matt wrote his own implementation https://github.com/mholt/acmez and started using that in Caddy soon after. There's a deeper explanation here: https://github.com/caddyserver/certmagic/issues/71

That said, I would use https://github.com/caddyserver/certmagic to manage you SSL certs.

I terminate SSL in GO (less moving parts to manage), and use https://github.com/caddyserver/certmagic to provision and renew my certs.

Caddy

That is true, unfortunately. We, the core maintainers, don't use k8s ourselves, so we need to defer to the community for help. See https://github.com/caddyserver/ingress

Caddy at its simplest form is an HTTP server. So you could use it to front end your application that otherwise isn't well suited for taking direct HTTP requests. Caddy would bring you other features like TLS support.

However I think in K8s world Caddy would make the most sense as an Ingress Controller. There is even a project as such: https://github.com/caddyserver/ingress

All traffic would terminate first at Caddy. Handling TLS, HTTP1/2/3, etc. Then passing it back to your application service/pod.

Sorry actually I'm mixing up caddy with traefik. And ingress is an http lb + something that talks to k8s to dynamically update the configuration. Caddy has a WIP ingress project https://github.com/caddyserver/ingress

We have an ingress controller in the works by the community here: https://github.com/caddyserver/ingress