traefik VS Caddy

Traefik is another widely used system that has automatic configuration and offers support for more things like swarm/kubernetes/etc.

I have a webapp which I currently have deployed by running nginx in a container. Works as it should, however I am intersted in adding more observability to the webapp and found this reverse-proxy https://github.com/traefik/traefik which seems to expose some nice metrics which can be useful for observability.

For frontend applications - it can be quite simple to implement preview environments with a simple static storage and a reverse proxy tool like Nginx or Traefik.

there's no magical number: a container can be as simple as a single binary or complicated multi-process solution that rivals a full blown operating system running in a VM. it really depends on what you're running...

Kubernetes alone is enough of an example. So are various cloud utilities used all around the world, such as ingress-nginx, cert-manager, traefik, Docker and countless others. Go is what smart modern web developers actually want to use to create great products. Everything else is what industry dinosaurs force them to use to make a living at big companies peddling trash.

I ended up using the NGINX Proxy Manager [the projects home site] and added certificates but I'm seeing a fair number of installs going with https://traefik.io on YouTube.

Glad it was helpful! I had never heard of it before either, but it looks like it's been around since 2015. I've leaned on Traefik a lot in the past, but Fabio seemed to be a lot simpler. Simplicity was the rule of thumb for this exercise, So I didn't dig too hard for performance comparisons...

If this is a feature request for headersregexp, then you should place it in Traefik GitHub.

Caddy is a web server like nginx. The biggest advandage of Caddy over nginx is, that it handles HTTPS automatically. You can find the script to install Caddy in their documentation.

This approach offers a level of customizability similar to what xcaddy does for the Caddy server, eliminating the complexities associated with writing Rhai scripts to customize a precompiled binary, as is the case with the Apollo Router.

Go is patching it soon: https://github.com/caddyserver/caddy/issues/5877#issuecommen...

(Caddy just uses Go's HTTP/2 implementation.)

Unfortunately, the CVE database(s) are too noisy to be useful. It could benefit from higher standards and more thorough vetting. (Maybe take some lessons from academia.)

A "security researcher" once filed a CVE for a regular bug in Caddy [0], making claims that were totally provably false. It was assigned 7.5... the same as Heartbleed [1] -- yes, the one that leaked almost all the private encryption keys on the Internet back in 2014.

More recently I inadvertently discovered a 0-day RCE in acme.sh [2]. (ACME clients are security-sensitive contexts since they typically deal with private keys and download signed credentials.) Anyway, it was assigned a CVSS 3.x score of * 9.8 * [3] -- I imagine that should be like "cyber-nuclear meltdown" territory, but no, this was actually benign as far as we can tell. Probably deserves more like a 5 or 6 or something.

Anyway, the whole system is broken, and I'm effectively ignoring CVEs now. But if someone tells me to patch my , I'll probably just do that.

[0]: https://github.com/caddyserver/caddy/issues/4775

[1]: https://nvd.nist.gov/vuln/detail/cve-2014-0160

[2]: https://matt.life/writing/the-acme-protocol-in-practice-and-...

[3]: https://nvd.nist.gov/vuln/detail/CVE-2023-38198

https://caddyserver.com/ is implemented in Go, production-ready, and easy to setup with a one-liner (though personally I would use official binaries or compile from source rather than use the builds from a distro package manager)

It’s had an Apache-2.0 license for at least the last 4 years: https://github.com/caddyserver/caddy/blob/master/LICENSE

Same for Caddy which is even easier than nginx https://caddyserver.com/

Header that is impossible to turn off since it's hardcoded here: https://github.com/caddyserver/caddy/blob/master/modules/cad...

The developer's annoying response is "it doesnt improve privacy or security, so we won't give you the option to remove it".

Nope that's https://caddyserver.com/, which also improves on nginx in a number of other ways.

Honestly when I saw this post on the top of HN I thought I'd time-warped back to 2013. There is a better choice today. It's called Caddy.