Jang go Tsenya Caddy Web Server ka HTTPS e e Itiragalang

Caddy ke web server e e amogelang le go ntšhwafatsa disetifikeiti tsa TLS ka default. Bakeng sa VPS e nnye e e tshwarelang domain e le nngwe kgotsa tse pedi, se se tlosa mofuta otlhe wa di-timer tsa Certbot le difaele tsa snippet tsa Nginx. Puo ya peakanyo (Caddyfile) e khutshwane. Reverse proxy, gzip, le HTTP/2 ke dikarolo tse di tlwaelegileng, e seng beke ya di-module tse dingwe.

Nginx e santse e le kgetho e e siameng ya mabenkele a mangwe: o setse o na le di-config tse di lekilweng mo ntwa, kgotsa o tlhoka module e e kgethegileng thata. Kaelo e ke ya kgetse e nngwe e e tlwaelegileng — o batla HTTPS e e bereng mo VPS e ntšha ya Hiddence ntle le go gopola di-snippet tsa include. Re tla tsenya Caddy go tswa mo apt repo ya semmuso, re tlhalose gore e bua jang le Let's Encrypt, re direle saete ya static, re proxy app ya selegae, re tshwarele di-domain tse dintsi, re lebe di-log, mme re tshwarele dintwa tsa tlwaelo tsa port 80 le Apache kgotsa Nginx e tona.

Fa Caddy e tshwanela sentle

HTTPS e e itiragalang ke setlhogo, mme poelo ya letsatsi le letsatsi ke dikarolo tse di tshikametseng tse di nnye. Caddy e reetsa mo 80 le 443, e fetisetsa HTTP kwa HTTPS, mme e boloka disetifikeiti mo directory ya yone ya data. O santse o tlhoka domain e e bontshang VPS. O santse o tshwanetse go se senye ACME (firewall 80/tcp, ga go na tsamaiso e nngwe e e utswang :80). Disetifikeiti tsa wildcard di tlhoka module ya mofani wa DNS — seo ke tsela e telele go feta setifikeiti sa host e le nngwe.

• HTTP→HTTPS e e itiragalang le ntšhwafatso ya setifikeiti
• Caddyfile e e ka balwang go na le di-server block tse telele
• Reverse proxy e e kgonang ya Node, Python, PHP-FPM ka peakanyo e nngwe, kgotsa di-backend tsa Docker
• HTTP/2 le di-default tsa TLS tsa sešwa ntle le spreadsheet ya di-cipher
• Yuniti ya systemd go tswa mo package ya semmuso

Ditlhokego

Domain e tshwanetse go rarabolola kwa VPS e pele ga Caddy e ka supa ACME HTTP-01. Fa DNS e santse e anama, Caddy e tla palelwa ke go ntsha mme e leke gape; seo se lebega jaaka 'Caddy e senyegile' fa ke DNS fela. Emisa Apache kgotsa Nginx pele fa di tshwere 80/443.

• Ubuntu 22.04 kgotsa 24.04
• A record ya domain kwa IP ya VPS (le AAAA fa o dirisa IPv6)
• Di-port 80 le 443 di gololesegile mme di letleletswe mo firewall
• Root kgotsa sudo

Kgato 1: Tsenya Caddy go tswa mo repository ya semmuso

O se ka wa tsenya Caddy e tona e e sa solofelwang go tswa mo Ubuntu universe ya default fa o batla TLS le ACME tsa jaanong. Porojeke ya Caddy e kwala motswedi wa apt. Morago ga go tsenya, modirisi wa caddy o a nna teng mme tirelo e a letlelelwa.

ssh root@YOUR_VPS_IP
apt update && apt -y install debian-keyring debian-archive-keyring apt-transport-https curl gpg

curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list

apt update
apt -y install caddy

caddy version
systemctl status caddy --no-pager

Kgato 2: Caddyfile ya ntlha — saete ya static

Caddyfile ya default ke /etc/caddy/Caddyfile. E emisetsa ka domain ya gago. Caddy e tla leka go nna le setifikeiti fa peakanyo e laela fa hostname e se localhost. Baya difaele tsa saete mo directory e e ka balwang ke modirisi wa caddy (gantsi ditumelo tsa mofuta wa www-data, mme package e dirisa modirisi wa caddy).

mkdir -p /var/www/example
echo '<h1>It works</h1>' > /var/www/example/index.html
chown -R caddy:caddy /var/www/example

cat >/etc/caddy/Caddyfile <<'EOF'
example.com {
    root * /var/www/example
    file_server
    encode gzip
}
EOF

caddy validate --config /etc/caddy/Caddyfile
systemctl reload caddy

# Watch issuance:
journalctl -u caddy -f

Kgato 3: Reverse proxy ya application ya selegae

Fa Gunicorn, Node, kgotsa Docker e reetsa mo 127.0.0.1:8000, Caddy e tshwanetse go nna tsamaiso e le nngwe e e bulegileng. Taelo ya reverse_proxy e fetisa di-header tsa Host le X-Forwarded-* ka tsela e e utlwalang ya di-app tse dintsi. Fa app e dira di-URL tsa HTTP tse di feletseng, baya di-flag tsa trusted proxy / HTTPS mo app (Django SECURE_PROXY_SSL_HEADER, Express trust proxy, le tse dingwe).

app.example.com {
    encode gzip
    reverse_proxy 127.0.0.1:8000
}

# Several hosts in one file are normal:
# blog.example.com {
#     root * /var/www/blog
#     file_server
# }

Kgato 4: Firewall le systemd

Letlelela 80 le 443. Yuniti ya Caddy ke caddy.service; reload e a lekana morago ga diphetogo tsa Caddyfile fa tsamaiso e phele sentle. Fa o fetola di-variable tsa tikologo tsa plugin ya DNS, go simolola gape ka botlalo go tlhamalala. Disetifikeiti di nna ka default kwa /var/lib/caddy/.local/share/caddy/ — tsenya tsela eo mo dipabalelong fa o kgathala ka meedi ya lebelo ka nako ya go tsenya gape.

ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

systemctl enable --now caddy
systemctl reload caddy

# Backup cert storage (path may vary slightly by version):
ls -la /var/lib/caddy/

Kgato 5: Di-log, compression le di-header

Di-log tsa pono di thusa fa bot e otla tsela kgotsa fa o rarabolola 404. O ka loga ka saete. Tsenya di-header tsa tshireletso fa o tshwarela app ya browser; o se ka wa kopisa sephuthelwana se se tona sa di-header ntle le go tlhaloganya HSTS (fa o baya max-age e telele, di-browser di a e gopola).

example.com {
    root * /var/www/example
    file_server
    encode gzip
    log {
        output file /var/log/caddy/example.log
    }
    header {
        X-Content-Type-Options nosniff
        Referrer-Policy no-referrer-when-downgrade
        -Server
    }
}

mkdir -p /var/log/caddy
chown caddy:caddy /var/log/caddy
systemctl reload caddy

Kgato 6: PHP le tse dingwe

Caddy e ka bua le PHP-FPM ka taelo ya php_fastcgi. Se se lekane bakeng sa di-host tse dintsi tsa WordPress kgotsa Laravel, mme o santse o tlhoka php-fpm e e tsentshitsweng le tsela ya socket e e tshwanang. Fa o setse o na le peakanyo e e phethegileng ya Nginx PHP, go fuduga mo maitseboeng a le mangwe ga go tlhokege — Caddy e phatsima thata mo reverse proxy + static + TLS e e itiragalang.

example.com {
    root * /var/www/example
    php_fastcgi unix//run/php/php8.3-fpm.sock
    file_server
}

# Confirm FPM is running:
systemctl status php8.3-fpm

Go fuduga go tswa mo Nginx ntle le dikgakgamalo tsa go kgaoga

Emisa Nginx pele ga o simolola Caddy kgotsa di tla lwantshana bakeng sa 80/443. Fokotsa DNS TTL letsatsi pele fa o sutisa le di-IP. Testa ka curl --resolve gore o kgone go otla VPS e ntšha pele ga o fetola A record. Nna le di-config tsa Nginx mo git beke e le nngwe fa o ka tlhoka go busetsa morago.

• systemctl stop nginx && systemctl disable nginx
• Tsenya Caddy, netefatsa Caddyfile, simolola Caddy
• curl -I --resolve example.com:443:NEW_IP https://example.com
• Ke gone o fetolang DNS fa IP e le ntšha
• Go ntsha gape go a itiragala; o se ka wa tsamaisa le Certbot kgatlhanong le hostname e e tshwanang

Go rarabolola mathata

Go palelwa ga ACME gantsi ke DNS, firewall, kgotsa tirelo e nngwe mo port 80. Mela ya log ya Caddy e bua ka tls.obtain. Fa saete e bereka mo HTTP mme e se mo HTTPS, go ntsha ga se a fela. Fa o bona disetifikeiti tse dintsi thata, o thuntse meedi ya lebelo ya Let's Encrypt — dirisa CA ya staging fa o testa, e seng ya production.

• validate e a palelwa: syntax ya Caddyfile, brace e e tlhaelang
• tumello e gannwe mo root: chown caddy ya directory ya saete
• bind: address already in use — ss -tulpn | grep -E ':80|:443'
• setifikeiti se felelwa ke nako: dig +short domain go tswa mo VPS, ufw allow 80
• 502 reverse_proxy: backend e kgaogile, kgotsa o proxied kwa localhost go tswa mo network ya container ka tsela e e fosagetseng

Dintlha tsa tshireletso

Di-default tsa TLS tsa Caddy di ikemiseditse. Tiro ya gago ke tshireletso ya application le SSH. O se ka wa tshuba Caddy admin API mo interface e e bulegileng. Ntlha ya default ya admin ke ya selegae; e tlogele jalo. Fa o dirisa Caddyfile go tswa mo internet, bala matcher nngwe le nngwe — snippet e e reverse_proxies /* kwa IP ya mo teng e ka nna proxy e e bulegileng.

• O se ka wa senola admin API
• Nna o ntšhwafaditse package
• HSTS fela morago ga gore o netefatse gore HTTPS e bereka bakeng sa di-hostname tsotlhe
• Kgaoganya di-hostname tsa teko le tsa production go sireletsa meedi ya lebelo ya ACME

Dikeletso

• caddy fmt --overwrite /etc/caddy/Caddyfile e nna e dira gore faele e nne e ka balwa
• Dirisa di-snippet tsa import fa o na le di-saete tse dintsi tse di tshwanang
• Bakeng sa Docker, image ya caddy:alpine e e nang le Caddyfile e e mountilweng e tlwaelegile
• Disetifikeiti tsa wildcard di tlhoka module ya DNS le token ya API — sireletsa token eo
• Bala journalctl -u caddy pele ga o kwala faele yotlhe sesha

Caddy mo VPS ke: package ya semmuso, Caddyfile e khutshwane, di-port 80/443 di bulegileng, DNS e setse e bontsha server, le systemd reload morago ga diphetogo. E dirise jaaka server ya difaele tsa static kgotsa jaaka reverse proxy kwa pele ga Gunicorn, Node, kgotsa Docker. HTTPS e e itiragalang e bereka fa ACME e ka araba mo port 80; fa go ntsha go palelwa, baakanya DNS le dikgotlhang tsa port pele ga o naya Caddy molato. Boloka /var/lib/caddy fa o tsenya gape gantsi.