Caddy Configuration Rules

Automatic HTTPS

• Caddy provisions SSL certificates automatically — don't manually configure Let's Encrypt unless you have specific needs
• Domain must resolve to the server publicly for HTTP challenge — use DNS challenge for internal/wildcard certs
• Ports 80 and 443 must be free — Caddy needs both even for HTTPS-only (80 handles ACME challenges and redirects)
• Let's Encrypt has rate limits — use staging CA during testing to avoid hitting production limits

Caddyfile Syntax

• Indentation is significant — blocks are defined by indentation, not braces in shorthand
• Site blocks need a space before the opening brace: example.com { not example.com{
• Use caddy fmt --overwrite to fix formatting — catches most syntax issues
• Validate before applying: caddy validate --config /etc/caddy/Caddyfile

Reverse Proxy

• Caddy adds X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host automatically — don't add them manually
• WebSocket works out of the box — no special configuration needed
• Load balancing is automatic with multiple backends — default is random, use lb_policy to change
• Passive health checks remove failed backends automatically