Instead of Nginx: Caddy

Why Caddy is better

• Caddy has served every site over HTTPS by default since 2015, obtaining and renewing certificates and redirecting HTTP with no extra tooling.
• A reverse proxy with TLS is a three-line Caddyfile, and config can also be changed live through a REST API with zero-downtime reloads.
• Caddy is written in Go, so it avoids the buffer-overflow class of bugs that C servers like Nginx are exposed to.
• Caddy needs no external libraries, not even libc, which makes containers and upgrades simple.

When to keep Nginx

Keep Nginx for very high traffic edges where its C performance and low memory use matter, for its mail and TCP/UDP proxy features, or where your team and tooling already know it well. Nginx now has its own ACME module since 1.29.0, so automatic certificates alone are no longer a reason to switch.

Switching

Rewrite each server block as a Caddyfile site block; reverse_proxy, file_server and redirects map directly. Caddy has an Nginx config adapter that helps with the first pass. Point DNS at the server and let Caddy get certificates on first request. Remove certbot cron jobs afterwards.

Watch out

Plugins must be compiled into the Caddy binary, so adding one means a custom build. Some advanced Nginx features, such as njs scripting or fine-grained caching rules, have no direct Caddy equivalent.

Also worth a look

• Traefik A reverse proxy that configures itself from Docker and Kubernetes labels; pick it when routes change with your containers.