To host a site with Caddy, point your domain’s DNS records at a Linux VPS, open TCP ports 80 and 443, install Caddy from your distribution’s official package, and place a site block in /etc/caddy/Caddyfile. Caddy can serve files directly or reverse-proxy an application on a private local port. With a public hostname, it obtains and renews an ACME certificate and redirects HTTP to HTTPS automatically.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you need before installing Caddy
Caddy is the web server and reverse proxy. The VPS supplies the public network address and compute resources; your domain supplies the hostname visitors will use. Have all of the following ready:
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
- A Linux VPS with a public IPv4 address, IPv6 address, or both.
- A registered domain name that you control.
- Administrative access to the VPS, normally through SSH, with permission to install packages and manage system services.
- Authority to edit the domain’s DNS zone.
- A site directory containing your static files, or an application already listening on a local address and port.
Caddy’s normal public certificate flow requires the hostname to resolve to the VPS and requires Internet access to ports 80 and 443. A domain that still points to an old server, a provider security group that drops traffic, or a host firewall that blocks either port will prevent certificate validation or keep visitors from reaching the site.
Plan the deployment in the right order
Do the network work before starting Caddy. This avoids troubleshooting a certificate request while DNS is still directed elsewhere.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- Record the VPS addresses. Copy the public IPv4 address from your VPS control panel. If you will publish IPv6, also copy the VPS’s public IPv6 address.
- Create DNS records. Add an
Arecord for the hostname pointing to the IPv4 address. Add anAAAArecord only when the VPS is correctly configured for IPv6 and the address is globally reachable. For the bare domain, use the zone’s normal apex-record format; for a subdomain such aswww, create a record for that name. - Wait for authoritative DNS. Query an authoritative DNS server for both the
AandAAAArecords. Do not rely only on a browser or a cached resolver. Every address returned must belong to the VPS that will run Caddy. - Open the network path. Permit inbound TCP 80 and TCP 443 in the VPS provider’s firewall or security group, then permit the same ports in the Linux firewall. If an upstream network firewall exists, open the ports there as well.
- Install Caddy and configure one site. Use the official package for your Linux distribution. Packaged installs integrate with systemd and are the recommended production route.
- Validate, start, and reload. Check the Caddyfile before applying it. After every edit, reload the service rather than stopping it unnecessarily.
Install Caddy as a system service
Choose the official Caddy package for the exact distribution and release running on the VPS. Distribution package commands differ, so use the package instructions that match your Linux family instead of copying a command for another release. The package should create a caddy systemd service and place its main configuration at /etc/caddy/Caddyfile.
Once installed, confirm the service is available and enabled:
sudo systemctl status caddy
sudo systemctl enable caddyEnabling the service makes it start during boot. The packaged service is preferable to running a foreground process in an SSH session: systemd can restart it, capture logs, and run it with the permissions expected by the package.
Running Caddy manually can require extra privileges because ports below 1024 are restricted on Linux. If you intentionally run the binary outside systemd, use suitable privileges or grant the binary the cap_net_bind_service capability. For a production website, use the packaged system service unless you have a specific reason not to.
Host static files directly
For a plain HTML, CSS, JavaScript, image, or download site, Caddy can read files from a directory and serve them itself. Create a directory and put the site content there, then make sure the service account can traverse the path and read the files.
sudo mkdir -p /var/www/example
sudo cp -r ./site-content/. /var/www/example/Edit /etc/caddy/Caddyfile so the hostname is followed by a root directive and file_server:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
example.com {
root * /var/www/example
file_server
}Replace example.com with the exact public hostname and replace the path with your chosen document root. The * matcher applies the root to all requests. file_server tells Caddy to map URL paths to files below that root and return the result.
A quick, temporary alternative is Caddy’s command-line file server:
caddy file-server --domain example.comThis is useful for a short-lived test, but a systemd-managed Caddyfile is easier to operate after reboots and configuration changes.
Reverse-proxy an application
Most web applications should not listen directly on the public Internet. Run the application on a local address and private port, then let Caddy handle the public hostname, TLS, and forwarding.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
First confirm that the application is actually listening on the address and port you intend to use. In this example the process listens on loopback port 9000, so it is reachable from the VPS but not exposed as a separate public service.
Use this Caddyfile block:
example.com {
reverse_proxy 127.0.0.1:9000
}When a request arrives for example.com, Caddy accepts it on the public HTTP or HTTPS listener and forwards it to 127.0.0.1:9000. Keep the application process manager separate from Caddy; Caddy proxies requests but does not start, stop, or deploy the backend application.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
For a quick deployment without editing a file, Caddy also provides:
caddy reverse-proxy --from example.com --to localhost:9000Use the command-line form for experiments or a temporary service. Put the configuration in the system Caddyfile for a persistent deployment.
Recommended Free Tools
Use more than one backend when needed
The reverse_proxy directive accepts multiple upstreams. That lets you add application instances as demand grows. Caddy supports load balancing, active health checks, passive health checks, request manipulation, and buffering. These features are useful when one process is no longer sufficient, but they add operational decisions: each instance must have compatible application state, health endpoints must represent real readiness, and logs must identify which upstream handled a request.
Validate and apply the configuration
Never reload an untested Caddyfile. A syntax error can leave the previous configuration running or make a reload fail, depending on the error.
- Validate the file.
sudo caddy validate --config /etc/caddy/CaddyfileA successful validation means Caddy can parse the file and load the referenced configuration.
- Reload without dropping established service.
sudo systemctl reload caddyReloading applies the new configuration while allowing the service to continue accepting traffic.
- Check service state.
sudo systemctl status caddyIf the reload failed, inspect the service log before changing additional lines.
- Test from outside the VPS. Visit the hostname over HTTPS from a network that is not the VPS itself. This confirms DNS, firewall rules, certificate issuance, and the web response together.
After changing a backend port, document root, hostname, or proxy options, repeat validation and reload. Keep a known-good copy of the last working Caddyfile so a bad edit can be reverted quickly.
How Caddy obtains HTTPS certificates
Caddy uses HTTPS by default when a host name is present in the configuration. For a public hostname, it requests a certificate from a public ACME certificate authority, completes the authority’s validation challenge, installs the certificate, and serves HTTPS. It also creates the HTTP-to-HTTPS redirect, keeps managed certificates renewed, and continues serving the site after renewal.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
The normal public flow depends on three conditions:
- The DNS
Aand/orAAAArecord resolves to this VPS. - TCP port 80 is reachable from the Internet for the HTTP validation path and redirect.
- TCP port 443 is reachable from the Internet for HTTPS traffic and any validation method that uses it.
You do not normally need to create certificate files or schedule a renewal job. Caddy’s certificate management is tied to the hostname in the site block. If the hostname is only available inside a private network, public certificate authorities cannot validate it through the standard public flow.
Localhost and private testing
A localhost name is different from a public domain. Caddy can serve local development sites with self-signed certificates, but browsers will warn because those certificates are not publicly trusted. A public hostname with working DNS and reachable ports uses a publicly trusted certificate instead. Do not treat a successful localhost test as proof that public issuance will work.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Static hosting versus reverse proxying
Choose the model that matches where your content is generated.
| Decision point | Static file server | Reverse proxy |
|---|---|---|
| What Caddy does | Reads files from a directory and returns them directly. | Forwards each request to an application upstream. |
| Configuration example | root * /var/www/example plus file_server. |
reverse_proxy 127.0.0.1:9000. |
| Backend process | None is required for the website content. | A separate application process must remain healthy and listening. |
| Public exposure | Only Caddy needs public ports 80 and 443. | The backend can stay on loopback or a private network; Caddy is the public entry point. |
| Scaling concerns | Usually document permissions, cache behavior, and storage. | Upstream availability, health checks, load balancing, buffering, and application state. |
| Operational complexity | Lower: deploy files and reload only when configuration changes. | Higher: operate both Caddy and the application, and diagnose failures between them. |
You can use both patterns on one VPS. Separate hostnames or path matchers can serve static assets directly while forwarding dynamic requests to an application, provided the routing rules are deliberately ordered and tested.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Firewall and permission checks
A successful Caddy configuration cannot overcome a blocked network path. Check each layer independently:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
- Provider firewall: allow inbound TCP 80 and 443 from the public Internet. Some VPS providers call this a security group, network ACL, or cloud firewall.
- Linux firewall: allow the same ports in UFW, nftables, firewalld, or the distribution’s configured firewall. Ensure the rule is applied to the interface carrying the public address.
- Local listener: verify that Caddy is bound to the expected ports after startup. A manually launched process may lack permission to bind them.
- File access: for static sites, the Caddy service account needs execute permission on every parent directory and read permission on the files.
- Backend reachability: for a proxy, the target address and port must match the process’s listening socket. A backend bound only to a different interface will produce an upstream connection error.
Troubleshooting by symptom
The certificate request fails
Check the authoritative DNS answer first. If the A or AAAA record still points to another host, the validation request reaches that host instead of Caddy. Then check both firewall layers for TCP 80 and 443. An IPv6 AAAA record is especially important: if it exists but the VPS cannot serve IPv6 correctly, some clients and validators will reach the broken address even when IPv4 works. Remove an incorrect AAAA record or fix IPv6 routing and firewall rules.
The browser cannot connect
Confirm the hostname resolves to the intended VPS from an external network, then test both HTTP and HTTPS. A provider firewall rule can override a correct Linux rule, and a Linux rule can block traffic even when the provider allows it. Confirm that the Caddy service is active and that no other process has taken ports 80 or 443.
Caddy returns an upstream connection error
Inspect the application’s listening address and port. The Caddyfile target must match exactly, including whether the process listens on 127.0.0.1, another local address, or a private network address. Verify that the backend process is running independently of Caddy. If the application has crashed or is bound only to an unexpected address, Caddy has nowhere to forward the request.
A manual launch cannot bind port 80 or 443
Low-numbered ports require appropriate privileges on Linux. Use the packaged systemd service, run the process with suitable privileges, or grant the binary cap_net_bind_service when you understand the security implications. Avoid solving the problem by exposing the application directly on an arbitrary public port; keep Caddy as the controlled public listener.
The site works on localhost but not publicly
Localhost tests do not exercise public DNS, provider firewalls, or ACME validation. A self-signed localhost certificate is also not equivalent to a publicly trusted certificate. Repeat the test with the real hostname from an external network after DNS and firewall changes have propagated.
Operating the site after launch
Keep the Caddyfile under version control or preserve dated backups. Record which hostname maps to which document root or backend port, and record who controls the DNS zone. Before each change, validate the complete file; after each successful reload, test the affected hostname over HTTPS.
For an application deployment, restart or update the backend through its own process manager, then check the proxy response. Caddy’s role is to provide the stable public edge: certificate management, HTTP-to-HTTPS redirection, request forwarding, and (when configured) balancing and health checks. The application’s process manager remains responsible for keeping workers alive.
If you add another hostname, create its DNS records and confirm them before adding the new site block. Each public hostname must be reachable on the VPS for its certificate flow. If you remove a hostname, remove or disable its Caddy configuration and clean up DNS when the old address should no longer receive traffic.
Quick Recap
Deployment checklist
- Domain ownership and VPS administrative access are confirmed.
- Authoritative
Aand optionalAAAArecords return the VPS addresses. - Provider and Linux firewalls allow TCP 80 and 443.
- Caddy was installed from the official package for the running distribution.
- The site block is in
/etc/caddy/Caddyfile. - Static content is readable, or the backend is listening on the configured target.
sudo caddy validate --config /etc/caddy/Caddyfilesucceeds.sudo systemctl reload caddyapplies the change.- The public hostname serves HTTPS and redirects HTTP.
- The Caddy service is enabled so it returns after a VPS reboot.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
