Comment on After 1.5 years of learning selfhosting, this is where I'm at

jkrtn@lemmy.ml ⁨11⁩ ⁨months⁩ ago

• 7Sea_Sailor@lemmy.dbzer0.com ⁨11⁩ ⁨months⁩ ago

  In addition to the other commenter and their great points, here’s some more things I like:

  • ressource efficient: im running all my stuff on low end servers, and cant afford my reverse proxy to waste gigabytes of RAM (kooking at you, NPM)
  • very easy syntax: the Caddyfile uses a very simple, easy to remember syntax. And the documentation is very precise and quickly tells me what to do to achieve something. I tried traefik and couldn’t handle the long, complicated tag names required to set anything up.
  • plugin ecosystem: caddy is written in go, and very easy to extend. There’s tons of plugins for different functionalities, that are (mostly) well documented and easy to use. Building a custom caddy executable takes one command.

  source

  • jkrtn@lemmy.ml ⁨11⁩ ⁨months⁩ ago

    I think the two of you have convinced me to check it out! It is sounding pretty great, so thank you in advance.

    source
• xantoxis@lemmy.world ⁨11⁩ ⁨months⁩ ago

  I can answer this one, but mainly only in reference to the other popular solutions:

  • nginx. Solid, reliable, uncomplicated, but. Reverse proxy semantics have a weird dependency on manually setting up a dns resolver (why??) and you have to restart the instance if your upstream gets replaced.
  • traefik. I am literally a cloud software engineer, I’ve been doing Linux networking since 1994 and I’ve made 3 separate attempts to configure traefik to work according to its promises. It has never worked correctly. Traefik’s main selling point to me is its automatic docker proxying via labels, but this doesn’t even help you if you also have multiple VMs. Basically a non-starter due to poor docs and complexity.
  • caddy. Solid, reliable, uncomplicated. It will do acme cert provisioning out of the box for you if you want (I don’t use that feature because I have a wildcard cert, but it seems nice). Also doesn’t suffer from the problems I’ve listed above.

  source

  • oh_gosh_its_osh@lemmy.ml ⁨11⁩ ⁨months⁩ ago

    Fully agree to this summary. traefik also gave me a hard time initially, but once you have the quirks worked out, it works as promised.

    Caddy is absolutely on my list as an alternative, but the lack of docker label support is currently the main roadblocker for me.

    source

    • 7Sea_Sailor@lemmy.dbzer0.com ⁨11⁩ ⁨months⁩ ago

      May I present to you: Caddy but for docker and with labels so kind of like traefik but the labels are shorter 👏 github.com/lucaslorentz/caddy-docker-proxy

      source

      • oh_gosh_its_osh@lemmy.ml ⁨11⁩ ⁨months⁩ ago

        Nice catch and thanks for sharing. Will definitely check it out.

        source
    • 0xZogG@hachyderm.io ⁨11⁩ ⁨months⁩ ago

      @oh_gosh_its_osh @xantoxis for #k8s solution though I think traefik has advantage of providing configuration via CRDs, no?

      source
  • jkrtn@lemmy.ml ⁨11⁩ ⁨months⁩ ago

    I feel so relieved reading that about traefik. I briefly set that up as a k8s ingress controller for educational purposes. It’s unnecessarily confusing, brittle, and the documentation didn’t help. If it’s a pain for people in the industry that makes me feel better. My next attempt at trying out k8s I’ll give Kong a shot.

    I really like solid, reliable, and uncomplicated. The fun part is running the containers and VMs, not spending hours on a config to make them accessible.

    source

    • notfromhere@lemmy.ml ⁨11⁩ ⁨months⁩ ago

      I have traefik running on my kubernetes cluster as an ingress controller and it works well enough for me after finagling it a bit. Fully automated through ansible and templated manifests.

      source

      • xantoxis@lemmy.world ⁨11⁩ ⁨months⁩ ago

        Heh. I am, as I said, a cloud sw eng, which is why I would never touch any solution that mentioned ansible, outside of the work I am required to do professionally. Too many scars. It’s like owning a pet raccoon, you can maybe get it to do clever things if you give it enough treats, but it will eventually kill your dog.

        source

        • -> View More Comments
• krash@lemmy.ml ⁨11⁩ ⁨months⁩ ago

  I see everyone else have already chimed in on whats so great about Caddy (because it is!), one thing that has been a thorn in my side though is the lack of integration of fail2ban since Caddy has moved on from the old common log format and moved on to more modern log formats. So if you want to use a IPS/IDS, you’ll have to either find a creative hack to make it work with fail2ban or rely on more modern (and resource heavier) solutions such as crowdsec.

  source

  • xinayder@infosec.pub ⁨11⁩ ⁨months⁩ ago

    You can install the log transformer plugin for Caddy and have it produce a readable log format for fail2ban: github.com/caddyserver/transform-encoder

    I had this setup on my VPS before I moved to a k3s setup. I will take a look at how to migrate my fail2ban setup to the new server.

    source

    • krash@lemmy.ml ⁨11⁩ ⁨months⁩ ago

      Cool, thanks for this! As a user of Caddy through Docker, I suppose I need to find a way to build a docker image to be able to do this?

      Sometimes new simple technologies makes things simple - but only as long as one intends to follow how they are used… 🙃

      source

      • xinayder@infosec.pub ⁨11⁩ ⁨months⁩ ago

        I think so, but if you check the official image you can definitely find out how to include custom plugins in it. I think the documentation might mention a thing or two about it too.

        source