How To Host a Website with Caddy on Ubuntu 22.04

Caddy is a web server designed around simplicity and security that comes with a number of features that are useful for hosting websites. For example, it can automatically obtain and manage TLS certificates from Let’s Encrypt to enable HTTPS, and includes support for HTTP/2. HTTPS is a system for securing traffic between your users and your server, and is quickly becoming a basic expectation of any website running in production — without it, Chrome and Firefox will warn that your website is “Not Secure” if users try to submit login information.

Building and Hosting with Caddy

In this tutorial, you’ll build Caddy from source using xcaddy, a custom Caddy builder tool, and use it to host a website secured with HTTPS. This entails compiling it, configuring it using a Caddyfile and installing a plugin. In the end, your domain will serve static pages, while being secured with free TLS certificates from Let’s Encrypt.

Prerequisites

• An Ubuntu 22.04 server with root privileges, with at least 2 GB RAM and a secondary, non-root account.
• The Go language toolchain installed on your server.
• A fully registered domain name.
• An A DNS record with your_domain pointing to your server’s public IP address and a CNAME DNS record with www.your_domain pointing to @.
• A personal access token (API key) with read and write permissions for your DigitalOcean account.

Step 1: Building Caddy

In this step, you’ll build Caddy from source with the ability to later add plugins, all without changing Caddy’s source code. You’ll use xcaddy to download and build Caddy and its plugins according to your needs.

Visit the xcaddy releases page and copy the link of the latest release for the linux_amd64 platform. Before downloading it, navigate to /tmp by running the following command:

cd /tmp

Then, download the latest release using wget:

wget https://github.com/caddyserver/xcaddy/releases/download/v0.3.1/xcaddy_0.3.1_linux_amd64.tar.gz

Once downloaded, extract only the binary:

tar xvf xcaddy_0.3.1_linux_amd64.tar.gz xcaddy

Finally, move the xcaddy executable to /usr/bin, making it accessible system wide:

sudo mv xcaddy /usr/bin

Now that xcaddy is installed, you’ll build Caddy. For that purpose, create a separate directory for storing it:

mkdir ~/caddy

Navigate to it by running the following command:

cd ~/caddy

To build the latest version of Caddy without any third-party plugins, run the following command:

xcaddy build

This command will take some time to finish, but it will print an output similar to this:

Output:

2022/08/10 15:55:18 [INFO] Temporary folder: /tmp/buildenv_2022-08-10-1555.834895411

Once finished, you’ll have the caddy executable available in the current folder. Move it to /usr/bin to install it:

sudo mv caddy /usr/bin

You can try running caddy to check that it’s installed correctly:

caddy version

The output will contain the version of Caddy you’ve just compiled:

Output: v2.6.1 h1:EDqo59TyYWhXQnfde93Mmv4FJfYe00dO60zMiEt+pzo=

Step 2: Installing Caddy

Now that you’ve verified you’re able to build and run Caddy, you can configure a systemd service so that Caddy will be launched automatically on system startup. To understand more about systemd, visit our Systemd Essentials tutorial.

Caddy requires its own user and group in order to run as a systemd service. Create the group with the following command:

sudo groupadd --system caddy

Then, create a new user called caddy that belongs to the caddy group:

sudo useradd --system \
    --gid caddy \
    --create-home \
    --home-dir /var/lib/caddy \
    --shell /usr/sbin/nologin \
    --comment "Caddy web server" \
    caddy

The new caddy user will have its own home directory created. Because its shell is set to nologin, it won’t be possible to log in as caddy.

Change ownership of the Caddy binary to the root user:

sudo chown root:root /usr/bin/caddy

This change will prevent other accounts from modifying the executable. However, while the root user will own Caddy, you are advised to execute it using other, non-root accounts present on the system, as will be the case with the systemd service. Running commands from a non-root account ensures that the attacker won’t be able to modify the binary or execute commands as root in the event that Caddy (or another program) is compromised.

Next, set the binary file’s permissions to 755, which will give root full read/write/execute permissions for the file, while other users will only be able to read and execute it:

sudo chmod 755 /usr/bin/caddy

You have now finished setting up the Caddy binary and are ready to start Caddy configuration.

Create a directory where you’ll store Caddy’s configuration files:

sudo mkdir /etc/caddy

Then set the user and group permissions for it:

sudo chown -R root:caddy /etc/caddy

Setting the user as root and the group as caddy ensures that Caddy will have read and write access to the folder (via the caddy group) and that only the superuser account will have the same rights to read and modify.

In a later step, you’ll enable automatic TLS certificate provisioning from Let’s Encrypt. In preparation for that, make a directory to store any TLS certificates that Caddy will obtain and give it the same ownership rules as the /etc/caddy directory:

sudo mkdir /etc/ssl/caddy
sudo chown -R root:caddy /etc/ssl/caddy

Caddy must be able to write certificates to this directory and read from it in order to encrypt requests. For this reason, modify the permissions for the /etc/ssl/caddy directory so that it’s only accessible by root and caddy:

sudo chmod 0770 /etc/ssl/caddy

Next create a directory to store the files that Caddy will host:

sudo mkdir /var/www

Then set the directory’s owner and group to caddy:

sudo chown caddy:caddy /var/www

To install the Caddy service, download the systemd unit file from the Caddy GitHub repository to /etc/systemd/system by running:

sudo sh -c 'curl https://raw.githubusercontent.com/caddyserver/dist/master/init/caddy.service > /etc/systemd/system/caddy.service'

Modify the service file’s permissions so it can only be modified by its owner, root:

sudo chmod 644 /etc/systemd/system/caddy.service

Then, reload systemd to detect the Caddy service:

sudo systemctl daemon-reload

Step 3: Configuring Caddy

In this section, you’ll write basic Caddy configuration for serving static files from your server.

Create a basic HTML file called index.html in /var/www:

sudo nano /var/www/index.html

Add the following lines:

 
<!DOCTYPE html>
<html>
<head>
<title>Hello from Caddy!</title>
</head>
<body>
<h1 style="font-family: sans-serif">This page is being served via Caddy</h1>
</body>
</html>

When shown in a web browser, this file will display a heading with the text “This page is being served via Caddy.” Save and close the file.

Caddy reads its configuration from a file called Caddyfile, stored under /etc/caddy. Create and open the file for editing:

sudo nano /etc/caddy/Caddyfile

Add the following lines:

http:// {
    root * /var/www
    encode gzip
    file_server
}

This basic Caddy config declares that all HTTP traffic to your server should be served with files (file_server) from /var/www (which is marked as root) and compressed using gzip to reduce page loading times on the client side.

Caddy has different directives for many use cases. For example, the log directive could be useful for logging all HTTP requests that occur. You can review more options at the official documentation page for directives.

When you are done, save and close the file.

To test that everything is working correctly, start the Caddy service:

sudo systemctl start caddy

Next, run systemctl status to find information about the status of the Caddy service:

sudo systemctl status caddy

You’ll receive the following:

Output
● caddy.service - Caddy
     Loaded: loaded (/etc/systemd/system/caddy.service; disabled; vendor preset: enabled)
     Active: active (running) since Wed 2022-08-10 15:02:41 UTC; 2s ago
       Docs: https://caddyserver.com/docs/
   Main PID: 5443 (caddy)
      Tasks: 7 (limit: 1119)
     Memory: 7.5M
        CPU: 30ms
     CGroup: /system.slice/caddy.service
             └─5443 /usr/bin/caddy run --environ --config /etc/caddy/Caddyfile

You can now visit your server’s IP in a web browser. Your sample web page will display:

“This page is being served via Caddy” message that displays when visiting your server’s IP in a web browser.

You have now configured Caddy to serve static files from your server. In the next step, you’ll extend Caddy’s functionality through plugins.

Step 4: Enabling Automatic TLS with Let’s Encrypt

Plugins can change and extend Caddy’s behavior. Generally, they offer more config directives, according to your use case. In this step, you’ll enable automatic Let’s Encrypt certificate provisioning and renewal, using TXT DNS records for verification. To verify using TXT DNS records, you’ll install the official plugin to interface with the DigitalOcean DNS API.

To add a plugin, you need to recompile Caddy using xcaddy, specifying the repositories of plugins that should be available. Run the following command to compile Caddy with support for DigitalOcean DNS:

xcaddy build --with github.com/caddy-dns/digitalocean@master

The output will be similar to this:

Output
...
2022/08/10 15:03:24 [INFO] exec (timeout=0s): /usr/local/go/bin/go get -d -v github.com/caddy-dns/digitalocean@master github.com/caddyserver/caddy/v2
go: downloading github.com/caddy-dns/digitalocean v0.0.0-20220527005842-9c71e343246b
go: downloading github.com/libdns/digitalocean v0.0.0-20220518195853-a541bc8aa80f
go: downloading github.com/digitalocean/godo v1.41.0
go: downloading github.com/google/go-querystring v1.0.0
...

Once the compilation is finished, move the resulting binary to /usr/bin by running:

sudo mv caddy /usr/bin

Then, set appropriate permissions:

sudo chown root:root /usr/bin/caddy
sudo chmod 755 /usr/bin/caddy

Next, you’ll configure Caddy to work with DigitalOcean’s API to set DNS records. Caddy needs to read your API token as an environment variable to configure DigitalOcean’s DNS, so you’ll edit its systemd unit file. Open the file for editing:

sudo nano /etc/systemd/system/caddy.service

Add the following line in the [Service] section, replacing your_token_here with your API token:

Environment=DO_AUTH_TOKEN=your_token_here

Save and close this file, then reload the systemd daemon to ensure the configuration is updated:

sudo systemctl daemon-reload

Run systemctl restart to apply your configuration changes:

sudo systemctl restart caddy

Then run systemctl status to check if it ran correctly:

sudo systemctl status caddy

You will receive the following output:

Output
● caddy.service - Caddy
     Loaded: loaded (/etc/systemd/system/caddy.service; disabled; vendor preset: enabled)
     Active: active (running) since Wed 2022-08-10 15:06:01 UTC; 2s ago
       Docs: https://caddyserver.com/docs/
   Main PID: 5620 (caddy)
      Tasks: 7 (limit: 1119)
     Memory: 7.5M
        CPU: 37ms
     CGroup: /system.slice/caddy.service
             └─5620 /usr/bin/caddy run --environ --config /etc/caddy/Caddyfile

Next, you’ll need to make slight changes to your Caddyfile. Open it for editing:

sudo nano /etc/caddy/Caddyfile

Add the following lines, replacing your_domain with your domain:

your_domain {
    root * /var/www
    encode gzip
    file_server
    
    tls {
        dns digitalocean {env.DO_AUTH_TOKEN}
    }
}

Save and close the file. Restart Caddy to apply the changes:

sudo systemctl restart caddy

Your website is now ready to be deployed and secured with automatic TLS certificates from Let’s Encrypt.

Conclusion

You now have Caddy installed and configured on your server, serving static pages at your desired domain and secured with free Let’s Encrypt TLS certificates. This setup ensures that your website is accessible over HTTPS and meets the current security expectations for modern web services.

Here are the key takeaways from this tutorial:

• You built Caddy from source using xcaddy, enabling you to add plugins and customize functionality.
• You installed and configured Caddy as a systemd service to ensure it runs automatically on system startup.
• You configured Caddy to serve static files from your server with gzip compression to optimize client-side loading times.
• You secured your website using Let’s Encrypt certificates and configured DNS verification via the DigitalOcean API plugin.

A good next step would be to set up notifications for when new versions of Caddy are released. For example, you could use the Atom feed for Caddy releases or a dedicated service such as dependencies.io.

You can explore Caddy’s documentation for more information on configuring and extending its capabilities to suit your use case. With its modular architecture and ease of use, Caddy is a powerful tool for web hosting and security.