| Time | Status | Description |
|---|---|---|
200 | GET media.example.com/library/sections/2/all 48 KB · HTTP/2.0 ·  203.0.113.24 | |
| update | Enabled the WAF on grafana.example.comavery · proxy_host | |
200 | POST git.example.com/avery/infra/git-upload-pack 1.2 MB · HTTP/2.0 · 2001:db8:6e21:9a40:d1c3:57fe:2b08:4419 | |
| update | Added upstream http://app-2:8080 to app.example.comavery · proxy_host | |
502 | GET app.example.com/v1/devices/sync 0 · HTTP/1.1 ·10.0.2.51 | |
403 | GET status.example.com/.env 512 B · HTTP/1.1 · 2001:db8:a0b::62 | |
| create | Created L4 proxy host postgres (5432/tcp)avery · l4_proxy_host | |
304 | GET home.example.com/static/frontend_latest/app.js 0 · HTTP/3.0 ·10.0.2.14 | |
| renew | Issued client certificate backup-runnersystem · certificate | |
200 | GET grafana.example.com/api/dashboards/uid/caddy 96 KB · HTTP/2.0 · 203.0.113.88 | |
| delete | Removed old-laptop from the Staging access listavery · access_list |
Caddy is a web server that gets TLS right by default. Caddy Proxy Manager is a UI in front of it, so the things Caddy can do - reverse proxying, certificates, a WAF, layer-4 streams - become things you configure and watch rather than things you write into a config file and hope about.
Reverse proxy
Multiple upstreams, twelve load-balancing policies, health checks, upstream timeouts, custom headers, location rules, redirects, rewrites, asset caching, compression, rate limiting, maintenance mode, Force HTTPS and HSTS, upstream DNS pinning, live upstream health, tags, a page per host, and bulk actions across hosts.
L4 TCP/UDP proxy
Layer 4 stream proxying. Port ranges, TLS SNI matching, PROXY protocol, health checks, geo blocking and access-list IP rules below HTTP.
Automatic HTTPS
ACME through Let’s Encrypt or any directory you point it at, DNS-01 across twenty-two providers with challenge delegation, certificates read from files on an agent’s host, plus a built-in CA for mutual TLS.
WAF
Coraza with the OWASP Core Rule Set. Per-host modes, tuning, exclusions scoped to a path or a variable, and an event log that explains why each request was blocked.
Traffic analytics
Why each request ended and how long it took, compared with the period before, filtered on any dimension and saved as shareable views. ClickHouse stores it, and a live view shows the raw access, WAF and Caddy logs. Each host has a page of its own, and the overview opens with what needs attention.
Accounts, audited
Sign in with a password, a passkey, SSO or LDAP/Active Directory. Every configuration change is recorded with the account that made it, and searchable. The whole configuration backs up to one encrypted file.