Install and inspect Caddy

Caddy is a web server written in Go. It’s a single binary with no dependencies, and it gets and renews HTTPS certificates for you without any setup.

Before we use any of that, we need the right binary on the machine. Caddy is modular: features like DNS providers are compiled into the binary itself. Two installs that print the same version number can have different features inside. So the first thing I do on any machine is check exactly what I installed.

Install it

On macOS, use Homebrew:

brew install caddy

On Debian or Ubuntu, add the official repository first, then install the package:

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install caddy

The package does more than copy a binary. It creates a caddy system user, installs a systemd service, and writes a default configuration to /etc/caddy/Caddyfile. We’ll use all three later in the course.

Inspect what you got

Now let’s look at the binary. Three commands tell you everything:

caddy version
caddy build-info
caddy list-modules --packages

caddy version prints something like v2.8.4. caddy build-info shows the Go version and every dependency compiled in. caddy list-modules --packages lists the modules in this build. Non-standard modules show up at the end of the list, so you can spot them at a glance.

Write down the version and any extra modules. Put them in your project notes or in the repository. When something behaves oddly in six months, you want to know which exact build you were running, not a guess.

Only trust official builds

A web server sees every request that reaches your machine, and it holds your TLS private keys. A binary copied from a random website can do anything it wants with both.

So install Caddy only from the official repositories or from the official downloads page. If you need extra modules, don’t download someone else’s build. Build your own with xcaddy, which compiles Caddy from source with the plugins you pick. It takes a couple of minutes and you know exactly what’s inside.

One small check before moving on: run which caddy. If you have an old binary somewhere in your PATH, this is the moment to find it, not after a confusing afternoon of debugging.