Caddy is a powerful, enterprise-ready, open source web server with automatic HTTPS written in Go.

wikipedia.org/wiki/Caddy_(web_server)

Caddy requires write access to two locations: a data directory, and a configuration directory. While it's not necessary to persist the files stored in the configuration directory, it can be convenient. However, it's very important to persist the data directory.

From the docs:

The data directory must not be treated as a cache. Its contents are not ephemeral or merely for the sake of performance. Caddy stores TLS certificates, private keys, OCSP staples, and other necessary information to the data directory. It should not be purged without an understanding of the implications.

This image provides for two mount-points for volumes: /data and /config.

In the examples below, a volume /var/appjail-volumes/caddy/data is mounted to /data, so that data will be persisted.

Note that volumes are persisted across container restarts and terminations, so if you move to a new image version, the same data and config directories can be re-used.

The default config file simply serves files from /usr/local/www/caddy, so if you want to serve index.html from the current working directory:

$ mkdir -p /var/appjail-volumes/caddy/data
$ echo "hello world" > index.html
$ appjail oci run -Pd \
    -o overwrite=force \
    -o virtualnet=":<random> default" \
    -o nat \
    -o expose="80:8080" \
    -o fstab="/var/appjail-volumes/caddy/data /data <pseudofs>" \
    -o fstab="$PWD/index.html usr/local/www/caddy/index.html nullfs ro" \
    ghcr.io/appjail-makejails/caddy caddy

To override the default Caddyfile, you can create one in the subfolder conf at $PWD/conf/Caddyfile and mount this folder at /usr/local/etc/caddy:

$ appjail oci run -Pd \
    -o overwrite=force \
    -o virtualnet=":<random> default" \
    -o nat \
    -o expose="80:8080" \
    -o fstab="/var/appjail-volumes/caddy/data /data <pseudofs>" \
    -o fstab="$PWD/conf /usr/local/etc/caddy" \
    ghcr.io/appjail-makejails/caddy caddy

The default Caddyfile only listens to port 80, and does not set up automatic TLS. However, if you have a domain name for your site, and its A/AAAA DNS records are properly pointed to this machine's public IP, then you can use this command to simply serve a site over HTTPS:

$ appjail oci run -Pd \
    -o overwrite=force \
    -o virtualnet=":<random> default" \
    -o nat \
    -o expose="80:8080" \
    -o expose="443:4443" \
    -o expose="443:4443 proto:udp" \
    -o fstab="/site /srv" \
    -o fstab="/var/appjail-volumes/caddy/data /data <pseudofs>" \
    -o fstab="/var/appjail-volumes/caddy/conf /usr/local/etc/caddy" \
    ghcr.io/appjail-makejails/caddy caddy \
    caddy file-server --domain example.com

The key here is that Caddy is able to listen to ports 80 and 443, both required for the ACME HTTP challenge.

See Caddy's docs for more information on automatic HTTPS support!

Most users deploying production sites will not want to rely on mounting files into a container, but will instead base their own images on caddy:

# note: never use the :latest tag in a production site
FROM ghcr.io/appjail-makejails/caddy:<version>

COPY Caddyfile /usr/local/etc/caddy/Caddyfile
COPY site /srv

Caddy is extendable through the use of "modules". See https://caddyserver.com/docs/extending-caddy for full details. You can find a list of available modules on the Caddy website's download page.

You can use the :builder image as a short-cut to building a new Caddy binary:

FROM ghcr.io/appjail-makejails/caddy:<version>-builder AS builder

RUN xcaddy build \
    --output /caddy \
    --with github.com/caddyserver/nginx-adapter \
    --with github.com/hairyhenderson/caddy-teapot-module@v0.0.3-0

FROM ghcr.io/appjail-makejails/caddy:<version>

COPY --from=builder /caddy /usr/local/bin/caddy

Note the second FROM instruction - this produces a much smaller image by simply overlaying the newly-built binary on top of the regular caddy image.

The xcaddy tool is used to build a new Caddy entrypoint, with the provided modules. You can specify just a module name, or a name with a version (separated by @). You can also specify a specific version (can be a version tag or commit hash) of Caddy to build from. Read more about xcaddy usage.

Note that the "standard" Caddy modules (github.com/caddyserver/caddy/master/modules/standard) are always included.

Caddy does not require a full restart when configuration is changed. Caddy comes with a caddy reload command which can be used to reload its configuration with zero downtime.

When running Caddy in a OCI container, the recommended way to trigger a config reload is by executing the caddy reload command in the running container.

The working directory is set to /usr/local/etc/caddy so Caddy can find your Caddyfile without additional arguments.

$ appjail oci exec -w /usr/local/etc/caddy caddy caddy reload

See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for more details.

Note: Only the host can make the changes described above. The jail cannot.

If you prefer to use appjail-director to run your stack, here's a sample service definition which goes in a file named appjail-director.yml. The configuration assumes you put a custom Caddyfile into $PWD/conf as described above.

options:
  - virtualnet: ':<random> default'
  - nat:
  - container: 'boot args:--pull'

services:
  caddy:
    name: caddy
    makejail: gh+AppJail-makejails/caddy
    volumes:
      - conf: /usr/local/etc/caddy
      - site: /srv
      - data: /data
      - config: /config
    options:
      - expose: '80:8080'
      - expose: '443:4443'
      - expose: '443:4443 proto:udp'

volumes:
  conf:
    device: !ENV '${PWD}/conf'
  data:
    device: /var/appjail-volumes/caddy/data
  site:
    device: !ENV '${PWD}/site'
  config:
    device: /var/appjail-volumes/caddy/config

Graceful reloads can then be conducted via appjail oci exec -w /usr/local/etc/caddy caddy caddy reload.

• caddy_from (default: ghcr.io/appjail-makejails/caddy): Location of OCI image. See also OCI Configuration.
• caddy_tag (default: latest): OCI image tag. See also OCI Configuration.

• PGID (default: 1000): Equivalent to PUID but for the Process Group ID.
• PUID (default: 1000): Process User ID for the container's main process, allowing you to match the owner of files written to mounted host volumes to your host system's user. Writable volumes are changed based on this environment variable.

build:
  variants:
    - tag: 15.1
      containerfile: Containerfile
      aliases: ["latest"]
      default: true
      args:
        FREEBSD_RELEASE: "15.1"
        NO_PKGCLEAN: "1"
      cache_dirs: ["pkgcache0:/var/cache/pkg"]