Managing Nginx with dozens of config files, installing Certbot, and constantly worrying about SSL renewals every three months is a real time-sink. Caddy has emerged as a lifesaver for developers. Having used Fedora as my primary OS for over two years, I’ve found Caddy to be a perfect fit for this ecosystem.
Why does Caddy make Nginx look ‘complicated’?
The traditional workflow usually involves: installing Nginx, configuring Virtual Hosts, installing Certbot, and then setting up Cronjobs for auto-renewing SSL. There are simply too many intermediate steps. Caddy completely changes the game. It 100% automates the issuance and renewal of SSL certificates from Let’s Encrypt or ZeroSSL as soon as you declare your domain name.
Instead of writing 50 lines of Nginx configuration, you only need 3 lines in a Caddyfile to run a Reverse Proxy for a Node.js or Python application. On a modern operating system like Fedora, using Caddy keeps the system lightweight and much easier to maintain.
The combination of Go and Fedora
Caddy is written in Go, which provides impressive parallel processing performance and high memory security. Fedora frequently updates to the latest packages, allowing you to access Caddy features (such as default HTTP/3 support) much earlier than other distributions.
However, Fedora has two specific security layers: firewalld and SELinux. This is often why users find that even after installing a Web Server, it remains inaccessible from the outside. We will address these issues below.
Steps to install Caddy using DNF
The most stable way to install Caddy on Fedora is through the DNF package manager. Caddy has been available in the official repositories since Fedora 33.
# Update the system
sudo dnf update -y
# Install Caddy
sudo dnf install caddy -yPerform a quick version check to confirm a successful installation:
caddy versionOpening Firewall Ports: A Critical Step
Fedora Server locks down connection ports by default. You must open port 80 (HTTP) and 443 (HTTPS) so the outside world can see your website. If you skip this step, browsers will return a “Connection Timed Out” error.
# Allow Web traffic through the firewall
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
# Apply changes immediately
sudo firewall-cmd --reloadCaddyfile Configuration: Minimal and Efficient
The main configuration file is located at /etc/caddy/Caddyfile. Suppose you have an application running on port 3000 and want to point the domain yourdomain.com to it.
Open the file and replace its content with the following:
yourdomain.com {
reverse_proxy localhost:3000
}Caddy will automatically handle everything: authenticating with Let’s Encrypt, obtaining the SSL certificate, configuring the HTTP to HTTPS redirect, and proxying traffic to your app. The entire process takes less than 30 seconds.
Overcoming SELinux Barriers
If you encounter a “502 Bad Gateway” error even though your application is running normally, there is a high probability that SELinux is blocking Caddy from connecting to the backend. This is a security mechanism that prevents web processes from making unauthorized network connections.
Run the following command to grant the necessary permissions to Caddy:
# Allow Web Server to connect to the network (Reverse Proxy)
sudo setsebool -P httpd_can_network_connect 1The -P flag ensures this setting persists after a server reboot. This is a practical tip to avoid mysterious site outages after routine maintenance.
Smooth Service Management
Enable Caddy so it starts automatically with the system:
# Start and enable Caddy to run on boot
sudo systemctl enable --now caddy
# Check operational status
sudo systemctl status caddyEvery time you edit the Caddyfile, you don’t need to restart the entire service. Use the reload command to apply the new configuration without interrupting existing connections:
sudo systemctl reload caddyHow to check logs when troubleshooting
If your domain isn’t receiving an SSL certificate, check the real-time logs. On Fedora, everything is recorded via journalctl:
sudo journalctl -u caddy -fThese logs will clearly indicate if Caddy is encountering a DNS error (failed SSL validation) or is being denied file access due to directory permissions.
Conclusion
Switching from Nginx to Caddy on Fedora Server has saved me a significant amount of administration time. You get the stability of Fedora combined with the convenience of Caddy. If you run into errors, always remember to check Firewalld and SELinux before diving deep into your code. Good luck with your deployment!
