Web / Caddy Server Interview questions
1. What is Caddy Server?
Caddy is an open-source web server written in Go that ships with automatic HTTPS turned on by default. It is maintained by the Caddy Web Server project (originally created by Matt Holt) and distributed as a single static binary with no external runtime dependencies. Beyond serving static files, C...
2. What are the key features of Caddy?
Caddy's feature set is built around removing the manual setup steps that other web servers leave to the operator. Automatic HTTPS - certificates are requested, installed, and renewed without operator action. HTTP/1.1, HTTP/2, and HTTP/3 - QUIC-based HTTP/3 is supported natively. Caddyfile syntax ...
3. What is automatic HTTPS in Caddy?
Automatic HTTPS is the behavior where Caddy detects that a site block uses a publicly resolvable domain name and, without any extra directive, requests a TLS certificate for it, installs the certificate, and starts serving that site over HTTPS. Under the hood, Caddy uses its embedded ACME client ...
4. What is a Caddyfile?
A Caddyfile is Caddy's native, human-friendly configuration format. Each site gets an address block, and directives inside that block describe what Caddy should do for requests to that address. example.com { root * /var/www/html file_server } In this snippet, example.com is the site address, root...
5. What is the purpose of the reverse_proxy directive?
The reverse_proxy directive forwards incoming client requests to one or more backend services (upstreams) and returns their response to the client, letting Caddy sit in front of application servers written in any language. example.com { reverse_proxy localhost:3000 } This block sends every reques...
6. What are the types of Caddy configuration formats?
Caddy's native, internal configuration language is JSON - every setting Caddy understands has a JSON representation. To avoid hand-writing JSON, Caddy ships config adapters that translate other formats into that JSON before Caddy loads it. Format How it's used JSON Native format; loaded directly,...
7. How do you install Caddy on Ubuntu Linux?
The recommended path on Debian and Ubuntu is Caddy's official APT repository, which keeps the package up to date through normal apt upgrades. sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \ | su...
8. How do you start, stop, and reload the Caddy service?
When Caddy is installed via the APT package, it registers as a systemd service, so the usual systemd verbs apply directly. sudo systemctl start caddy # start the service sudo systemctl stop caddy # stop the service sudo systemctl restart caddy # stop then start (drops connections briefly) sudo sy...
9. How do you serve static files with Caddy?
Static file serving needs just two directives inside a site block: one to point at the folder on disk, and one to actually hand files to clients. example.com { root * /var/www/html file_server } root * sets the file root for all matched requests, and file_server reads matching files from that roo...
10. What is the purpose of the file_server directive?
file_server is Caddy's built-in static file handler. Once a site block has a file root set (usually via root * ), file_server maps incoming request paths to files under that root and streams them back. It automatically resolves index.html for directory-style requests, sets ETag and Last-Modified ...
11. What is the encode directive used for?
encode compresses HTTP response bodies before sending them to the client, reducing transfer size for text-based content like HTML, CSS, JavaScript, and JSON. example.com { encode zstd gzip file_server } Caddy negotiates the format based on the client's Accept-Encoding header and picks the best ma...
12. How do you configure access logging in Caddy?
The log directive turns on structured access logging for a site block and lets you control the output destination and format. example . com { log { output file /var/log/caddy/access.log { roll_size 10mb roll_keep 10 } format json } file_server } By default, logs are written as JSON lines to stder...
13. What is the respond directive used for?
respond writes a static response body and status code directly, without touching the file system or an upstream. It's the quickest way to return a fixed answer for a route. :8080 { respond "Service is healthy" 200 } api.example.com { respond /health "OK" 200 reverse_proxy localhost:4000 } Typical...
14. Define matchers in Caddyfile?
A matcher is a condition that decides which requests a directive applies to. Without one, a directive applies to every request in its site block; with one, it only fires for requests that meet the condition. example . com { @api path / api /* reverse_proxy @api localhost: 4000 @images { path *. j...
15. What is the purpose of the header directive?
header adds, sets, or removes HTTP headers on requests or responses passing through a site block, which is useful for security headers, caching hints, and CORS. example . com { header { Strict-Transport-Security "max-age=31536000" X-Content-Type-Options "nosniff" -Server } reverse_proxy localhost...
16. How do you redirect HTTP to HTTPS in Caddy?
Caddy already redirects plain HTTP to HTTPS by default whenever automatic HTTPS is active for a domain, so most sites need no extra directive at all - Caddy adds an implicit redirect on port 80. www.example.com { redir https://example.com{uri} permanent } example.com { file_server } The example a...
17. What is the Caddy admin API?
The admin API is a REST endpoint, listening on localhost:2019 by default, through which Caddy's entire running configuration can be inspected and changed at runtime. curl localhost:2019/config/ curl -X POST localhost:2019/load \ -H "Content-Type: application/json" \ -d @caddy_config.json Every Ca...
18. List the certificate authorities Caddy can obtain TLS certificates from?
Caddy is not tied to a single CA - its automatic HTTPS is built on the ACME protocol, so it can work with any CA that speaks ACME, and it ships with sensible defaults out of the box. CA Role Let's Encrypt Default primary CA for public certificates. ZeroSSL Default fallback CA if Let's Encrypt iss...
19. What are Caddy modules?
Modules are the building blocks Caddy is assembled from - every capability, from serving files to proxying requests to issuing certificates, is implemented as a module that registers itself under a namespace, such as http.handlers.file_server or http.handlers.reverse_proxy . The core Caddy binary...
20. How do you use environment variable placeholders in a Caddyfile?
The {env.VAR_NAME} placeholder pulls a value from the environment Caddy is running in, letting the same Caddyfile adapt to different environments without editing it. { email {env.ACME_EMAIL } } { $SITE_DOMAIN } { reverse_proxy {$BACKEND_HOST } : { $BACKEND_PORT } } Inside directive arguments, {en...
21. Why is Caddy considered easier to configure than Nginx?
Caddy trades explicitness for sensible defaults, so common tasks take fewer lines and less manual certificate work than an equivalent Nginx setup. Task Nginx Caddy HTTPS setup Manual Certbot install, cron renewal, cert paths in config Automatic on server start, zero extra tooling Config syntax Ve...
22. Why do we use the Caddyfile instead of writing JSON directly?
Every Caddy feature exists in JSON first, so technically nothing requires a Caddyfile. Teams reach for it anyway because it removes repetitive boilerplate: a two-line Caddyfile site block can expand into dozens of lines of nested JSON once matchers, handlers, and routes are spelled out explicitly...
23. How does Caddy handle automatic certificate renewal?
Caddy tracks the expiration date of every certificate it manages and renews each one well before it lapses, without any cron job or external scheduler. Internally, the CertMagic library runs a background maintenance routine that periodically checks each managed certificate. Once a certificate is ...
24. How is load balancing configured in Caddy's reverse_proxy?
Listing multiple upstreams in a reverse_proxy block turns it into a load balancer, and the lb_policy subdirective controls how requests are distributed among them. example.com { reverse_proxy backend1:8080 backend2:8080 backend3:8080 { lb_policy least_conn health_uri /healthz health_interval 10s ...
25. What is the difference between Caddy v1 and Caddy v2?
Aspect Caddy v1 Caddy v2 Architecture Monolithic, directives hardcoded into the core Modular; features are pluggable modules assembled via xcaddy Native config Caddyfile only JSON is native; Caddyfile is adapted to JSON Runtime API Limited Full admin API for live, partial config changes License R...
26. What is the difference between the Caddyfile and JSON config format?
Aspect Caddyfile JSON Readability Concise, directive-based, easy to scan Verbose, deeply nested objects Feature coverage Covers common cases; some niche module options need JSON Exposes every module option Caddy supports Loading Adapted to JSON at startup/reload via a config adapter Loaded direct...
27. Which is better and why: Caddy or Nginx for a small project that needs HTTPS quickly?
For a small project where the priority is getting HTTPS working with minimal setup, Caddy is generally the faster, lower-friction choice, because it removes the certificate management step entirely - point a domain at the server, define a site block, and HTTPS is live without touching Certbot or ...
28. How can you optimize Caddy for high-traffic websites?
Caddy performs well out of the box, but a few adjustments matter once traffic grows. Enable HTTP/3 to cut connection setup latency for repeat visitors on supporting clients. Tune reverse_proxy timeouts and keep-alives so idle backend connections are reused instead of re-established for every requ...
29. How do you troubleshoot Caddy certificate issues?
Certificate problems in Caddy almost always trace back to one of a small set of causes, so working through them in order usually finds the issue quickly. Check the logs - run journalctl -u caddy -f or read the configured log output for ACME error messages, which usually name the exact failure. Co...
30. Explain the lifecycle of a Caddy TLS certificate?
A certificate under Caddy's management moves through a repeating cycle rather than a one-time setup, driven by CertMagic's background maintenance loop. flowchart TD A[Site block loaded with public hostname] --> B{Valid cert already in storage?} B -- No --> C[Start ACME order with CA] C --> D[Comp...
31. Explain the execution flow of an HTTP request in Caddy?
A request passes through several distinct stages between hitting the network socket and reaching the client back as a response. sequenceDiagram participant C as Client participant L as Listener participant T as TLS Layer participant M as Matcher/Router participant H as Handler Chain participant U...
32. Explain the internal working of Caddy's config adapter?
A config adapter is the component that translates some input format into Caddy's native JSON structure before the server loads it. The Caddyfile is the most-used example, but the same mechanism supports other adapters too. When you run caddy run --config Caddyfile or caddy reload , Caddy first de...
33. What happens when Caddy fails to obtain a certificate?
A failed certificate request doesn't take the site down immediately. Caddy logs the specific ACME error, retries with an exponential backoff, and keeps serving whatever it can in the meantime. If this is the very first certificate for a domain and issuance keeps failing, Caddy has no certificate ...
34. When should you use on-demand TLS in Caddy?
On-demand TLS obtains a certificate the first time a request actually arrives for a given hostname, rather than at startup for a fixed, known list of domains. It's the right tool when the set of domains Caddy needs to serve isn't known ahead of time. { on_demand_tls { ask https: // internal . exa...
35. When would you choose Caddy over Traefik?
Aspect Caddy Traefik Primary config style Caddyfile or JSON, edited directly or via admin API Labels/annotations read from Docker, Kubernetes, Consul, etc. Best fit Standalone servers, VMs, or simple container setups with a config you maintain yourself Dynamic container/orchestrator environments ...
36. How does Caddy implement HTTP/3 support?
HTTP/3 runs over QUIC, which itself runs over UDP rather than TCP, so Caddy needs a separate code path from its HTTP/1.1 and HTTP/2 handling to support it. Caddy implements this using the quic-go library, a Go implementation of QUIC and HTTP/3. example.com { reverse_proxy localhost:3000 } No spec...
37. Why doesn't Caddy require a separate Certbot setup?
Certbot exists to bridge the gap between web servers that don't speak ACME natively (like traditional Nginx or Apache setups) and Let's Encrypt. Caddy closes that gap itself by embedding a full ACME client directly in the server process, through the CertMagic library. Where a Certbot-based setup ...
38. What is the difference between snippets and named matchers in a Caddyfile?
Aspect Snippet Named matcher Symbol (name) in parentheses @name with an at sign What it holds A reusable block of one or more directives A reusable request-matching condition Where used Imported with import name inside a site block Passed as an argument to a directive, e.g. header @images ... Typ...
39. How do you configure basic authentication in Caddy?
Caddy protects routes with HTTP Basic Authentication through the basic_auth directive, but it refuses plaintext passwords in the config - you must hash them first. caddy hash-password --plaintext "mySecretPass" # outputs a bcrypt hash , e . g . $ 2a $ 14 $ Zkq ... admin . example . com { basic_au...
40. How do you set up a wildcard certificate in Caddy?
Wildcard certificates (like *.example.com ) can only be validated with a DNS-01 ACME challenge, because a wildcard covers subdomains that don't correspond to a single reachable server for HTTP-01 validation. That means a DNS provider plugin, compiled in via xcaddy , is required. xcaddy build --wi...
41. Explain the internal working of Caddy's module system?
Caddy is built around a small core plus a registry of modules, rather than one monolithic codebase. Every non-trivial capability - HTTP handlers, TLS storage backends, log encoders, matchers - is a Go type that implements a specific interface and registers itself with caddy.RegisterModule under a...
42. How do you build a custom Caddy binary with xcaddy?
xcaddy is a build tool that compiles a Caddy binary with extra modules baked in, since Caddy's plugins are added at compile time rather than loaded dynamically. go install github.com / caddyserver / xcaddy / cmd / xcaddy @ latest xcaddy build \ -- with github.com / caddy - dns / cloudflare \ -- w...
43. Explain the execution flow of Caddy's middleware chain?
Inside a matched route, Caddy's HTTP handlers behave like classic middleware: each one wraps the next, deciding whether to act before calling onward, after the call returns, or instead of calling onward at all. flowchart LR R[Request enters route] --> H1[Handler 1: e.g. header] H1 -->|calls next|...
44. How does Caddy's storage module work for certificate persistence?
Certificates, private keys, and ACME account data all need to survive restarts and, in a cluster, be visible to every instance - that's the job of CertMagic's Storage interface, which Caddy uses for everything related to certificate persistence. Storage backend Typical use case file_system (defau...
45. What is the purpose of the layer4 app in Caddy?
Caddy's core HTTP app operates at layer 7 - it understands hostnames, paths, and headers. The layer4 app (also called caddy-l4, maintained as a separate module) extends Caddy down to layer 4, letting it route raw TCP and UDP connections before any protocol-specific parsing happens. { "apps" : { "...
46. How do you configure Caddy for zero-downtime configuration reloads at scale?
A single reload already avoids downtime through Caddy's admin API; scaling that reliably across a fleet needs a bit more process discipline on top. sequenceDiagram participant Op as Deploy pipeline participant N1 as Caddy Node 1 participant N2 as Caddy Node 2 participant AdminAPI as Admin API (:2...
47. Explain the internal working of CertMagic in Caddy?
CertMagic is the Go library, also written by the Caddy project, that gives Caddy its automatic HTTPS behavior. Caddy's TLS app is essentially a thin integration layer over CertMagic rather than a separate implementation. Internally, CertMagic maintains a per-domain certificate cache in memory bac...
48. How do you implement rate limiting in Caddy?
Rate limiting is not part of Caddy's core - there's no built-in rate_limit directive in a stock binary. It's added through a third-party module, most commonly github.com/mholt/caddy-ratelimit , compiled in with xcaddy like any other plugin. xcaddy build --with github.com/mholt/caddy-ratelimit api...
49. What is the difference between Caddy's global options block and site address blocks?
Aspect Global options block Site address block Syntax position First, unlabeled { } block at the very top of the file Block labeled with a domain/address, e.g. example.com { } Scope Server-wide settings: admin API, ACME email/CA, default ports, logging defaults Behavior for requests to that speci...
50. How do you set up a multi-domain reverse proxy with per-host TLS in Caddy?
Because Caddy issues certificates per hostname automatically, running several independent domains through the same instance just means writing several site blocks - each one gets its own certificate and its own routing without extra TLS configuration. shop.example.com { reverse_proxy localhost:40...
