Tujuan Pembelajaran

Goals

• Memahami apa itu Caddy dan keunggulannya
• Mampu install dan konfigurasi Caddy
• Membuat reverse proxy
• Setup automatic HTTPS dengan Let's Encrypt
• Konfigurasi static files dan PHP
• Load balancing dan advanced features

Keunggulan Caddy

• Automatic HTTPS - Tanpa konfigurasi
• Konfigurasi Sederhana - Hanya satu file
• HTTP/3 Support - Lebih cepat
• Zero Config SSL - Dari awal

Dasar-Dasar Caddy

Jadwal Minggu 1

Apa itu Caddy?

Sejarah

• Dibuat oleh Matt Holt
• Dirilis tahun 2015
• Written in Go

Kapan Pakai Caddy?

• Butuh HTTPS otomatis
• Konfigurasi simpel
• Static website
• Reverse proxy sederhana
• Development server

Instalasi Caddy

Install di Ubuntu/Debian

# Install dependencies
sudo apt install -y apt-transport-https ca-certificates curl gnupg

# Add Caddy repository
sudo curl -fsSL "https://dl.cloudsmith.io/public/caddy/stable/gpg.key" | gpg --dearmor -o /usr/share/keyrings/caddy-archive-keyring.gpg
sudo curl -fsSL "https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt" | sudo tee /etc/apt/sources.list.d/caddy-stable.list

# Install Caddy
sudo apt update
sudo apt install caddy

Verify Installation

caddy version

Caddyfile Dasar

Struktur Dasar

# Basic Caddyfile
example.com {
    respond "Hello, World!"
}

Dengan Static Files

mysite.com {
    root * /var/www/html
    file_server
}

Commands Penting

# Validate Caddyfile
caddy validate

# Format Caddyfile
caddy fmt

# Reload konfigurasi
caddy reload

Static Files

Serve Static Website

www.example.com {
    # Root folder
    root * /var/www/mysite
    
    # Enable file server
    file_server
    
    # Enable index files
    index index.html index.htm
}

Dengan PHP Support

www.example.com {
    root * /var/www/html
    
    php_fastcgi localhost:9000
    file_server
}

Path Rewrite

www.example.com {
    root * /var/www/app
    
    # Rewrite /app ke /app/public
    rewrite /app /app/public
    
    php_fastcgi localhost:9000
    file_server
}

Reverse Proxy

Proxy ke Local Port

api.example.com {
    reverse_proxy localhost:3000
}

Proxy ke Docker Container

myapp.example.com {
    reverse_proxy container-name:3000
}

Proxy dengan WebSocket Support

app.example.com {
    reverse_proxy localhost:8080 {
        header_up X-Real-IP {remote}
        header_up X-Forwarded-For {remote}
        header_up X-Forwarded-Proto {scheme}
    }
}

Advanced Caddy

Jadwal Minggu 2

Automatic HTTPS

Cara Kerja

• Request ke port 80 → redirect ke HTTPS
• Ambil certificate dari Let's Encrypt
• Auto-renew sebelum expired
• HTTP/3 (QUIC) support

Konfigurasi Domain

example.com {
    # Automatic HTTPS - tidak perlu konfigurasi tambahan
    root * /var/www/html
    file_server
}

Disable HTTPS (Development)

localhost:8080 {
    http_port 8080
    https_port 8443
    respond "Dev Server"
}

TLS Options

Custom TLS Config

example.com {
    tls {
        protocols tls1.2 tls1.3
        ciphers TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256
    }
    
    reverse_proxy localhost:3000
}

External TLS (Managed Elsewhere)

example.com {
    tls external
    
    reverse_proxy backend:443 {
        transport http {
            tls
            tls_server_name backend.example.com
        }
    }
}

Self-Signed Certificate (Development)

example.com {
    tls self_signed
    
    respond "Internal Dev"
}

Load Balancing

Round Robin

api.example.com {
    reverse_proxy localhost:3000 localhost:3001 localhost:3002
}

dengan Health Check

api.example.com {
    reverse_proxy localhost:3000 localhost:3001 localhost:3002 {
        health_uri /health
        health_interval 5s
        health_timeout 3s
    }
}

IP Hash (Sticky Session)

app.example.com {
    reverse_proxy localhost:3000 localhost:3001 {
        lb_policy ip_hash
    }
}

Security Headers

Header Security

example.com {
    header {
        X-Frame-Options "SAMEORIGIN"
        X-Content-Type-Options "nosniff"
        X-XSS-Protection "1; mode=block"
        Referrer-Policy "strict-origin-when-cross-origin"
        Content-Security-Policy "default-src 'self'"
    }
    
    reverse_proxy localhost:3000
}

CORS Headers

api.example.com {
    @cors {
        header Origin *
    }
    
    respond @cors "OK" 200 {
        Access-Control-Allow-Origin "*"
        Access-Control-Allow-Methods "GET, POST, OPTIONS"
    }
    
    reverse_proxy localhost:3000
}

Logging - Monitoring

Access Log

example.com {
    log {
        output file /var/log/caddy/access.log
    }
    
    reverse_proxy localhost:3000
}

Error Log

example.com {
    log {
        output file /var/log/caddy/error.log
        level ERROR
    }
    
    reverse_proxy localhost:3000
}

Console Output (Development)

example.com {
    log {
        output stdout
    }
    
    respond "Debug mode"
}

Cheat Sheet

Commands

caddy run                 # Start Caddy
caddy start               # Start as daemon
caddy stop                # Stop Caddy
caddy reload              # Reload config
caddy validate            # Validate Caddyfile
caddy fmt                 # Format Caddyfile
caddy list-certificates   # List certificates
caddy revoke              # Revoke certificate

Common Directives

root * /path/to/files    # Document root
file_server              # Enable static file serving
reverse_proxy localhost:3000  # Proxy to backend
php_fastcgi localhost:9000   # PHP support
encode gzip             # Enable gzip compression
log { }                 # Logging
header { }              # Set headers
tls { }                 # TLS configuration