Looking to move from Caddy
Recently it’s come to my attention that Caddy has an AI sponsor so I have been looking at moving away from Caddy.
I’m currently looking for another reverse proxy to use in place of Caddy. For TLS I am looking into using CertBot and it appears there’s a module (github.com/desec-io/certbot-dns-desec) I can use that works for desec.io to handle my certs.
I have two questions, the first is about CertBot. Since Caddy is handling my certs automatically, how often would I want to renew my certs? Desec.io has this command to obtain a cert:
certbot certonly \ --authenticator dns-desec \ --dns-desec-credentials /etc/letsencrypt/secrets/$DOMAIN.ini \ -d "$DOMAIN" \ -d "*.$DOMAIN"
Would I be required to run the same command periodically to renew my cert?
My second question is a bit more open ended. I am looking to hear any suggestions or experiences about different reverse proxies that are preferably free of AI. There is a list here with some suggested alternatives: codeberg.org/ethical-foss/open-slopware#web-serve…
HAProxy seems like it’s always overlooked. I have been using it for years myself, pretty solid and just works.
If you run pfSense you can also use HAProxy with a GUI.
Just keep in mind that HAProxy is only a proxy (technically a performance-oriented load-balancer). It’s not a web server.
I mention it because some of us also rely on our reverse proxy to serve small static webpages for various purposes (I serve a small status page generated by a cron script, for example).
I also make use of Caddy’s built in file server to serve static pages so this is good to know about HAProxy
You can serve static pages by using the error page config line with monitor uri
I also just use acme certbot (setup via puppet letsencrypt module) to do the certs and there’s a restart haproxy post script on cert update
I would argue that’s a bit of a perversion 😃 but on the other hand if it can serve my static page… I’ll have to reconsider HAProxy for my stuff. Thanks!
Haha I get it, something something doing it because we could,… But never ask if we should. But it’s a fun trick with haproxys features, you could probably also do something with acls and or lua too if you wanted to be fancy