Deploy Caddy Reverse Proxy

Deploy and Host self hosted Caddy Reverse Proxy (Caddy Reverse Proxy for Private Railway Services) on Railway

This template deploys official Caddy 2.11.7 as one public front door for a private Railway service.

About Hosting Caddy Reverse Proxy open-source software on Railway (self hosted Caddy as a reverse proxy on Railway template)

Caddy is an open-source web server and reverse proxy, and this template runs the official Caddy 2.11.7 image as one service.

Railway handles edge TLS, the private IPv6 network, and restarts. For path routing or basic auth, fork the repo and edit the Caddyfile.

Why Deploy Caddy Reverse Proxy, the Nginx alternative on Railway (Railway Free Trial)

Nginx is the usual choice for a reverse proxy, but its config and separate TLS setup add friction when you only need a front door for one private service.

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Caddy Reverse Proxy on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

Railway vs Other Hosting Providers and VPS for Caddy Reverse Proxy self hosting

Railway runs the host, private networking, and edge TLS for this template, while other options give you a machine to manage yourself.

Pick Railway when you want the proxy running fast, and a VPS when you need full control of the machine.

Common Use Cases for hosted Caddy Reverse Proxy

• Basic auth in front of an internal dashboard: Put Caddy with basicauth in front of an admin tool that has no login. Caddy checks the password hash from caddy hash-password, then forwards traffic over the private network. Nobody gets in without the credentials.
• One domain routing /api and / to two services: Use handle /api/* for API traffic and a catch-all handle block for the frontend. Users see one domain, and both services stay private.
• Security and cache headers without app changes: Add Strict-Transport-Security or Cache-Control with the header directive. This works well when the app is third-party or hard to change.
• Compression for an app that lacks it: The template enables encode gzip zstd, so plain responses from an older upstream still get compressed on the way out.
• A gateway for several private services: Run one public Caddy in front of several internal services, each reached by its own service.railway.internal name, so every backend stays off the public internet.

Dependencies for Caddy Reverse Proxy Docker hosted on Railway

This section covers what the template needs and what it does once running.

Deployment Dependencies for Managed Caddy Reverse Proxy Service (Web Server)

You need a Railway project and, if Caddy will front another service, that service already deployed in the same project so it gets a private address.

Implementation Details for Caddy Reverse Proxy (Using Caddy official docker image)

With UPSTREAM empty, Caddy serves static files from /srv and compresses responses with gzip and zstd.

How does Caddy Reverse Proxy compare against other ways to put a proxy in front of a Railway service

Caddy vs Nginx (Nginx Alternative)

• Config Style: Caddy reads a short Caddyfile, and one-variable mode gets a reverse proxy running with UPSTREAM set and no file edits. Nginx wins if you already have a large config you don't want to touch.
• TLS: On Railway we turn auto_https off and let the Railway edge handle TLS. Nginx usually needs certbot alongside it.
• Ecosystem: Nginx has decades of tutorials and modules. If your team already runs it, that familiarity is worth a lot.

Caddy vs Traefik (Label-Driven Proxy Alternative)

• Setup Model: Traefik discovers routes from container labels and fits Docker and Kubernetes clusters well. Caddy keeps routes in one readable file, which is simpler for a couple of private services.
• Dynamic Routing: Traefik reacts to container changes automatically. With Caddy you edit the Caddyfile and redeploy, which is more manual but easier to reason about.
• Fit on Railway: Traefik expects control over the container runtime that Railway does not give you, so Caddy is the lighter choice here.

Caddy vs HAProxy (TCP and HTTP Load Balancer Alternative)

• Layer Coverage: HAProxy excels at raw TCP load balancing and very high connection counts. Caddy focuses on HTTP, which covers most web apps.
• Load Balancing: Caddy handles multiple upstreams with health checks in a few lines. HAProxy offers finer tuning when you need it.
• Operational Weight: HAProxy has a steeper learning curve for header rules and routing. Caddy gets you path routing and basic auth with less config.

Caddy vs Railway Domains Alone (No Proxy Layer)

• Public Exposure: Railway domains point straight at a service. Caddy lets you remove the public domain from the app and expose only the proxy.
• Access Control: A bare Railway domain has no authentication. Caddy can add basic auth with a hash from caddy hash-password.
• Headers and Routing: Without a proxy you cannot add security headers, compression, or /api routing to one domain. Railway domains are simpler if you need none of that.

How to use Caddy Reverse Proxy (the OSS web server and reverse proxy)?

1. Deploy the Caddy Reverse Proxy template. It needs no inputs.
2. Make sure your app listens on ::, and note its private domain and port, such as myapp.railway.internal and 3000.
3. On the caddy service, set UPSTREAM to myapp.railway.internal:3000 and redeploy. The template adds X-Forwarded-Proto and X-Real-IP headers.
4. Open the Caddy public URL and confirm your app answers. A 502 usually means a wrong port or an IPv4-only app.
5. Remove the public domain from the app service so only Caddy is exposed.
6. For path routing or basic auth, fork the template repo, edit the Caddyfile, and deploy from your fork:

:{$PORT} {
	encode gzip zstd
	basic_auth {
		admin your-caddy-hash-password-output
	}
	handle /api/* {
		reverse_proxy api.railway.internal:8080
	}
	handle {
		reverse_proxy web.railway.internal:3000
	}
}

Generate the hash with caddy hash-password.

How to self host Caddy Reverse Proxy on other VPS Services (Caddy self hosting guide)

On your own VPS you handle TLS and the upstream networking yourself, since Railway's edge is not in front of it.

Clone the Repository

Grab the template source so you have the Caddyfile and Dockerfile.

git clone https://github.com/onepush-dev/caddy.git
cd caddy

Install Dependencies

You only need Docker on the VPS. Open ports 80 and 443 in your firewall.

sudo apt-get update && sudo apt-get install -y docker.io

Configure Environment Variables

Set UPSTREAM to the local address of your app, and PORT if you want something other than the default.

UPSTREAM=127.0.0.1:3000
PORT=8080

Start the Caddy Reverse Proxy Application

Build and run the container, then check that your app answers through Caddy. This build keeps auto_https off, so add TLS in front of it.

docker build -t caddy-proxy .
docker run -d --network host -e PORT=8080 -e UPSTREAM=127.0.0.1:3000 caddy-proxy
curl -I http://localhost:8080

Railway handles the edge TLS, private IPv6 networking and restarts for you, which is why the Railway version skips these steps.

Official Pricing of Caddy Reverse Proxy (Caddy pricing)

Caddy is free and open source under the Apache-2.0 license, so there is no license fee. Check Railway's pricing page for current rates, since they change.

Caddy Reverse Proxy cloud vs self hosted comparison (Pricing, features, costs, and more)

Caddy Reverse Proxy is open source under Apache-2.0, so you can self host it or let Railway run it from the official template.

Monthly cost of self hosting Caddy Reverse Proxy on Railway

A single Caddy service at light traffic is typically a few dollars a month on Railway's usage pricing, and the trial credit covers early experiments.

System Requirements for Hosting Caddy Reverse Proxy on a VPS

Caddy is a small Go binary, so a VPS with one vCPU and a few hundred megabytes of RAM handles light reverse proxy work.

Frequently Asked Questions (FAQs)

Why do I get a 502 from Caddy after setting UPSTREAM?

A 502 almost always means Caddy cannot reach the upstream on that host and port.

Why not run HTTPS inside the container?

Railway terminates TLS at its edge, so Caddy listens on plain HTTP on PORT with auto_https off.

How do I add basic auth in front of my app?

Generate a bcrypt hash with caddy hash-password, then add a basicauth block with your username and that hash to the Caddyfile.

Do WebSockets work through this proxy?

Yes, Caddy's reverse_proxy handles WebSocket upgrades automatically, so you do not need extra configuration for them.

Will my app see the real client IP?

Caddy sets X-Real-IP and X-Forwarded-Proto on proxied requests, and trusted_proxies is configured for private ranges.

Can I use my own domain with this template?

Yes, add a custom domain to the caddy service in Railway networking and Railway issues the TLS certificate.