Host a website on lInux with HTTPS using Caddy

Updated: 28 September 2026 · Applies to: Caddy 2 on Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9

Caddy is a web server that gets and renews HTTPS certificates automatically. It is configured with a short Caddyfile. These steps install Caddy 2 from its official repositories on Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9. The old unsigned repository used in earlier guides should no longer be used.

Install

# Ubuntu / Debian
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update && sudo apt install caddy

# AlmaLinux / Rocky
sudo dnf install 'dnf-command(copr)'
sudo dnf copr enable @caddy/caddy
sudo dnf install caddy
sudo systemctl enable --now caddy

Host a website with HTTPS

1. Point the domain's A (and AAAA) records to the server, and open ports 80 and 443 in the firewall.
2. Put the site in a folder: sudo mkdir -p /var/www/example.com and copy your files there.
3. Edit /etc/caddy/Caddyfile:

example.com, www.example.com {
    root * /var/www/example.com
    file_server
    encode gzip zstd
    # for PHP sites (Ubuntu 24.04 path; /run/php-fpm/www.sock on AlmaLinux/Rocky):
    # php_fastcgi unix//run/php/php8.3-fpm.sock
}

1. Check and reload: caddy validate --config /etc/caddy/Caddyfile && sudo systemctl reload caddy.
2. Open https://example.com. Caddy has requested the certificate from Let's Encrypt (or ZeroSSL) and renews it automatically.

Reverse proxy

To publish an app running on a local port: app.example.com { reverse_proxy 127.0.0.1:3000 }.

Note: On AlmaLinux/Rocky with SELinux, label the web folder: sudo semanage fcontext -a -t httpd_sys_content_t "/var/www/example.com(/.*)?" && sudo restorecon -R /var/www/example.com. Caddy and Apache/Nginx cannot both use ports 80 and 443.