Table of Contents
Was this article helpful?
Try Vultr Today with

$50 Free on Us!

Want to contribute?

You could earn up to $600 by adding new articles.

How to Install and Configure Caddy on CentOS 7

Last Updated: Mon, Nov 20, 2017
CentOS Linux Guides Web Servers


Caddy is an emerging web server program with native support for HTTP/2 and automatic HTTPS. With ease of use and security in mind, Caddy can be used to rapidly deploy an HTTPS-enabled site with a single config file.


Step 1: Install the Latest Stable Release of Caddy

On a Linux, Mac, or BSD operating system, use the following command to install the latest stable system-specific release of Caddy:

curl | bash

When prompted, input your sudo password to finish the installation.

The Caddy binary will be installed to the /usr/local/bin directory. Use the following command to confirm:

which caddy

The output shoud be:


For security purposes, NEVER run the Caddy binary as root. In order to give Caddy the ability to bind to privileged ports (e.g. 80, 443) as a non-root user, you need to run the setcap command as follows:

sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/caddy

Step 2: Configure Caddy

Create a dedicated system user: caddy and a group of the same name for Caddy:

sudo useradd -r -d /var/www -M -s /sbin/nologin caddy

Note: The user caddy created here can only be used to manage the Caddy service and cannot be used for logging in.

Create the home directory /var/www for the Caddy web server, and the home directory /var/www/ for your site:

sudo mkdir -p /var/www/

sudo chown -R caddy:caddy /var/www

Create a directory to store SSL certificates:

sudo mkdir /etc/ssl/caddy

sudo chown -R caddy:root /etc/ssl/caddy

sudo chmod 0770 /etc/ssl/caddy

Create a dedicated directory to store the Caddy config file Caddyfile:

sudo mkdir /etc/caddy

sudo chown -R root:caddy /etc/caddy

Create the Caddy config file named Caddyfile:

sudo touch /etc/caddy/Caddyfile

sudo chown caddy:caddy /etc/caddy/Caddyfile

sudo chmod 444 /etc/caddy/Caddyfile

cat <<EOF | sudo tee -a /etc/caddy/Caddyfile {

    root /var/www/





Note: The Caddyfile file created above is only a basic configuration for running a static website. You can learn more about how to write a Caddyfile here.

In order to facilitate the operations of Caddy, you can setup a systemd unit file for Caddy and then use systemd to manage Caddy.

Use the vi editor to create the Caddy systemd unit file:

sudo vi /etc/systemd/system/caddy.service

Populate the file:


Description=Caddy HTTP/2 web server

Documentation= systemd-networkd-wait-online.service



; User and group the process will run as.



; Letsencrypt-issued certificates will be written to this directory.


; Always set "-root" to something safe in case it gets forgotten in the Caddyfile.

ExecStart=/usr/local/bin/caddy -log stdout -agree=true -conf=/etc/caddy/Caddyfile -root=/var/tmp

ExecReload=/bin/kill -USR1 $MAINPID

; Use graceful shutdown with a reasonable timeout




; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.


; Unmodified caddy is not expected to use more than that.


; Use private /tmp and /var/tmp, which are discarded after caddy stops.


; Use a minimal /dev


; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.


; Make /usr, /boot, /etc and possibly some more folders read-only.


; … except /etc/ssl/caddy, because we want Letsencrypt-certificates there.

;   This merely retains r/w access rights, it does not add any new. Must still be writable on the host!


; The following additional security directives only work with systemd v229 or later.

; They further retrict privileges that can be gained by caddy. Uncomment if you like.

; Note that you may have to add capabilities required by any plugins in use.





Save and quit:


Start the Caddy service and make it automatically start on system boot:

sudo systemctl daemon-reload

sudo systemctl start caddy.service

sudo systemctl enable caddy.service

Step 3: Modify firewall rules

In order to allow visitors to access your Caddy site, you need to open ports 80 and 443:

sudo firewall-cmd --permanent --zone=public --add-service=http 

sudo firewall-cmd --permanent --zone=public --add-service=https

sudo firewall-cmd --reload

Step 4: Create a test page for your site

Use the following command to create a file named index.html in your Caddy site home directory:

echo '<h1>Hello World!</h1>' | sudo tee /var/www/

Restart the Caddy service to load new contents:

sudo systemctl restart caddy.service

Finally, point your web browser to or You should see the message Hello World! as expected.

Want to contribute?

You could earn up to $600 by adding new articles.