Skip to content

Operations

This page covers running Caddy HTTPS Gateway day to day: how it is secured, how it is updated, what to back up, where the logs are, and how to get help.

Security model

  • Loopback only. Caddy listens on 127.0.0.1 ports 8080, 8443 and 2019. Nothing is reachable from the network until you change the Caddyfile and the security group yourself.
  • Unprivileged service. Caddy runs as the caddy system user, without the capability to bind ports below 1024.
  • Per-instance secrets. The basic auth password and the local CA are created on first boot. The password file is readable only by root. The CA private key stays under /var/lib/caddy/data, readable only by caddy. Only the public CA certificate is copied to /etc/caddy/local-root.crt.
  • SSH. Password authentication and root login are turned off.
  • No AWS access. Caddy does not call AWS APIs and needs no IAM permissions. If you later connect it to an AWS service, attach a role limited to just that.

Manage the service

sudo systemctl status caddy
sudo systemctl reload caddy
sudo systemctl restart caddy

caddy.service waits for sushi-caddy-firstboot.service, which prepares the instance on first boot. On later boots it leaves an existing Caddyfile unchanged.

Each time Caddy starts, it copies the public CA certificate to /etc/caddy/local-root.crt. If that certificate does not appear within about 60 seconds, the service start fails rather than running without it.

Logs

Caddy logs to the systemd journal:

sudo journalctl -u caddy --no-pager -n 100
sudo journalctl -u sushi-caddy-firstboot --no-pager

Updates

  • Ubuntu packages get security updates automatically through unattended upgrades.
  • Caddy itself is pinned at v2.11.7. Unattended upgrades do not replace /usr/bin/caddy. A new Caddy release comes as a new version of the AMI: launch it, restore your backup, and move traffic over.

Do not run caddy upgrade

It downloads a different binary from outside the image. Update by launching a new version of the AMI instead.

Backups

Back up these paths together before you replace the instance:

  • /etc/caddy/Caddyfile
  • /etc/caddy/pilot.password
  • /var/lib/caddy/data
  • /etc/caddy/local-root.crt (public, safe to copy)

If /var/lib/caddy/data is lost, Caddy creates a new local CA on the next start, and clients that trusted the old local-root.crt stop trusting the gateway until you give them the new one.

The root volume is the only disk. There is no separate data volume.

Check the installation

The image includes a self-test that runs as root. It starts the services if they are not running, makes requests on loopback, checks a wrong and a right password, reloads Caddy during a download, and confirms every socket is on loopback:

sudo bash /opt/sushi/bin/smoke.sh

It ends with SUSHI_CADDY_SMOKE_PASSED when every check passes. The self-test and the walkthrough expect the default Caddyfile and sample site, so run them before you change the configuration.

Support

Software Sushi provides AMI packaging and setup guidance. Email info@softwaresushi.com with installation questions. Support coverage beyond that requires a separate agreement. This offer does not include support from the Caddy project.