Serve the site with Caddy and HTTPS

The server is locked down and the domain points at it. This page puts a web server in front: it opens the web ports, installs Caddy from its official repository, creates the web root with a placeholder page, writes one Caddyfile, and checks from your laptop that https://example.com answers with a valid certificate. The next page replaces the placeholder with the real site.

Before you start

$dig +short A example.com

203.0.113.10

Open the web ports

$sudo ufw allow 80/tcp
$sudo ufw allow 443/tcp
$sudo ufw allow 443/udp

Install Caddy

$sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl gnupg
$curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
$curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
$sudo chmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg
$sudo chmod o+r /etc/apt/sources.list.d/caddy-stable.list
$sudo apt update && sudo apt install -y caddy

$systemctl is-active caddy

active

Create the web root and a placeholder

$sudo install -d -m 755 /var/www/example.com/releases/placeholder
$echo '<!doctype html><meta charset="utf-8"><title>example.com</title><p>example.com is being set up. Back soon.</p>' | sudo tee /var/www/example.com/releases/placeholder/index.html
$echo '<!doctype html><meta charset="utf-8"><title>Not found</title><p>404: nothing here.</p>' | sudo tee /var/www/example.com/releases/placeholder/404.html
$sudo ln -sfn releases/placeholder /var/www/example.com/current

Write the Caddyfile

The block below is the whole of /etc/caddy/Caddyfile, already set for the two choices of this page, HSTS and IP masking in the logs: change them in the panel and the file follows. Copy the command and paste it in the terminal. It replaces the default file in one go; there is nothing to add to it afterwards.

{
    email ${ADMIN_EMAIL}
}
www.example.com {
    redir https://example.com{uri} permanent
}
example.com {
    root * /var/www/example.com/current
    encode zstd gzip
    file_server
    handle_errors 404 {
        rewrite * /404.html
        file_server
    }
    header {
        X-Content-Type-Options "nosniff"
        Referrer-Policy "strict-origin-when-cross-origin"
        X-Frame-Options "DENY"
        Permissions-Policy "camera=(), microphone=(), geolocation=()"
        -Server
    }
    @static path /_next/static/*
    header @static Cache-Control "public, max-age=31536000, immutable"
    @media path *.jpg *.jpeg *.png *.webp *.avif *.svg *.mp3 *.opus *.wav *.mp4
    header @media Cache-Control "public, max-age=604800"
    header Strict-Transport-Security "max-age=86400"
    log {
        output file /var/log/caddy/access.log {
            roll_size 10MiB
            roll_keep 10
        }
        format filter {
            request>remote_ip ip_mask 16 32
            request>client_ip ip_mask 16 32
        }
    }
}

HSTS. The Strict-Transport-Security line of the file follows your choice.

Validate and reload

$sudo -u caddy caddy validate --config /etc/caddy/Caddyfile
$sudo systemctl reload caddy
$sudo journalctl -u caddy -f

$dig +short A example.com
$dig +short A www.example.com
$dig +short AAAA example.com
$dig +short CAA example.com

$sudo vim /etc/caddy/Caddyfile

    acme_ca https://acme-staging-v02.api.letsencrypt.org/directory

Check it from your laptop

$curl -sI https://example.com/ | head -1

HTTP/2 200

$curl -sI https://www.example.com/ | head -1

HTTP/2 301

$curl -sI https://www.example.com/ | grep -i '^location'

location: https://example.com/

$curl -s -o /dev/null -w '%{http_code}' https://example.com/nope/

404

$curl -sI https://example.com/ | grep -ci '^strict-transport-security'

1

Done

example.com now answers over HTTPS with a Let's Encrypt certificate that Caddy renews on its own, well before expiry. www and plain HTTP redirect to https://example.com, HTTP/3 is available, static assets are cached hard, and the access log rotates itself with masked addresses. Visitors see the placeholder.

The next page, Deploy atomic releases with rsync, builds the Next.js site on your laptop, uploads it as a new release under /var/www/example.com, and swaps the current link to put it live.