dhimanparas20/caddy repository overview

⁠Custom Secured Caddy: Rate Limit + CrowdSec + Coraza WAF + Native Healthcheck

⁠Overview

This is a custom-built, highly secure Docker image based on the official caddy:latest runtime. It has been compiled using xcaddy to include three powerful, enterprise-grade security modules, transforming Caddy from a standard web server into a robust Web Application Firewall (WAF) and bot-blocking proxy.

Additionally, this image features a native, built-in Docker Healthcheck, making it completely self-monitoring right out of the box.

⁠Included Features & Modules

1. Rate Limiting: github.com/mholt/caddy-ratelimit
2. Smart IP Blocking: github.com/hslatman/caddy-crowdsec-bouncer/http
3. Web Application Firewall (WAF): github.com/corazawaf/coraza-caddy/v2
4. Self-Monitoring: Baked-in HEALTHCHECK using wget to ensure the server is actively routing traffic, not just holding a port open.

⁠Why Use This Image?

The standard Caddy binary is fantastic for automatic HTTPS and reverse proxying, but it lacks native application-layer security. This image provides a Defense in Depth architecture with zero extra build steps required on your host machine:

• Stop Brute Force Attacks: Natively limit requests per second/minute to protect login endpoints and APIs.
• Block Known Botnets: Integrate seamlessly with CrowdSec to automatically drop connections from known malicious IP addresses before they hit your app.
• Prevent Intrusions: Inspect payloads for SQL injections, Cross-Site Scripting (XSS), and common scanner signatures using Coraza WAF.
• Plug-and-Play Reliability: Because the healthcheck is baked directly into the Dockerfile, orchestration tools (like Docker Swarm or simple Compose setups) will automatically know if the container is healthy without needing bulky configuration blocks.

⁠How to Use

⁠1. Docker Compose

Simply drop this image into your docker-compose.yml. Notice that you do not need a healthcheck block in your compose file—Docker reads it directly from the image automatically!

services:
  caddy:
    image: dhimanparas20/caddy:latest
    container_name: custom-caddy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./caddy_data:/data
      - ./caddy_config:/config