morsalin1342/caddy repository overview

⁠Caddy — Production-Ready Web Server with Essential Plugins

Maintained by morsalin1342⁠ · GitHub⁠

A custom Caddy build with the OWASP Coraza WAF, rate limiting, AI-crawler blocking, Brotli compression, HTTP caching, and 6 DNS challenge providers for automatic HTTPS.

⁠✨ Why This Image?

⁠Quick Start

docker run -d --name caddy \
    -p 80:80 -p 443:443 -p 443:443/udp \
    -v $(pwd)/Caddyfile:/etc/caddy/Caddyfile:ro \
    -v caddy_data:/data \
    morsalin1342/caddy:latest

⁠Example Caddyfile

{
    order coraza_waf first
}

example.com {
    encode zstd gzip
    cache
    coraza_waf {
        load_owasp_crs
        directives `
            Include @coraza.conf-recommended
            Include @crs-setup.conf.example
            Include @owasp_crs/*.conf
            SecRuleEngine DetectionOnly
        `
    }
    reverse_proxy localhost:8080
}

load_owasp_crs is required for the @ include paths to resolve. Start in DetectionOnly, tune out false positives, then switch to On.

⁠What's Included

⁠Available Tags

latest, 2.11.4 — version-tagged for production stability.

⁠❓ FAQ

Q: How do I turn the WAF on? A: Add order coraza_waf first to the global options, then a coraza_waf block with load_owasp_crs. Without load_owasp_crs the @ include paths do not resolve and Caddy fails at startup. Start at SecRuleEngine DetectionOnly.

Q: How do I get a wildcard certificate? A: All six DNS providers are pre-compiled. Set your provider's credentials and use the tls directive with dns <provider>.

Q: Can I use this with PHP? A: Use frankenphp⁠ for Caddy and PHP in one container, or pair this with php⁠ over FastCGI.

⁠🔗 Related Images & Tools

⭐ If this image helps you, consider giving it a star on GitHub⁠!