转：Caddy部署

转自：https://www.giuem.com/caddy-tutorial-for-debian/

下载安装

首先去 Download Caddy 选择你需要的插件，然后复制下方的 One-step installer script (bash)，例如我的是

<span class="line">curl https://getcaddy.com | bash -s http.cache,http.cors,http.expires,http.filemanager,http.git,http.ipfilter,http.minify,http.nobots,http.ratelimit,http.realip,tls.dns.cloudflare</span> 1 <span class="line">curl https://getcaddy.com | bash -s http.cache,http.cors,http.expires,http.filemanager,http.git,http.ipfilter,http.minify,http.nobots,http.ratelimit,http.realip,tls.dns.cloudflare</span>

安装完后输入 which caddy，不出意外的话会输出 /usr/local/bin/caddy

至此，安装完毕，但是目前它不会开机自启，只是简单地把二进制文件下载下来，所以下一步要注册服务。

注册服务

这里我使用的是官方提供的脚本 caddy.service，其他系统也可以在这里找到相应的脚本。

把这个文件下载到 /etc/systemd/system/ 。

<span class="line">sudo curl -s https://raw.githubusercontent.com/mholt/caddy/master/dist/init/linux-systemd/caddy.service -o /etc/systemd/system/caddy.service</span> 1 <span class="line">sudo curl -s https://raw.githubusercontent.com/mholt/caddy/master/dist/init/linux-systemd/caddy.service -o /etc/systemd/system/caddy.service</span>

创建所需目录，我图方便没有修改脚本直接使用默认值了，如果有特殊需求，可以自己更改目录。

<span class="line">sudo mkdir /etc/caddy</span> <span class="line">sudo chown -R root:www-data /etc/caddy</span> <span class="line">sudo touch /etc/caddy/Caddyfile</span> <span class="line">sudo mkdir /etc/ssl/caddy</span> <span class="line">sudo chown -R www-data:root /etc/ssl/caddy</span> <span class="line">sudo chmod 0770 /etc/ssl/caddy</span> <span class="line">sudo mkdir /var/www</span> <span class="line">sudo chown www-data:www-data /var/www</span> 1 2 3 4 5 6 7 8 9 10 <span class="line">sudo mkdir /etc/caddy</span> <span class="line">sudo chown -R root:www-data /etc/caddy</span> <span class="line">sudo touch /etc/caddy/Caddyfile</span>   <span class="line">sudo mkdir /etc/ssl/caddy</span> <span class="line">sudo chown -R www-data:root /etc/ssl/caddy</span> <span class="line">sudo chmod 0770 /etc/ssl/caddy</span>   <span class="line">sudo mkdir /var/www</span> <span class="line">sudo chown www-data:www-data /var/www</span>

上面创建了三个目录，/etc/caddy 用了存放 Caddy 的配置文件，/etc/ssl/caddy 存放证书，/var/www 是默认的网站目录。

接着，重新加载 systemd daemon，让配置生效。

<span class="line">sudo systemctl daemon-reload</span> 1 <span class="line">sudo systemctl daemon-reload</span>

让 Caddy 开机自启。

<span class="line">sudo systemctl enable caddy.service</span> 1 <span class="line">sudo systemctl enable caddy.service</span>

至此，Caddy 已经成功注册服务，并能够开机自启了。

配置

这部分的内容我不打算详细记录，主要是官方文档已经写的很详细了。

下面是我的配置，

<span class="line">example.com {</span> <span class="line"> <span class="built_in"> proxy </span>/ 127.0.0.1:9001 {</span> <span class="line"> header_upstream Host {host}</span> <span class="line"> header_upstream X-Real-IP {remote}</span> <span class="line"> header_upstream X-Forwarded-For {remote}</span> <span class="line"> header_upstream X-Forwarded-Proto {scheme} </span> <span class="line"> }</span> <span class="line"> gzip</span> <span class="line"> header / -Server</span> <span class="line"> header / Strict-Transport-Security <span class="string">"max-age=31536000;"</span></span> <span class="line"> tls user@example.com {</span> <span class="line"> protocols tls1.0 tls1.2</span> <span class="line"> <span class="built_in"> dns </span>cloudflare</span> <span class="line"> }</span> <span class="line">}</span> 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 <span class="line">example.com {</span> <span class="line"> <span class="built_in"> proxy </span>/ 127.0.0.1:9001 {</span> <span class="line">    header_upstream Host {host}</span> <span class="line">    header_upstream X-Real-IP {remote}</span> <span class="line">    header_upstream X-Forwarded-For {remote}</span> <span class="line">    header_upstream X-Forwarded-Proto {scheme}  </span> <span class="line">  }</span> <span class="line">  gzip</span> <span class="line">  header / -Server</span> <span class="line">  header / Strict-Transport-Security <span class="string">"max-age=31536000;"</span></span> <span class="line">  tls user@example.com {</span> <span class="line">    protocols tls1.0 tls1.2</span> <span class="line">   <span class="built_in"> dns </span>cloudflare</span> <span class="line">  }</span> <span class="line">}</span>

如果要使用 DNS 的方式认证域名的话，需要设置环境变量，修改 /etc/systemd/system/caddy.service ，加入环境变量，我使用的是 CloudFlare 的 DNS，所以我需要添加 CLOUDFLARE_EMAIL 和 CLOUDFLARE_API_KEY ，其他 DNS 看这里 。

<span class="line">[Service]</span> <span class="line"><span class="built_in">..</span>.</span> <span class="line"><span class="built_in">..</span>.</span> <span class="line"><span class="attribute">Environment</span>=CADDYPATH=/etc/ssl/caddy</span> <span class="line">+ <span class="attribute">Environment</span>=CLOUDFLARE_EMAIL=xxx</span> <span class="line">+ <span class="attribute">Environment</span>=CLOUDFLARE_API_KEY=xxx</span> <span class="line"><span class="built_in">..</span>.</span> <span class="line"><span class="built_in">..</span>.</span> 1 2 3 4 5 6 7 8 9 10 <span class="line">[Service]</span> <span class="line"><span class="built_in">..</span>.</span> <span class="line"><span class="built_in">..</span>.</span>   <span class="line"><span class="attribute">Environment</span>=CADDYPATH=/etc/ssl/caddy</span> <span class="line">+ <span class="attribute">Environment</span>=CLOUDFLARE_EMAIL=xxx</span> <span class="line">+ <span class="attribute">Environment</span>=CLOUDFLARE_API_KEY=xxx</span>   <span class="line"><span class="built_in">..</span>.</span> <span class="line"><span class="built_in">..</span>.</span>

写完配置后输入 sudo systemctl start caddy.service 启动 Caddy。

输入 journalctl --boot -u caddy.service 可以查看日志。

启用 QUIC

关于 QUIC 的介绍，可以看一下这篇文章，一句话概况呢就是减少 TLS 握手次数，加快网站速度。

修改 /etc/systemd/system/caddy.service ，在 ExecStart=/usr/local/bin/caddy -log stdout -agree=true -conf=/etc/caddy/Caddyfile -root=/var/tmp 后面加上 -quic ，即

<span class="line">ExecStart=/usr/local/bin/caddy -log stdout -agree=true -conf=/etc/caddy/Caddyfile -root=/var/tmp -quic</span> 1 <span class="line">ExecStart=/usr/local/bin/caddy -log stdout -agree=true -conf=/etc/caddy/Caddyfile -root=/var/tmp -quic</span>

然后重新加载 Systemd，并重启 Caddy

<span class="line">sudo systemctl daemon-reload</span> <span class="line">sudo systemctl restart caddy.service</span> 1 2 <span class="line">sudo systemctl daemon-reload</span> <span class="line">sudo systemctl restart caddy.service</span>

同时，别忘了给主机开放 443 (UDP) 端口。

目前 QUIC 只有 Chrome 支持，并且需要手动开启（默认只有白名单域名启用）。访问 chrome://flags/#enable-quic，切换为 Enabled 即可。开启后，重启 Chrome，访问网站，通过 Chrome DevTools – Security 可以看到协议已经是 QUIC 了。