Whitestrake

Heck, you could extend it with Caddy Docker Proxy and go right back to the labels-as-configuration method.

https://github.com/lucaslorentz/caddy-docker-proxy

I actually do this, because I kinda like having the proxy config right next to the app config in my Compose file, but I also dislike how much manual configuration Traefik needs. Downside is you need to know how to write Caddyfile (easy enough) and then also know how to write labels so CDP translates them into the correct Caddyfile (also easy enough, but could be annoying if you're learning both at the same time). Upshot is that once you know how it translates and you know what you need to write, it works just like Traefik but with just two labels, and I think that's pretty neat.

Caddy can support a surprising amount of weird and wonderful configurations, too.

I tried to submit the Caddy configuration for this to www.gnuterrypratchett.com, but looking at it, it doesn't seem like it was ever added to the site.

The configuration is simply:

Header X-Clacks-Overhead "GNU Terry Pratchett"

It is supported by default. Out of the box you can configure it this way.

It is not _configured_ by default. There is an important distinction.

It's not mentioned in documentation because the documentation [1] does not provide an _exhaustive_ list of the kinds of addresses that Caddy can be configured to serve.

1. https://caddyserver.com/docs/caddyfile/concepts#addresses

I sign up with your website @ my website.

For example: ycombinator.com@example.com.

Nobody blocks dots in email addresses, although I have had some sites in the past email me using the first part of my email address as my name; it's amusing to open an email from example.com saying "Hi, example.com!"

Just to clarify, Caddy v1 exports metrics to Prometheus. V2 could easily do the same, it's just as extensible as v1.

https://caddyserver.com/v1/docs/http.prometheus

You were the one who posted the link! If the landing page isn't designed for HN audiences then maybe that's not the link you should have posted on HN?

The logical extreme of this statement is that @mholt shouldn't post a link to any website unless that link is specifically tailored to the average reader of the site he's posting to. That, or Hacker News is special among all websites @mholt could post to.

I don't think that's fair. I also don't see the defensiveness you see - instead, I see @mholt explaining his website's strategy for the benefit of your understanding (as well as that of any future readers). The alternative to which would be not responding to your feedback at all, as he already has sound reasoning not to incorporate your specific suggestion (which we know because he explained it).

It's important to read into the best possible interpretation of a comment and respond to that, assuming good faith, especially on communities like this one. Otherwise we begin to assume everyone is attacking or defending.

It is true. The part that makes it consistent with Uber's flouting of the law is that there's another team above the legal team, and that team's job is to find ways to maximize income.

It's a function of priority: make money > minimize legal liability > satisfy customers.

This is technically true, but contextually lacking.

acme-go/lego doesn't use HTTP validation unless you disable just about every other form of validation first. TLS-ALPN validation is much more likely, so port 443.

That said, it is very easy to allow software to bind to privileged ports without providing it root access; this has been solved for a very, very long time.

Why would a process need to run as root or have write privileges to /etc in order to automate LetsEncrypt renewals?

I run Caddy (which uses acme-go/lego as its ACME provider) as a non-root user with no access to /etc at all. It seems to be running fine.

No worries, hope it makes the facts nice and transparent for people. If anyone reading this has questions or concerns about Caddy, I'd invite further discussion over on their forums.

I believe AWS can do this because they have proof that you own the domain (effectively DNS validation) before handing out certs. Caddy can do similar with DNS validation - fetching your cert without needing to be publicly accessible. It needs you to hook into the API of one of the supported DNS providers though, because validation is still done on a per-request basis (but it has been able to do wildcards for a while). I understand that AWS is more validate once, sign certificates many times, which is quite convenient - and it all hooks into their systems fairly automatically.

I am sorry to hear about the damage done to your business. I appreciate that you took the time to list out those grievances. I'd like to respond on a few points, for the sake of clarity (if you're interested, but also for other readers here).

That header thing was indeed a bit of a fiasco; a misguided attempt to honour the few that stepped up to support Caddy monetarily. Once the depth of the issue was made clear to the developers, it was indeed walked back.

Regarding OS packaging teams - it's not the dev's responsibility to become approved package maintainers for individual distros; it's generally not done, either. The distro maintainers themselves decide which packages to make available, and how to package them. Caddy doesn't offer repos for the individual popular package managers because of the nature of Caddy's third party plugin architecture - none of the package managers allow arbitrary downloads from a build server (rightly so - the package maintaining process is intended to provide much higher assurance of security), and they don't allow for the package to be built to request either. Not only that, but those plugins may or may not be trusted by the user themselves; the usefulness of anyone being able to extend Caddy and publish their own plugin at any time comes with that downside.

The licensing arrangement was born out of a simple need - Caddy devs gotta eat. The code itself is Apache 2.0 - the Caddy project is as FOSS as it gets. The commercial part is the build server, which isn't open source - if you use it to build your binaries, those binaries are considered either commercial or personal in nature. I can tell you that the devs would like nothing more than to have a different method that would satisfy their monetary requirements so they could make the build server binaries free, too.

The idea behind exiting on start with an error is to ensure that when the user starts the server, they know straight away that there's a problem and Caddy can't do what you're asking it to (which is manage your HTTPS certificates). There are ways to get Caddy up, even with out a valid HTTPS certificate, and get your site online regardless - they're just not _automatic_.

The fragile state concept is one we come across frequently. The truth is that when people say they're restarting the server, the meaning of restart is "shut down, then start", instead of "reload". Caddy has graceful reload capabilities; you can swap the Caddyfile and even the binary itself out without interrupting the server (this isn't true on Windows, though, where varied signaling of the Caddy process is not possible in the same way as it is on *nix based systems).

I myself have posted working solutions to full live server migrations (for the entire set of websites), between two fully working and secured (HTTPS) Caddy instances, accounting for DNS propagation. It's not unsupported or difficult, just not _automatic_; it requires some specific configuration and a careful hand (like most live site migrations). The somewhat-recent filesystem clustering Caddy does isn't even related to migration - it's actually supportive of distributed fleets solving challenges for other instances. You've always been able to share the TLS assets between Caddy instances and have them be used.

I wish I (or the developers) had been given a chance to offer some guidance - I believe we would have been able to help avoid some of the downtime and losses suffered by your business.

I help out a lot at Caddy's community forums. I'd like to know more about your experience with Caddy.

user-hostile behavior

Which behaviour is user-hostile? Perhaps we could address it?

outright dangerous behavior in the way it fetches SSL certificates

For reference, Caddy uses https://github.com/xenolf/lego/ for its ACME interactions with LetsEncrypt. Could you elaborate on what part of Caddy's behaviour is _dangerous_?

very bad choice for critical sites

What makes it a bad choice, exactly?

Investors are gonna invest, right? They're there to make money. Presumably they believe the company's operations are legal and likely to provide returns.

My civil rights _should_ trump your parliamentary privilege (in an ideal world, I guess)...

They have to attempt to keep Apple from learning about it, as I understand it. I wonder what steps Apple will take to bar this kind of eventuality. If an employee makes a good faith attempt to comply with this request, which is then blocked by the overseas manufacturer, can they throw their hands up and say, "Well, I tried!"? Would this allow them to avoid the $50k fine and 10 years in jail the Government can hand out for not complying?

I find myself disappointed that they took away `.dev` as local development TLD, and this is what they start using it for.

Requiring rewriting titles is a bad idea as you are never in an automated fashion going to make a better title.

Depends on how you define "better".

I would argue that a rewritten title you can read is "better" than an un-rewritten title you can't read because the site couldn't "link" it without risking a lawsuit or signing an agreement.

With more decentralization comes more freedom of association; I will choose to be a part of communities that I judge to have a reasonable view of what is "hatred", and those communities will, just like they do today, kick out offenders.

Decentralization will give people the opportunity to spread their hatred among themselves, without involving me, which is... exactly how things operate today.

So... Bring on infotech decentralization, I guess. It's got its merits, and for me, nothing about all this hate speech will change.

Not knowing the difference between ignorance and knowledge.

Like the Dunning-Kruger Effect?

https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect

Can't think of a better explanation than this video by CGP Grey, titled "This Video Will Make You Angry", [7:26].

https://www.youtube.com/watch?v=rE3j_RHkqJc

If the blocking issue is a startup connection to its controller, could this be mitigated by having a local controller?

it does not need SSL to be "secure".

do not need to be "secured"

Which is it - is the site secure without SSL, or does the site not need to be secure?

In the former case, I disagree wholeheartedly. In the latter case, you're not blocked from browsing the site - only informed that it is insecure, a factual statement.

Attempting to enforce deregulation is regulation.

Ahh, if only Apple released a non-touchbar MBP with Touch ID! I'd have used this in a heartbeat.

Do you have to settle for just one?

I have catch-alls set up across several domains I own, they all go into one inbox and replies etc. are sent from the same email the original was addressed to, automatically.

I usually use one domain for casual use (like games, Twitch, anonymous services), one for semi-professional stuff (with my real name), and one for actual business.

I think that GP has an issue with the implication that the publisher is in a position of power to allow this behaviour in the first place and could also possibly deny it.

I'm criticizing the people that make that argument because they've been responded to over and over again, and yet they still make exactly the same argument

This statement might be true as a generalisation, but is probably not true for this specific instance of conversation in this thread. I certainly haven't been responded to over and over again, yet I considered making similar arguments.

I appreciate the effort you've put into your points, though - thank you.

As another grid-noob, I thought I'd try to tackle this one. It seems to require only one additional style to define the grid:

    <div style="display:grid; grid:auto/repeat(auto-fit,minmax(min-content,0)); justify-content:space-between;">
      <div>Left</div>
      <div>Right</div>
    </div>

It's strictly less effort to do this with flex, but I expect that as soon as you have more than two single-word divs as children, Grid becomes more useful.

Dismissing an argument because it's often repeated by many people sounds like you're making an argument against popularity, maybe even a fallacy fallacy.

Other than the link at the end of your post, I don't think anything you said actually challenges the opposing argument.

This sounds less like a one-time-pad and more like a random string broken off into multiple individual one-time-pads.