Use Caddy as a Reverse Proxy for Automatic SSL

Caddy is a reverse proxy that provisions and renews HTTPS certificates automatically through Let's Encrypt, so n8n gets SSL, HTTP/2, and WebSocket support with almost no configuration. Its entire reverse proxy for n8n is a three-line Caddyfile, and it removes the cron renewal scripts and certificate paths that the Nginx-plus-Certbot approach requires.

What is Caddy and why use it with n8n?

Caddy provides automatic HTTPS via Let's Encrypt with zero certificate management. Compared to the Nginx + Certbot combination, Caddy eliminates cron-based renewal scripts, manual certificate paths, and SSL configuration boilerplate. Its entire reverse proxy config for n8n fits in three lines.

Real-world example: You expose n8n at n8n.example.com with automatic SSL, HTTP/2, and WebSocket support (required for the n8n editor).

How do you configure Caddy for n8n?

Caddyfile

n8n.example.com {
    reverse_proxy n8n:5678
}

docker-compose.yml (adding Caddy)

services:
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"  # HTTP/3

    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      n8n:
        condition: service_healthy

  n8n:
    image: n8nio/n8n:1.94.1
    restart: unless-stopped
    # Remove the ports mapping -- Caddy handles external access

    # ports:

    #   - "5678:5678"

    environment:
      N8N_HOST: n8n.example.com
      N8N_PROTOCOL: https
      WEBHOOK_URL: https://n8n.example.com/

volumes:
  caddy_data:
  caddy_config:

How does Caddy handle SSL and WebSockets?

Tip: WebSocket Support Caddy automatically proxies WebSocket connections. No additional upgrade or connection headers are needed, unlike Nginx where you must explicitly configure proxy_set_header Upgrade and proxy_set_header Connection.

Caddy will automatically obtain and renew a TLS certificate for n8n.example.com, redirect HTTP to HTTPS, and enable HTTP/2 -- all with the two-line Caddyfile above.

Related: Set a Unique Encryption Key and Back It Up · Configure Payload Size and Binary Data Mode for Large Files