chaidocs
linux

6. The Capstone Project

Akash Kadlag 9 pages 2 min read Updated Oct 20, 2026
On this page
  1. Welcome
  2. Trapped on Localhost
  3. Why Not Expose Direct Ports?
  4. Enter the Reverse Proxy
  5. The Magic of Caddyfile
  6. Routing Traffic: API vs UI
  7. Watch Out: Order Matters!
  8. Test First, Reload Gracefully
  9. Why Caddy Instead of Nginx?

Welcome

01 Welcome

Trapped on Localhost

02 A locked cloud-kitchen warehouse labeled 127.0.0.1 with hungry customers waiting outside a closed security gate.
Notes
• Both your API and SSR Frontend are running happily under systemd. • But both are locked inside `127.0.0.1` (loopback). • Nobody outside can access them yet. • We need a single, secure HTTPS gateway to open shop to the public.

Why Not Expose Direct Ports?

03 A user confused between two browser tabs: 'zomato.com:3000' and 'zomato.com:3001' with warning signs over open ports.
Notes
• Imagine asking users to visit `zomato.com:3000` for the app and `:3001` to order food. • Exposing raw ports doubles your attack surface to hackers. • Handling SSL/TLS certificates directly inside Node or Hono is messy and fragile. • You need one single front desk to handle routing, security, and traffic.

Enter the Reverse Proxy

04 Flow diagram: Mobile user -> HTTPS -> Caddy Reverse Proxy -> forwards internally to Port 3000 (UI) and Port 3001 (API).
Notes
• A reverse proxy stands at the public entrance on standard web ports (80 / 443). • Like a Swiggy delivery partner picking items from a closed dark store, users never talk to your backend directly. • The proxy accepts the public HTTPS request, hands it to internal ports, and returns the response.

The Magic of Caddyfile

05 A clean notepad showing your domain name with a shiny green padlock stamped on top automatically.
Notes
• Config file lives at `/etc/caddy/Caddyfile`. • Simply typing your domain at the top automatically provisions free, auto-renewing SSL certificates. • Zero manual Certbot setup or cron jobs required.

Routing Traffic: API vs UI

06 A traffic cop routing a '/api/payment' car to lane 3001 and a standard 'homepage' car to lane 3000.
Notes
• `handle /api/*`: Forwards backend calls to Hono listening on `127.0.0.1:3001`. • `handle`: Catch-all rule forwards everything else to your SSR frontend on `127.0.0.1:3000`. • Remember: The frontend isn't just static files; it is a live Node server rendering pages on the fly.

Watch Out: Order Matters!

07 A giant funnel labeled 'Catch-All' incorrectly sitting above a smaller funnel labeled '/api/*', intercepting all packets.
Notes
• Caddy reads your `handle` blocks sequentially, and the first match wins. • If you place the catch-all block at the top, it swallows all `/api/*` traffic. • Like an IRCTC queue: specific queues (Tatkal / Ladies) must come before the general catch-all line.

Test First, Reload Gracefully

08 A safety-check checklist with green checkmarks, followed by a smooth running train without stopping at the platform.
Notes
• Run `sudo caddy validate`: Checks your config syntax before applying, avoiding accidental crashes. • Run `sudo systemctl reload caddy`: Applies changes seamlessly without dropping active user connections. • Perfect for zero-downtime updates during peak IPL match hours.

Why Caddy Instead of Nginx?

09 Side-by-side comparison: Nginx needing multiple tools and scripts vs Caddy holding a built-in HTTPS shield in one hand.
Notes
• Nginx is the industry workhorse behind giant apps like Flipkart and Paytm. • But Nginx demands manual SSL certificate setup with tools like Certbot. • Caddy gives you built-in, out-of-the-box HTTPS with just 5 lines of config.