---
title: 6. The Capstone Project
collection: linux
author: Akash Kadlag
updated: 2026-10-20
source: https://docs.chaicode.com/linux/the-capstone-project
---

# 6. The Capstone Project

![Welcome](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/f877da1c2d62d506cb83900b22de7140d4aa9af099d396b5672ee10519fcb17a.png)

Welcome

![A locked cloud-kitchen warehouse labeled 127.0.0.1 with hungry customers waiting outside a closed security gate.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/35662aa7b7bcf8c90b2b5705f3515c437e2f7e10b60e425818d4c9b7f2959279.png)

Trapped on Localhost — • Both your API and SSR Frontend are running happily under systemd.
• But both are locked inside `127.0.0.1` (loopback).
• Nobody outside can access them yet.
• We need a single, secure HTTPS gateway to open shop to the public.

![A user confused between two browser tabs: 'zomato.com:3000' and 'zomato.com:3001' with warning signs over open ports.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/216ea7e6e308e9e4c800b5f0345c1ab2cd3dc70d959ee3a50b63b13fc2cd7a1f.png)

Why Not Expose Direct Ports? — • Imagine asking users to visit `zomato.com:3000` for the app and `:3001` to order food.
• Exposing raw ports doubles your attack surface to hackers.
• Handling SSL/TLS certificates directly inside Node or Hono is messy and fragile.
• You need one single front desk to handle routing, security, and traffic.

![Flow diagram: Mobile user -> HTTPS -> Caddy Reverse Proxy -> forwards internally to Port 3000 (UI) and Port 3001 (API).](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/bb964c1f18a8b30f3dc49ca03559ff1be47a35d84fbda68e73d31b7642a56121.png)

Enter the Reverse Proxy — • A reverse proxy stands at the public entrance on standard web ports (80 / 443).
• Like a Swiggy delivery partner picking items from a closed dark store, users never talk to your backend directly.
• The proxy accepts the public HTTPS request, hands it to internal ports, and returns the response.

![A clean notepad showing your domain name with a shiny green padlock stamped on top automatically.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/847186a259c4dcc6c0f49253c815e2f3fee48f4b6ba9eedf67fea50f0c997d70.png)

The Magic of Caddyfile — • Config file lives at `/etc/caddy/Caddyfile`.
• Simply typing your domain at the top automatically provisions free, auto-renewing SSL certificates.
• Zero manual Certbot setup or cron jobs required.

![A traffic cop routing a '/api/payment' car to lane 3001 and a standard 'homepage' car to lane 3000.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/efa131700032d50e1aee88914b6604cd9e5cdaa09641d62214bf65ef11ff0922.png)

Routing Traffic: API vs UI — • `handle /api/*`: Forwards backend calls to Hono listening on `127.0.0.1:3001`.
• `handle`: Catch-all rule forwards everything else to your SSR frontend on `127.0.0.1:3000`.
• Remember: The frontend isn't just static files; it is a live Node server rendering pages on the fly.

![A giant funnel labeled 'Catch-All' incorrectly sitting above a smaller funnel labeled '/api/*', intercepting all packets.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/2902f04a91c67c7a49633e1559214de0de639b1af6860e7bf2a28b19cd5a1972.png)

Watch Out: Order Matters! — • Caddy reads your `handle` blocks sequentially, and the first match wins.
• If you place the catch-all block at the top, it swallows all `/api/*` traffic.
• Like an IRCTC queue: specific queues (Tatkal / Ladies) must come before the general catch-all line.

![A safety-check checklist with green checkmarks, followed by a smooth running train without stopping at the platform.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/2c3258110a50a921d18cd94b1a82eb549c11ba1a4d016977b50aea731d5192c3.png)

Test First, Reload Gracefully — • Run `sudo caddy validate`: Checks your config syntax before applying, avoiding accidental crashes.
• Run `sudo systemctl reload caddy`: Applies changes seamlessly without dropping active user connections.
• Perfect for zero-downtime updates during peak IPL match hours.

![Side-by-side comparison: Nginx needing multiple tools and scripts vs Caddy holding a built-in HTTPS shield in one hand.](https://docs.chaicode.com/cdn-cgi/image/width=1600,format=auto,fit=scale-down/assets/85211e254d905b35cd4b51df467b7c394996b677c9f64456944da3af162074b1.png)

Why Caddy Instead of Nginx? — • Nginx is the industry workhorse behind giant apps like Flipkart and Paytm.
• But Nginx demands manual SSL certificate setup with tools like Certbot.
• Caddy gives you built-in, out-of-the-box HTTPS with just 5 lines of config.