/root/web/caddy 目录存储Caddyfile/root/web/site 目录存储web网页/${HOME}/.local/share/caddy   Caddy2 会自动创建的 data storage 目录，用来存储CA证书 /${HOME}/.config/caddy/     Caddy2会自动创建的配置文件路径，比如存放 autosave.json 文件等

#download
wget https://github.com/caddyserver/caddy/releases/download/v2.4.6/caddy_2.4.6_linux_amd64.tar.gz#upzip
tar -zxf caddy_2.4.6_linux_amd64.tar.gz caddy#copy file to program path
mv ./caddy  /usr/local/bin/#设置仅root账号能写caddy二进制文件，其他账号可读可执行
chmod 755 /usr/local/bin/caddy#check caddy 程序
which caddy
caddy version

groupadd --system caddyuseradd --system \
--gid caddy \
--create-home \
--home-dir /var/lib/caddy \
--shell /usr/sbin/nologin \
--comment "Caddy web server" \
caddy

#创建一个空的 Caddyfile， 该文件并不是json格式， Caddy还支持另一种adapt的Json配置文件， 用的较少
#推荐将Caddyfile放到 /etc/caddy 路径下，这里为了方便备份放到 root 账号的路径下了。
mkdir -p /root/web/caddy/#设置目录的owner为root账号和caddy group账号
chown -R root:caddy  /root/web/caddy

touch /root/web/caddy/Caddyfile

#创建web网页的存储目录
mkdir -p /root/web/site#将目录的owner设置好为caddy group和user账号
chown caddy:caddy /root/web/site 

#该配置文件中包含 Caddyfile 路径
touch /etc/systemd/system/caddy.service#设置仅root账号可以修改该文件
chmod 644 /etc/systemd/system/caddy.service

# caddy.service
#
# For using Caddy with a config file.
#
# Make sure the ExecStart and ExecReload commands are correct
# for your installation.
#
# See https://caddyserver.com/docs/install for instructions.
#
# WARNING: This service does not use the --resume flag, so if you
# use the API to make changes, they will be overwritten by the
# Caddyfile next time the service is restarted. If you intend to
# use Caddy's API to configure it, add the --resume flag to the
# `caddy run` command or use the caddy-api.service file instead.[Unit]
Description=Caddy
Documentation=https://caddyserver.com/docs/
After=network.target network-online.target
Requires=network-online.target[Service]
Type=notifyUser=caddy
Group=caddy
ExecStart=/usr/local/bin/caddy run --environ --config /root/web/caddy/Caddyfile
ExecReload=/usr/local/bin/caddy reload --config /root/web/caddy/Caddyfile
TimeoutStopSec=5s
LimitNOFILE=1048576
LimitNPROC=512
PrivateTmp=true
ProtectSystem=full
AmbientCapabilities=CAP_NET_BIND_SERVICE[Install]
WantedBy=multi-user.target

#(可选，仅CentOS)，关闭防火墙(如果之前没关闭的话)
systemctl status firewalld
systemctl stop firewalld
systemctl mask firewalld    # 如果不想关闭，可以加如下规则
firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --permanent --zone=public --add-service=https
firewall-cmd --reload

# reloading daemon to apply caddy system service file
sudo systemctl daemon-reload# starting caddy
sudo systemctl start caddy# activating caddy system file
sudo systemctl enable caddy
sudo systemctl restart caddy

#check statussystemctl status caddy.service

1 自签名方式，caddyfile中的语法：tls self_signedCaddy生成一个不可信的自签名证书，但可达到了密文传输的效果， 该证书持续7天，所以它一般仅用于本地开发。
2. 手工向证书发行方申请手动从证书发行方申请证书，然后在Caddy配置中指定证书和秘钥文件路径：tls /path/example.com.crt /path/example.com.key
3. 主机自动申请方式如果目标域名(例如: example.com)已经解析到了本机，那么 Caddy2 启动后会尝试自动通过 ACME HTTP 申请证书(默认的证书发行方为 let's encrypt)。优点：配置简单，语法如下， 后面的 email 参数是告知 CA 申请人的邮箱。tls email
2. dns 自动申请方式Let's encrypt通过域名服务商提供的域名解析记录api，来验证我们对域名的所有权。优点：不需要任何公网IP地址，只要通过dns的解析记录即可完成验证； 另外，如果网站启用了 CDN，必须使用这个方式。缺点：配置比较麻烦，需要设置一些环境变量，另外还需要下载对应dns 服务商的插件(插件简化了caddy调用DNS服务商API的过程)，。 caddyfile中的语法：tls {dns <provider> ...}

http://example.com {redir https://example.com{url}
}https://example.com {tls hostmaster@example.comroot * /root/web/siteencode gzipfile_serverheader / {Content-Security-Policy = "upgrade-insecure-requests; default-src 'self'; style-src 'self'; script-src 'self'; img-src 'self'; object-src 'self'; worker-src 'self'; manifest-src 'self';"Strict-Transport-Security = "max-age=63072000; includeSubDomains; preload"X-Xss-Protection = "1; mode=block"X-Frame-Options = "DENY"X-Content-Type-Options = "nosniff"Referrer-Policy = "strict-origin-when-cross-origin"Permissions-Policy = "fullscreen=(self)"cache-control = "max-age=0,no-cache,no-store,must-revalidate"}
}

# 以后台的方式启动 caddy
caddy start -config  /root/web/caddy/Caddyfile# 以前台的方式启动 caddy
caddy run -config  /root/web/caddy/Caddyfile# 停止
caddy stop # reload 配置文件
caddy reload  -config  /root/web/caddy/Caddyfile # 安装 CA 证书到本地目录
caddy trust# 美化(格式化) Caddyfile
caddy fmt -overwrite /root/web/caddy/Caddyfile# 将标准的 Caddyfile 转成 json 格式的等效配置文件， 一般不用这种配置文件
caddy adapt -config  /root/web/caddy/Caddyfile -pretty

vi /etc/security/limits.conf
# 新增内容
*        soft    noproc 10240
*        hard    noproc 10240
*        soft    nofile 10240
*        hard    nofile 10240

vi /etc/sysctl.conf
# 新增内容
fs.file-max = 6553560