skills.rest
f4rkh4d
f4rkh4dCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

forge-caddy

Harden Caddyfile configurations for production traffic with safe defaults.

Updated Aug 23, 2026
Search Tags:#security headers#reverse proxy#caddy#production hardening#json logging#tls acme
One-click install
npx skills add https://github.com/f4rkh4d/forge-skill --skill forge-caddy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: forge-caddy
Source: https://github.com/f4rkh4d/forge-skill/tree/main/skills/infra/forge-caddy
Command: npx skills add https://github.com/f4rkh4d/forge-skill --skill forge-caddy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) and scripts (resource) components.

What problem does it solve?

Prevents production Caddyfiles from shipping with common security, reliability, and TLS mistakes that turn “it works” into an unsafe deployment.

Core Features & Use Cases

  • Production Caddyfile guardrails: Ensures global options (email + admin off), safe defaults, and correct structure (one site block per domain).
  • Secure HTTPS and TLS discipline: Avoids ACME staging leaks, requires mandatory email for ACME, and manages on_demand TLS with tenant validation.
  • Operational hardening: Adds security header packs, structured JSON logging, reverse_proxy health checks, rate limiting patterns, and safe file_server usage.

Quick Start

Ask the agent to write a production-ready Caddyfile for your domains using forge-caddy’s rules, including global email/admin off, security headers, reverse_proxy health checks, and hardened logging.

Frequently Asked Questions about forge-caddy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I harden a Caddyfile for production traffic?▼

Harden a Caddyfile by enforcing safe global options, correct HTTPS TLS ACME automation, per-site security headers, reverse_proxy health checks, and structured JSON logging to prevent common misconfigurations.

What security headers should I configure for a Caddy reverse proxy?▼

Caddy reverse proxy security headers should be applied per-site within site blocks to establish production guardrails, preventing unsafe defaults and ensuring reliable traffic forwarding.

Does Caddy support rate limiting and on_demand TLS for multi-tenant deployments?▼

Caddy supports rate limiting via plugins and on_demand TLS with tenant validation, requiring mandatory ACME email configuration and disabling admin endpoints for safe multi-tenant deployments.

Why does my Caddyfile work locally but fail production TLS checks?▼

Caddyfile production TLS checks fail due to ACME staging leaks, missing mandatory ACME email, or incorrect global admin off settings, requiring strict TLS discipline to resolve.

Can I use Caddy file_server safely in a production environment?▼

Caddy file_server can be used safely in production by applying hardened file_server behavior, ensuring proper structure with one site block per domain, and enforcing secure defaults.

forge-caddy: what production guardrails does it apply to Caddy configurations?▼

forge-caddy applies production guardrails to Caddy configurations by enforcing global email and admin off, correct HTTPS TLS handling, per-site security headers, and reverse_proxy health_uri checks to harden deployments.

Related Skills

Explore More Software Engineering Skills→
ddnettersddnetters
2

caddy-reverse-proxy

Manage Caddy reverse proxy configurations with automatic HTTPS and Docker deployments.

Community
Intermediate
salvo-rssalvo-rs
20

salvo-tls-acme

Automates ACME certificate provisioning and renewal for Rust Salvo apps via Rustls and HTTP-01/TLS-ALPN-01 challenges.

Official
Advanced
hoangnh2412hoangnh2412
12

healthcheck-dotnet-minio

Implement a MinIO readiness probe for .NET health checks.

Community
Basic
JayRHaJayRHa
3

nginx-config-pro

Generate nginx reverse-proxy configurations with TLS, caching, and security headers.

Community
Advanced