Traefik, Nginx or Caddy: which one to pick?

A reverse proxy is the single entry point of your server: it receives all HTTP/HTTPS traffic and routes it to the right service based on the requested domain name. It's also where TLS certificates live — one place to handle HTTPS instead of one per service.

Traefik is built for containers. It reads the labels on your Docker services and creates routes on its own: add a container with 3 labels and it's live with automatic HTTPS (Let's Encrypt). No reloads, no per-service config file. The trade-off: the initial setup (static file + dynamic labels) has a learning curve, and debugging can feel opaque at first.

Nginx is the historic reference: extremely fast, everywhere, endlessly documented — every error you'll ever hit already has a Stack Overflow answer. But everything is manual: one server block per service, a reload on every change, and HTTPS goes through certbot (a separate tool with its own renewal cron). It works great, but it doesn't automate itself.

Caddy is the simplicity champion: automatic HTTPS by default (literally zero config for certificates) and a 3-line Caddyfile to proxy a service. Its ecosystem is smaller, and native Docker discovery isn't in the official binary (you need a third-party plugin like caddy-docker-proxy).

Criterion	Traefik	Nginx	Caddy
Auto HTTPS	✅ built-in (Let's Encrypt)	❌ via certbot	✅ built-in, zero config
Docker discovery	✅ native (labels)	❌ manual config	⚠️ third-party plugin
Config	Medium (labels + static file)	Verbose, one file per service	Minimal (Caddyfile)
Ecosystem	Large, container-focused	Huge, ubiquitous	Smaller, growing

Traefik. The jiha.tech track is Docker-centric, and that's exactly where Traefik shines: every service you'll deploy (Vaultwarden, Immich, monitoring…) exposes itself with a few labels in its docker-compose.yml, without ever touching the proxy config. Learn it once, reuse it everywhere — and it's the same pattern you'll meet at work on containerized stacks.

# Exposer un service avec Traefik = 3 labels / Exposing a service with Traefik = 3 labels
services:
  app:
    image: myapp:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=Host(`app.mondomaine.fr`)"
      - "traefik.http.routers.app.tls.certresolver=letsencrypt"

• Caddy if you use little or no Docker, or you want the simplest HTTPS out there for 2-3 static services. For a first server without containers, it's unbeatable.
• Nginx if you need raw performance (heavy traffic, fine-grained caching, tuning), if your host/company mandates it, or if you want to learn the tool you'll find in 80% of existing infrastructures.
• And if you already have a proxy that works: keep it. Migrating a working reverse proxy for the hype is rarely a good investment.