- Check On-Demand TLS before you pack up
- What you're really replacing
- The seven options side by side
- Classic web servers for traditional hosting
- When the job is spreading load
- Proxies built for containers and clusters
- A Docker-packaged option for a home server
- Signs you should stay where you are
- Your switch plan, step by step
- Frequently asked questions
Only leave Caddy if it can't do something you need. A classic general-purpose web server suits traditional hosting, a dedicated load balancer suits spreading heavy traffic across machines, a cloud-native proxy suits Kubernetes and container clusters, and a proxy manager packaged as a Docker image suits a home server that already runs everything in containers.
Caddy's big selling point is that it takes HTTPS off your plate, obtaining and renewing TLS certificates for every site you serve by default. So if you're a developer, sysadmin or homelab owner running it as a web server or reverse proxy and you're now looking around, something specific has probably nudged you. Maybe a new job uses a different stack, maybe a client's hosting expects something else, or maybe you've outgrown a single box and need traffic spread across several.
This page sorts the alternatives by the job they're built for, because a load balancer and a home-server Docker image aren't fighting over the same reader.
Check On-Demand TLS before you pack up
Beyond the everyday automatic certificates, Caddy has a feature called On-Demand TLS, which obtains and renews a certificate during the handshake itself. Its own page pitches that at customer-owned domains: think of a software service where each customer points their own web address at your platform and expects HTTPS to work straight away, with no ticket and no waiting.
If that's part of your setup, it's the hardest piece to replace. None of the options below is known for the same trick, so moving would mean building and maintaining your own certificate workflow for every customer domain, and testing renewals before anything expires. If you only serve a handful of your own sites, this won't matter much. If you serve hundreds of customer domains, it may be the single reason to stay put.
Even for small setups, write down how certificates are issued today before you change anything. The automatic default is so quiet that it's easy to forget it's doing a job at all, right up until a certificate lapses on the new server.
What you're really replacing
It helps to name the jobs your current server does before shopping for a new one. For most people it's three: serving files, passing requests on to an app running behind it, and handling certificates. Some setups add a fourth, spreading traffic across several machines. A replacement that only covers two of those means a second tool for the rest, and two tools means two sets of logs to read when something goes wrong.
So grab a notepad and write down which of those jobs you rely on. If it's only the middle one, a dedicated proxy may suit you. If it's all four, you'll want something general-purpose, or a pair of tools that are well documented together.
The seven options side by side
| Name | Group | Where it fits |
|---|---|---|
| Apache HTTP Server | Classic | Per-directory config |
| Envoy | Cluster | Edge of a platform |
| HAProxy | Balancer | In front of a pool |
| lighttpd | Classic | Revised BSD licence |
| nginx | Classic | All-rounder |
| Nginx Proxy Manager | Home Docker | Self-hosted apps |
| Traefik Proxy | Cluster | Container routing |
Treat it as a sorting tool, not a ranking. Find your group in the second column and read only that section below; weighing a home Docker setup against a cluster proxy gets you nowhere useful.
Classic web servers for traditional hosting
These are the closest to a like-for-like swap if you serve websites from one or a few machines and want a general-purpose server that also proxies. Check how each handles certificates before you commit. We've set out the differences in our Caddy and nginx head-to-head, and there's a separate look at how nginx compares with Apache if you're torn between those two.
Apache HTTP Server
Its feature list covers per-directory .htaccess rules, virtual hosts and modules loaded at runtime. If you've inherited a site that already leans on .htaccess files, that per-folder setup is the first thing to check against any other server.
lighttpd
Released under the open source revised BSD licence. Test it against your list of jobs before it makes your shortlist, starting with how it handles certificates.
nginx
One package handles web serving, reverse proxying, caching and spreading load, and it ships under the 2-clause BSD License. If your company wants a supplier behind it, enterprise distributions come from F5, Inc.
When the job is spreading load
If your reason for looking is traffic rather than features, a dedicated balancer sitting in front of several application servers is a different shape of setup altogether. Plan whether it sits in front of your current server or takes over from it before you install anything.
HAProxy
Its site calls it a reliable, high performance TCP/HTTP load balancer. Judge it on balancing rather than on web-serving extras.
Proxies built for containers and clusters
Running services in Kubernetes or a fleet of containers changes what you want from a proxy. Check how each picks up new services in your cluster, and how it tells you when a route has gone missing.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Envoy
An open source edge and service proxy, designed, its site says, for cloud-native and AI-native applications. That makes it a candidate when one proxy has to sit both at the edge and between your own services.
Traefik Proxy
Traefik Labs pitches the open source edition as a cloud-native application proxy. Its Hub API Gateway is a separate product, so check which one a tutorial is talking about before you follow it.
A Docker-packaged option for a home server
Plenty of people searching for an alternative aren't running a platform at all; they're running a few self-hosted apps at home. If that's you, and Docker is already how those apps run, a proxy manager that ships the same way can be the simpler fit.
Nginx Proxy Manager
Built as a Docker image, it only needs a database alongside it to run. If Docker is already how you run everything else at home, it slots into the same routine.
Signs you should stay where you are
Leaving a server that works is a lot of effort for a sideways step. If your sites load, your certificates renew and nobody on the team is struggling with the config, the honest answer may be to stay. The reasons that do justify a move are specific: a platform your company has standardised on, a traffic pattern that needs a separate balancer, or a cluster that wants its proxy to configure itself from the services running inside it.
Be wary of switching because a bigger name feels more serious. A server you understand and can debug at 2am beats a famous one you're still learning. If you're curious, run the newcomer on a side project first and let it earn its place.
Your switch plan, step by step
A live site needs a slow changeover. Give each step a pause and check nothing has gone quiet before you move to the next.
- List every domain, redirect, header and rewrite rule you rely on today.
- Note exactly how each certificate is issued and renewed right now.
- Build the new server on a test box with a staging subdomain.
- Recreate one low-traffic site and compare responses side by side.
- Prove certificate renewal works on the new box before any real expiry date.
- Move sites one at a time, keeping the old config ready for a quick rollback.
- Watch error logs for a full week before switching the old server off.
If you're weighing a cluster proxy against a classic server, our guide to how Traefik stacks up against nginx walks through that particular choice.
Frequently asked questions
Is Caddy free to use?
Caddy's own site calls it free software that relies on support from its backers to survive. So if you're leaving, it's more likely about features or fit than about a bill.
Can nginx proxy mail as well as web traffic?
It can. Mail proxying sits on its feature list next to TCP and UDP proxying, so it can front more than websites if you need it to.
Do any of these renew certificates automatically?
Don't assume it. Check each project's documentation, and treat renewal as something to prove on a test box, not a given.
Can I run two of these together?
There's nothing stopping you. If you add a balancer in front of a web server, decide which tool owns certificates so the two aren't fighting over the same job.
Which option suits a home lab best?
If Docker already runs everything at home, Nginx Proxy Manager slots in as a Docker image that only needs a database. If you enjoy config files, the classic servers are the next place to look.
Do I need Kubernetes to use Envoy or Traefik?
Both pitch themselves at cloud-native setups, so expect their guides to assume containers. On a single server, a classic option may be simpler to live with.
