基础设施与运维 caddy-reverse-proxy 更新于 2026-10-29

Caddy 工程规则

Caddy rules: automatic HTTPS, single 443 owner and validated config reloads

✓ 应当这么做

✓ Terminate TLS with automatic certificate management and renewals proven to work
✓ Serve precompressed static assets with long-lived cache headers and hashed names
✓ Keep one reverse proxy as the single ingress owner of port 443

38 篇

Production Dockerfile rules: minimal multi-stage images and non-root runtime

Compose rules: explicit healthchecks, pinned images and network segmentation

Kubernetes rules: resource limits, readiness probes and rolling-update safety

Helm rules: values schema validation and template-time guard rails

Terraform rules: locked remote state, reviewed plans and no console drift

Ansible rules: idempotent tasks, changed_when discipline and vaulted secrets