Caddy

The Admin API is local-only by default (127.0.0.1:2019) — no auth required for local access. Remote access requires explicit configuration with TLS and optional auth. For agent use in containerized deployments, binding the Admin API to a private network interface with TLS client certificate auth is recommended. Caddy's file serving and proxy features have separate auth mechanisms (basic auth, forward auth). The local-default approach minimizes attack surface but requires network-level controls for remote access.

Caddy is a modern open-source web server and reverse proxy with a standout feature for agents: a JSON-based Admin API that allows complete live configuration management without server restarts. Agents can add, remove, or modify routes, upstreams, TLS settings, and middleware in real time by POSTing to the Admin API. This is directly useful for agents managing dynamic service deployments. Auto-HTTPS is built-in: Caddy automatically obtains and renews TLS certificates via Let's Encrypt or ZeroSSL. The Admin API is local-only by default (127.0.0.1:2019) but can be configured for remote access. Open-source under Apache 2.0. Confidence is docs-derived.

The Caddy Admin API at /config/ uses a recursive JSON structure mirroring Caddy's internal config model. Methods: GET (read), POST (add/replace), PUT (insert), PATCH (update), DELETE. Config paths like /config/apps/http/servers/myserver allow surgical updates. The API also exposes /id/ endpoints for direct access to named config objects. Full config replacement via POST /load. The API is well-designed for programmatic management: agents can build Caddy configs as JSON objects and push them live. Caddyfile format is for human use; JSON is the agent-native path.

Admin API returns standard HTTP status codes: 200 for successful reads, 200 for modifications, 400 for malformed config (with a detailed error message explaining the schema violation), 404 for non-existent config paths. Config validation happens before applying changes — invalid configs are rejected with an error message, not applied. No partial-apply risk. Health endpoint: /sys/health. Caddy handles TLS renewal errors gracefully with retry logic. Error messages from the Admin API are detailed and actionable.

Documentation at caddyserver.com/docs is excellent: Admin API reference with all methods and example payloads, Caddyfile syntax reference, module documentation for all built-in functionality, and architecture guides. The JSON config structure is fully documented with a JSON schema. Community support via the Caddy forum and GitHub Discussions. Documentation quality is among the best for open-source infrastructure tools. The Admin API docs include copy-paste examples for common operations.