Reverse Proxy for Home Server — Nginx, Caddy, or Traefik?

A few months ago, I started stacking services on the home server: one port for the web app, one port for the API, another for the monitoring dashboard, and so on. If I open it from outside the network, I have to memorize numbers like 192.168.1.2:3001 or 192.168.1.2:8080. It's like having a house with lots of doors, but each door has a different number and no nameplate. Guests who come will definitely be confused.

This is when I realized that reverse proxy was not just an option, but rather the foundation of a neat home server. Through this article, I want to share my experience comparing three popular candidates: Nginx, Caddy, and Traefik. Each has its own character, and the right choice depends on our work style.

What is a Reverse Proxy?

Think of a reverse proxy like a receptionist in an office. Visitors only need to know the office address, not the room number of each employee. The receptionist receives guests, checks their destination, then directs them to the correct room. In the server world, a reverse proxy receives requests from the internet, then forwards them to the application running behind it—usually on localhost or the local network.

The reverse proxy's work doesn't stop there. It can also handle SSL termination (securing HTTPS connections), load balancing, compression, caching, and even simple protection like rate limiting. In essence, he makes the many services behind him look like one neat entrance.

Why does a Home Server Need a Reverse Proxy?

If we run more than one service on one machine, reverse proxy helps three main things:

• A neat subdomain or path. Instead of remembering the port, we can use ai.lan, office.lan, or adammuiz.com/pdf/.
• Automatic HTTPS. Reverse proxy can handle SSL certificates so we don't need to configure TLS in each application.
• Isolation and security. The original application can be hidden behind a proxy, and can even only be accessed via localhost.

On my own server, reverse proxy is the reason why b.lan, o.lan, and several other tools can share one IP without clashing. Without him, every service would be fighting over ports 80 and 443.

Nginx — The Reliable Veteran

Nginx is like an old motorbike that is still going strong for touring. It's been around for a long time, the documentation is abundant, and the performance is proven. Many tutorials on the internet are still based on Nginx, so if you get stuck, chances are there are other people who have experienced the same problem.

The advantage of Nginx is its flexibility. It can be a reverse proxy, static web server, load balancer, or caching layer. The basic configuration is quite clear, although for beginners it feels a little long-winded because you have to understand the concepts of server block, location, and upstream.

The downside? Nginx doesn't have built-in automatic HTTPS. If we want Let's Encrypt, we need to install certbot or something similar, then set cron to renew. It's not a big deal, but it requires an extra step.

Caddy — The Smart Minimalist

Caddy is a reverse proxy that feels like it uses a modern language compared to the classic Nginx. The configuration file is very concise, and the most attractive feature is automatic HTTPS. Caddy can manage Let's Encrypt certificates itself without additional crons. Just write the domain, and it will try to get a certificate.

If you're just starting a home server and want fast results without a lot of configuration, Caddy is a very sensible choice. One line like this is enough to advance one service:

ai.lan {
    reverse_proxy localhost:3001
}

Configure Caddy to forward the domain to the service on port 3001.

Of course, the Caddy isn't completely perfect. The community is smaller than Nginx, and for certain complex configurations, Caddy expressions can feel unfamiliar. But for a home server scale, it is often more than enough.

Traefik — Cloud-Native Options

Traefik feels like a network admin born in the container era. It is designed to work with Docker, Kubernetes, and dynamic labels. If you run a lot of containers and frequently add or remove services, Traefik can detect changes automatically via Docker labels.

Traefik's advantage is its seamless integration with modern ecosystems. It also has an interesting built-in dashboard, so we can see active routing. But its strength is also its weakness: Traefik requires an understanding of Docker, labels, and providers. If your home server is still based on traditional services or SystemD, Traefik can feel redundant.

Brief Comparison

Simple Configuration Example

To make the picture more realistic, here is an example of forwarding a subdomain to a local service in each reverse proxy. Let's say we have a service at localhost:3001 and want to access it via ai.lan.

Nginx

server {
    listen 80;
    server_name ai.lan;

    location / {
        proxy_pass http://localhost:3001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Server block Nginx to reverse proxy to local services.

Caddy

ai.lan {
    reverse_proxy localhost:3001
}

A minimalist version of the Caddy for the same needs.

Traefik (with Docker labels)

labels:
  - "traefik.enable=true"
  - "traefik.http.routers.ai.rule=Host(`ai.lan`)"
  - "traefik.http.routers.ai.service=ai-service"
  - "traefik.http.services.ai-service.loadbalancer.server.port=3001"

Docker labels for Traefik automatically detect services.

If you're still confused, start with Caddy for a service or two. Once you feel comfortable, then consider whether you need Nginx for more detailed control or Traefik for the container environment.

Which Do I Choose?

On my current server, Nginx is still the main reverse proxy. The reason is simple: I'm used to the configuration pattern, and most of my services don't run in Docker. But for new projects that want to run quickly with automatic HTTPS, I don't hesitate to choose Caddy.

Traefik attracts my attention, especially if one day I move towards more serious container orchestration. But for a private home server with several services, Traefik feels like bringing a container truck to deliver a single box.

Conclusion

Reverse proxy is a device that makes our home server not look like a supermarket where each shelf has different access. He unites many services into one entrance that is neat, safe, and easy to remember.

Nginx is suitable for those who like full control and a large community. Caddy is suitable for those who want to go fast with minimal configuration. Traefik is suitable for those who live in the Docker ecosystem and need dynamic automation.

There is no absolute answer. The best is the tool that suits your needs today, not the most popular tool on the forum. Choose one, run it, and experience for yourself how a reverse proxy changes the way you manage your home server.

If you have experience with one of these three reverse proxies, write in the comments column. I enjoy learning from other people's perspectives.