xyz.sh adds no telemetry and performs no hidden actions. Read the full source on the page or download it with curl -fsSL xyz.sh/ .sh first; every script has a / .sh.sha256 checksum. Piping a remote script to bash is still a risk — review the source first. The binary comes from https://github.com/caddyserver/caddy/releases; the default version's SHA-512 is pinned in the script and a mismatch aborts.

Which operating systems are supported?

Declared support: Debian, Ubuntu, CentOS, Rocky Linux, and AlmaLinux. The script detects the distribution and warns on an unknown one. It was tested in Docker containers of these systems (syntax, --dry-run, and whatever can run in a container; see tests/RESULTS.md); parts that need systemd, kernel modules, or the public internet still need a real VPS.

Yes. Run it as root or via sudo bash; it exits with a message otherwise. --dry-run and --status show what it would do first.

The certificate request failed — why?

Make sure the domain's A/AAAA records point to this server, TCP 80 and 443 are open in the firewall and security group, and nothing else (such as Nginx) uses those ports. journalctl -u caddy shows details.

Caddy Reverse Proxy and Automatic HTTPS Tutorial

This tutorial shows how to install Caddy with xyz.sh/caddy and reverse-proxy a domain with automatic HTTPS.

Prerequisites

Root, systemd, and TCP 80/443 free and open.

A domain pointed at this server (when using --domain).

Steps

Optional: read the source with curl -fsSL xyz.sh/caddy.sh and compare xyz.sh/caddy.sh.sha256.

Install Caddy only: curl -fsSL xyz.sh/caddy | bash -s -- -y

Reverse-proxy local port 8080 for a domain: curl -fsSL xyz.sh/caddy | bash -s -- --domain example.com --to 127.0.0.1:8080 -y

Set an ACME email: add --email me@example.com

Run again with another --domain to add sites; the same domain updates its block.

How to verify

Run systemctl status caddy and caddy version; after adding a domain, https://your-domain should show the backend with a Let's Encrypt or ZeroSSL certificate.

How to undo or uninstall

curl -fsSL xyz.sh/caddy | bash -s -- --uninstall -y stops and removes the caddy service and /usr/bin/caddy; /etc/caddy and certificate data in /var/lib/caddy are kept — delete them manually if needed.