Caddy — Dependencies#

Module info#

  • Module: github.com/caddyserver/caddy/v2
  • Go version: 1.25.0
  • Direct dependencies: ~50 (43 in the first require block + 7 unmarked in the third block)
  • Indirect dependencies: 116 (go.mod // indirect entries)
  • Total modules in go.sum: ~285 (571 lines ÷ 2 hashes per module)

Dependency categories#

Core infrastructure#

  • go.uber.org/zap v1.27.1 + go.uber.org/zap/exp v0.3.0 — high-performance structured logging; Caddy’s logging system is built entirely on zap, including level control and caller info
  • go.uber.org/automaxprocs v1.6.0 — automatically sets GOMAXPROCS to match Linux cgroup CPU quota; used at startup in containerized deployments
  • github.com/KimMachineGun/automemlimit v0.7.5 — similar to automaxprocs but for memory limits; sets GOMEMLIMIT from cgroup constraints
  • github.com/BurntSushi/toml v1.6.0 — TOML parsing for the config adapter that converts TOML configs to Caddy’s native JSON format
  • gopkg.in/yaml.v3 v3.0.1 — YAML parsing for the YAML config adapter
  • github.com/spf13/cobra v1.10.2 + github.com/spf13/pflag v1.0.10 — CLI framework for the caddy binary (start, stop, reload, run, adapt subcommands)
  • github.com/google/uuid v1.6.0 — UUID generation for request IDs and module identity
  • github.com/dustin/go-humanize v1.0.1 — human-readable byte/duration formatting in log output and admin responses
  • github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b — config diff display in the admin API’s config comparison output
  • github.com/Masterminds/sprig/v3 v3.3.0 — template functions (string manipulation, crypto, date) exposed to the Caddyfile template engine

Networking/HTTP#

  • github.com/quic-go/quic-go v0.59.0 — full QUIC implementation used for HTTP/3 support; a first-class transport alongside HTTP/1.1 and HTTP/2
  • github.com/go-chi/chi/v5 v5.2.5 — HTTP router used internally for the admin API’s REST endpoints (not for user-facing routing, which uses Caddy’s own handler chain)
  • github.com/pires/go-proxyproto v0.11.0 — PROXY protocol v1/v2 support for reading real client IPs from load balancer connections
  • golang.org/x/net v0.52.0 — stdlib extensions: HTTP/2 internals, DNS utilities, proxy support
  • golang.org/x/sync v0.20.0 — errgroup, singleflight used for concurrent operations
  • golang.org/x/time v0.15.0 — rate limiting (token bucket) used in the rate-limit handler module
  • github.com/miekg/dns v1.1.72 (indirect) — full DNS client/server library, pulled in by certmagic for DNS-01 ACME challenges
  • github.com/tailscale/tscert v0.0.0-20251216020129-aea342f6d747 — Tailscale certificate integration for getting TLS certs via Tailscale’s CA

TLS / PKI#

  • github.com/caddyserver/certmagic v0.25.2 — Caddy’s own spin-off library implementing automatic ACME certificate acquisition and renewal; the heart of Caddy’s auto-HTTPS feature
  • github.com/caddyserver/zerossl v0.1.5 — ZeroSSL ACME directory integration (alternative to Let’s Encrypt)
  • github.com/mholt/acmez/v3 v3.1.6 — ACME client library (also by Matt Holt) used by certmagic for RFC 8555 protocol interactions
  • github.com/cloudflare/circl v1.6.3 — Cloudflare’s cryptographic library providing post-quantum key exchange (X25519Kyber768), used for TLS 1.3 key establishment
  • github.com/smallstep/certificates v0.30.2 + github.com/smallstep/nosql v0.8.0 + github.com/smallstep/truststore v0.13.0 — Smallstep’s step-ca integration; powers caddypki, Caddy’s built-in internal CA for mTLS and development HTTPS
  • go.step.sm/crypto v0.77.1 — Smallstep’s crypto primitives (JWK, x509 utilities) underlying the PKI module
  • github.com/libdns/libdns v1.1.1 — abstract DNS provider interface used by certmagic for DNS-01 challenge support; third-party DNS providers implement this interface
  • golang.org/x/crypto v0.49.0 — extended crypto: SSH, bcrypt, ed25519, PBKDF, used across TLS and auth modules
  • golang.org/x/crypto/x509roots/fallback v0.0.0-20260323153451-8400f4a93807 — embedded fallback CA bundle for systems without system roots

Observability#

  • github.com/prometheus/client_golang v1.23.2 — Prometheus metrics exposition; Caddy exposes /metrics by default
  • github.com/prometheus/client_model v0.6.2 — Prometheus protobuf model for metrics serialization
  • go.opentelemetry.io/otel v1.42.0 + go.opentelemetry.io/otel/sdk v1.42.0 + go.opentelemetry.io/otel/trace v1.42.0 — OpenTelemetry core: tracing and metrics SDK
  • go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 — automatic HTTP request instrumentation wrapping net/http handlers
  • go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 — auto-detects and configures OTLP exporters from environment variables (OTLP gRPC/HTTP, stdout, Prometheus)
  • go.opentelemetry.io/contrib/propagators/autoprop v0.67.0 — auto-detects trace propagation format (W3C, B3, Jaeger, OT) from environment

Data/Storage#

  • github.com/smallstep/nosql v0.8.0 — abstract NoSQL KV store interface with backends for bbolt, badger, MySQL, PostgreSQL; used by the PKI CA for certificate storage
  • go.etcd.io/bbolt v1.4.3 (indirect) — embedded BoltDB used as the default CA storage backend
  • github.com/dgraph-io/badger v1.6.2 + v2 (indirect) — BadgerDB embedded KV store, alternative CA storage backend
  • github.com/jackc/pgx/v5 v5.8.0 (indirect) — PostgreSQL driver for the nosql PostgreSQL backend
  • github.com/go-sql-driver/mysql v1.9.3 (indirect) — MySQL driver for the nosql MySQL backend
  • github.com/klauspost/compress v1.18.5 — high-performance compression (gzip, zstd, snappy, brotli) for the HTTP compression handler
  • github.com/fxamacker/cbor/v2 v2.9.0 (indirect) — CBOR serialization, used by smallstep for structured CA data

Content rendering#

  • github.com/yuin/goldmark v1.8.2 + github.com/yuin/goldmark-highlighting/v2 — Markdown-to-HTML rendering with syntax highlighting for the file server’s markdown template feature
  • github.com/alecthomas/chroma/v2 v2.23.1 — syntax highlighting library powering goldmark-highlighting

Security/Auth#

  • github.com/google/cel-go v0.27.0 — Common Expression Language evaluator; used in request matching rules to support arbitrary boolean expressions in route matchers
  • github.com/slackhq/nebula v1.10.3 (indirect) — overlay network library; pulled in via smallstep for nebula-based certificate issuance
  • github.com/coreos/go-oidc/v3 v3.17.0 (indirect) — OIDC token verification, via the smallstep CA
  • golang.org/x/oauth2 v0.36.0 (indirect) — OAuth2 flows, via smallstep

Testing#

  • github.com/stretchr/testify v1.11.1 — assertion library; used in caddytest package and unit tests throughout
  • github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b — diff display (also used at runtime in admin API, dual-purpose)

Runtime tuning#

  • github.com/klauspost/cpuid/v2 v2.3.0 — CPU feature detection; used to select optimal compression and crypto implementations
  • github.com/DeRuina/timberjack v1.4.0 — log rotation library (alternative to lumberjack) for file-based log output

Stdlib reliance#

Caddy makes heavy use of the Go standard library — it is a web server after all. Key stdlib packages:

  • net/http — the HTTP/1.1 and HTTP/2 server foundation; Caddy implements http.Handler at every level
  • crypto/tls — TLS configuration and handshake; deeply integrated with certmagic
  • context — pervasive throughout the request lifecycle
  • encoding/json — native config format is JSON; json.RawMessage is used heavily for deferred module config parsing
  • net — listener management, network address parsing
  • sync + sync/atomic — concurrency primitives across the core
  • log/slog — not used (replaced entirely by zap)
  • text/template — used in file server templates and Caddyfile template directives

The project’s philosophy is to use stdlib as the primary HTTP infrastructure and lean on third-party deps primarily for: TLS automation, compression, QUIC, observability, and config adapters.

Shared dependencies#

Dependencies that overlap with other projects in the 50-project set:

  • go.uber.org/zap — shared with Kubernetes, etcd, Prometheus, and many others; the de facto structured logger in the Go ecosystem
  • github.com/prometheus/client_golang — shared with Prometheus, Kubernetes, Traefik, Grafana; universal metrics exposition standard
  • github.com/spf13/cobra — shared with Kubernetes, Hugo, Traefik; dominant CLI framework
  • gopkg.in/yaml.v3 — shared with virtually every project that touches YAML config
  • go.etcd.io/bbolt — shared with etcd (original author); embedded bolt DB is used across the ecosystem for lightweight persistence
  • golang.org/x/crypto, golang.org/x/net, golang.org/x/sync — near-universal across all Go projects
  • github.com/stretchr/testify — standard test assertion library across the ecosystem
  • google.golang.org/grpc (indirect) — pulled in via OpenTelemetry OTLP exporters; shared with most CNCF-adjacent projects

Vendoring#

Caddy does not vendor its dependencies. There is no vendor/ directory in the repository. This is consistent with its philosophy as an application that is typically built via xcaddy (a dedicated build tool), which handles dependency management. Module proxy caching (GOMODCACHE) is relied upon for reproducible builds, and the go.sum file ensures integrity. The absence of vendoring keeps the repository size manageable given the 285+ transitive modules.

Notable dependency decisions#

  1. Own TLS ecosystem: Caddy’s author (Matt Holt) maintains several of the critical TLS dependencies himself — certmagic, acmez, zerossl, and libdns. This vertical integration means Caddy can evolve its auto-HTTPS feature without waiting for upstream maintainers, but creates a tight coupling between the server and its author’s library ecosystem.

  2. go-chi for admin, not for user routing: Chi is used only internally for the /config/ admin API REST endpoints. User-facing routing uses Caddy’s own handler chain mechanism. This avoids exposing chi’s abstractions to module authors while still getting a well-tested router for the admin REST surface.

  3. Full OpenTelemetry stack as direct dep: Rather than making observability optional or plugin-based, Caddy includes the entire OpenTelemetry SDK and all major exporters (OTLP gRPC, OTLP HTTP, stdout, Prometheus) as direct dependencies. This makes the binary larger but means zero-config observability works out of the box with environment variables.

  4. Post-quantum cryptography (cloudflare/circl): Including circl for X25519Kyber768 makes Caddy one of the first general-purpose web servers to offer post-quantum key exchange by default — a forward-looking security decision with real binary size cost.

  5. Smallstep embedded CA (heavy PKI stack): The caddypki module pulls in smallstep/certificates, which transitively requires multiple database backends (bbolt, badger, PostgreSQL, MySQL), gRPC, OIDC, and CBOR. This is a significant weight for functionality most deployments never use (internal CA). It reflects a philosophy of “batteries included” at the cost of a heavier dependency graph.

  6. Autoscaling runtime (automaxprocs + automemlimit): Automatically adjusting GOMAXPROCS and GOMEMLIMIT to match cgroup limits is increasingly common in containerized Go services; Caddy adopts both early as direct deps, reflecting awareness of cloud-native deployment realities.

  7. CEL for dynamic matching: Using Google’s Common Expression Language for route matchers rather than a custom expression language is an unusual choice. CEL is production-proven (used in Kubernetes admission webhooks and Firebase Security Rules) but adds a substantial dependency. The trade-off is correctness and expressiveness over simplicity.

Backward Caddy — Structure Caddy — Architecture Forward