What this comparison adds
The site's Reverse Proxy Generator writes a configuration for Caddy, Traefik or nginx; this page is where the choice between them is made. It sets the three side by side on six criteria read from each project's own documentation and LICENSE file, and says when each one fits. No other page on the site compares them.
The comparison
Each cell links to the page it was read from and shows the day it was read; a cell older than the refresh window is marked stale.
| Provider | Configuration | Automatic HTTPS | Docker discovery | Admin API and status | HTTP/3 | License |
|---|---|---|---|---|---|---|
| Caddy | Caddyfile or native JSON; changes applied via the admin API /load endpoint or caddy reload, with zero downtime and rollback on failure. | Built in and on by default: provisions TLS certificates via ACME and renews them, and redirects HTTP to HTTPS; no separate tool needed. | No Docker label provider among standard modules; upstreams are set in config, or fetched dynamically via SRV or A/AAAA DNS lookups. | Admin REST API, default address localhost:2019, for reading and changing config; no web dashboard is described in the docs. | Supported; the protocols server option defaults to h1 h2 h3, so HTTP/3 is on by default. | Apache License 2.0. |
| Traefik | Install config in YAML/TOML file, CLI args or env vars; routing config comes from providers and is hot-reloaded without restart. | Built in via ACME certificate resolvers (HTTP, TLS or DNS challenge) with automatic renewal; a resolver must be configured. | Built in: the Docker provider reads container labels (e.g. in a Compose file) to create routes. | Built-in API and web dashboard showing active routes; off by default (api option false), docs advise securing it in production. | Supported as the http3 option on an entryPoint; requires a TCP entryPoint, usually the one used for TLS. | MIT License. |
| nginx | Text config file nginx.conf; changes apply after nginx -s reload, which checks syntax and starts new workers while old ones finish. | ACMEv2 via ngx_http_acme_module, distributed separately (source in nginx-acme repo, prebuilt nginx-module-acme package); must be added to nginx. | No Docker provider; upstream servers are listed in config. The resolve parameter re-resolves DNS names (open source since 1.27.3). | stub_status module gives basic status information (connections, requests); not built by default. | ngx_http_v3_module (since 1.25.0) is documented as experimental; not built by default, included in Linux binary packages. | 2-clause BSD-style license (copyright Igor Sysoev, Nginx, Inc.). |
When to choose each
Reasoned from the cells above. Each fits a different situation; none is better in general.
- Choose Caddy
- Choose Caddy when you want certificates issued and renewed without a separate tool, HTTP/3 on by default, and config changes pushed through an API with rollback, and you are fine listing upstreams in the config rather than via Docker labels.
- Choose Traefik
- Choose Traefik when you want routes created from Docker labels in your Compose file, routing changes applied without a restart, ACME certificates from a configured resolver, and an optional built-in dashboard of active routes.
- Choose nginx
- Choose nginx when you want a text config file applied by a graceful reload and upstreams listed explicitly, and you are fine adding the separately distributed ACME module for certificates and treating HTTP/3 as experimental.
How to read the columns
- Configuration
- The configuration format and how a change takes effect: a reload, an API call, or a provider the proxy watches.
- Automatic HTTPS
- Whether the proxy itself issues and renews certificates over ACME, and what has to be set up or added for it.
- Docker discovery
- Whether routes can come from the containers themselves (labels) or are listed in the configuration.
- Admin API and status
- What the proxy offers to see or change its state while it runs: an API, a dashboard or a status page.
- HTTP/3
- Whether HTTP/3 over QUIC is supported, and whether it is on by default or documented as experimental.
- License
- The license of the open-source project, as its LICENSE file states it.
Method
The tools and the criteria were chosen in a content decision (#2929, 18 Oct 2026): tools that do the same job, each with public documentation, compared on what a choice between them turns on.
Each cell was read by hand from the project's own documentation, repository or pricing page, and keeps that page and the day it was read. Where a project publishes nothing on a criterion, the cell says what it does instead and cites the page that was checked. A cell is stale 90 days after it was read.
The tools keep a fixed order and no column is a score. This page runs no benchmark and names no winner; ANAROQ is never one of the sides, and nobody pays for a place.
Limits
- Features change between releases: the cell's date says when it was true, and the project's page is authoritative.
- A few criteria, not every difference: the columns are what a choice usually turns on, not a full feature list.
- No benchmark: performance, resource use and reliability were not measured.
Use it on the site
Sources
Every page a cell was read from, with the day it was read.
- Caddy caddyserver.com
- Caddy caddyserver.com
- Caddy caddyserver.com
- Caddy caddyserver.com
- Caddy raw.githubusercontent.com
- Traefik doc.traefik.io
- Traefik doc.traefik.io
- Traefik doc.traefik.io
- Traefik doc.traefik.io
- Traefik doc.traefik.io
- Traefik raw.githubusercontent.com
- nginx nginx.org
- nginx nginx.org
- nginx nginx.org
- nginx nginx.org
- nginx nginx.org
- nginx nginx.org