Caddy

The automation wraps the ACME protocol yet still obeys the same public rules: challenges are validated over the network, and when the origin is hidden behind a load balancer you may need the DNS challenge instead of the HTTP one. One directive is enough A bare caddy file-server (or a tls directive) turns automatic HTTPS on by default: Caddy generates a key pair and drives the ACME flow against a certificate authority to obtain a certificate, then reloads it into the running server. It stores the issued key and certificate in its own data store under an ID derived from the domain, so the next start reuses them instead of re-issuing on every boot. You never author the protocol steps, but you still own the boundaries: a domain must be publicly reachable, or you switch to a DNS challenge with a provider plugin so the validation runs where it can actually answer. ...

Build, publish, and confirm with the same evidence the notes describe, end to end.

Start with a narrow policy, then expand it only when a documented feature needs another resource.

Test compressed and uncompressed requests separately so caches and validators describe the bytes actually served.

Use SNI, inspect the public certificate, and alert before renewal becomes an incident.

One root, one file_server, and a small header policy make a static deployment easy to inspect.