Caddy vs Pomerium
Caddy
caddyserver.com
Pomerium
pomerium.comSide by side
| Figure | Caddy | Pomerium |
|---|---|---|
| Price from | $25/mo | $7/mo |
| Free plan | — | Yes |
| Free trial | — | Yes |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Android | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 8 | 9 |
| Spec score · Reverse Proxy Software | 8.0 (#13) | 8.9 (#3) |
| Deployment | Caddy can be deployed as a command-line process, system service, container, Kubernetes workload, or embedded component. | Pomerium Core provides official binaries for Linux and macOS, Linux deb/rpm packages, Docker images, and source builds. |
| Extensibility | Caddy can be extended with compile-time plugins, which are built into its static binary. | Official integrations include a Terraform provider, Kubernetes Ingress Controller, CLI/Desktop clients and Go and JavaScript SDKs. |
| Integrations | Caddy supports DNS challenge integrations for providers including Cloudflare, DigitalOcean, Route 53, and dozens of others through libdns. | Listed integrations include Grafana, Kubernetes, Okta, Cloud Run, Docker, Google Kubernetes Engine, FleetDM, BambooHR, Auth0, Azure Active Directory, GitHub, GitLab, Google Workspace, OneLogin, OpenID Connect, and Ping Identity. |
| Support | Free community help is available through the forum; paid sponsorship tiers offer private support and other services depending on tier. | The pricing page lists community forum, email support, dedicated Slack channel, phone support, and dedicated customer success manager options. |
Plans
Caddy
- Indie$25 a month
- Indie Pro$50 a month
- Startup$99 a month
- Startup Pro$249 a month
- Business$999 a month
- Business+$2,999 a month
- Enterprise$5,900 a month
- Enterprise+$11,900 a month
Pomerium
- Personal FreeFree
- Business$7 a month
- Zero PersonalFree
- Zero PersonalFree
- Zero Business$7 a month
- Zero Business (annual)$7 a month
- Zero Business (monthly)$9 a month
- EnterprisePriced on request
- EnterprisePriced on request
In their own words
Caddy
Caddy is an extensible server platform used as a web server or proxy, and it is self-hosted. By default, it obtains and renews TLS certificates for sites and redirects HTTP to HTTPS. Its reverse proxy supports HTTP, HTTPS, WebSockets, gRPC, and FastCGI, along with load balancing and health checks. Configuration options include JSON through a RESTful API, the Caddyfile, and other adapters. Compile-time plugins extend its static binary. DNS challenge integrations include Cloudflare, DigitalOcean, Route 53, and other providers through libdns. Caddy can run as a command-line process, system service, container, Kubernetes workload, or embedded component. The software is free, with no paywalled features; sponsorship plans add services and support while leaving the license unchanged. Free community help is available through a forum. Caddy says its TLS defaults meet PCI DSS, NIST, and HIPAA compliance requirements, and that dependencies are verified with Go modules and release artifacts are cryptographically signed.
Pomerium
Pomerium is an open-source identity-aware proxy for controlling access to internal applications, servers, services, and workloads without requiring VPN client software. It checks identity, device state, and request context before granting access, and authenticates through identity providers that support OpenID Connect. Listed access scenarios include HTTP, MCP, SSH, gRPC, TCP, and UDP; supported app protocols also include HTTPS, HTTP/2, HTTP/3, and WebSocket. Pomerium removes its authentication cookies before forwarding requests upstream, and sensitive databroker data is encrypted at rest. Downstream TLS has a minimum of TLS 1.2. Deployment options include Linux and macOS binaries, packages, Docker images, source builds, and desktop clients for Windows, macOS, and Linux. The free Personal plan lists 10 users, 10 routes, five policies, and two service accounts. Business costs $7.00 per month, billed annually, and lists limits of 1,000 users, 100 routes, 100 policies, and 20 service accounts. A free trial is also listed.