> ## Content Index
> Fetch the complete content index at: https://ostreff.info/llms.txt
> Use this file to discover other available public pages before exploring further.

# Caddy security recommendation
- URL: https://ostreff.info/ghost-recommendation/
- Published: 2023-10-19T16:39:24.000Z
- Updated: 2025-02-22T10:33:50.000Z
- Author: Jordan Ostreff
- Tags: caddy, #security, FreeBSD

Use security/portacl-rc to enable privileged port binding:

```bash
# portmaster security/portacl-rc
# sysrc portacl_users+=www
# sysrc portacl_user_www_tcp="http https"
# sysrc portacl_user_www_udp="https"
# service portacl enable
# service portacl start
```

Configure caddy to run as www:www

```bash
# sysrc caddy_user=www caddy_group=www
```

Note if Caddy has been started as root previously, files in  
/var/log/caddy, /var/db/caddy, and /var/run/caddy may require their ownership  
changing manually.

```bash
# chown -R www:www /var/log/caddy && chown -R www:www /var/db/caddy && chown -R www:www /var/run/caddy
```