Product Overview

What you'll learn

What you'll learn: This page covers the full DashCaddy architecture, design philosophy, component breakdown, and how it compares to manual self-hosting. By the end, you'll understand why DashCaddy exists, what problems it solves, and how its layers work together as a unified platform.

What DashCaddy is

DashCaddy brings together the layers that self-hosters usually wire by hand — Docker deployment, Caddy reverse proxy, Technitium DNS automation, internal certificate distribution, service monitoring, and operational tooling — and unifies them behind a single, cohesive control plane.

Instead of editing a dozen config files and praying the layers agree, you deploy a service once and DashCaddy wires the runtime, the proxy route, the DNS record, the TLS certificate, and the health checks for you. The goal is simple: make running self-hosted services feel like one product instead of six fragile integrations.

Platform architecture

DashCaddy is a production-grade platform built on eight distinct layers, each responsible for a specific concern. Together they form a complete self-hosting stack that replaces dozens of manual configuration steps with a single declarative action.

1. Application Layer

The Application Layer is what operators interact with directly. It is a React-based dashboard that provides real-time visibility into every service, container, and infrastructure component managed by DashCaddy. Beyond the visual interface, this layer exposes a REST API under /api/v1/ and a WebSocket channel for live updates. Every action available in the UI — deploying a service, editing a Caddy route, reviewing audit logs — is available through the API, making the dashboard a thin client over a fully programmable control plane. The application layer also handles authentication, role-based access control, TOTP two-factor enrollment, and multi-user admin invitations.

2. Orchestration Layer

The Orchestration Layer is the Node.js/Express engine at the heart of DashCaddy. It receives deployment requests, coordinates Docker container lifecycle, drives Caddy reverse proxy configuration through the Admin API, manages Technitium DNS records programmatically, and handles certificate issuance and renewal. This layer is responsible for ensuring that every deployment is atomic — either all layers succeed or the operation rolls back cleanly. It maintains the authoritative service state store, tracks health checks, and publishes events over WebSocket for the dashboard. The orchestration engine also powers the Smart Defaults Wizard, Service Discovery, and the Caddyfile-as-Code builder.

3. Runtime Layer

The Runtime Layer is Docker and Docker Compose — the container workloads that actually run your services. DashCaddy manages container creation, network attachment, volume mounts, environment variable injection, and lifecycle operations (start, stop, restart, remove). For advanced deployments, the platform supports Docker Swarm for multi-host orchestration and Fleet Management for coordinating services across multiple servers. Every container managed by DashCaddy is tracked in the service state store, enabling features like Service Discovery (adopting existing containers) and Disaster Recovery (full-system backup and restore with SHA-256 checksum verification).

4. Edge Layer

The Edge Layer is Caddy — the reverse proxy that terminates HTTPS connections and routes traffic to your services. DashCaddy manages Caddy entirely through its Admin API, never requiring manual edits to a Caddyfile. The Caddyfile-as-Code builder generates configuration declaratively, and the orchestration layer applies changes atomically. Caddy handles automatic TLS certificate issuance and renewal using its built-in ACME client for public domains or its internal CA for private networks. The Edge Layer also provides load balancing, header manipulation, request logging, and rate limiting — all configurable through the DashCaddy dashboard without touching Caddy's native configuration syntax.

5. Name Resolution Layer

The Name Resolution Layer is Technitium DNS — a self-hosted authoritative DNS server that DashCaddy controls programmatically. When you deploy a service with hostname plex.local, the orchestration layer creates an A record pointing to your host's IP address automatically. When you remove the service, the record is cleaned up. This eliminates the manual DNS management that plagues most self-hosting setups. Technitium DNS also supports zone transfers, forwarding, and custom record types for advanced networking scenarios. The integration is optional — if you don't configure DNS, DashCaddy skips this layer and your services still deploy with direct IP access.

6. Trust Layer

The Trust Layer handles certificate authority management and internal HTTPS distribution. Caddy's built-in CA issues certificates automatically for every service, but those certificates are only trusted if the client device trusts the issuing CA. DashCaddy solves this with DashCA — an internal certificate authority distribution surface. The Smart Defaults Wizard initializes DashCA on first launch and offers the root certificate for download. Once installed on client devices (browsers, phones, IoT devices), every service managed by DashCaddy presents a trusted HTTPS connection without certificate warnings. This layer also handles certificate renewal tracking and expiration alerts.

7. Observability Layer

The Observability Layer provides real-time health monitoring, structured audit logging, and metrics export. Every service managed by DashCaddy has a health check that runs continuously, with status updates pushed to the dashboard over WebSocket. The layer exports Prometheus-compatible metrics at /metrics, enabling integration with Grafana, VictoriaMetrics, or any Prometheus-compatible monitoring stack. Audit logs capture every administrative action — who deployed what, when, and from which IP — providing the accountability required for multi-user environments. The Security Center aggregates logs from multiple sources (Caddy access logs, container stdout, authentication events) into a unified event pipeline for threat detection and forensic analysis.

8. Intelligence Layer

The Intelligence Layer makes DashCaddy AI-native. The AI Intent Router accepts natural-language commands like "deploy Plex on port 32400" or "show me all unhealthy services" and translates them into API calls. The MCP (Model Context Protocol) Server exposes DashCaddy operations to external AI assistants — Claude, ChatGPT, or any MCP-compatible client can deploy services, check health, or modify configuration through the protocol. This layer also powers the Plugin system, allowing third-party extensions to hook into DashCaddy's event stream and extend functionality without modifying core code.

Design philosophy

DashCaddy is built on three principles that guide every architectural decision:

• Atomic operations: Deploying a service should succeed or fail as a single transaction. You should never end up with a container running but no DNS record, or a Caddy route pointing to a container that doesn't exist. The orchestration layer coordinates all layers and rolls back on failure.
• Declarative configuration: You describe what you want (hostname, port, image), and DashCaddy figures out the implementation details (Caddy route, DNS record, certificate). The Caddyfile-as-Code builder generates configuration from your intent, not the other way around.
• Progressive disclosure: The Smart Defaults Wizard gets you running in minutes with sensible defaults. Advanced users can customize every layer — Caddy headers, DNS record types, container resource limits — but complexity is optional, not mandatory.

Comparison: Manual vs. DashCaddy Free vs. DashCaddy Premium

Real-world scenarios

Home lab operator

You run Plex, Nextcloud, Home Assistant, and a dozen other services on a single NUC. With DashCaddy, you deploy each from a template, and every service gets a clean subdomain (plex.local,nextcloud.local) with trusted HTTPS. Service Discovery adopts containers you already had running, so you don't need to redeploy anything. The dashboard gives you one place to see health, restart services, and review logs.

Small business internal tools

Your team needs Gitea, Grafana, and a wiki behind HTTPS with role-based access. DashCaddy Free handles deployment, DNS, and certificates. TOTP 2FA and multi-user admin ensure only authorized team members can modify infrastructure. Audit logs track who deployed what and when.

Multi-site fleet management

You manage DashCaddy instances across three offices. Premium's Fleet Management gives you a single dashboard to monitor all hosts, deploy services to specific sites, and enforce configuration standards. Swarm support lets you scale a service across multiple nodes within a site.

Premium licensing

DashCaddy Premium is a fixed-duration license. You buy the duration you want; Premium features unlock for that duration and deactivate when it expires. You purchase a new license to renew. Pricing tiers:

• $20 — 30-day license
• $50 — 90-day license
• $70 — 180-day license
• $99 — 365-day license

Premium features include SSO (OIDC/SAML), Recipes (multi-service deployment blueprints), Docker Swarm orchestration, and Fleet Management for multi-host coordination. The core platform is fully functional without a license; Premium is for teams that need enterprise-grade access control and multi-site visibility.

Next steps

• Installation Guide — get DashCaddy running on your host with the guided installer or manual setup.
• Deploy Your First Service — walk through deploying Plex (or any template) end-to-end.