Unfortunately it looks like I have the same problem 
although I’m running Ubuntu 17.04 on Linode:
adrian@toolbox:~$ uname -a
Linux toolbox 4.9.15-x86_64-linode81 #1 SMP Fri Mar 17 09:47:36 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux
adrian@toolbox:~$ systemd --version
systemd 232
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN
My caddy.service is basically a copy → paste from GitHub, except that I’ve uncommented the last three parameters, as recommended for newer systemd:
adrian@toolbox:~$ cat /etc/systemd/system/caddy.service
[Unit]
Description=Caddy HTTP/2 web server
Documentation=https://caddyserver.com/docs
After=network-online.target
Wants=network-online.target systemd-networkd-wait-online.service
[Service]
Restart=on-failure
StartLimitInterval=86400
StartLimitBurst=5
; User and group the process will run as.
User=www-data
Group=www-data
; Letsencrypt-issued certificates will be written to this directory.
Environment=CADDYPATH=/etc/ssl/caddy
; Always set "-root" to something safe in case it gets forgotten in the Caddyfile.
ExecStart=/usr/local/bin/caddy -log stdout -agree=true -conf=/etc/caddy/Caddyfile -root=/var/tmp
ExecReload=/bin/kill -USR1 $MAINPID
; Limit the number of file descriptors; see `man systemd.exec` for more limit settings.
LimitNOFILE=1048576
; Unmodified caddy is not expected to use more than that.
LimitNPROC=64
; Use private /tmp and /var/tmp, which are discarded after caddy stops.
PrivateTmp=true
; Use a minimal /dev
PrivateDevices=true
; Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
ProtectHome=true
; Make /usr, /boot, /etc and possibly some more folders read-only.
ProtectSystem=full
; … except /etc/ssl/caddy, because we want Letsencrypt-certificates there.
; This merely retains r/w access rights, it does not add any new. Must still be writable on the host!
ReadWriteDirectories=/etc/ssl/caddy
; The following additional security directives only work with systemd v229 or later.
; They further retrict privileges that can be gained by caddy. Uncomment if you like.
; Note that you may have to add capabilities required by any plugins in use.
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
[Install]
WantedBy=multi-user.target
I only have one caddy binary with (I think) proper permissions:
adrian@toolbox:~$ which -a caddy
/usr/local/bin/caddy
adrian@toolbox:~$ ls -hal /usr/local/bin/caddy
-rwxr-xr-x 1 root root 5.1M May 21 16:33 /usr/local/bin/caddy
adrian@toolbox:~$ stat /usr/local/bin/caddy
File: /usr/local/bin/caddy
Size: 5322619 Blocks: 10400 IO Block: 4096 regular file
Device: 800h/2048d Inode: 1995 Links: 1
Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2017-05-21 16:33:24.879306395 +0200
Modify: 2017-05-21 16:33:24.885973064 +0200
Change: 2017-05-21 19:03:29.376648819 +0200
Birth: -
Folders for storing configuration and SSL certificates should also be set up properly, although they shouldn’t matter here because it doesn’t look like Caddy gets to the point it can use them:
adrian@toolbox:~$ stat /etc/caddy
File: /etc/caddy
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 800h/2048d Inode: 486893 Links: 2
Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 33/www-data)
Access: 2017-05-21 19:12:10.356399795 +0200
Modify: 2017-05-21 18:15:12.683364771 +0200
Change: 2017-05-21 19:03:38.886684979 +0200
Birth: -
adrian@toolbox:~$ stat /etc/ssl/caddy
File: /etc/ssl/caddy
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 800h/2048d Inode: 486894 Links: 2
Access: (0770/drwxrwx---) Uid: ( 33/www-data) Gid: ( 0/ root)
Access: 2017-05-22 19:11:09.240680874 +0200
Modify: 2017-05-21 16:21:15.485636515 +0200
Change: 2017-05-21 19:03:53.363408381 +0200
Birth: -
The www-data user should be configured properly (it has been automatically added by the system). Relevant snippets from /etc/passwd and /etc/group:
adrian@toolbox:~$ cat /etc/passwd
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
adrian@toolbox:~$ cat /etc/group
www-data:x:33:
I saw that systemd-networkd-wait-online.service had a problem with a dependency, so I’ve manually started and enabled systemd-networkd and it’s working now as it should.
Nevertheless, even after a reboot caddy.service does not work:
adrian@toolbox:~$ sudo systemctl status caddy.service
● caddy.service - Caddy HTTP/2 web server
Loaded: loaded (/etc/systemd/system/caddy.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Mon 2017-05-22 19:11:19 CEST; 12min ago
Docs: https://caddyserver.com/docs
Process: 3588 ExecStart=/usr/local/bin/caddy -log stdout -agree=true -conf=/etc/caddy/Caddyfile -root=/var/tmp (code=exited, status=203/EXEC)
Main PID: 3588 (code=exited, status=203/EXEC)
May 22 19:11:19 toolbox systemd[1]: caddy.service: Main process exited, code=exited, status=203/EXEC
May 22 19:11:19 toolbox systemd[1]: caddy.service: Unit entered failed state.
May 22 19:11:19 toolbox systemd[1]: caddy.service: Failed with result 'exit-code'.
May 22 19:11:19 toolbox systemd[1]: caddy.service: Service hold-off time over, scheduling restart.
May 22 19:11:19 toolbox systemd[1]: Stopped Caddy HTTP/2 web server.
May 22 19:11:19 toolbox systemd[1]: caddy.service: Start request repeated too quickly.
May 22 19:11:19 toolbox systemd[1]: Failed to start Caddy HTTP/2 web server.
May 22 19:11:19 toolbox systemd[1]: caddy.service: Unit entered failed state.
May 22 19:11:19 toolbox systemd[1]: caddy.service: Failed with result 'exit-code'.
Any suggestions would be much appreciated 