Architecture Pillar // 04
Embedded Caddy Ingress & Sub-ms TLS
Zero-downtime routing, automated ACME certificate management, and sub-millisecond dynamic route reloads.
Why Traefik Struggles in Agent Workflows
Many PaaS platforms use Traefik configured via Docker socket labels. When AI agents repeatedly add, reconfigure, or delete routes, Traefik's label-polling mechanism frequently triggers certificate renewal race conditions or drops open WebSocket streams during full proxy restarts.
Caddy API Engine
Smoooth communicates directly with Caddy's dynamic JSON admin API over local loopback. When an agent creates a new ingress route:
- Atomic Route Diff: Smoooth POSTs only the changed server block to Caddy's API. Routing tables update in under 2ms.
- Zero Active Connection Disruption: Existing HTTP/2 and WebSocket connections are never interrupted or terminated during configuration updates.
- Automated TLS: Caddy handles Let's Encrypt and ZeroSSL ACME handshakes automatically, with sub-second issuance.
Declarative Ingress Rules
# Declaring automatic ingress via MCP manifest:
ingress:
domain: "api.mydomain.com"
target_port: 8080
tls:
mode: "acme"
email: "[email protected]"
websocket_enabled: true
rate_limit:
requests_per_second: 100