Caddy now supports post-quantum key agreement, when you compile it with Go 1.23 or later, such that visitors whose browser supports it (such as Chrome on Desktop and Edge), will be secure against the threat of store-now/decrypt-later.
Compile caddy from source with Go 1.23+. This is easiest with xcaddy.
$ go version # make sure you got Go 1.23 or later!
go version go1.23.0 darwin/arm64
$ go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
[ ... ]
$ xcaddy build master
[ ... ]
$ ./caddy version # PQ caddy ready to Go!
It's also straightforward without xcaddy:
$ git clone https://github.com/caddyserver/caddy/
$ cd caddy/cmd/caddy
$ go build
[...]
$ ./caddy version
Caddy will support the post-quantum key agreement X25519Kyber768Draft00 which is enabled by default.
For client support, see for instance pq.cloudflareresearch.com
This also enables post-quantum for Caddy to upstream, when operating as a reverse proxy.