[francislavoie]

> Said large percentage of users will be installing through a package manager anyway

Exactly, which is why the environment variable approach is perfectly fine. The env var will be set in the systemd config.

> You're expecting users to know how to secure their systems

Again, our view is that the TCP socket for admin is secure enough for 99.99% of users, and has been for over 3 years since Caddy v2 was released. We've still not seen any evidence of a practical exploit in the wild.