My understanding is that the config is available via localhost only. It most instances it does not need to be disabled. I think the hope is that it will be left enabled in production, not disabled.

You mean because it's on a different port that typically wouldn't be opened in the firewall to allow remote access?

The default listen address is "localhost:2019", which means it'll only accept requests from apps running on the same machine. If you're running untrusted code on the same machine, then that might be problematic for you. You can also change the admin endpoint to be a unix socket instead of a TCP endpoint which allows you to use linux file permissions to protect it.

Excellent. I'm really excited about Caddy 2. We've been using Caddy 1 to server all our main sites over https and simply for the last 4 years. I moved away from Apache and have never ever looked back.

Well done Matt and Francis

Thank you Toby :) Glad you've been with us for so long! Thank you for your support.

The commercial licence for the prebuilt binaries is $50 pm for 2 instances. You can build yourself from source with no restrictions.

OK, I see the requirement to pay is only for the binaries. It does seem like grabbing binaries from gocaddy.com is the preferred installation method vs. apt-get, etc for nginx.

$300 is the annual rate for 1 instance.

:) https://caddyserver.com

Does it mean something that the page is now 404