[netheril96]

Not really. If someone logins as user A on the machine, and caddy runs as user B, then unless A has sudo access, A cannot modify caddy. But with this admin HTTP endpoint, user A now can arbitrarily modify caddy.

[anakaine]

This does kind of beg the question, who is sharing their load balancer / reverse proxy?

[ufmace]

That's true, but I think if your production web server is running on a system that you expect to have other users log into and do things on while having the Unix permissions prevent them from interfering with the production server, then your whole architecture and process is deeply broken far beyond the ability of any Caddy design decisions to address.

[rekoil]

That's another really good point, even if it's less common these days to see this type of shared machine.