API hardening: Limit access

Thanks. That’s a good finding, thanks.

So I’d assume that Caddy will take care of creating that socket on service start.

Once I restart caddy, I am getting this error:

Oct 01 04:52:53 server1 caddy[54892]: Error: loading initial config: loading new config: starting caddy administration endpoint: listen unix /run/caddy-admin.sock: bind: permission denied

Okay. /run is owned by root and caddy is using a separate user, so I guess, caddy cannot create that socket. So I changed it to:

  admin unix//etc/caddy/socket/caddy-admin.sock
}

which is writeable for that user:

drwxr-xr-x   2 caddy caddy 4.0K Oct  1 05:03 socket

But still it’s having it’s troubles:

Oct 01 05:03:31 server1 caddy[54982]: Error: loading initial config: loading new config: starting caddy administration endpoint: unable to set permissions (--w-------) on /etc/caddy/socket/caddy-admin.sock: chmod /etc/caddy/socket/caddy-admin.sock: no such file or directory