OK. It’s becasue from systemd
Blockquote
ProtectSystem= Takes a boolean argument or the special values “full” or “strict”. If true, mounts the [/usr](file:///usr) and [/boot](file:///boot) directories read-only for processes invoked by this unit. If set to “full”, the [/etc](file:///etc) directory is mounted read-only, too. If set to “strict” the entire file system hierarchy is mounted read-only, except for the API file system subtrees [/dev](file:///dev), [/proc](file:///proc) and [/sys](file:///sys) (protect these directories using PrivateDevices=, ProtectKernelTunables=, ProtectControlGroups=).
This default setup is stupid. In normal cases Caddy doesn’t need write permission in its storage folder?? I don’t think so. Then why it’s set up like this by default.