lfarzati

This is excellent advice, thank you.

This is for making the uploaded images in S3 accessible by anyone. The rationale is that the screenshots can be viewed by browsers without any sort of authorization.

But since this is just an environment setting, you can change it if your use case is different.

I did the same, localdots started actually as a simple script using mkcert for solo projects. :)

Unless I'm forgetting something now, the only reason I switched to smallstep was for ACME support which mkcert lacks for now (see https://github.com/FiloSottile/mkcert/issues/154).

I wanted an ACME solution to better automate the server config with Caddy.

Thanks for raising this point! Honestly, I'm not sure. Probably not. Given that localdots is meant to be used only for local development, would this be considered an important feature anyway? I'm not sure I see the security concerns here.