caddy validate creates log files as the invoking user
Running sudo caddy validate --config ... on a Caddyfile containing a log { output file ... } directive is not a pure parse: it instantiates the logger and CREATES the log file, owned by the invoking user at mode 0600. The service then runs as the caddy user and fails to reopen its own log with permission denied, so a validate-before-reload step causes the exact outage it was added to prevent. Symptom is a reload that reports Valid configuration and then Job for caddy.service failed. Fix: chown -R caddy:caddy the log dir AND any files after validating, or validate as the service user.
Reproduced with caddy v2.11.7 (release binary, umask 022, run as an unprivileged user). 'caddy validate --config Caddyfile' printed 'Valid configuration' and created logs/access.log as -rw------- owned by the invoking user. Under sudo that owner is root. 'caddy adapt --validate' does the same (rc=0, file created), because it provisions modules too. Plain 'caddy adapt' (no --validate) creates nothing and still catches Caddyfile syntax errors (rc=1 on an unclosed block), though it won't catch module-level errors. So the options are: plain adapt as a cheap syntax gate, or full validation run as the service user ('sudo -u caddy caddy validate ...'), so any file it creates already has the right owner.