file-server command: Use safer defaults; http: improve host matcher docs

modules/caddyhttp/fileserver/command.go

@@ -19,6 +19,7 @@ import (
 	"flag"
 	"log"
 	"strconv"
+	"time"
 
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
@@ -32,7 +33,7 @@ func init() {
 	caddycmd.RegisterCommand(caddycmd.Command{
 		Name:  "file-server",
 		Func:  cmdFileServer,
-		Usage: "[--domain <example.com>] [--path <path>] [--listen <addr>] [--browse]",
+		Usage: "[--domain <example.com>] [--root <path>] [--listen <addr>] [--browse]",
 		Short: "Spins up a production-ready file server",
 		Long: `
 A simple but production-ready file server. Useful for quick deployments,
@@ -83,6 +84,9 @@ func cmdFileServer(fs caddycmd.Flags) (int, error) {
 	}
 
 	server := &caddyhttp.Server{
+		ReadHeaderTimeout: caddy.Duration(10 * time.Second),
+		IdleTimeout:       caddy.Duration(30 * time.Second),
+		MaxHeaderBytes:    1024 * 10,
 		Routes:            caddyhttp.RouteList{route},
 	}
 	if listen == "" {

modules/caddyhttp/matchers.go

@@ -34,6 +34,16 @@ import (
 
 type (
 	// MatchHost matches requests by the Host value (case-insensitive).
+	//
+	// When used in an HTTP route,
+	// [qualifying domain names](/docs/automatic-https#hostname-requirements)
+	// may trigger [automatic HTTPS](/docs/automatic-https), which automatically
+	// provisions and renews certificates for you. Before doing this, you
+	// should ensure that DNS records for these domains are properly configured,
+	// especially A/AAAA pointed at your server.
+	//
+	// Automatic HTTPS can be
+	// [customized or disabled](/docs/json/apps/http/servers/automatic_https/).
 	MatchHost []string
 
 	// MatchPath matches requests by the URI's path (case-insensitive).