feat: Prevent user-defined listeners from conflicting with Admin API

listeners.go

@@ -697,3 +697,15 @@ type ListenerWrapper interface {
 var listenerPool = NewUsagePool()
 
 const maxPortSpan = 65535
+
+func ConflictWithAdminAddr(addr NetworkAddress) bool {
+	adminAddr := NetworkAddress{
+		StartPort: uint(2019),
+		EndPort:   uint(2019),
+	}
+	if addr.StartPort <= adminAddr.EndPort && addr.EndPort >= adminAddr.StartPort {
+		Log().Error("conflict with admin api", zap.Uint("addr", addr.StartPort), zap.Uint("admin", adminAddr.StartPort))
+		return true
+	}
+	return false
+}

modules/caddyhttp/app.go

@@ -417,6 +417,10 @@ func (app *App) Validate() error {
 		// each server must use distinct listener addresses
 		for _, addr := range srv.Listen {
 			listenAddr, err := caddy.ParseNetworkAddress(addr)
+			// check for conflict with admin API
+			if caddy.ConflictWithAdminAddr(listenAddr) {
+				return fmt.Errorf("listener address '%s' already claimed by admin API", addr)
+			}
 			if err != nil {
 				return fmt.Errorf("invalid listener address '%s': %v", addr, err)
 			}