Thanks for implementing this. I was able to get it working with the private beta during the second half of a football game—pretty good compared to my previous TLS experiences 
.
It wasn’t clear from the notes, but it looks like specifying -agree for automatic operation is needed only the first time you run caddy, is that correct?