Use a proper argument handling package
I see no other way to listen on both http AND https than with --prod (although ideally I'd listen to quic+https/2+http but oh well)
but, with --prod, it OVERRIDES the cert, key, and served path???
which to me seems rather unhinged, that it doesn't error about the manual flags, but rather SILENTLY overrides them, doesn't find the respective certs, and then errors about THAT
even the examples given, give BOTH --prod AND --key and --cert, be it the dockerfiles, or in the readme claiming
For production, store the keys in a directory with as strict permissions as possible, then specify them with the --cert and --key flags.
where naturally you'd be using --prod in production
I literally had to go looking in the source code to even find it was an actual "feature"
Thanks for reporting! I'll switch the flag/argument handling to a package like spf13/cobra or urfave/cli.