Caddy 2 decides whether to manage certificates from the site address itself. An address that is a hostname, such as example.com, gets automatic HTTPS: a certificate is obtained, the site is served on 443, and an HTTP-to-HTTPS redirect is installed on 80. An address written as :8080 or prefixed with http:// gets plain HTTP and no certificate management.
This catches people running Caddy inside a container behind another proxy. Writing example.com in the Caddyfile makes Caddy try to obtain a public certificate, which fails when ports 80 and 443 are not reachable from the internet, and the site does not come up. Writing http://example.com or :80 serves plain HTTP for the outer proxy to terminate.
An IP address as the site address also disables automatic HTTPS, since public certificate authorities do not issue for most IPs. To keep the hostname but use a locally trusted certificate, add tls internal, which uses Caddy's own CA and, on a system where Caddy can, installs the root into the local trust store. auto_https off in the global options block disables the whole subsystem.