It's easier than that - just allow two setup options that generate different config files: "development (insecure)" and "production". First one is quick and eas

It's easier than that - just allow two setup options that generate different config files: "development (insecure)" and "production". First one is quick and easy and relatively more unsafe, second one is fully secured based on whatever best practices. "People will find and set all the configuration options correctly" is what got us into this mess.