Try importing it in a separate file, with the comment above

2 files changed, 29 insertions, 12 deletions

diff --git a/cmd/main.go b/cmd/main.go
index d9dfc6b2f..31a121aa6 100644
--- a/cmd/main.go
+++ b/cmd/main.go
@@ -38,18 +38,6 @@ import (
 	"go.uber.org/automaxprocs/maxprocs"
 	"go.uber.org/zap"
 
-	// For running in minimal environments, this can ease
-	// headaches related to establishing TLS connections.
-	// "Package fallback embeds a set of fallback X.509 trusted
-	// roots in the application by automatically invoking
-	// x509.SetFallbackRoots. This allows the application to
-	// work correctly even if the operating system does not
-	// provide a verifier or system roots pool. ... It's
-	// recommended that only binaries, and not libraries,
-	// import this package. This package must be kept up to
-	// date for security and compatibility reasons."
-	_ "golang.org/x/crypto/x509roots/fallback"
-
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
 )
diff --git a/cmd/x509rootsfallback.go b/cmd/x509rootsfallback.go
new file mode 100644
index 000000000..f8b64edb8
--- /dev/null
+++ b/cmd/x509rootsfallback.go
@@ -0,0 +1,29 @@
+// Copyright 2015 Matthew Holt and The Caddy Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package caddycmd
+
+// For running in minimal environments, this can ease
+// headaches related to establishing TLS connections.
+// "Package fallback embeds a set of fallback X.509 trusted
+// roots in the application by automatically invoking
+// x509.SetFallbackRoots. This allows the application to
+// work correctly even if the operating system does not
+// provide a verifier or system roots pool. ... It's
+// recommended that only binaries, and not libraries,
+// import this package. This package must be kept up to
+// date for security and compatibility reasons."
+import (
+	_ "golang.org/x/crypto/x509roots/fallback"
+)