Yes, it's enough for most people. Companies have thrown Caddy in front of their infrastructure last minute before losing PCI compliance due to TLS management problems. As others have said, Caddy doesn't do security headers by default (yet?), but its default TLS parameters are very good.