code: func QualifiesForManagedTLS(c ConfigHolder) bool {
  	if c == nil {
  		return false
  	}
  	tlsConfig := c.TLSConfig()
  	if tlsConfig == nil {
  		return false
  	}
  
  	return (!tlsConfig.Manual || tlsConfig.OnDemand) && // user might provide own cert and key
  
  		// if self-signed, we've already generated one to use
  		!tlsConfig.SelfSigned &&
  
  		// user can force-disable managed TLS
  		c.Port() != "80" &&
  		tlsConfig.ACMEEmail != "off" &&
  
  		// we get can't certs for some kinds of hostnames, but
  		// on-demand TLS allows empty hostnames at startup
  		(HostQualifies(c.Host()) || tlsConfig.OnDemand)
  }
docs: // QualifiesForManagedTLS returns true if c qualifies for
  // for managed TLS (but not on-demand TLS specifically).
  // It does NOT check to see if a cert and key already exist
  // for the config. If the return value is true, you should
  // be OK to set c.TLSConfig().Managed to true; then you should
  // check that value in the future instead, because the process
  // of setting up the config may make it look like it doesn't
  // qualify even though it originally did.