@@ -32,6 +32,7 @@ ./linde-hardware.nix
 
     ../settings/configuration/nix-linux.nix
     ../settings/services/git-server.nix
+    ../settings/services/caddy.nix
   ];
   age.secrets = {
     paperless =
@@ -46,7 +47,6 @@ mode = "400";
         symlink = false;
       };
     acme.file = ../../secrets/acme.age;
-    caddy.file = ../../secrets/caddy.age;
     binarycache.file = ../../secrets/binarycache.age;
     powerdns.file = ../../secrets/powerdns.age;
     redis-website.file = ../../secrets/redis-website.age;
@@ -281,7 +281,6 @@ extraSetFlags = [
       "--advertise-exit-node"
     ];
     useRoutingFeatures = "both";
-    permitCertUid = config.services.caddy.user;
   };
 
   services.mycal = {
@@ -563,7 +562,6 @@ defaults = {
       inherit email;
       dnsProvider = "pdns";
       credentialsFile = config.age.secrets.acme.path;
-      reloadServices = [ "caddy" ];
       validMinDays = 32;
     };
     acceptTerms = true;
@@ -578,55 +576,13 @@ group = "redis-website";
       reloadServices = [ "redis-website" ];
     };
   };
-  users.groups.acme.members = [
-    "caddy"
-  ];
 
   services.caddy = {
-    enable = true;
-    group = "caddy";
-    environmentFile = config.age.secrets.caddy.path;
-    package = pkgs.nur.repos.xyenon.caddy.withPlugins {
-      plugins = [
-        "github.com/caddyserver/cache-handler@v0.16.0"
-        "github.com/mholt/caddy-l4@v0.0.0-20260212155620-dd12cc413469"
-        "github.com/tailscale/caddy-tailscale@v0.0.0-20260106222316-bb080c4414ac"
-      ];
-      hash = "sha256-A+wDNJijfD1pnOePXCVMXYzRNxf4Fmpbq2rJG+FMstM=";
-    };
-    globalConfig = ''
-      cache
-      servers {
-        listener_wrappers {
-          layer4 {
-            @ssh ssh
-            route @ssh {
-              proxy ${net-ip4}:22
-            }
-            route
-          }
-          tls
-        }
-      }
-      tailscale {
-        tags tag:app
-      }
-    '';
     virtualHosts =
       let
         inherit (import ../../lib/caddy.nix { inherit lib; }) security-headers;
       in
       {
-        "http://" = {
-          # Needed for HTTP->HTTPS servers
-        };
-        "${hostname}.${domain}" = {
-          serverAliases = [ "https://" ];
-          extraConfig = ''
-            respond * 204
-            ${security-headers { }}
-          '';
-        };
         "pdns.${domain}" = {
           extraConfig = ''
             log {
@@ -805,10 +761,6 @@ '';
         };
       };
   };
-  systemd.services.caddy.serviceConfig = {
-    UMask = "007";
-  };
-
   services.open-webui = {
     enable = true;
     environment = {
@@ -934,19 +886,6 @@ TRUST_PROXY = true;
     };
   };
 
-  users.groups.webservice = {
-    members = [
-      "caddy"
-    ];
-  };
-  systemd.tmpfiles.rules = [
-    # setgid bit (2)
-    # sticky bit (4)
-    "d /run/web/ 6770 caddy webservice -"
-  ];
-  systemd.services.caddy.serviceConfig = {
-    ReadWritePaths = [ "/run/web" ];
-  };
   systemd.services.readeck.serviceConfig = {
     SupplementaryGroups = [ "webservice" ];
   };