@@ -0,0 +1,71 @@
+{
+  config,
+  pkgs,
+  ...
+}:
+{
+  age.secrets.caddy.file = ../../../secrets/caddy.age;
+
+  services.tailscale.permitCertUid = config.services.caddy.user;
+
+  security.acme.defaults.reloadServices = [ "caddy" ];
+  users.groups.acme.members = [ "caddy" ];
+
+  services.caddy = {
+    enable = true;
+    group = "caddy";
+    environmentFile = config.age.secrets.caddy.path;
+    package = pkgs.nur.repos.xyenon.caddy.withPlugins {
+      plugins = [
+        "github.com/caddyserver/cache-handler@v0.16.0"
+        "github.com/mholt/caddy-l4@v0.0.0-20260212155620-dd12cc413469"
+        "github.com/tailscale/caddy-tailscale@v0.0.0-20260106222316-bb080c4414ac"
+      ];
+      hash = "sha256-A+wDNJijfD1pnOePXCVMXYzRNxf4Fmpbq2rJG+FMstM=";
+    };
+    globalConfig = ''
+      cache
+      servers {
+        listener_wrappers {
+          layer4 {
+            @ssh ssh
+            route @ssh {
+              proxy localhost:22
+            }
+            route
+          }
+          tls
+        }
+      }
+      tailscale {
+        tags tag:app
+      }
+    '';
+    virtualHosts = {
+      "http://" = {
+        # Needed for HTTP->HTTPS servers
+      };
+      "${config.networking.fqdn}" = {
+        serverAliases = [ "https://" ];
+        extraConfig = ''
+          respond * 204
+        '';
+      };
+    };
+  };
+  systemd.services.caddy.serviceConfig = {
+    UMask = "007";
+  };
+
+  users.groups.webservice = {
+    members = [ "caddy" ];
+  };
+  systemd.tmpfiles.rules = [
+    # setgid bit (2)
+    # sticky bit (4)
+    "d /run/web/ 6770 caddy webservice -"
+  ];
+  systemd.services.caddy.serviceConfig = {
+    ReadWritePaths = [ "/run/web" ];
+  };
+}