@@ -562,59 +562,34 @@ users.groups.acme.members = [
     "caddy"
   ];
 
-  services.haproxy = {
-    enable = true;
-    config = ''
-      defaults
-        mode tcp
-        timeout connect 5000ms
-        timeout client 50000ms
-        timeout server 50000ms
-
-      frontend http
-        bind ${net-ip4}:80
-        default_backend caddy
-
-      frontend https
-        bind ${net-ip4}:443
-
-        tcp-request inspect-delay 5s
-        acl sniff_https req.ssl_hello_type 1
-        acl sniff_ssh req.payload(0,7) -m str "SSH-2.0"
-        tcp-request content accept if sniff_https
-        use_backend ssh if sniff_ssh
-        use_backend ssh if { req_ssl_sni -i ssh.alin.ovh }
-        use_backend pr_caddys if { req_ssl_sni -i pr.alin.ovh }
-
-        default_backend caddys
-
-      backend caddy
-        server caddy [${net-ip6}]:80
-
-      backend caddys
-        server caddys [${net-ip6}]:443
-
-      backend pr_caddys
-        server pr_caddys [${gitpr6}]:443
-
-      backend ssh
-        mode tcp
-        server ssh [${net-ip6}]:22
-        timeout server 2h
-    '';
-  };
   services.caddy = {
     enable = true;
     group = "caddy";
     package = pkgs.nur.repos.xyenon.caddy.withPlugins {
       plugins = [
         "github.com/caddyserver/cache-handler@v0.16.0"
+        "github.com/mholt/caddy-l4@v0.0.0-20251111042133-1823cde2603c"
       ];
-      hash = "sha256-MfzzRfL30c65XbeALnCZvGJaHa6e6icMjy4DUCBV284=";
+      hash = "sha256-lshM7iq7r+wY0ChtUc3FOHFXWweUM+hU6wBjFiokl+c=";
     };
     globalConfig = ''
       cache
-      default_bind [${net-ip6}]
+      servers {
+        listener_wrappers {
+          layer4 {
+            @ssh ssh
+            route @ssh {
+              proxy ${net-ip4}:22
+            }
+            @prs tls sni pr.alin.ovh
+            route @prs {
+              proxy [${gitpr6}]:443
+            }
+            route
+          }
+          tls
+        }
+      }
     '';
     virtualHosts =
       let