diff --git a/ansible/group_vars/all/vault.yml b/ansible/group_vars/all/vault.yml
index 798e2d8..d1f18ec 100644
--- a/ansible/group_vars/all/vault.yml
+++ b/ansible/group_vars/all/vault.yml
@@ -1,45 +1,60 @@
 $ANSIBLE_VAULT;1.1;AES256
-65343264303166346334396163363362326334626531336363363766326135393462373564313539
-6633346163343664393232363965383334303563396236360a316265623239333431636133306663
-65623237393564323936303936633036343137646637633963396166313462626165616463616665
-3235373562626238640a636163623535376565373835653831666361636563616230353639626131
-38393530363461346334356437613934306330666563326661343465653362313038346535386337
-62623964633764343964653061373137366539326433396231396339313231633632353465323139
-33333866383834376165303964353639386234646535626333363932333764646137663036303530
-32326635343631623535323830333934376466323338353234323464666435383436633139343037
-62666333383231356163383530353339336230373431616665333638633234656231393166303639
-32386134386264613839313564316164336461373738646630636630363731643066633132336636
-64663532663661653539653431353763303436323234383864353064333631643435633733366435
-32656332626633313134623361343965643962663134613363626265353865643738363738316232
-62356136623166303038653830393138646637636335366362323239316333616331383765663861
-33643331323766646463663862396232306233343134326436326235336165616662383636616539
-39373962336264636363303734343666646534343733666632626338393936393032626130643233
-30633963656166343834396431323233363036353165623934336532333662323932336630636235
-63326631366234383732316464383364316337393034303433646365343763633135336336376161
-33326436303863326666616234396438623864333538313363623261353962336430316132343830
-36353761326133666166393930343233643861366138363930623362336566386230316236353365
-65663632383436333536636161393133316334376262653330303238636431353966646666663665
-30386137623066343135616534323336313162643066636330323934646162303362373838313532
-61386163356537613334616537656134373835326265393765303436396233383239393365336136
-64623130383538306331323939386634316663663263306362363830383930346232313965613035
-33353235663230663635316136666335343233646539613832643431393134303865616232636435
-66366437353863336235646438353431616465396365373562636461623938303663326461656134
-66353735343237363164326236663363376333316163353462626234393861663535323463623233
-66623934336662323830616362653035353563343564636431383837643961303637366131633132
-33376133376465623030643935643737636339333236316566636663323934626265633863343963
-38626563323166343264643465626264393838643330393739386330656461656561306539653232
-63393838626233386531353063366131366237633162393537363963633361386238643232336230
-36363062386262303364303736373061316265373730366437326166336163386335623665323234
-35383865646466363534383833653764303833323230613863313735393264336132303934633465
-65616138636134613361316539343739353735666538653438333264623034306633663634306438
-33643165353534623039626536636433373963383866303535333931633633393138663464336562
-36643432366233323235613139626236346135633237613265343933646434373939396265626366
-34313835346463303132326537323166363032306133623662343736393435383330356433306138
-65653931613832313832323936353638303937613863646430633266306330656135386533306462
-30663366396566393134653663356531316639303635343236666333363637636433336533356663
-35346261363134326165316463626439306130653165636134616434663736616666643963336464
-61643834613164336234386237393333636234306162306563363430646262363963366666653666
-64323036323731626236343361613566643565666138386631633462613836613766626562353934
-32363936626466346464356131653232326330386239666638626333346238623964383666393961
-38393264663636353161663636393733396332333838333962393439346533353332653362356230
-62613039376539636363
+61356165613635386631393135656434646436303665313031346566323336313138353433316463
+3363323534613064643132663335623238366431393062340a346538396662306537663163623366
+38626166383933616331623231373137306562623637313263333237633661663436666266616433
+3862346438643638650a306634333535653633613534646630386131333236366538333765323333
+38656163303837303732663561373232393132343331663164656262393730326434373731333636
+36613538646431396536363936336562616431656665653965373864633366663836353434626434
+34383932373461333564303439623565383661646365386665393831383463663662356536356236
+36373964666236626465366161636135393734356536633466383262326537343833636630343738
+62353066316131613737373162643363653662656261363465386364323962656537373061373032
+33343763353464383438363438343965653532393831343930393562633630383932653862623637
+38386239353237356631646436356166373961333464396639383538383662326534343339313330
+65373339356364636634616532363832386631323062363530313861336238353261353334306235
+62616338396431316537346638656365356564346666366366343638356261623664393263323937
+30343261363562383332323462336435376664386134646562643836363834313237373631353731
+35653535663864643266313332356635363262363533663232656531373130336539633066376139
+32316665393831663035623962656364363831333563366135636164346335383738363336663566
+63356532643563393939383635386462663561386434323939303431653438653131363538383034
+33623933333464363032656636643033326162626163353633343062633966343332383138363963
+36383831663562616533316436366566323061386535343538393861383462333166343562316633
+30623665623035393537393965626363323132656433313339396233356666346634316332616336
+37363635363330323230373332326565343530653335383437373230366563366237633665626331
+66623336626230663361636439316337393865383035326136653264666438666566646132353036
+38616264313833316536623238633339373466613866626366383835656638623863323838653030
+63303938376164653966356435386333363731656666313234663535666165646233313137343563
+36386437393139656438333262383437656666343831313239323961373637653163643664356565
+62346431393133656530316262303763646165643336396661666431383436323562336137653031
+62626538373839613734396366653065306534636630346338316237616161613037616364356431
+38643965376133616161336633383664326230383435363334353137303162663738313331346238
+39356161616533616134356231323530306338333162343363353531303263636632613036386638
+63633136386232306234323936303563646466313935326631396565383432386130656638616266
+32383334363237336539396665336366643764633131643663643137376438323666326435626461
+64346633636431393137633537306431646564386565303933636434386462346630626537346438
+32623333666133303061646564366366326665363163396262633164323631636337346130303239
+38373936663337356134666132303165393365663763396362623434633737373538653566646134
+62316164396438303532616266313062326666633130656338653139376634306664633031333037
+31636166306565353334633435656233336233363664306264626237623366336161303134353433
+63383739666462623336386537346662633666626466393039653439346436653937633537396436
+35393339383066326630353066623132333034656539363561346462626265363263303535343961
+39316461616630326539613731303039613736393633373338646266323938326162373831346336
+30656130343463366534323030646238313465306266383034623065636665623366333063383736
+38373063393837306462303564643962373334343139626338623935336435643730646532633630
+66363730386636633639346463363365343239373265303738353732653633653437636130636664
+39386365353334653765343335303263363461313965383664326563333734626533376436626530
+63353163323637303730353564383733653365613635353764333266393532653663326533646132
+39313763373735323835626437306435373238653432393936643165663663656665316132653330
+35383038353532656434366336346235363563636264303734633138323963396562306232646236
+38366536306561653937336333373434336164663336613839353439356435333833396363636437
+38323934613735643363656233333037336465336564313966623063376566663030303230323262
+65643564666534326234306164343365383632333061316238623565353538313538396364313337
+35336230313339643736653238386231343661623337306236383665356632366236356335323530
+66373831616239376231636361333430343433303233393066323865663434643433303832373262
+36366534646161323130393931626362626139663139643263366639656531613436313533363130
+65643736363833333939613566663339623964333262643863333030623138633464386238613934
+31323639333234336264313663376465323737353766643839303665313737336534386665363034
+30326439666433373232306136306365343764643434306561343339353132346430646436343362
+32333765616262363930353435616563333736313533653339656231316230346166363335356638
+37333561366339613136306438306130343230663732333862663838396463623661303961336433
+65646332373139303462303633346432366530643130366133363937653739653036366136373434
+343864373734666431326239373866313734
diff --git a/ansible/infra_secrets.yml b/ansible/infra_secrets.yml
index 798e2d8..4803d86 100644
--- a/ansible/infra_secrets.yml
+++ b/ansible/infra_secrets.yml
@@ -1,45 +1,60 @@
 $ANSIBLE_VAULT;1.1;AES256
-65343264303166346334396163363362326334626531336363363766326135393462373564313539
-6633346163343664393232363965383334303563396236360a316265623239333431636133306663
-65623237393564323936303936633036343137646637633963396166313462626165616463616665
-3235373562626238640a636163623535376565373835653831666361636563616230353639626131
-38393530363461346334356437613934306330666563326661343465653362313038346535386337
-62623964633764343964653061373137366539326433396231396339313231633632353465323139
-33333866383834376165303964353639386234646535626333363932333764646137663036303530
-32326635343631623535323830333934376466323338353234323464666435383436633139343037
-62666333383231356163383530353339336230373431616665333638633234656231393166303639
-32386134386264613839313564316164336461373738646630636630363731643066633132336636
-64663532663661653539653431353763303436323234383864353064333631643435633733366435
-32656332626633313134623361343965643962663134613363626265353865643738363738316232
-62356136623166303038653830393138646637636335366362323239316333616331383765663861
-33643331323766646463663862396232306233343134326436326235336165616662383636616539
-39373962336264636363303734343666646534343733666632626338393936393032626130643233
-30633963656166343834396431323233363036353165623934336532333662323932336630636235
-63326631366234383732316464383364316337393034303433646365343763633135336336376161
-33326436303863326666616234396438623864333538313363623261353962336430316132343830
-36353761326133666166393930343233643861366138363930623362336566386230316236353365
-65663632383436333536636161393133316334376262653330303238636431353966646666663665
-30386137623066343135616534323336313162643066636330323934646162303362373838313532
-61386163356537613334616537656134373835326265393765303436396233383239393365336136
-64623130383538306331323939386634316663663263306362363830383930346232313965613035
-33353235663230663635316136666335343233646539613832643431393134303865616232636435
-66366437353863336235646438353431616465396365373562636461623938303663326461656134
-66353735343237363164326236663363376333316163353462626234393861663535323463623233
-66623934336662323830616362653035353563343564636431383837643961303637366131633132
-33376133376465623030643935643737636339333236316566636663323934626265633863343963
-38626563323166343264643465626264393838643330393739386330656461656561306539653232
-63393838626233386531353063366131366237633162393537363963633361386238643232336230
-36363062386262303364303736373061316265373730366437326166336163386335623665323234
-35383865646466363534383833653764303833323230613863313735393264336132303934633465
-65616138636134613361316539343739353735666538653438333264623034306633663634306438
-33643165353534623039626536636433373963383866303535333931633633393138663464336562
-36643432366233323235613139626236346135633237613265343933646434373939396265626366
-34313835346463303132326537323166363032306133623662343736393435383330356433306138
-65653931613832313832323936353638303937613863646430633266306330656135386533306462
-30663366396566393134653663356531316639303635343236666333363637636433336533356663
-35346261363134326165316463626439306130653165636134616434663736616666643963336464
-61643834613164336234386237393333636234306162306563363430646262363963366666653666
-64323036323731626236343361613566643565666138386631633462613836613766626562353934
-32363936626466346464356131653232326330386239666638626333346238623964383666393961
-38393264663636353161663636393733396332333838333962393439346533353332653362356230
-62613039376539636363
+34616531626537376463326332306434383163393761363536633133363161373631376437653234
+3831656536313531343433376264643261396634633965370a303931336236323766313065636535
+31343338616364386132623232373266663665353563666535383232666262663062323864303932
+3439373734316639650a633732333064633335383833663261326464336538636666323063646331
+66653464636534663935616461636132613162303530663237376661343338396133323431623561
+30303563303465633231306339326561313533333536376433393130376634303932643339656336
+30616130343733626162366561393939393766623138616537393032376665396139333561623830
+33623130336235633034666561383165616439316334323664623661343438663733373833306335
+30396165313731636435636263353133326135346236323030653734353831626238666663656364
+62386164363361373464383730333733626333333736306535336635613634646535383237326332
+37636532663933663739303634333235343137333363316430643263326231613635643633636437
+30336462633233396430633939616661643261666136656363363461343230653738613166346434
+63376363666462346539343063343562623962303130616535306439653134633630353963373337
+64313239353162363862643432666438383330636638333464323731643163643236313535313030
+65656231383738356537326661663163376634613031396436646633376139313237343534653065
+64323532346133313265346334353530393633396339316330366536646565353836396662303866
+65373030393463306664623235626437613965303837313365373632643935656630303936373837
+64663539623764656636613263346638376665626262663430333231633735653563643864343835
+62303637383332653366383066326536316336306539623230353066343739316430356437313365
+33323031613130643832636133636263303565623330306135333762363036633737343933623437
+33633436363062643436376632336235666330656265316333323361316430656631383734343238
+65616366666536363866343361666563643336306532666332643230656264303565353032393932
+36613738326239376161383064646634623639356439663965323237303361343838373737636235
+39656465333063633136643463356564636537326339653033633063366265636138656466646264
+32643961343863656464353439346531633036613138353333353631626665396239326465303632
+39336664333038636435366333623336353963323535316436646136313739373537376537353735
+66333265633232346536313933333836643439656666636236626266323333383935383565616139
+38626133356364613562393664643563346539366364636332613162663337356232333735393431
+30343635393462356431646336636663333735343164616261343836363366616162613563613066
+66333034613234626431356536323832393466363135653231336238356334353638613838626430
+63636630313533363563376161663637353362383431663130646666646433353864373736613662
+62343666633862643839666532656132653939663437373164393536653739376265303130353636
+62616538326330333136626238306133363634326365366637363961333635356133613564373131
+64626139656633663065353862343135393233333231386166346532656534623361623061336434
+37616565626134333863376532393861376132323434656433613731613834633963386635353336
+39653263346637303836663763653264396139383363616461393333333362616332663863363834
+61613832326466646133626337663364333566326633313664613236346135653332373035313034
+62356530313065393737393634313166313039616635363365633031336434396463326462316236
+62353838636533303664663132353838636632353733316639643964666139383539333761663531
+37366530373165653063303032383461326535613336343635626538373635356266396666346133
+61383434323565306438356634646338666232363238393932353365363461376130323363363236
+34643862653937353461383265663933646264373365623465313666643662633334366437646434
+34343332613832366235663563353435323738356339383338333361383561336366376238393237
+38656265663164376666616366623062393530366261623361383365376235643035353838313235
+32396430376139313430316439333539343266393965353030636638656661316137313437663832
+64366661323865383262323036613230316233666566386133363633303931323464663238323861
+62333132346165353830653062353763306232366563323430383933653163373562326536393362
+66353931376262383931613931303034356537363137366235643430323465623162363031373034
+64653563666533363062333831336463376530306639616631303266386136666233653638653732
+31313537393838333730303235363661326333646531653935633935373362303732653565656438
+36626330623063373832333739643666396135653838643164376264393863646433353036643731
+34623636623366353466333237373265323936643134613230326565303663306431373634356334
+37613732393262626135306632623336613364323632316636623037656538313236666562633438
+37306361333130376538366232393637646263656239303431623963626265386634313735373162
+64393733303132383464386330626135336237303563326238633437346164333738646431333730
+62616533363638643261306565373835303832313539656564386132393863373039653938616261
+36343031356361336563316230343433633033353130373933313361326164633765316433616162
+62356338393634653330623933313433343630386264396337373532376335316362333164363963
+363663666365336564663232363462613162
diff --git a/ansible/roles/caddy_site/handlers/main.yml b/ansible/roles/caddy_site/handlers/main.yml
index fb57280..4bfa7ff 100644
--- a/ansible/roles/caddy_site/handlers/main.yml
+++ b/ansible/roles/caddy_site/handlers/main.yml
@@ -2,7 +2,11 @@
 # Fires once at the end of the play, however many sites notified it.
 # Anything later in the same play that needs the new config live must be
 # preceded by `- ansible.builtin.meta: flush_handlers`.
+# become is explicit because handlers do not inherit it from the task that
+# notified them. headscale's play runs become: no and elevates per task, so
+# without this the reload would run unprivileged and fail.
 - name: Reload caddy
+  become: true
   ansible.builtin.systemd:
     name: caddy
     state: reloaded
diff --git a/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml b/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml
index 3fa36d4..860b765 100644
--- a/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml
+++ b/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml
@@ -498,64 +498,29 @@
   vars:
     datum_gateway_subdomain: "{{ subdomains.datum_gateway }}"
     datum_gateway_domain: "{{ datum_gateway_subdomain }}.{{ root_domain }}"
-    caddy_sites_dir: "{{ caddy_sites_dir }}"
     uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}"
 
   tasks:
-    - name: Ensure Caddy sites-enabled directory exists
-      file:
-        path: "{{ caddy_sites_dir }}"
-        state: directory
-        owner: root
-        group: root
-        mode: "0755"
+    - name: Publish the DATUM Gateway dashboard through Caddy
+      ansible.builtin.include_role:
+        name: caddy_site
+      vars:
+        caddy_site_name: datum-gateway
+        caddy_site_domain: "{{ datum_gateway_domain }}"
+        caddy_site_upstream: "knots-box:{{ datum_gateway_api_port }}"
+        caddy_site_resolvers: "100.100.100.100"
+        caddy_site_basic_auth:
+          - user: "{{ datum_dashboard_username }}"
+            hash: "{{ datum_dashboard_password_hash }}"
 
-    - name: Ensure Caddyfile includes import directive for sites-enabled
-      lineinfile:
-        path: /etc/caddy/Caddyfile
-        line: "import sites-enabled/*"
-        insertafter: EOF
-        state: present
-        backup: yes
-        create: yes
-        mode: "0644"
-
-    - name: Create Caddy reverse proxy config for DATUM Gateway dashboard
-      copy:
-        dest: "{{ caddy_sites_dir }}/datum-gateway.conf"
-        content: |
-          {{ datum_gateway_domain }} {
-              basic_auth {
-                  {{ datum_dashboard_username }} {{ datum_dashboard_password_hash }}
-              }
-              reverse_proxy knots-box:{{ datum_gateway_api_port }} {
-                  # Resolve via Tailscale MagicDNS
-                  transport http {
-                      resolvers 100.100.100.100
-                  }
-              }
-          }
-        owner: root
-        group: root
-        mode: "0644"
-
-    - name: Validate Caddy config
-      command: caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
-      register: caddy_validate
+    # The role validates the site fragment on its own. This re-validates the
+    # whole assembled Caddyfile, which is the only thing that catches a
+    # conflict between this site and another. Kept from the hand-rolled
+    # version; the other nine services never had it.
+    - name: Validate the assembled Caddyfile
+      ansible.builtin.command: caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
       changed_when: false
 
-    - name: Display Caddy validation output
-      debug:
-        msg: "{{ caddy_validate.stdout_lines + caddy_validate.stderr_lines }}"
-
-    - name: Reload Caddy
-      command: systemctl reload caddy
-      register: caddy_reload
-
-    - name: Display Caddy reload output
-      debug:
-        msg: "{{ caddy_reload.stdout_lines + caddy_reload.stderr_lines }}"
-
     - name: Display DATUM Gateway dashboard URL
       when: uptime_kuma_enabled | default(false)
       debug:
diff --git a/ansible/services/headscale/deploy_headscale_playbook.yml b/ansible/services/headscale/deploy_headscale_playbook.yml
index 61ba22e..527e4c2 100644
--- a/ansible/services/headscale/deploy_headscale_playbook.yml
+++ b/ansible/services/headscale/deploy_headscale_playbook.yml
@@ -8,7 +8,6 @@
     - ./headscale_vars.yml
   vars:
     headscale_subdomain: "{{ subdomains.headscale }}"
-    caddy_sites_dir: "{{ caddy_sites_dir }}"
     headscale_domain: "{{ headscale_subdomain }}.{{ root_domain }}"
     headscale_base_domain: "tailnet.{{ root_domain }}"
     headscale_namespace: "{{ service_settings.headscale.namespace }}"
@@ -230,39 +229,34 @@
         port: '3478'
         proto: udp
 
-    - name: Ensure Caddy sites-enabled directory exists
-      become: yes
-      file:
-        path: "{{ caddy_sites_dir }}"
-        state: directory
-        owner: root
-        group: root
-        mode: '0755'
-
-    - name: Ensure Caddyfile includes import directive for sites-enabled
-      become: yes
-      lineinfile:
-        path: /etc/caddy/Caddyfile
-        line: 'import sites-enabled/*'
-        insertafter: EOF
-        state: present
-        backup: yes
-
-    - name: Create Caddy reverse proxy configuration for headscale
-      become: yes
-      copy:
-        dest: "{{ caddy_sites_dir }}/headscale.conf"
-        content: |
-          {{ headscale_domain }} {
-              reverse_proxy localhost:{{ headscale_port }}
+    - name: Publish headscale through Caddy
+      ansible.builtin.include_role:
+        name: caddy_site
+        # This play is become: no and elevates per task. `apply` is how an
+        # include_role passes become down to the role's tasks - `become:` on
+        # the include itself is rejected. The role's handler sets its own.
+        apply:
+          become: yes
+      vars:
+        caddy_site_name: headscale
+        caddy_site_domain: "{{ headscale_domain }}"
+        # Raw body, and it must stay raw: the /admin* route in front of
+        # Headplane is not expressible as a plain reverse_proxy. The previous
+        # version of this task wrote only `reverse_proxy localhost:8080`, which
+        # would have deleted the admin route and its auth on the next run.
+        caddy_site_body: |
+          @headplane {
+              path /admin*
           }
-        owner: root
-        group: root
-        mode: '0644'
-
-    - name: Reload Caddy to apply new config
-      become: yes
-      command: systemctl reload caddy
+          handle @headplane {
+              basicauth {
+                  {{ headscale_ui_username }} {{ headscale_ui_password_hash }}
+              }
+              reverse_proxy http://localhost:{{ headplane_port }}
+          }
+          # Headscale API is protected by its own API key authentication
+          # All API operations require a valid Bearer token in the Authorization header
+          reverse_proxy * http://localhost:{{ headscale_port }}
 
     # ═════════════════════════════════════════════════════════════════════════
     # DEPRECATED — Uptime Kuma was decommissioned on 2026-09-11.
diff --git a/ansible/services/headscale/headscale_vars.yml b/ansible/services/headscale/headscale_vars.yml
index 0b0ee50..05fc040 100644
--- a/ansible/services/headscale/headscale_vars.yml
+++ b/ansible/services/headscale/headscale_vars.yml
@@ -22,3 +22,6 @@ remote_port: "{{ hostvars.get(remote_host_name, {}).get('ansible_port', 22) }}"
 # Local backup
 local_backup_dir: "{{ lookup('env', 'HOME') }}/headscale-backups"
 backup_script_path: "{{ lookup('env', 'HOME') }}/.local/bin/headscale_backup.sh"
+
+# Headplane (headscale admin UI), proxied at /admin* behind Caddy basic auth
+headplane_port: 3000
diff --git a/ansible/services/ntfy/deploy_ntfy_playbook.yml b/ansible/services/ntfy/deploy_ntfy_playbook.yml
index d030123..61fafe1 100644
--- a/ansible/services/ntfy/deploy_ntfy_playbook.yml
+++ b/ansible/services/ntfy/deploy_ntfy_playbook.yml
@@ -8,7 +8,6 @@
     - ./ntfy_vars.yml
   vars:
     ntfy_subdomain: "{{ subdomains.ntfy }}"
-    caddy_sites_dir: "{{ caddy_sites_dir }}"
     ntfy_domain: "{{ ntfy_subdomain }}.{{ root_domain }}"
 
   tasks:
@@ -76,42 +75,23 @@
       shell: |
         (echo "{{ ntfy_password }}"; echo "{{ ntfy_password }}") | ntfy user add --role=admin "{{ ntfy_username }}"
 
-    - name: Ensure Caddy sites-enabled directory exists
-      file:
-        path: "{{ caddy_sites_dir }}"
-        state: directory
-        owner: root
-        group: root
-        mode: '0755'
+    - name: Publish ntfy through Caddy
+      ansible.builtin.include_role:
+        name: caddy_site
+      vars:
+        caddy_site_name: ntfy
+        caddy_site_domain: "{{ ntfy_domain }}, http://{{ ntfy_domain }}"
+        # Raw body: ntfy needs a plain-HTTP listener for its CLI/app clients,
+        # with only GETs to the docs and topic paths redirected to HTTPS.
+        caddy_site_body: |
+          reverse_proxy 127.0.0.1:{{ ntfy_port }}
 
-    - name: Ensure Caddyfile includes import directive for sites-enabled
-      lineinfile:
-        path: /etc/caddy/Caddyfile
-        line: 'import sites-enabled/*'
-        insertafter: EOF
-        state: present
-        backup: yes
-
-    - name: Create Caddy reverse proxy configuration for ntfy
-      copy:
-        dest: "{{ caddy_sites_dir }}/ntfy.conf"
-        content: |
-          {{ ntfy_domain }}, http://{{ ntfy_domain }} {
-              reverse_proxy 127.0.0.1:{{ ntfy_port }}
-
-              @httpget {
-                  protocol http
-                  method GET
-                  path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
-              }
-              redir @httpget https://{host}{uri}
+          @httpget {
+              protocol http
+              method GET
+              path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
           }
-        owner: root
-        group: root
-        mode: '0644'
-
-    - name: Reload Caddy to apply new config
-      command: systemctl reload caddy
+          redir @httpget https://{host}{uri}
 
   handlers:
     - name: Restart ntfy