From 16cbd189b8a9b715ad14a92563103533efaa1f4e Mon Sep 17 00:00:00 2001
From: counterweight <counterweightoperator@protonmail.com>
Date: Fri, 11 Sep 2026 23:37:38 +0200
Subject: [PATCH] ntfy, datum-gateway, headscale: use the caddy_site role

Completes Stage 3. No hand-rolled Caddy plumbing remains anywhere:
`grep sites-enabled` outside roles/ returns nothing, and so does
`grep "systemctl reload caddy"`.

ntfy uses caddy_site_body for its plain-HTTP listener and @httpget redirect.
Verified ok/unchanged against watchtower; the one other changed task is a
pre-existing "Update APT cache".

datum-gateway keeps a whole-Caddyfile validate after the role call. The role
validates its own fragment, but only a whole-file validate catches a conflict
between two sites, and this playbook was the only one that ever had it. Its
two debug tasks that echoed command output are gone with the commands.

headscale is the one that mattered. Its playbook wrote
`reverse_proxy localhost:8080`, but spacey is actually running a /admin*
route in front of Headplane behind Caddy basic auth. Running that playbook
would have deleted the admin route and its auth - a hazard that predates this
work. It now renders the config that is really there, verified ok/unchanged
via --start-at-task (the play cannot reach Caddy in check mode: "Install
headscale package" fails because the .deb is not really downloaded, before
and after this edit alike).

Supporting changes for headscale:
  - headscale_ui_password_hash added to infra_secrets.yml and the identical
    group_vars/all/vault.yml, read from the live config on spacey. The vault
    already had headscale_ui_username (= counterweight, confirmed) and
    headscale_ui_password; I did not verify the password is the plaintext of
    this hash.
  - headplane_port added to headscale_vars.yml.
  - The role's handler now sets become: true. Handlers do not inherit become
    from the task that notified them, and this play runs become: no.
  - The include uses `apply: become: yes`; `become:` on an include_role is
    rejected outright.

All 14 site files on all 3 hosts still byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 ansible/group_vars/all/vault.yml              | 103 ++++++++++--------
 ansible/infra_secrets.yml                     | 103 ++++++++++--------
 ansible/roles/caddy_site/handlers/main.yml    |   4 +
 .../deploy_datum_gateway_playbook.yml         |  69 +++---------
 .../headscale/deploy_headscale_playbook.yml   |  60 +++++-----
 ansible/services/headscale/headscale_vars.yml |   3 +
 .../services/ntfy/deploy_ntfy_playbook.yml    |  50 +++------
 7 files changed, 184 insertions(+), 208 deletions(-)

diff --git a/ansible/group_vars/all/vault.yml b/ansible/group_vars/all/vault.yml
index 798e2d8..d1f18ec 100644
--- a/ansible/group_vars/all/vault.yml
+++ b/ansible/group_vars/all/vault.yml
@@ -1,45 +1,60 @@
 $ANSIBLE_VAULT;1.1;AES256
-65343264303166346334396163363362326334626531336363363766326135393462373564313539
-6633346163343664393232363965383334303563396236360a316265623239333431636133306663
-65623237393564323936303936633036343137646637633963396166313462626165616463616665
-3235373562626238640a636163623535376565373835653831666361636563616230353639626131
-38393530363461346334356437613934306330666563326661343465653362313038346535386337
-62623964633764343964653061373137366539326433396231396339313231633632353465323139
-33333866383834376165303964353639386234646535626333363932333764646137663036303530
-32326635343631623535323830333934376466323338353234323464666435383436633139343037
-62666333383231356163383530353339336230373431616665333638633234656231393166303639
-32386134386264613839313564316164336461373738646630636630363731643066633132336636
-64663532663661653539653431353763303436323234383864353064333631643435633733366435
-32656332626633313134623361343965643962663134613363626265353865643738363738316232
-62356136623166303038653830393138646637636335366362323239316333616331383765663861
-33643331323766646463663862396232306233343134326436326235336165616662383636616539
-39373962336264636363303734343666646534343733666632626338393936393032626130643233
-30633963656166343834396431323233363036353165623934336532333662323932336630636235
-63326631366234383732316464383364316337393034303433646365343763633135336336376161
-33326436303863326666616234396438623864333538313363623261353962336430316132343830
-36353761326133666166393930343233643861366138363930623362336566386230316236353365
-65663632383436333536636161393133316334376262653330303238636431353966646666663665
-30386137623066343135616534323336313162643066636330323934646162303362373838313532
-61386163356537613334616537656134373835326265393765303436396233383239393365336136
-64623130383538306331323939386634316663663263306362363830383930346232313965613035
-33353235663230663635316136666335343233646539613832643431393134303865616232636435
-66366437353863336235646438353431616465396365373562636461623938303663326461656134
-66353735343237363164326236663363376333316163353462626234393861663535323463623233
-66623934336662323830616362653035353563343564636431383837643961303637366131633132
-33376133376465623030643935643737636339333236316566636663323934626265633863343963
-38626563323166343264643465626264393838643330393739386330656461656561306539653232
-63393838626233386531353063366131366237633162393537363963633361386238643232336230
-36363062386262303364303736373061316265373730366437326166336163386335623665323234
-35383865646466363534383833653764303833323230613863313735393264336132303934633465
-65616138636134613361316539343739353735666538653438333264623034306633663634306438
-33643165353534623039626536636433373963383866303535333931633633393138663464336562
-36643432366233323235613139626236346135633237613265343933646434373939396265626366
-34313835346463303132326537323166363032306133623662343736393435383330356433306138
-65653931613832313832323936353638303937613863646430633266306330656135386533306462
-30663366396566393134653663356531316639303635343236666333363637636433336533356663
-35346261363134326165316463626439306130653165636134616434663736616666643963336464
-61643834613164336234386237393333636234306162306563363430646262363963366666653666
-64323036323731626236343361613566643565666138386631633462613836613766626562353934
-32363936626466346464356131653232326330386239666638626333346238623964383666393961
-38393264663636353161663636393733396332333838333962393439346533353332653362356230
-62613039376539636363
+61356165613635386631393135656434646436303665313031346566323336313138353433316463
+3363323534613064643132663335623238366431393062340a346538396662306537663163623366
+38626166383933616331623231373137306562623637313263333237633661663436666266616433
+3862346438643638650a306634333535653633613534646630386131333236366538333765323333
+38656163303837303732663561373232393132343331663164656262393730326434373731333636
+36613538646431396536363936336562616431656665653965373864633366663836353434626434
+34383932373461333564303439623565383661646365386665393831383463663662356536356236
+36373964666236626465366161636135393734356536633466383262326537343833636630343738
+62353066316131613737373162643363653662656261363465386364323962656537373061373032
+33343763353464383438363438343965653532393831343930393562633630383932653862623637
+38386239353237356631646436356166373961333464396639383538383662326534343339313330
+65373339356364636634616532363832386631323062363530313861336238353261353334306235
+62616338396431316537346638656365356564346666366366343638356261623664393263323937
+30343261363562383332323462336435376664386134646562643836363834313237373631353731
+35653535663864643266313332356635363262363533663232656531373130336539633066376139
+32316665393831663035623962656364363831333563366135636164346335383738363336663566
+63356532643563393939383635386462663561386434323939303431653438653131363538383034
+33623933333464363032656636643033326162626163353633343062633966343332383138363963
+36383831663562616533316436366566323061386535343538393861383462333166343562316633
+30623665623035393537393965626363323132656433313339396233356666346634316332616336
+37363635363330323230373332326565343530653335383437373230366563366237633665626331
+66623336626230663361636439316337393865383035326136653264666438666566646132353036
+38616264313833316536623238633339373466613866626366383835656638623863323838653030
+63303938376164653966356435386333363731656666313234663535666165646233313137343563
+36386437393139656438333262383437656666343831313239323961373637653163643664356565
+62346431393133656530316262303763646165643336396661666431383436323562336137653031
+62626538373839613734396366653065306534636630346338316237616161613037616364356431
+38643965376133616161336633383664326230383435363334353137303162663738313331346238
+39356161616533616134356231323530306338333162343363353531303263636632613036386638
+63633136386232306234323936303563646466313935326631396565383432386130656638616266
+32383334363237336539396665336366643764633131643663643137376438323666326435626461
+64346633636431393137633537306431646564386565303933636434386462346630626537346438
+32623333666133303061646564366366326665363163396262633164323631636337346130303239
+38373936663337356134666132303165393365663763396362623434633737373538653566646134
+62316164396438303532616266313062326666633130656338653139376634306664633031333037
+31636166306565353334633435656233336233363664306264626237623366336161303134353433
+63383739666462623336386537346662633666626466393039653439346436653937633537396436
+35393339383066326630353066623132333034656539363561346462626265363263303535343961
+39316461616630326539613731303039613736393633373338646266323938326162373831346336
+30656130343463366534323030646238313465306266383034623065636665623366333063383736
+38373063393837306462303564643962373334343139626338623935336435643730646532633630
+66363730386636633639346463363365343239373265303738353732653633653437636130636664
+39386365353334653765343335303263363461313965383664326563333734626533376436626530
+63353163323637303730353564383733653365613635353764333266393532653663326533646132
+39313763373735323835626437306435373238653432393936643165663663656665316132653330
+35383038353532656434366336346235363563636264303734633138323963396562306232646236
+38366536306561653937336333373434336164663336613839353439356435333833396363636437
+38323934613735643363656233333037336465336564313966623063376566663030303230323262
+65643564666534326234306164343365383632333061316238623565353538313538396364313337
+35336230313339643736653238386231343661623337306236383665356632366236356335323530
+66373831616239376231636361333430343433303233393066323865663434643433303832373262
+36366534646161323130393931626362626139663139643263366639656531613436313533363130
+65643736363833333939613566663339623964333262643863333030623138633464386238613934
+31323639333234336264313663376465323737353766643839303665313737336534386665363034
+30326439666433373232306136306365343764643434306561343339353132346430646436343362
+32333765616262363930353435616563333736313533653339656231316230346166363335356638
+37333561366339613136306438306130343230663732333862663838396463623661303961336433
+65646332373139303462303633346432366530643130366133363937653739653036366136373434
+343864373734666431326239373866313734
diff --git a/ansible/infra_secrets.yml b/ansible/infra_secrets.yml
index 798e2d8..4803d86 100644
--- a/ansible/infra_secrets.yml
+++ b/ansible/infra_secrets.yml
@@ -1,45 +1,60 @@
 $ANSIBLE_VAULT;1.1;AES256
-65343264303166346334396163363362326334626531336363363766326135393462373564313539
-6633346163343664393232363965383334303563396236360a316265623239333431636133306663
-65623237393564323936303936633036343137646637633963396166313462626165616463616665
-3235373562626238640a636163623535376565373835653831666361636563616230353639626131
-38393530363461346334356437613934306330666563326661343465653362313038346535386337
-62623964633764343964653061373137366539326433396231396339313231633632353465323139
-33333866383834376165303964353639386234646535626333363932333764646137663036303530
-32326635343631623535323830333934376466323338353234323464666435383436633139343037
-62666333383231356163383530353339336230373431616665333638633234656231393166303639
-32386134386264613839313564316164336461373738646630636630363731643066633132336636
-64663532663661653539653431353763303436323234383864353064333631643435633733366435
-32656332626633313134623361343965643962663134613363626265353865643738363738316232
-62356136623166303038653830393138646637636335366362323239316333616331383765663861
-33643331323766646463663862396232306233343134326436326235336165616662383636616539
-39373962336264636363303734343666646534343733666632626338393936393032626130643233
-30633963656166343834396431323233363036353165623934336532333662323932336630636235
-63326631366234383732316464383364316337393034303433646365343763633135336336376161
-33326436303863326666616234396438623864333538313363623261353962336430316132343830
-36353761326133666166393930343233643861366138363930623362336566386230316236353365
-65663632383436333536636161393133316334376262653330303238636431353966646666663665
-30386137623066343135616534323336313162643066636330323934646162303362373838313532
-61386163356537613334616537656134373835326265393765303436396233383239393365336136
-64623130383538306331323939386634316663663263306362363830383930346232313965613035
-33353235663230663635316136666335343233646539613832643431393134303865616232636435
-66366437353863336235646438353431616465396365373562636461623938303663326461656134
-66353735343237363164326236663363376333316163353462626234393861663535323463623233
-66623934336662323830616362653035353563343564636431383837643961303637366131633132
-33376133376465623030643935643737636339333236316566636663323934626265633863343963
-38626563323166343264643465626264393838643330393739386330656461656561306539653232
-63393838626233386531353063366131366237633162393537363963633361386238643232336230
-36363062386262303364303736373061316265373730366437326166336163386335623665323234
-35383865646466363534383833653764303833323230613863313735393264336132303934633465
-65616138636134613361316539343739353735666538653438333264623034306633663634306438
-33643165353534623039626536636433373963383866303535333931633633393138663464336562
-36643432366233323235613139626236346135633237613265343933646434373939396265626366
-34313835346463303132326537323166363032306133623662343736393435383330356433306138
-65653931613832313832323936353638303937613863646430633266306330656135386533306462
-30663366396566393134653663356531316639303635343236666333363637636433336533356663
-35346261363134326165316463626439306130653165636134616434663736616666643963336464
-61643834613164336234386237393333636234306162306563363430646262363963366666653666
-64323036323731626236343361613566643565666138386631633462613836613766626562353934
-32363936626466346464356131653232326330386239666638626333346238623964383666393961
-38393264663636353161663636393733396332333838333962393439346533353332653362356230
-62613039376539636363
+34616531626537376463326332306434383163393761363536633133363161373631376437653234
+3831656536313531343433376264643261396634633965370a303931336236323766313065636535
+31343338616364386132623232373266663665353563666535383232666262663062323864303932
+3439373734316639650a633732333064633335383833663261326464336538636666323063646331
+66653464636534663935616461636132613162303530663237376661343338396133323431623561
+30303563303465633231306339326561313533333536376433393130376634303932643339656336
+30616130343733626162366561393939393766623138616537393032376665396139333561623830
+33623130336235633034666561383165616439316334323664623661343438663733373833306335
+30396165313731636435636263353133326135346236323030653734353831626238666663656364
+62386164363361373464383730333733626333333736306535336635613634646535383237326332
+37636532663933663739303634333235343137333363316430643263326231613635643633636437
+30336462633233396430633939616661643261666136656363363461343230653738613166346434
+63376363666462346539343063343562623962303130616535306439653134633630353963373337
+64313239353162363862643432666438383330636638333464323731643163643236313535313030
+65656231383738356537326661663163376634613031396436646633376139313237343534653065
+64323532346133313265346334353530393633396339316330366536646565353836396662303866
+65373030393463306664623235626437613965303837313365373632643935656630303936373837
+64663539623764656636613263346638376665626262663430333231633735653563643864343835
+62303637383332653366383066326536316336306539623230353066343739316430356437313365
+33323031613130643832636133636263303565623330306135333762363036633737343933623437
+33633436363062643436376632336235666330656265316333323361316430656631383734343238
+65616366666536363866343361666563643336306532666332643230656264303565353032393932
+36613738326239376161383064646634623639356439663965323237303361343838373737636235
+39656465333063633136643463356564636537326339653033633063366265636138656466646264
+32643961343863656464353439346531633036613138353333353631626665396239326465303632
+39336664333038636435366333623336353963323535316436646136313739373537376537353735
+66333265633232346536313933333836643439656666636236626266323333383935383565616139
+38626133356364613562393664643563346539366364636332613162663337356232333735393431
+30343635393462356431646336636663333735343164616261343836363366616162613563613066
+66333034613234626431356536323832393466363135653231336238356334353638613838626430
+63636630313533363563376161663637353362383431663130646666646433353864373736613662
+62343666633862643839666532656132653939663437373164393536653739376265303130353636
+62616538326330333136626238306133363634326365366637363961333635356133613564373131
+64626139656633663065353862343135393233333231386166346532656534623361623061336434
+37616565626134333863376532393861376132323434656433613731613834633963386635353336
+39653263346637303836663763653264396139383363616461393333333362616332663863363834
+61613832326466646133626337663364333566326633313664613236346135653332373035313034
+62356530313065393737393634313166313039616635363365633031336434396463326462316236
+62353838636533303664663132353838636632353733316639643964666139383539333761663531
+37366530373165653063303032383461326535613336343635626538373635356266396666346133
+61383434323565306438356634646338666232363238393932353365363461376130323363363236
+34643862653937353461383265663933646264373365623465313666643662633334366437646434
+34343332613832366235663563353435323738356339383338333361383561336366376238393237
+38656265663164376666616366623062393530366261623361383365376235643035353838313235
+32396430376139313430316439333539343266393965353030636638656661316137313437663832
+64366661323865383262323036613230316233666566386133363633303931323464663238323861
+62333132346165353830653062353763306232366563323430383933653163373562326536393362
+66353931376262383931613931303034356537363137366235643430323465623162363031373034
+64653563666533363062333831336463376530306639616631303266386136666233653638653732
+31313537393838333730303235363661326333646531653935633935373362303732653565656438
+36626330623063373832333739643666396135653838643164376264393863646433353036643731
+34623636623366353466333237373265323936643134613230326565303663306431373634356334
+37613732393262626135306632623336613364323632316636623037656538313236666562633438
+37306361333130376538366232393637646263656239303431623963626265386634313735373162
+64393733303132383464386330626135336237303563326238633437346164333738646431333730
+62616533363638643261306565373835303832313539656564386132393863373039653938616261
+36343031356361336563316230343433633033353130373933313361326164633765316433616162
+62356338393634653330623933313433343630386264396337373532376335316362333164363963
+363663666365336564663232363462613162
diff --git a/ansible/roles/caddy_site/handlers/main.yml b/ansible/roles/caddy_site/handlers/main.yml
index fb57280..4bfa7ff 100644
--- a/ansible/roles/caddy_site/handlers/main.yml
+++ b/ansible/roles/caddy_site/handlers/main.yml
@@ -2,7 +2,11 @@
 # Fires once at the end of the play, however many sites notified it.
 # Anything later in the same play that needs the new config live must be
 # preceded by `- ansible.builtin.meta: flush_handlers`.
+# become is explicit because handlers do not inherit it from the task that
+# notified them. headscale's play runs become: no and elevates per task, so
+# without this the reload would run unprivileged and fail.
 - name: Reload caddy
+  become: true
   ansible.builtin.systemd:
     name: caddy
     state: reloaded
diff --git a/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml b/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml
index 3fa36d4..860b765 100644
--- a/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml
+++ b/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml
@@ -498,64 +498,29 @@
   vars:
     datum_gateway_subdomain: "{{ subdomains.datum_gateway }}"
     datum_gateway_domain: "{{ datum_gateway_subdomain }}.{{ root_domain }}"
-    caddy_sites_dir: "{{ caddy_sites_dir }}"
     uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}"
 
   tasks:
-    - name: Ensure Caddy sites-enabled directory exists
-      file:
-        path: "{{ caddy_sites_dir }}"
-        state: directory
-        owner: root
-        group: root
-        mode: "0755"
+    - name: Publish the DATUM Gateway dashboard through Caddy
+      ansible.builtin.include_role:
+        name: caddy_site
+      vars:
+        caddy_site_name: datum-gateway
+        caddy_site_domain: "{{ datum_gateway_domain }}"
+        caddy_site_upstream: "knots-box:{{ datum_gateway_api_port }}"
+        caddy_site_resolvers: "100.100.100.100"
+        caddy_site_basic_auth:
+          - user: "{{ datum_dashboard_username }}"
+            hash: "{{ datum_dashboard_password_hash }}"
 
-    - name: Ensure Caddyfile includes import directive for sites-enabled
-      lineinfile:
-        path: /etc/caddy/Caddyfile
-        line: "import sites-enabled/*"
-        insertafter: EOF
-        state: present
-        backup: yes
-        create: yes
-        mode: "0644"
-
-    - name: Create Caddy reverse proxy config for DATUM Gateway dashboard
-      copy:
-        dest: "{{ caddy_sites_dir }}/datum-gateway.conf"
-        content: |
-          {{ datum_gateway_domain }} {
-              basic_auth {
-                  {{ datum_dashboard_username }} {{ datum_dashboard_password_hash }}
-              }
-              reverse_proxy knots-box:{{ datum_gateway_api_port }} {
-                  # Resolve via Tailscale MagicDNS
-                  transport http {
-                      resolvers 100.100.100.100
-                  }
-              }
-          }
-        owner: root
-        group: root
-        mode: "0644"
-
-    - name: Validate Caddy config
-      command: caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
-      register: caddy_validate
+    # The role validates the site fragment on its own. This re-validates the
+    # whole assembled Caddyfile, which is the only thing that catches a
+    # conflict between this site and another. Kept from the hand-rolled
+    # version; the other nine services never had it.
+    - name: Validate the assembled Caddyfile
+      ansible.builtin.command: caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
       changed_when: false
 
-    - name: Display Caddy validation output
-      debug:
-        msg: "{{ caddy_validate.stdout_lines + caddy_validate.stderr_lines }}"
-
-    - name: Reload Caddy
-      command: systemctl reload caddy
-      register: caddy_reload
-
-    - name: Display Caddy reload output
-      debug:
-        msg: "{{ caddy_reload.stdout_lines + caddy_reload.stderr_lines }}"
-
     - name: Display DATUM Gateway dashboard URL
       when: uptime_kuma_enabled | default(false)
       debug:
diff --git a/ansible/services/headscale/deploy_headscale_playbook.yml b/ansible/services/headscale/deploy_headscale_playbook.yml
index 61ba22e..527e4c2 100644
--- a/ansible/services/headscale/deploy_headscale_playbook.yml
+++ b/ansible/services/headscale/deploy_headscale_playbook.yml
@@ -8,7 +8,6 @@
     - ./headscale_vars.yml
   vars:
     headscale_subdomain: "{{ subdomains.headscale }}"
-    caddy_sites_dir: "{{ caddy_sites_dir }}"
     headscale_domain: "{{ headscale_subdomain }}.{{ root_domain }}"
     headscale_base_domain: "tailnet.{{ root_domain }}"
     headscale_namespace: "{{ service_settings.headscale.namespace }}"
@@ -230,39 +229,34 @@
         port: '3478'
         proto: udp
 
-    - name: Ensure Caddy sites-enabled directory exists
-      become: yes
-      file:
-        path: "{{ caddy_sites_dir }}"
-        state: directory
-        owner: root
-        group: root
-        mode: '0755'
-
-    - name: Ensure Caddyfile includes import directive for sites-enabled
-      become: yes
-      lineinfile:
-        path: /etc/caddy/Caddyfile
-        line: 'import sites-enabled/*'
-        insertafter: EOF
-        state: present
-        backup: yes
-
-    - name: Create Caddy reverse proxy configuration for headscale
-      become: yes
-      copy:
-        dest: "{{ caddy_sites_dir }}/headscale.conf"
-        content: |
-          {{ headscale_domain }} {
-              reverse_proxy localhost:{{ headscale_port }}
+    - name: Publish headscale through Caddy
+      ansible.builtin.include_role:
+        name: caddy_site
+        # This play is become: no and elevates per task. `apply` is how an
+        # include_role passes become down to the role's tasks - `become:` on
+        # the include itself is rejected. The role's handler sets its own.
+        apply:
+          become: yes
+      vars:
+        caddy_site_name: headscale
+        caddy_site_domain: "{{ headscale_domain }}"
+        # Raw body, and it must stay raw: the /admin* route in front of
+        # Headplane is not expressible as a plain reverse_proxy. The previous
+        # version of this task wrote only `reverse_proxy localhost:8080`, which
+        # would have deleted the admin route and its auth on the next run.
+        caddy_site_body: |
+          @headplane {
+              path /admin*
           }
-        owner: root
-        group: root
-        mode: '0644'
-
-    - name: Reload Caddy to apply new config
-      become: yes
-      command: systemctl reload caddy
+          handle @headplane {
+              basicauth {
+                  {{ headscale_ui_username }} {{ headscale_ui_password_hash }}
+              }
+              reverse_proxy http://localhost:{{ headplane_port }}
+          }
+          # Headscale API is protected by its own API key authentication
+          # All API operations require a valid Bearer token in the Authorization header
+          reverse_proxy * http://localhost:{{ headscale_port }}
 
     # ═════════════════════════════════════════════════════════════════════════
     # DEPRECATED — Uptime Kuma was decommissioned on 2026-09-11.
diff --git a/ansible/services/headscale/headscale_vars.yml b/ansible/services/headscale/headscale_vars.yml
index 0b0ee50..05fc040 100644
--- a/ansible/services/headscale/headscale_vars.yml
+++ b/ansible/services/headscale/headscale_vars.yml
@@ -22,3 +22,6 @@ remote_port: "{{ hostvars.get(remote_host_name, {}).get('ansible_port', 22) }}"
 # Local backup
 local_backup_dir: "{{ lookup('env', 'HOME') }}/headscale-backups"
 backup_script_path: "{{ lookup('env', 'HOME') }}/.local/bin/headscale_backup.sh"
+
+# Headplane (headscale admin UI), proxied at /admin* behind Caddy basic auth
+headplane_port: 3000
diff --git a/ansible/services/ntfy/deploy_ntfy_playbook.yml b/ansible/services/ntfy/deploy_ntfy_playbook.yml
index d030123..61fafe1 100644
--- a/ansible/services/ntfy/deploy_ntfy_playbook.yml
+++ b/ansible/services/ntfy/deploy_ntfy_playbook.yml
@@ -8,7 +8,6 @@
     - ./ntfy_vars.yml
   vars:
     ntfy_subdomain: "{{ subdomains.ntfy }}"
-    caddy_sites_dir: "{{ caddy_sites_dir }}"
     ntfy_domain: "{{ ntfy_subdomain }}.{{ root_domain }}"
 
   tasks:
@@ -76,42 +75,23 @@
       shell: |
         (echo "{{ ntfy_password }}"; echo "{{ ntfy_password }}") | ntfy user add --role=admin "{{ ntfy_username }}"
 
-    - name: Ensure Caddy sites-enabled directory exists
-      file:
-        path: "{{ caddy_sites_dir }}"
-        state: directory
-        owner: root
-        group: root
-        mode: '0755'
+    - name: Publish ntfy through Caddy
+      ansible.builtin.include_role:
+        name: caddy_site
+      vars:
+        caddy_site_name: ntfy
+        caddy_site_domain: "{{ ntfy_domain }}, http://{{ ntfy_domain }}"
+        # Raw body: ntfy needs a plain-HTTP listener for its CLI/app clients,
+        # with only GETs to the docs and topic paths redirected to HTTPS.
+        caddy_site_body: |
+          reverse_proxy 127.0.0.1:{{ ntfy_port }}
 
-    - name: Ensure Caddyfile includes import directive for sites-enabled
-      lineinfile:
-        path: /etc/caddy/Caddyfile
-        line: 'import sites-enabled/*'
-        insertafter: EOF
-        state: present
-        backup: yes
-
-    - name: Create Caddy reverse proxy configuration for ntfy
-      copy:
-        dest: "{{ caddy_sites_dir }}/ntfy.conf"
-        content: |
-          {{ ntfy_domain }}, http://{{ ntfy_domain }} {
-              reverse_proxy 127.0.0.1:{{ ntfy_port }}
-
-              @httpget {
-                  protocol http
-                  method GET
-                  path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
-              }
-              redir @httpget https://{host}{uri}
+          @httpget {
+              protocol http
+              method GET
+              path_regexp ^/([-_a-z0-9]{0,64}$|docs/|static/)
           }
-        owner: root
-        group: root
-        mode: '0644'
-
-    - name: Reload Caddy to apply new config
-      command: systemctl reload caddy
+          redir @httpget https://{host}{uri}
 
   handlers:
     - name: Restart ntfy