{ ... }:

# Caddy reverse proxy — base enable + open the web ports.
# Each host adds its own `services.caddy.virtualHosts.<name>` (LAN names on
# jupiter, public domains with automatic HTTPS on the neptun).
{
  services.caddy.enable = true;
  networking.firewall.allowedTCPPorts = [ 80 443 ];
}