diff --git a/scripts/caddy/README.md b/scripts/caddy/README.md
new file mode 100644
index 0000000..d5d3566
--- /dev/null
+++ b/scripts/caddy/README.md
@@ -0,0 +1,15 @@
+# koopa Caddy apply
+
+| File | Role |
+|------|------|
+| `Caddyfile` | Desired config (sync from admin-log `configs/caddy/Caddyfile`) |
+| `apply.sh` | Backup live, install, validate, `systemctl reload caddy` |
+
+```bash
+# as hernani (prompts for sudo password)
+~/koopa-caddy/apply.sh
+# or
+sudo ~/koopa-caddy/apply.sh
+```
+
+Override source: `CADDYFILE_SRC=/path/to/Caddyfile ~/koopa-caddy/apply.sh`
diff --git a/scripts/caddy/apply.sh b/scripts/caddy/apply.sh
new file mode 100755
index 0000000..2b19e56
--- /dev/null
+++ b/scripts/caddy/apply.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Apply koopa Caddyfile (git.hacktivism.ch, forgejo-ssh note :9200, ACME host list).
+# Usage: sudo ~/koopa-caddy/apply.sh
+#    or: ~/koopa-caddy/apply.sh   (will re-exec with sudo if needed)
+set -euo pipefail
+
+SRC="${CADDYFILE_SRC:-/home/hernani/koopa-caddy/Caddyfile}"
+DST="/etc/caddy/Caddyfile"
+BACKUP_DIR="/etc/caddy"
+
+if [[ ! -f "$SRC" ]]; then
+  echo "error: source missing: $SRC" >&2
+  exit 1
+fi
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  exec sudo -E "$0" "$@"
+fi
+
+ts=$(date +%Y%m%d-%H%M%S)
+bak="${BACKUP_DIR}/Caddyfile.bak-${ts}"
+cp -a "$DST" "$bak"
+echo "backup: $bak"
+
+cp "$SRC" "$DST"
+chown root:caddy "$DST" 2>/dev/null || chown root:root "$DST"
+chmod 644 "$DST"
+
+echo "validate..."
+if command -v caddy >/dev/null 2>&1; then
+  caddy validate --config "$DST"
+else
+  echo "warn: caddy binary not in PATH; skipping validate" >&2
+fi
+
+echo "reload..."
+systemctl reload caddy
+systemctl is-active caddy
+
+echo "spot-check:"
+grep -n "git.hacktivism\|9200\|9024" "$DST" | head -10
+echo "OK: $DST updated from $SRC"