diff --git a/configs/caddy/Caddyfile b/configs/caddy/Caddyfile
new file mode 100644
index 0000000..8af5bd9
--- /dev/null
+++ b/configs/caddy/Caddyfile
@@ -0,0 +1,11 @@
+# taler LE issued 2026-07-07; on disk under /etc/caddy/certs/
+{
+	auto_https disable_redirects
+}
+taler.hacktivism.ch {
+	tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
+	reverse_proxy https://127.0.0.1:8081 {
+		transport http { tls_insecure_skip_verify }
+		header_up Host {host}
+	}
+}
diff --git a/configs/caddy/Caddyfile.taler-host b/configs/caddy/Caddyfile.taler-host
new file mode 100644
index 0000000..8af5bd9
--- /dev/null
+++ b/configs/caddy/Caddyfile.taler-host
@@ -0,0 +1,11 @@
+# taler LE issued 2026-07-07; on disk under /etc/caddy/certs/
+{
+	auto_https disable_redirects
+}
+taler.hacktivism.ch {
+	tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
+	reverse_proxy https://127.0.0.1:8081 {
+		transport http { tls_insecure_skip_verify }
+		header_up Host {host}
+	}
+}
diff --git a/host/caddy/Caddyfile b/host/caddy/Caddyfile
new file mode 100644
index 0000000..8af5bd9
--- /dev/null
+++ b/host/caddy/Caddyfile
@@ -0,0 +1,11 @@
+# taler LE issued 2026-07-07; on disk under /etc/caddy/certs/
+{
+	auto_https disable_redirects
+}
+taler.hacktivism.ch {
+	tls /etc/caddy/certs/taler.hacktivism.ch/fullchain.pem /etc/caddy/certs/taler.hacktivism.ch/privkey.pem
+	reverse_proxy https://127.0.0.1:8081 {
+		transport http { tls_insecure_skip_verify }
+		header_up Host {host}
+	}
+}
diff --git a/host/caddy/README.md b/host/caddy/README.md
new file mode 100644
index 0000000..4b5053f
--- /dev/null
+++ b/host/caddy/README.md
@@ -0,0 +1,4 @@
+# Caddy
+
+- 2026-07-07 taler LE (certbot)
+- 2026-07-08 Caddy :443 with copied certs