diff --git a/configs/caddy/Caddyfile b/configs/caddy/Caddyfile
index 8af5bd9..08f6077 100644
--- a/configs/caddy/Caddyfile
+++ b/configs/caddy/Caddyfile
@@ -1,5 +1,7 @@
-# taler LE issued 2026-07-07; on disk under /etc/caddy/certs/
 {
+	email info+koopa@hacktivism.ch
+	http_port 8085
+	https_port 8443
 	auto_https disable_redirects
 }
 taler.hacktivism.ch {
diff --git a/configs/ports.md b/configs/ports.md
new file mode 100644
index 0000000..c8e350f
--- /dev/null
+++ b/configs/ports.md
@@ -0,0 +1,3 @@
+# Ports
+
+80→8085, 443→8443; Caddy 8085/8443; merchant 8081
diff --git a/configs/systemd/caddy.service.d-no-resume.conf b/configs/systemd/caddy.service.d-no-resume.conf
new file mode 100644
index 0000000..8a32924
--- /dev/null
+++ b/configs/systemd/caddy.service.d-no-resume.conf
@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile
diff --git a/configs/systemd/http-proxy.socket b/configs/systemd/http-proxy.socket
new file mode 100644
index 0000000..1dda110
--- /dev/null
+++ b/configs/systemd/http-proxy.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=Forward incoming HTTP :80 to Caddy on 127.0.0.1:9000
+
+[Socket]
+ListenStream=0.0.0.0:80
+ListenStream=[::]:80
+BindIPv6Only=yes
+Service=https-proxy@9000.service
+
+[Install]
+WantedBy=sockets.target
diff --git a/configs/systemd/https-proxy.socket b/configs/systemd/https-proxy.socket
new file mode 100644
index 0000000..bedf449
--- /dev/null
+++ b/configs/systemd/https-proxy.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=Forward incoming HTTPS :443 to Caddy on 127.0.0.1:9001
+
+[Socket]
+ListenStream=0.0.0.0:443
+ListenStream=[::]:443
+BindIPv6Only=yes
+Service=https-proxy@9001.service
+
+[Install]
+WantedBy=sockets.target
diff --git a/configs/systemd/https-proxy@.service b/configs/systemd/https-proxy@.service
new file mode 100644
index 0000000..a61c775
--- /dev/null
+++ b/configs/systemd/https-proxy@.service
@@ -0,0 +1,5 @@
+[Unit]
+Description=Proxy for incoming HTTPS traffic to port %i
+
+[Service]
+ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:%i
diff --git a/host/caddy/Caddyfile b/host/caddy/Caddyfile
index 8af5bd9..08f6077 100644
--- a/host/caddy/Caddyfile
+++ b/host/caddy/Caddyfile
@@ -1,5 +1,7 @@
-# taler LE issued 2026-07-07; on disk under /etc/caddy/certs/
 {
+	email info+koopa@hacktivism.ch
+	http_port 8085
+	https_port 8443
 	auto_https disable_redirects
 }
 taler.hacktivism.ch {
diff --git a/host/systemd/README.md b/host/systemd/README.md
new file mode 100644
index 0000000..ddc73ee
--- /dev/null
+++ b/host/systemd/README.md
@@ -0,0 +1,13 @@
+# systemd units (host)
+
+| Unit | Role |
+|------|------|
+| `caddy.service` | reverse proxy (drop-in: no `--resume`) |
+| `http-proxy.socket` | bind **:80** → `systemd-socket-proxyd` → `127.0.0.1:9000` |
+| `https-proxy.socket` | bind **:443** → `systemd-socket-proxyd` → `127.0.0.1:9001` |
+| `https-proxy@.service` | template: `systemd-socket-proxyd 127.0.0.1:%i` |
+| `firewalld.service` | host firewall |
+| `sshd.service` | SSH |
+| `tor.service` | Tor relay (ORPort 8080) |
+
+Privileged ports 80/443 are held by **systemd**, not by Caddy (Caddy listens on 9000/9001 as user `caddy`).
diff --git a/host/systemd/caddy.service.d-no-resume.conf b/host/systemd/caddy.service.d-no-resume.conf
new file mode 100644
index 0000000..8a32924
--- /dev/null
+++ b/host/systemd/caddy.service.d-no-resume.conf
@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile
diff --git a/host/systemd/http-proxy.socket b/host/systemd/http-proxy.socket
new file mode 100644
index 0000000..1dda110
--- /dev/null
+++ b/host/systemd/http-proxy.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=Forward incoming HTTP :80 to Caddy on 127.0.0.1:9000
+
+[Socket]
+ListenStream=0.0.0.0:80
+ListenStream=[::]:80
+BindIPv6Only=yes
+Service=https-proxy@9000.service
+
+[Install]
+WantedBy=sockets.target
diff --git a/host/systemd/https-proxy.socket b/host/systemd/https-proxy.socket
new file mode 100644
index 0000000..bedf449
--- /dev/null
+++ b/host/systemd/https-proxy.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=Forward incoming HTTPS :443 to Caddy on 127.0.0.1:9001
+
+[Socket]
+ListenStream=0.0.0.0:443
+ListenStream=[::]:443
+BindIPv6Only=yes
+Service=https-proxy@9001.service
+
+[Install]
+WantedBy=sockets.target
diff --git a/host/systemd/https-proxy@.service b/host/systemd/https-proxy@.service
new file mode 100644
index 0000000..a61c775
--- /dev/null
+++ b/host/systemd/https-proxy@.service
@@ -0,0 +1,5 @@
+[Unit]
+Description=Proxy for incoming HTTPS traffic to port %i
+
+[Service]
+ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:%i