diff --git a/configs/README.md b/configs/README.md
index 82ae124..f1f03fb 100644
--- a/configs/README.md
+++ b/configs/README.md
@@ -13,6 +13,7 @@ Directories are named to match **live podman container names** where possible.
 | `tops/` | `koopa-tops-ng1` … `ng3` | `nginx:1.27-alpine` |
 | `caddy/` `firewalld/` `systemd/` | host services | |
 | `tor/` | **`koopa-tor-relay`** (podman host net) | `localhost/koopa-tor-relay:latest` |
+| `paivana/` | **`koopa-paivana`** (+ upstream) | `localhost/koopa-paivana:latest` |
 
 **Authoritative running inventory:** `host/overview/LIVE.md`.
 
diff --git a/configs/caddy/Caddyfile b/configs/caddy/Caddyfile
index 03f88aa..77b2f34 100644
--- a/configs/caddy/Caddyfile
+++ b/configs/caddy/Caddyfile
@@ -1,7 +1,7 @@
 # Internal only (not in the browser URL):
 # 9010 merchant API | 9011 exchange API | 9012 bank API
 # 9013 bank landing | 9014 exchange landing | 9015 merchant landing
-# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | | 9200 forgejo-ssh
+# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9200 forgejo-ssh
 # 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
 
 {
@@ -174,7 +174,20 @@ tops.ng3.hacktivism.ch {
 	}
 }
 
-http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch {
+
+# 9025 paivana-httpd (GOA paywall)
+paivana.hacktivism.ch {
+    header Alt-Svc "clear"
+    reverse_proxy 127.0.0.1:9025 {
+        header_up Host {host}
+        header_up X-Forwarded-For {remote_host}
+        header_up X-Forwarded-Host {host}
+        header_up X-Forwarded-Proto {scheme}
+        header_up X-Forwarded-Port 443
+    }
+}
+
+http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch {
     handle /.well-known/acme-challenge/* {
         root * /var/www/acme
         file_server
diff --git a/configs/ports.md b/configs/ports.md
index c49ed7c..24aad5d 100644
--- a/configs/ports.md
+++ b/configs/ports.md
@@ -16,6 +16,7 @@
 | 9022 | podman `koopa-prime` (Jellyfin) → Caddy `prime.hacktivism.ch` |
 | 9023 | podman qBittorrent → Caddy `bt.hacktivism.ch` |
 | **9024** | podman **`koopa-forgejo`** (HTTP) → Caddy **`git.hacktivism.ch`** |
+| **9025** | podman **`koopa-paivana`** (paivana-httpd) → Caddy **`paivana.hacktivism.ch`** |
 | **9200** | podman **Forgejo git-SSH** (host-direct; not Caddy) |
 | 9090–9092 | podman `koopa-tops-ng1` … `ng3` → Caddy `tops.ng{1,2,3}.hacktivism.ch` |
 | 8080 | Tor ORPort |
diff --git a/host/caddy/Caddyfile b/host/caddy/Caddyfile
index 03f88aa..77b2f34 100644
--- a/host/caddy/Caddyfile
+++ b/host/caddy/Caddyfile
@@ -1,7 +1,7 @@
 # Internal only (not in the browser URL):
 # 9010 merchant API | 9011 exchange API | 9012 bank API
 # 9013 bank landing | 9014 exchange landing | 9015 merchant landing
-# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | | 9200 forgejo-ssh
+# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9200 forgejo-ssh
 # 9090 tops ng1 | 9091 tops ng2 | 9092 tops ng3
 
 {
@@ -174,7 +174,20 @@ tops.ng3.hacktivism.ch {
 	}
 }
 
-http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch {
+
+# 9025 paivana-httpd (GOA paywall)
+paivana.hacktivism.ch {
+    header Alt-Svc "clear"
+    reverse_proxy 127.0.0.1:9025 {
+        header_up Host {host}
+        header_up X-Forwarded-For {remote_host}
+        header_up X-Forwarded-Host {host}
+        header_up X-Forwarded-Proto {scheme}
+        header_up X-Forwarded-Port 443
+    }
+}
+
+http://taler.hacktivism.ch, http://exchange.hacktivism.ch, http://bank.hacktivism.ch, http://castopod.hacktivism.ch, http://bonfire.hacktivism.ch, http://prime.hacktivism.ch, http://bt.hacktivism.ch, http://git.hacktivism.ch, http://paivana.hacktivism.ch, http://tops.ng1.hacktivism.ch, http://tops.ng2.hacktivism.ch, http://tops.ng3.hacktivism.ch {
     handle /.well-known/acme-challenge/* {
         root * /var/www/acme
         file_server
diff --git a/host/caddy/README.md b/host/caddy/README.md
index 92e5219..a38be73 100644
--- a/host/caddy/README.md
+++ b/host/caddy/README.md
@@ -10,6 +10,7 @@ Canonical mirror in this repo: **`configs/caddy/Caddyfile`** (same content as `h
 
 Public sites: `taler` / `exchange` / `bank` / `castopod` / `bonfire` / `prime` / `bt` / **`git`** / **`paivana`** / tops.ng*.  
 Forgejo HTTP: Caddy → `127.0.0.1:9024`. Git SSH is **host :9200** (not Caddy).  
+Paivana: Caddy → `127.0.0.1:9025`.
 
 Validate/reload on host:
 
diff --git a/host/overview/LIVE.md b/host/overview/LIVE.md
index 30f810d..f235056 100644
--- a/host/overview/LIVE.md
+++ b/host/overview/LIVE.md
@@ -33,6 +33,7 @@ ss -lntp | grep -E '90[0-9]{2}|9200|8080'
 | `koopa-prime-jellyfin` | `linuxserver/jellyfin:10.10.7` | **9022** | `prime.hacktivism.ch` |
 | `koopa-prime-qbittorrent` | `linuxserver/qbittorrent:5.0.4` | **9023**, **6881** | `bt.hacktivism.ch` |
 | `koopa-forgejo` (+ postgres) | `forgejo:11-rootless` | **9024**, **9200** | `git.hacktivism.ch` |
+| **`koopa-paivana`** (+ upstream) | `localhost/koopa-paivana:latest` | **9025** | `paivana.hacktivism.ch` |
 | **`koopa-tor-relay`** | `localhost/koopa-tor-relay:latest` | **8080**, **9051** (host net) | Tor OR (non-exit) |
 | `koopa-tops-ng1` | `nginx` | **9090** | `tops.ng1.hacktivism.ch` |
 | `koopa-tops-ng2` | `nginx` | **9091** | `tops.ng2.hacktivism.ch` |
@@ -55,6 +56,7 @@ Managed from **`/home/hernani/ansible-taler-exchange/`** (see `configs/taler-exc
 | `prime.hacktivism.ch` | 9022 |
 | `bt.hacktivism.ch` | 9023 |
 | `git.hacktivism.ch` | 9024 (HTTP); git-SSH **9200** host-direct |
+| `paivana.hacktivism.ch` | 9025 (paivana-httpd GOA paywall) |
 | `tops.ng1.hacktivism.ch` | 9090 |
 | `tops.ng2.hacktivism.ch` | 9091 |
 | `tops.ng3.hacktivism.ch` | 9092 |
@@ -70,6 +72,7 @@ Config: `/etc/caddy/Caddyfile` (mirror `configs/caddy/Caddyfile`).
 | `~/koopa-bonfire/` | Bonfire compose + gitbot |
 | `~/koopa-prime/` | Jellyfin + qBittorrent |
 | `~/koopa-forgejo/` | Forgejo rootless |
+| `~/koopa-paivana/` | Paivana paywall (`koopa-paivana`) |
 | `~/koopa-tops/` | tops.ng1–ng3 (`koopa-tops-ng*`) |
 | `~/koopa-caddy/` | Caddyfile working tree on host |
 | `~/koopa-tor-relay/` | Tor relay container (torrc, data/identity, log) |
diff --git a/host/overview/services.md b/host/overview/services.md
index c725124..0bff244 100644
--- a/host/overview/services.md
+++ b/host/overview/services.md
@@ -35,6 +35,7 @@ flowchart TB
       Prime["koopa-prime jellyfin\n:9022"]
       BT["qbittorrent\n:9023"]
       Forgejo["koopa-forgejo ROOTLESS\n:9024 HTTP / :9200 SSH"]
+      Paivana["koopa-paivana\n:9025"]
     end
 
     Tor["tor ORPort :8080"]
@@ -59,6 +60,7 @@ flowchart TB
   CaddyHTTPS -->|prime.hacktivism.ch| Prime
   CaddyHTTPS -->|bt.hacktivism.ch| BT
   CaddyHTTPS -->|git.hacktivism.ch| Forgejo
+  CaddyHTTPS -->|paivana.hacktivism.ch| Paivana
 ```
 
 ## Port table
@@ -78,6 +80,7 @@ flowchart TB
 | 9022 | podman | **jellyfin** (prime) |
 | 9023 | podman | **qbittorrent** (bt) |
 | **9024** | podman | **forgejo** HTTP → `git.hacktivism.ch` |
+| **9025** | podman | **paivana** → `paivana.hacktivism.ch` |
 | **9200** | podman | **forgejo** git-SSH (host-direct) |
 | 9090–9092 | podman | **tops** `koopa-tops-ng1`…`ng3` |
 | 8080 | tor | ORPort |
@@ -94,6 +97,7 @@ Full port notes: `configs/ports.md`.
 | Merchant container | `configs/taler-hacktivism/`, `scripts/taler-merchant/` |
 | Exchange container | `configs/taler-exchange/`, `scripts/taler-exchange/` |
 | **Forgejo rootless** | `configs/forgejo/`, `2026/2026-07-10--forgejo-rootless.md` |
+| Paivana paywall | `configs/paivana/` |
 | tops (`koopa-tops-ng*`) | `configs/tops/` |
 | Tor relay (`koopa-tor-relay` podman) | `configs/tor/`, `host/tor/` |
 | Tor monitoring scripts | `scripts/monitoring/` |