# systemd units (host)

| Unit | Role |
|------|------|
| `caddy.service` | reverse proxy (drop-in: no `--resume`) |
| `http-proxy.socket` | bind **:80** → `systemd-socket-proxyd` → `127.0.0.1:9000` |
| `https-proxy.socket` | bind **:443** → `systemd-socket-proxyd` → `127.0.0.1:9001` |
| `https-proxy@.service` | template: `systemd-socket-proxyd 127.0.0.1:%i` |
| `firewalld.service` | host firewall |
| `sshd.service` | SSH |
| `tor.service` | Tor relay (ORPort 8080) |

Privileged ports 80/443 are held by **systemd**, not by Caddy (Caddy listens on 9000/9001 as user `caddy`).