systemd units (host)

Unit	Role
`caddy.service`	reverse proxy (drop-in: no `--resume`)
`http-proxy.socket`	bind :80 → `systemd-socket-proxyd` → `127.0.0.1:9000`
`https-proxy.socket`	bind :443 → `systemd-socket-proxyd` → `127.0.0.1:9001`
`https-proxy@.service`	template: `systemd-socket-proxyd 127.0.0.1:%i`
`firewalld.service`	host firewall
`sshd.service`	SSH
`tor.service`	Tor relay (ORPort 8080)

Privileged ports 80/443 are held by systemd, not by Caddy (Caddy listens on 9000/9001 as user caddy).