diff --git a/auth-proxy/src/index.ts b/auth-proxy/src/index.ts
index 96babc7..a87e380 100644
--- a/auth-proxy/src/index.ts
+++ b/auth-proxy/src/index.ts
@@ -224,14 +224,14 @@ function loginHtml(opts: {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Hephaestus — Sign in with wallet</title>
-<link rel="stylesheet" href="/static/login.css">
+<link rel="stylesheet" href="static/login.css">
 </head>
 <body>
 <main id="app"
       data-state="${escapeHtml(opts.state)}"
       data-redirect-uri="${escapeHtml(opts.redirectUri)}"
       data-oidc-nonce="${escapeHtml(opts.oidcNonce)}"></main>
-<script type="module" src="/static/wallet.js"></script>
+<script type="module" src="static/wallet.js"></script>
 </body>
 </html>`;
 }
diff --git a/caddy/Caddyfile b/caddy/Caddyfile
new file mode 100644
index 0000000..2668fa6
--- /dev/null
+++ b/caddy/Caddyfile
@@ -0,0 +1,26 @@
+# Caddy fronts the whole Hephaestus stack.
+# - Automatic Let's Encrypt cert for code.silentmode.st (HTTP-01 challenge on :80)
+# - Path-based routing:
+#     /auth/* → auth-proxy container (prefix stripped before forwarding)
+#     /       → Forgejo container
+# - HTTPS-only for browser traffic; SSH git access stays on port 2222 outside Caddy.
+#
+# {$SITE_HOSTNAME} is provided by docker-compose from .env (SITE_HOSTNAME).
+
+{$SITE_HOSTNAME} {
+    encode gzip zstd
+
+    # Auth-proxy under /auth/*. handle_path STRIPS the /auth prefix before proxying,
+    # so /auth/challenge upstream is just /challenge on auth-proxy.
+    handle_path /auth/* {
+        reverse_proxy auth-proxy:4000
+    }
+
+    # Everything else → Forgejo. Big body size so git push + LFS + release uploads work.
+    handle {
+        reverse_proxy forgejo:3000
+        request_body {
+            max_size 2GB
+        }
+    }
+}
diff --git a/docker-compose.yml b/docker-compose.yml
index e296019..7c2dee8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,4 +1,21 @@
 services:
+  caddy:
+    image: caddy:2-alpine
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+      - "443:443/udp"   # HTTP/3
+    environment:
+      SITE_HOSTNAME: ${SITE_HOSTNAME}
+    volumes:
+      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy-data:/data
+      - caddy-config:/config
+    depends_on:
+      - forgejo
+      - auth-proxy
+
   postgres:
     image: postgres:16-alpine
     restart: unless-stopped
@@ -23,8 +40,9 @@ services:
       CLIENT_SECRET: ${AUTH_PROXY_CLIENT_SECRET}
       CHALLENGE_DOMAIN: ${AUTH_PROXY_CHALLENGE_DOMAIN}
       FORGEJO_REDIRECT_URI: ${FORGEJO_ROOT_URL}user/oauth2/hephaestus-wallet/callback
-    ports:
-      - "4000:4000"
+    # Caddy proxies /auth/* → auth-proxy:4000 over the internal network. No public port.
+    expose:
+      - "4000"
     volumes:
       - auth-proxy-keys:/data
 
@@ -65,8 +83,11 @@ services:
       FORGEJO__oauth2_client__UPDATE_AVATAR: "false"
       # Skip the web installer wizard — everything is already configured
       FORGEJO__server__INSTALL_LOCK: "true"
+    # Caddy proxies / → forgejo:3000 over the internal network. No public HTTP port.
+    # 22 stays on 2222 for git-over-SSH (no TLS involved).
+    expose:
+      - "3000"
     ports:
-      - "3000:3000"
       - "2222:22"
     volumes:
       - forgejo-data:/data
@@ -80,3 +101,5 @@ volumes:
   postgres-data:
   forgejo-data:
   auth-proxy-keys:
+  caddy-data:
+  caddy-config: