diff --git a/docs/architecture-overview.md b/docs/architecture-overview.md
index f75dde6..2a2cccf 100644
--- a/docs/architecture-overview.md
+++ b/docs/architecture-overview.md
@@ -1,6 +1,6 @@
 <!-- verified: 2026-09-18
-     rocky-docker-lxc@7dd5025 : caddy/Caddyfile
-     caddy-vm@9369f8b : caddy/Caddyfile
+     rocky-docker-lxc@d225776 : caddy/conf/Caddyfile
+     caddy-vm@c5c3420 : caddy/conf/Caddyfile
      trilium : 2wCPV6NXQa3l, 0mu75aAXGH8X, fscYadnUtmD5, QMTh5G7ldlLV, TIbCwYGitboy, Cl4TWBZ7ytYr, 6cJurv76PNDR, nAPJq9A1iuX8, DvKxK0gHXsng
 -->
 
diff --git a/docs/homelab-inventory.md b/docs/homelab-inventory.md
index 6896f1c..16afd44 100644
--- a/docs/homelab-inventory.md
+++ b/docs/homelab-inventory.md
@@ -1,6 +1,6 @@
 <!-- verified: 2026-09-07
      ansible@9a4ba6d : roles/homelab_inventory_hardware, roles/homelab_inventory_vms, roles/homelab_inventory_services, playbooks/homelab_inventory_hardware.yml, playbooks/homelab_inventory_vms.yml, playbooks/homelab_inventory_services.yml
-     rocky-docker-lxc@145d3df : caddy/Caddyfile, dashy/docker-compose.yaml
+     rocky-docker-lxc@d225776 : caddy/conf/Caddyfile, dashy/docker-compose.yaml
      trilium : O0d4fqw0mr05
 -->
 
diff --git a/docs/netbird-zero-trust.md b/docs/netbird-zero-trust.md
index 7e564ff..1ac486e 100644
--- a/docs/netbird-zero-trust.md
+++ b/docs/netbird-zero-trust.md
@@ -1,5 +1,5 @@
 <!-- verified: 2026-09-19
-     netbird-lxc@13b5d80 : netbird/Caddyfile, netbird/docker-compose.yaml, netbird/config.yaml.ctmpl
+     netbird-lxc@ea8967e : netbird/conf/Caddyfile, netbird/docker-compose.yaml, netbird/config.yaml.ctmpl
      iac@f770e1c : ansible/roles/secure_vault/netbird_agent, terraform/containers.tf
      trilium : qWLU4xqYLdJ3, oYuIjaczDrZA, nAPJq9A1iuX8, Cl4TWBZ7ytYr
 -->
@@ -56,9 +56,10 @@ The real path a request takes:
 And this is the actual splitter doing that work — the real config, not a description of the logic:
 
 ```
-$ cat Caddyfile
+$ cat conf/Caddyfile
 {
-	admin off
+	# Container loopback only (port not published) - `caddy reload` needs it.
+	admin localhost:2019
 	auto_https off
 	servers {
 		protocols h1 h2 h2c
diff --git a/docs/secrets-and-pki.md b/docs/secrets-and-pki.md
index 6f04c36..e01b7ab 100644
--- a/docs/secrets-and-pki.md
+++ b/docs/secrets-and-pki.md
@@ -1,6 +1,6 @@
 <!-- verified: 2026-09-19
      iac@f770e1c : ansible/roles/secure_vault, ansible/group_vars/all/vault_provisioner.yml, ansible/roles/monitoring/mqtt_client
-     rocky-docker-lxc@7dd5025 : caddy/Caddyfile
+     rocky-docker-lxc@d225776 : caddy/conf/Caddyfile
      trilium : Eu0wns00QOBG, wovVrgvoDVy2, 1seDR2nBmxKO, GW8BMoTKtRBe, JbKe9CHzOP9D, Tu7FX48fxSQZ, DvKxK0gHXsng, otSPaU6IfjlP
 -->
 
diff --git a/docs/sso-and-identity.md b/docs/sso-and-identity.md
index b704cda..687db4c 100644
--- a/docs/sso-and-identity.md
+++ b/docs/sso-and-identity.md
@@ -1,6 +1,6 @@
 <!-- verified: 2026-09-18
-     rocky-docker-lxc@7dd5025 : caddy/Caddyfile
-     caddy-vm@9369f8b : caddy/Caddyfile
+     rocky-docker-lxc@d225776 : caddy/conf/Caddyfile
+     caddy-vm@c5c3420 : caddy/conf/Caddyfile
      iac@f770e1c : ansible/roles/bootstrap_roles/docker_git_setup
      trilium : baWhWTUejvY6, hWiIGZIlvQiN, nAPJq9A1iuX8
 -->
diff --git a/stacks/platform/caddy-internal/docker-compose.yaml b/stacks/platform/caddy-internal/docker-compose.yaml
index cb3bc84..6ae7b30 100644
--- a/stacks/platform/caddy-internal/docker-compose.yaml
+++ b/stacks/platform/caddy-internal/docker-compose.yaml
@@ -6,11 +6,11 @@ services:
     ports:
       - "${HTTPS_PORT}:443"
     volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile
+      - ./conf:/etc/caddy:ro
       - /path/to/caddy-internal/caddy_data:/data
       - /path/to/caddy-internal/caddy_config:/config
       - /path/to/caddy-internal/logs:/var/log/caddy
-      - ./certs/pki_int_ca.crt:/etc/caddy/certs/pki_int_ca.crt:ro
+      - ./certs:/etc/caddy/certs:ro
     networks:
       - caddy-net
 
diff --git a/stacks/platform/caddy/docker-compose.yaml b/stacks/platform/caddy/docker-compose.yaml
index d5cc860..fcbe3dd 100644
--- a/stacks/platform/caddy/docker-compose.yaml
+++ b/stacks/platform/caddy/docker-compose.yaml
@@ -6,7 +6,7 @@ services:
     ports:
       - "${HTTPS_PORT}:443"
     volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile
+      - ./conf:/etc/caddy:ro
       - /path/to/caddy/caddy_data:/data
       - /path/to/caddy/caddy_config:/config
       - /etc/caddy/certs:/etc/caddy/certs