Caddy

Reverse proxy for all internal services under `*.hake.rodeo`. Uses a custom xcaddy build with the Cloudflare DNS module for DNS-01 ACME challenges — no ports are exposed to the internet, and wildcard certs are issued automatically via Let's Encrypt. Currently routes 11 subdomains including Proxmox, IPMI, and all containerized services. Adding a new service is two steps: a Caddyfile entry and a Pi-hole local DNS record.