diff --git a/caddy/Caddyfile b/caddy/Caddyfile
new file mode 100644
index 0000000..5043e7a
--- /dev/null
+++ b/caddy/Caddyfile
@@ -0,0 +1,48 @@
+# ── Authelia forward auth snippet ────────────────────────────────────────────
+(authelia) {
+    forward_auth authelia:9091 {
+        uri /api/authz/forward-auth
+        copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
+    }
+}
+
+# ── Authelia login portal ─────────────────────────────────────────────────────
+auth.{$MY_DOMAIN} {
+    reverse_proxy authelia:9091
+    log {
+        output file /var/log/caddy/auth.log
+    }
+}
+
+# ── AI Portal (landing page / stack switcher) ─────────────────────────────────
+localai.{$MY_DOMAIN} {
+    import authelia
+    reverse_proxy 192.0.2.1:8080
+    log {
+        output file /var/log/caddy/localai.log
+    }
+}
+
+# ── Open WebUI (Chat) ─────────────────────────────────────────────────────────
+chat.{$MY_DOMAIN} {
+    import authelia
+    reverse_proxy 192.0.2.1:3000
+    log {
+        output file /var/log/caddy/chat.log
+    }
+}
+
+# ── InvokeAI (Images) ─────────────────────────────────────────────────────────
+images.{$MY_DOMAIN} {
+    import authelia
+    reverse_proxy 192.0.2.1:9090
+    log {
+        output file /var/log/caddy/images.log
+    }
+}
+
+# ── Template for future services ──────────────────────────────────────────────
+# newservice.{$MY_DOMAIN} {
+#     import authelia
+#     reverse_proxy INTERNAL_IP:PORT
+# }