diff --git a/lib/common.sh b/lib/common.sh
index c8bdb4f..9315e86 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -320,7 +320,7 @@ configure_caddy_for_service() {
 
 # $SERVICE_NAME
 $SERVICE_DOMAIN {
-    reverse_proxy localhost:$SERVICE_PORT
+    reverse_proxy host.docker.internal:$SERVICE_PORT
 
     # Security headers
     header {
diff --git a/services/actualbudget.sh b/services/actualbudget.sh
index 7da0e9c..a6eacee 100644
--- a/services/actualbudget.sh
+++ b/services/actualbudget.sh
@@ -40,10 +40,18 @@ services:
       - ./data:/data
     env_file:
       - .env
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
 AB_COMPOSE
 
     cat > .env << AB_ENV
 TZ=$TZ_VAL
+CADDY_NET=$SITE_CADDY_NET
 AB_ENV
 
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$AB_DIR"
diff --git a/services/arm.sh b/services/arm.sh
index 7f5dd19..858309b 100644
--- a/services/arm.sh
+++ b/services/arm.sh
@@ -73,10 +73,18 @@ services:
       # Add more optical drives as needed:
       # - /dev/sr1:/dev/sr1
     privileged: true
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 ARM_COMPOSE
 
     cat > .env << ARM_ENV
 ARM_OUTPUT=$ARM_OUTPUT
+CADDY_NET=$SITE_CADDY_NET
 ARM_ENV
 
     mkdir -p config logs
diff --git a/services/audiobookshelf.sh b/services/audiobookshelf.sh
index c230602..4754beb 100644
--- a/services/audiobookshelf.sh
+++ b/services/audiobookshelf.sh
@@ -50,11 +50,19 @@ services:
       - \${PODCASTS_PATH:-./podcasts}:/podcasts
     ports:
       - "13378:80"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 ABS_COMPOSE
 
     cat > .env << ABS_ENV
 AUDIOBOOKS_PATH=$AUDIOBOOKS_PATH
 PODCASTS_PATH=./podcasts
+CADDY_NET=$SITE_CADDY_NET
 ABS_ENV
 
     mkdir -p config metadata podcasts
diff --git a/services/caddy.sh b/services/caddy.sh
index 2adeb96..8233122 100644
--- a/services/caddy.sh
+++ b/services/caddy.sh
@@ -82,6 +82,15 @@ services:
       - ACME_AGREE=true
     labels:
       - "io.podman.annotations.label/crowdsec.enable=true"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    driver: bridge
+    name: caddy_net
 CADDY_COMPOSE
 
     # Create Caddyfile if it doesn't exist
@@ -114,7 +123,7 @@ CADDY_COMPOSE
 # Example:
 # myservice.yourdomain.com {
 #     import authelia
-#     reverse_proxy localhost:PORT
+#     reverse_proxy host.docker.internal:PORT
 # }
 
 # ActualBudget
@@ -124,7 +133,7 @@ CADDY_COMPOSE
 #         format json
 #         level INFO
 #     }
-#     reverse_proxy localhost:5006
+#     reverse_proxy host.docker.internal:5006
 #     header {
 #         Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
 #         X-Frame-Options "SAMEORIGIN"
@@ -165,7 +174,7 @@ a web service). You can also edit it by hand:
 
 ```
 myservice.example.com {
-    reverse_proxy localhost:1234
+    reverse_proxy host.docker.internal:1234
     log {
         output file /var/log/caddy/myservice.example.com.log
         format json
diff --git a/services/emby.sh b/services/emby.sh
index e8edbdc..ea1bb4e 100644
--- a/services/emby.sh
+++ b/services/emby.sh
@@ -59,10 +59,18 @@ services:
     # Uncomment for hardware transcoding (Intel/AMD):
     # devices:
     #   - /dev/dri:/dev/dri
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 EMBY_COMPOSE
 
     cat > .env << EMBY_ENV
 MEDIA_PATH=$MEDIA_PATH
+CADDY_NET=$SITE_CADDY_NET
 EMBY_ENV
 
     mkdir -p config
diff --git a/services/filebrowser.sh b/services/filebrowser.sh
index 13ef4c3..afaa04f 100644
--- a/services/filebrowser.sh
+++ b/services/filebrowser.sh
@@ -26,13 +26,11 @@ name: filebrowser
 
 services:
   filebrowser:
-    image: filebrowser/filebrowser:s6
+    image: filebrowser/filebrowser:latest
     container_name: filebrowser
     hostname: filebrowser
     restart: unless-stopped
     environment:
-      - PUID=$(id -u "$ACTUAL_USER")
-      - PGID=$(id -g "$ACTUAL_USER")
       - TZ=${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}
     volumes:
       - ${FB_PATH}:/srv
@@ -40,10 +38,18 @@ services:
       - ./config/settings.json:/config/settings.json
     ports:
       - "8085:80"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 FB_COMPOSE
 
     cat > .env << FB_ENV
 FB_PATH=$FB_PATH
+CADDY_NET=$SITE_CADDY_NET
 FB_ENV
 
     mkdir -p database config
@@ -64,6 +70,8 @@ FB_SETTINGS
     echo ""
     log_success "Filebrowser configured at $FB_DIR"
 
+    configure_caddy_for_service "FileBrowser" "8085" "files"
+
     write_readme "$FB_DIR" << MD
 # FileBrowser
 
diff --git a/services/fmd.sh b/services/fmd.sh
index d5ba5d5..9d52ff9 100644
--- a/services/fmd.sh
+++ b/services/fmd.sh
@@ -44,10 +44,18 @@ services:
       - ./data:/fmd/data
     ports:
       - "8084:8080"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
 FMD_COMPOSE
 
     cat > .env << FMD_ENV
 FMD_ADMIN_PASSWORD=$FMD_PASS
+CADDY_NET=$SITE_CADDY_NET
 FMD_ENV
 
     mkdir -p data
diff --git a/services/frigate-audio.sh b/services/frigate-audio.sh
index 4cad85f..e9b050f 100644
--- a/services/frigate-audio.sh
+++ b/services/frigate-audio.sh
@@ -169,6 +169,7 @@ FN_FRIGATE__MQTT__PASSWORD=${MQTT_PASS}
 FN_FRIGATE__SERVER=http://frigate:5000
 FN_FRIGATE__PUBLIC_URL=${FRIGATE_PUBLIC_URL}
 FN_ALERTS__NTFY__SERVER=${NTFY_SERVER}
+CADDY_NET=$SITE_CADDY_NET
 ENVEOF
     chmod 600 "$DIR/.env"
     log_success ".env written"
@@ -225,6 +226,8 @@ COMPOSEEOF
       - "8554:8554"
       - "8555:8555/tcp"
       - "8555:8555/udp"
+    networks:
+      - caddy_net
     healthcheck:
       test: ["CMD", "curl", "-f", "http://127.0.0.1:5000/api/version"]
       interval: 10s
@@ -257,6 +260,11 @@ COMPOSEEOF
         condition: service_healthy
     volumes:
       - ./frigate-notify/config.yml:/app/config.yml:ro
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 COMPOSEEOF
     log_success "docker-compose.yml written"
 
diff --git a/services/frigate-notify.sh b/services/frigate-notify.sh
index 49c2214..4ffed19 100644
--- a/services/frigate-notify.sh
+++ b/services/frigate-notify.sh
@@ -37,6 +37,13 @@ services:
     restart: unless-stopped
     volumes:
       - ./config.yml:/app/config.yml:ro
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
 FN_COMPOSE
 
     # Smart defaults based on what's installed
diff --git a/services/frigate.sh b/services/frigate.sh
index 98557d9..6f4bcd1 100644
--- a/services/frigate.sh
+++ b/services/frigate.sh
@@ -71,10 +71,18 @@ $DEVICE_BLOCK
       - "8554:8554"
       - "8555:8555/tcp"
       - "8555:8555/udp"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 FRIGATE_COMPOSE
 
     cat > .env << FRIGATE_ENV
 FRIGATE_MEDIA=$FRIGATE_MEDIA
+CADDY_NET=$SITE_CADDY_NET
 FRIGATE_ENV
 
     mkdir -p config
diff --git a/services/homeassistant.sh b/services/homeassistant.sh
index 060daf9..bd7488b 100644
--- a/services/homeassistant.sh
+++ b/services/homeassistant.sh
@@ -29,13 +29,16 @@ install_homeassistant() {
     echo "                 HomeKit, mDNS/Zeroconf, some Zigbee/Z-Wave & Bluetooth)."
     local HA_NETMODE=""
     prompt_text "  Choose networking mode [1]:" "1" HA_NETMODE
-    local HA_NET_LINES
+    local HA_NET_LINES HA_CADDY_NET_LINES
     if [ "$HA_NETMODE" = "2" ]; then
         HA_NET_LINES="    network_mode: host"
+        HA_CADDY_NET_LINES=""
         echo "  → Host networking selected (best device discovery)."
     else
         HA_NET_LINES="    ports:
       - \"8123:8123\""
+        HA_CADDY_NET_LINES="    networks:
+      - caddy_net"
         echo "  → Bridge networking selected (port 8123 published)."
     fi
 
@@ -55,6 +58,12 @@ services:
       - ./config:/config
       - /run/dbus:/run/dbus:ro
 ${HA_NET_LINES}
+${HA_CADDY_NET_LINES}
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 HOMEASSISTANT_COMPOSE
 
     mkdir -p config
diff --git a/services/immich.sh b/services/immich.sh
index e8d2f7d..09c9561 100644
--- a/services/immich.sh
+++ b/services/immich.sh
@@ -137,6 +137,8 @@ services:
     restart: always
     healthcheck:
       disable: false
+    networks:
+      - caddy_net
 
   immich-machine-learning:
     container_name: immich_machine_learning
@@ -170,6 +172,11 @@ services:
 
 volumes:
   model-cache:
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
 IMMICH_COMPOSE
     else
         cat > docker-compose.yml << 'IMMICH_COMPOSE'
@@ -192,6 +199,8 @@ services:
     restart: always
     healthcheck:
       disable: false
+    networks:
+      - caddy_net
 
   immich-machine-learning:
     container_name: immich_machine_learning
@@ -225,6 +234,11 @@ services:
 
 volumes:
   model-cache:
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
 IMMICH_COMPOSE
     fi
 
@@ -254,6 +268,7 @@ DB_PASSWORD=$DB_PASS
 DB_USERNAME=postgres
 DB_DATABASE_NAME=immich
 TZ=$TZ_VAL
+CADDY_NET=$SITE_CADDY_NET
 IMMICH_ENV
     else
         cat > .env << IMMICH_ENV
@@ -271,6 +286,7 @@ DB_PASSWORD=$DB_PASS
 DB_USERNAME=postgres
 DB_DATABASE_NAME=immich
 TZ=$TZ_VAL
+CADDY_NET=$SITE_CADDY_NET
 IMMICH_ENV
     fi
 
diff --git a/services/jellyfin.sh b/services/jellyfin.sh
index a1d4d67..273a3dc 100644
--- a/services/jellyfin.sh
+++ b/services/jellyfin.sh
@@ -69,10 +69,18 @@ $HWACCEL_BLOCK
       - "8096:8096"
       - "1900:1900/udp"
       - "7359:7359/udp"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 JELLYFIN_COMPOSE
 
     cat > .env << JELLYFIN_ENV
 MEDIA_PATH=$MEDIA_PATH
+CADDY_NET=$SITE_CADDY_NET
 JELLYFIN_ENV
 
     mkdir -p config cache
diff --git a/services/js99er.sh b/services/js99er.sh
index bc47bde..c62645c 100644
--- a/services/js99er.sh
+++ b/services/js99er.sh
@@ -260,6 +260,13 @@ services:
     ports:
       - "${JS99ER_PORT}:80"
     restart: unless-stopped
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 COMPOSE
     log_success "Created js99er/docker-compose.yml"
 
diff --git a/services/lyrion.sh b/services/lyrion.sh
index 1844009..0a901ee 100644
--- a/services/lyrion.sh
+++ b/services/lyrion.sh
@@ -56,10 +56,16 @@ services:
       - \${MUSIC_PATH}:/music:ro
       - ./playlists:/playlists:rw
       - /etc/localtime:/etc/localtime:ro
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 LYRION_COMPOSE
 
     cat > .env << LYRION_ENV
 MUSIC_PATH=$MUSIC_PATH
+CADDY_NET=$SITE_CADDY_NET
 LYRION_ENV
 
     mkdir -p config playlists
diff --git a/services/magicmirror.sh b/services/magicmirror.sh
index e0bb4e5..aa4e256 100644
--- a/services/magicmirror.sh
+++ b/services/magicmirror.sh
@@ -63,6 +63,13 @@ services:
       - ./css:/opt/magic_mirror/css
     ports:
       - "$MM_PORT:8080"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 MM_COMPOSE
 
         mkdir -p config modules css
diff --git a/services/mealie.sh b/services/mealie.sh
index 7f07d28..e8d6fa9 100644
--- a/services/mealie.sh
+++ b/services/mealie.sh
@@ -50,6 +50,13 @@ services:
       - ./data:/app/data
     ports:
       - "9925:9000"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 MEALIE_COMPOSE
 
     mkdir -p data
diff --git a/services/meshcentral.sh b/services/meshcentral.sh
index 7dfb25e..e249ccb 100644
--- a/services/meshcentral.sh
+++ b/services/meshcentral.sh
@@ -54,12 +54,20 @@ services:
     ports:
       - "4430:443"
       - "4433:4433"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
 MC_COMPOSE
 
     cat > .env << MC_ENV
 MC_HOSTNAME=$MC_HOSTNAME
 MC_REVERSE_PROXY=false
 MC_TLS_PORT=443
+CADDY_NET=$SITE_CADDY_NET
 MC_ENV
 
     mkdir -p data files backups
diff --git a/services/ntfy.sh b/services/ntfy.sh
index fb004d4..70cd5bc 100644
--- a/services/ntfy.sh
+++ b/services/ntfy.sh
@@ -35,10 +35,18 @@ services:
       - ./config:/etc/ntfy
     ports:
       - "8090:80"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
 NTFY_COMPOSE
 
     cat > .env << NTFY_ENV
 TZ=${SITE_TZ:-$(cat /etc/timezone 2>/dev/null || echo UTC)}
+CADDY_NET=$SITE_CADDY_NET
 NTFY_ENV
 
     mkdir -p cache config
@@ -47,6 +55,8 @@ NTFY_ENV
     echo ""
     log_success "ntfy configured at $NTFY_DIR"
 
+    configure_caddy_for_service "ntfy" "8090" "ntfy"
+
     write_readme "$NTFY_DIR" << MD
 # ntfy
 
diff --git a/services/portainer.sh b/services/portainer.sh
index 0ad880e..f8a3338 100644
--- a/services/portainer.sh
+++ b/services/portainer.sh
@@ -33,6 +33,13 @@ services:
     ports:
       - "9000:9000"
       - "9443:9443"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
 PORTAINER_COMPOSE
 
     mkdir -p data
@@ -41,6 +48,8 @@ PORTAINER_COMPOSE
     echo ""
     log_success "Portainer configured at $PORTAINER_DIR"
 
+    configure_caddy_for_service "Portainer" "9000" "portainer"
+
     write_readme "$PORTAINER_DIR" << MD
 # Portainer
 
diff --git a/services/traccar.sh b/services/traccar.sh
index 0a03bdd..7e91cbe 100644
--- a/services/traccar.sh
+++ b/services/traccar.sh
@@ -42,6 +42,13 @@ services:
       - "8082:8082"
       - "5000-5150:5000-5150"
       - "5000-5150:5000-5150/udp"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
 TRACCAR_COMPOSE
 
     mkdir -p logs data config
diff --git a/services/uptimekuma.sh b/services/uptimekuma.sh
index 3264a3a..907b864 100644
--- a/services/uptimekuma.sh
+++ b/services/uptimekuma.sh
@@ -32,6 +32,13 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
     ports:
       - "3001:3001"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
 UPTIME_COMPOSE
 
     mkdir -p data
diff --git a/services/watchtower.sh b/services/watchtower.sh
index a0e0f11..d453872 100644
--- a/services/watchtower.sh
+++ b/services/watchtower.sh
@@ -71,6 +71,13 @@ services:
       - WATCHTOWER_DEBUG=false
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: \${CADDY_NET:-caddy_net}
 WT_COMPOSE
 
     # Create .env
@@ -99,6 +106,7 @@ MONITOR_ONLY=$MONITOR_ONLY
 #
 # Full list: https://containrrr.dev/shoutrrr/services/overview/
 NOTIFICATION_URL=$NTFY_URL
+CADDY_NET=$SITE_CADDY_NET
 WT_ENV
 
     chown -R "$ACTUAL_USER:$ACTUAL_USER" "$WT_DIR" 2>/dev/null || true
diff --git a/services/wg-easy.sh b/services/wg-easy.sh
index 422ef03..f2dea62 100644
--- a/services/wg-easy.sh
+++ b/services/wg-easy.sh
@@ -60,11 +60,19 @@ services:
     ports:
       - "51820:51820/udp"
       - "51821:51821/tcp"
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
 WGEASY_COMPOSE
 
     cat > .env << WGEASY_ENV
 WG_HOST=$WG_HOST
 WG_PASSWORD=$WG_PASSWORD
+CADDY_NET=$SITE_CADDY_NET
 WGEASY_ENV
 
     mkdir -p config
diff --git a/services/wolf-pair.sh b/services/wolf-pair.sh
index c6fc969..508bb03 100644
--- a/services/wolf-pair.sh
+++ b/services/wolf-pair.sh
@@ -239,6 +239,11 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
     restart: unless-stopped
+
+networks:
+  caddy_net:
+    external: true
+    name: ${CADDY_NET:-caddy_net}
 COMPOSE
     log_success "docker-compose.yml written"