Caddy LAN reverse proxy — .internal aliases for all internal services + HTTPS for cloud domains with pihole local DNS overrides (Cloudflare DNS-01 certs). Custom build with caddy-dns/cloudflare plugin (Dockerfile + xcaddy). Docker container with network_mode: host on port 80 (HTTP) + 443 (HTTPS). Routes by Host header to backend services across ironclad, forge, surfaceblack, and other hosts. Wildcard DNS (*.internal → 192.168.86.5) via pihole dnsmasq. Cloud domains currently handled: nextcloud.unbiasedrhino.cyou. Path: ~/prod/caddy-lan/