The site stays tailnet-only on the contacts tsnet node, so its cert
comes from a DNSimple DNS-01 challenge.

Assisted-by: Claude Opus 5 via Claude Code

diff --git a/host_vars/lotus-land-story.sops.yml b/host_vars/lotus-land-story.sops.yml
index 5936526..77ac994 100644
--- a/host_vars/lotus-land-story.sops.yml
+++ b/host_vars/lotus-land-story.sops.yml
@@ -5,6 +5,8 @@ authelia:
     smtp_username: ENC[AES256_GCM,data:/ajEHjEuEpVFpds7,iv:Yw1PCFgo6DtU3CYE7cp7CHOCMqAW7i+MHwdM6RapG9c=,tag:bvSMNrcXwGGZDbnFMLZAjw==,type:str]
     smtp_password: ENC[AES256_GCM,data:7uXkHRTpGfIr9fi2/74OVA==,iv:/XBhtaxyZoEZPwO4sPGzwIuj0cC9ny71gyEPk2jyvHU=,tag:7TpC8lJVsW3v54hRP5oXXw==,type:str]
     oidc_private_key: ENC[AES256_GCM,data:pmOfS5lcX6vHv4kipF/s7h36zE8SrwyfbAPGouPzinZQARKIXHolwfnmHZfGdzQS6pOOw4FC+m8dx82Wcs7oxOYQuArrea0Vjv5MCyxrZwpzyTW7LWvsHrISpzELtWSDEYxvu62iqqBKgCverZh66zxzGurLfM82+quw4xHIPpgjs7DEZcdkkx/ZleEYEwcmvDyw6nEEhOhQ0+vyHDQErvB8Y8gWWoZ5XjGcKJdxO9tRTt3aYPY9aJzChcvbI8UtoEUK121seqJYuSHLK6hiaUvUh2LZ/KvRof62V6lOnKgKFzLJIFk0u648a+0Zhpsw9mGJ383mJKwlA5oTa9Roc30xM67MCwHYtXnulLW3rpMKDaR9Y4+AqS2zSTbLOb9MQbPRb/lgzFTZftaDuF0z6+g8Oz97ozYAxZ7EqA8dFBVvFWi9y+SCTRZrIgX/5d40I7POkHnQLk07y3xwFVXzYPrdnGslZy/8PIhokmvYkPj/s9ugJgTrAA6cNf9Qe6kx/6ei70YSclZJqANXRZ0+ZSQ0olySzQt1SBcyecIwMQ+SEyyZ8sQWZ6QYN8wLQeHGOW6tJ0WeLGpNFpiTIGEG/Mntafoh/KJnW7qfUblzfrmT8RTiwBwgH5BROv0Td1GDs4TFIoTyLJh8YntPjeTuHDHGH7bf1j+dck9IUyu0yft3AwyVce/VQuR7yZt7SmjAnJTMcqiqRsI7/jQbVszd01vlQvTp6bUkVinTvXQVDX0PA51wh12OA/5y7SSZhYrbYWVhVZYGLB41e3MBs9AshRWcb0JkOlKDzSjzpT1ihI7P3NHJzKPuhTmbX+nKRygTllBk3USsZth6XJXPlwykyzgyJ/QRChN+IXgBA/2zoiP55p9XbcnTsKOLFHJJXnGq+kEY4yTtgAGGwaOcbn1WVZB45m523wpY1hugCRvD68tcEzZMQIxV8YCeHo+vJOAoWlSm05FgL89pp51zoBVs7oHepfWDvZuMS6PL7nArLHkOpS0/MdJ8vqvSJ4ayIiTHPTnjBMmZRzYB80XmNHWGGJcZCUtNhSGgRR1AlOmjvVsQ4OeTqIjvLA2tbWMZyE/MCjo/hcSX3waY+P3/bY9jRgrCc9nUIGivciV0Yf6WPzhuElwI2kFICMBBZLoZcgj8P/73GH34mG/gXoGVom86UwCv+6U2fE0a0IkKNn9rBslebr704wTjY+WaIB5Pq+DIsdmvavNd7LrI6JMRFx/NrCcmUXNLXEvDKDTNpcgZmVZeLIgPSHDB1rRCqKu46sV0kcBxc9PcUsmqsKOe9QKSJqlCJO9Ympx2spZrCHW4ASByEpWTS9yutMMsbBZAYluuCeb5umESKA1x+UJY6I55MuA+6lTabLp3+ETTRu70UDkWlQHx4Nm1XkaMldOCHm22tX1fIvz6krFQfvZCUfjsv1ab9NZFW7u0LZmq2y79Y3Z6qOpb9mN6ycGWsn8pgg3tDxueDRYzdCJwr798vn/sP+l9F0f8yhgP0jz84BjI9nZMMPyvQjLQ5evcS6CQFNtB0A9EC98yoH2adYB4zJlwEiU8zYeSt3QgAWp64w2gzMR/8bsRGk4yOzCC2rZKrq5heY/246FCy2ZYUE9PW0EJiZySr/6aNz0XmK2WfwgZSAnUAvSMhG8Rag2KasskIajh1rRAPr/TFv5yXufvTflzuLIlq0f84asqRu2DTsduTIbTRecoqltq+mEwoHSZBeYLpEOhQARCE83FL6wDlpLn8elUvHJcHgYvmO55+1qoU9zV3R22vXk5oCh+rM6B4npkx5CfitFVX4Woopti0DAoa7wuLkrVzl7XDhWdWOeJwsxFcKW71S0gW0QDNp4x5yvzRLQpyaOrTp4zbCEs/RQ9XYvpp2nrAjoDX/AtYy0RXpVD5RU0l1yWineuZc2173SBwMamQsIh40Hfw2TKpXhYRmBZCfnJqTwy2Lqjt98mo3vQacZ93rEqqyJl0AkUaIMdYyya5AcSLoojuS3gPh6zaoa0yDrWpK4MzEn0C8dlElKpbV9ZnZyrDepjiOyj1IIHsiCCiq05T03Dx1iwjj63fYlgpGtKo9XoEq+UfbL8iBcJAjqN+1o6/TgUKt7do01byOdjVCyY1wRcYr4rOxySUO9f8cm5h3t9yDPCqMNna3ZZ7iR9OCID0HqTKSg+Z/68eqUwKgb/qcCTVG0JOYgvHsdPtPg5KYEODI08vMVBn+ipM9K3Y5QrZsqb/g9monmE+fvuM/RiVX8KMkKlB6CzqMMhKtRpfh5B+6uab9KOAH9iTn388XTc5Wb4HJBV0CR6jdhkjN2h7LyGVYA50d3UobfN2Tw+3HPvE3NY+pg86+9Jyj3UpY+w/gxHDesMxyfaBaL4BVT1MP0o6Typ158qUooIzyzaGhbEQJUDRccnG32BiA6A/wCUKwS8xzXRrie9B+KE7vDkHN14V5oU2Gjl2U5LTromHGireiekoS3xthRShxOtqL4RccCWc2EGUm4yiqP4Ml6Fbj6pjcjncLbp2R7rES+36bk0X/Fn7noHDKaf/cI6lvCOxYZIFTj2j/E5SyXgVndFKMp6HGJfoZeB55sMzW2OsI860sRWLzOoSTMFplLoqTGFKYcSn9grzIHMi9VefIBXQFijIJiMa30WImROQXLQyx+qKWqlk0yXIuOFc7lCiwQBzxoUCupa0x5fLRtMU7snX9QLtqRoMpjsE2lApjlHNvRqvzyA+nZV8LbvKafhPuYwkJ8rlBmXtyhQE1aejEqBon1ohYCay3Y1+WEcJke5IePz24jeeUYoMpNvczxtt2VV7zrUCSLop1lqgSVSFcM1ebmct1WQGcSJa4CGOXJ6T5CBzkQrB6YnI9z5AyBfWaBSiq8cZ/7mroJFR+lANjBjBf1fdb8vqK+zbV4wesfJTqYqcE6ykMdvDgTT92D5X3WLqgxyWWaaHjJDwMLVoUxHMhGIwEBxYNZY49Pny/P4WmM4uiG2Z5b4MaRd3vkSrnpFY+mOoN0Z6UEbGM68sUeieKHew3dWS0TELki9+e780LvmwnbgzJMaFGkLockGM77yYK6U6C/l84y77TTa9Cn7swrJMmZtzfnubG5dIlYb+ofCAmaOZPboftSZLqCsNbouByiaym1lti/M6gCSQ6OVjE4IE3p5HfTcnnifkpASu9gL1UR0vgZ/IebaK2gdfgYupNFCIqZVTOWquc5kEDlcrpXahC5yCynKu89dpuKCR/TVUin88qrOjMRvmmtWadiYF/v1MVudLLR7g6H+IxhpcUz8p4Vg61cZEiXY7xfeC9pJBBAvKr9pQpMLnV4qIkseh5JxVoeyI5lazTp1LB4BbYzoq3J8uJ5KQ97009Uv1rAMDjqnpZTtJD73H77iG/QezgTfedsCh9MIVtzHaR55oB7K8L88nflSHoulEYC/+fV1d8C9kVbHbHTzEWHZ4yDGIfnjku/EHCB1dHHpVNmxftta6RpjjuKtNkERx2bkuemf2gyUEVvFhTjHHT+2CMDmUotvlCiIOBSa0poqbW4GlkDhJtKB91ekFvH6kJK/Ft3B5QdAyRjtH+vHkHkmwurabHmvmDBcOh6m/rginB0ffvBZsMUuzOoe3I0ahgduJ/E91CI0kYCfedQk3Ep4odlEPwc4hhElZ0CuEbHZOQP+C1zBEZohd+4dpNTLcF2z3kHPqOeKp4f07N0Atgx8awyj4f2o2BYWAnEsoNGUo5xzf6kb1E9dYLW/qD9f5aNmTHIdFmMSSorYRzLVvbumO2S4TTtZjrbSX1RI+yOTuasgOQXCBhiZw9jk+9p3TxYJh8Mutcw//+vGmeTPXpleXeiECgxeE3z7qDK/cIUG+kXi6bXt4BLKuxLCk4r4LeI4xShK81Kug1xdCsz4XvjeIFj8U1q6tTRkLe0B9gFAkw3K1SHE8nevh4wlRnMbVr7Qw6174Slcc+cglYNIgt1x4mf4rbyzILiq8GAO4d+MEHkO2UyrBd88qYE+GU0PIBylq4aAuTDAcyu2kK1sXq60DcBJoEMzuW9Ua7Rs5Xc+TF5Ci9IB3qW5K9W2Sm5EEKXxJjXpa71skT5AcXEr/KoQnibRHeN5ju3QI1yS/3l8Mm4+gOqt5eJdQtyCasYgEhsDPuc25pVuToStSpc4oFltymDHakREs6AhTKlVA6+oNEBwJ8q8b8ReMPUCWELvl9vbyZD1Ls26vnm+4C+sIqNR6ZuGwqdMWMoo4D1jseaRz4NpD0FBKW4kdPy45fHfE87DzYuBNHTdFDbtrMB9acKFZ2UxUM+27ghU7L1ZrMLacIgB5wTwgNmCh6oye2/ZF6XLUU7U9hSIT0aZ,iv:Dh9NlKWKnLPzTN8QmXlhg+Ep+M1RZ6VmM3jCOZgYCKY=,tag:fKdNNFJtHkL5xI9cfXTZuQ==,type:str]
+dnsimple:
+    caddy_token: ENC[AES256_GCM,data:WUhuf3tQbo/nsA4VFFynjbFxqB5eUFkZnR7zEZ36Sb0ATifSNFjSykHA4g==,iv:ogwGmqRfrX9GSfnnI4q4Pdy/oDw34CKKyZIL+/VhnvY=,tag:f6IlTx1qlTTprvlvlAh/Cg==,type:str]
 gitea:
     mailer_password: ENC[AES256_GCM,data:B+o/G/mZmwx8/oA/U+7JhdyDFMCgjxZhwD7SbNOcJswZfVZ47c49IQo84H8qyvZf1Ab0eTJPRBLSb9fIJ1WEPWQvMRbu,iv:m6DRcCR1D0sP8WQVctjdDQgLQ+B/YiTzUqz7KbnU0Pg=,tag:XkoyW/uZsLsnq49bxMY3Og==,type:str]
     metrics:
@@ -69,7 +71,7 @@ sops:
             LEedZQPpxvyODlXv/10aLZhO2DZBOtjw9W2ctfg9WoyX7OxZvdbFnA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age15ars55ulrp9hz6r0utvluayrglt40wv0t997njez0y9l3e43cersn6kgh7
-    lastmodified: "2026-09-15T03:48:47Z"
-    mac: ENC[AES256_GCM,data:jzfUBJmeNEjueDgaJ0ykpPDq7QB+JmgiN0flF3Tzy/Va6qdnLVHtIguTjRFlw3tM/FMkZ4/vLC5sjS1MYnzbctRmD+HFUS0bN2ah1xlEZApLk0KnibaUizTDd/mxG6zgHCY8QRNb5B8DweWUwEBem5kM/BiUpwnqmYia0IZEOCc=,iv:gLvMCh2IYhSimLegLFbDVTXoOzUiSbLwg8UmA4/Lfuw=,tag:s9I1NcQEYSOrMwLZ8HbT8A==,type:str]
+    lastmodified: "2026-09-16T15:59:34Z"
+    mac: ENC[AES256_GCM,data:PV6WcqzlIOcLTQdeAyLWO8WJrz5or85CN1jHxJxM1IAyXYDpa6vZSNSckHJAS5dVsLRC7ntCK4CDpDHJS0927a5Z8CQILw39g8rD6Hz3VTTcRcz21nC2s1NBR+TyP/QVRWbM10d/+htKPp8tmYIVkH0zSceN5uoRKyYj6DjXYkQ=,iv:SK+Nz5pP+O45oH+Q1WwMr2CphF05RUSaN5JJaRm3660=,tag:5CbwYPeQtSs5X8IaDXuADw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3
diff --git a/host_vars/lotus-land-story.yml b/host_vars/lotus-land-story.yml
index d3e2206..e2dd70a 100644
--- a/host_vars/lotus-land-story.yml
+++ b/host_vars/lotus-land-story.yml
@@ -2,7 +2,7 @@ versions:
   anubis:           v1.26.2
   authelia:         4.39.27
   cadvisor:         0.60.5
-  caddy:            2.11.4-2026.09.15 # don't forget to update caddy-kejadlen first!
+  caddy:            2.11.4-2026.09.16 # don't forget to update caddy-kejadlen first!
   calibre_web:      0.6.26-ls383
   dockhand:         v1.0.46
   gamja:            caf6e99
diff --git a/lotus-land-story/caddy.yml b/lotus-land-story/caddy.yml
index ae38345..66b57ad 100644
--- a/lotus-land-story/caddy.yml
+++ b/lotus-land-story/caddy.yml
@@ -41,6 +41,7 @@
         restart: true
         env:
           TS_AUTHKEY: "{{ tailscale.auth_key }}"
+          DNSIMPLE_API_ACCESS_TOKEN: "{{ dnsimple.caddy_token }}"
         ports:
           - "80:80"
           - "443:443"
diff --git a/lotus-land-story/templates/Caddyfile b/lotus-land-story/templates/Caddyfile
index 47bc4bc..2469001 100644
--- a/lotus-land-story/templates/Caddyfile
+++ b/lotus-land-story/templates/Caddyfile
@@ -133,11 +133,16 @@ books {
 	}
 }
 
-contacts {
-	import tsauth contacts
+contacts.chislan.family {
+	bind tailscale/contacts
+	log
+	tls {
+		dns dnsimple {env.DNSIMPLE_API_ACCESS_TOKEN}
+	}
+	tailscale_auth
+
 	reverse_proxy pro-tacts:9292 {
-		header_up Tailscale-User-Login {http.auth.user.tailscale_login}
-		header_up Tailscale-User-Name {http.auth.user.tailscale_user}
+		header_up Remote-User {http.auth.user.tailscale_user}
 	}
 }