diff --git a/mountain-of-faith/caddy.yml b/mountain-of-faith/caddy.yml
new file mode 100644
index 0000000..e979387
--- /dev/null
+++ b/mountain-of-faith/caddy.yml
@@ -0,0 +1,96 @@
+# https://caddyserver.com/docs/install#debian-ubuntu-raspbian
+
+- name: Run Caddy
+  tags: caddy
+  hosts: mountain-of-faith
+  become: true
+  tasks:
+
+    # sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl
+    - name: Install prerequisites
+      ansible.builtin.apt:
+        pkg:
+          - apt-transport-https
+          - curl
+          - debian-archive-keyring
+          - debian-keyring
+        state: present
+        update_cache: true
+
+    # curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+    # chmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+    - name: Add Caddy GPG key
+      ansible.builtin.apt_key:
+        url: https://dl.cloudsmith.io/public/caddy/stable/gpg.key
+        keyring: /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+        state: present
+
+    - name: Set permissions on Caddy keyring
+      ansible.builtin.file:
+        path: /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+        mode: '0644'
+
+    # curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
+    # chmod o+r /etc/apt/sources.list.d/caddy-stable.list
+    - name: Add Caddy repository
+      ansible.builtin.apt_repository:
+        repo: "deb [signed-by=/usr/share/keyrings/caddy-stable-archive-keyring.gpg] https://dl.cloudsmith.io/public/caddy/stable/deb/debian any-version main"
+        filename: caddy-stable
+        state: present
+
+    # sudo apt update
+    # sudo apt install caddy
+    - name: Install Caddy
+      ansible.builtin.apt:
+        name: caddy
+        state: present
+        update_cache: true
+
+    # https://github.com/caddyserver/caddy/issues/5372#issuecomment-1755730902
+    - name: Allow Caddy to resolve mDNS
+      block:
+
+        - name: Install systemd-resolved
+          ansible.builtin.apt:
+            name: systemd-resolved
+
+        - name: Configure resolved.conf to enable MulticastDNS
+          ansible.builtin.lineinfile:
+            path: /etc/systemd/resolved.conf
+            regexp: '^#?MulticastDNS='
+            line: 'MulticastDNS=yes'
+          notify: Restart systemd-resolved
+
+    - name: Configure Caddy
+      ansible.builtin.copy:
+        content: |
+          {
+            debug
+          }
+
+          :80 {
+            reverse_proxy hopeless-masquerade.local
+          }
+
+          http://pihole {
+            reverse_proxy :8080
+          }
+        dest: /etc/caddy/Caddyfile
+        mode: "0644"
+      notify: Restart Caddy
+
+  handlers:
+    - name: Restart Caddy
+      ansible.builtin.systemd:
+        name: caddy
+        state: restarted
+        enabled: true
+
+    - name: Restart systemd-resolved
+      ansible.builtin.systemd:
+        name: systemd-resolved
+        state: restarted
+        enabled: true
+
+
+# vim: ft=yaml.ansible
diff --git a/mountain-of-faith/main.yml b/mountain-of-faith/main.yml
index 801b60f..82f81e7 100644
--- a/mountain-of-faith/main.yml
+++ b/mountain-of-faith/main.yml
@@ -102,10 +102,10 @@
         ports:
           - "53:53/tcp"
           - "53:53/udp"
-          - "80:80/tcp"
-          - "443:443/tcp"
-          #- "67:67/udp" # DHCP
-          #- "123:123/udp" # NTP
+          - "8080:80/tcp"
+          # - "443:443/tcp"
+          # - "67:67/udp" # DHCP
+          # - "123:123/udp" # NTP
         networks:
           - name: mountain-of-faith
         env:
@@ -122,6 +122,7 @@
         restart_policy: unless-stopped
         state: started
 
+- import_playbook: caddy.yml
 - import_playbook: minio.yml
 - import_playbook: syncthing.yml