The tailscale auth key is a podman secret injected as TS_AUTHKEY; the plugin reads it only when registering a node, so an expired key does not disturb a running caddy.

Assisted-by: GLM-5.3 via pi

diff --git a/legacy-of-lunatic-kingdom/caddy.yml b/legacy-of-lunatic-kingdom/caddy.yml
new file mode 100644
index 0000000..10b4f80
--- /dev/null
+++ b/legacy-of-lunatic-kingdom/caddy.yml
@@ -0,0 +1,67 @@
+# https://caddyserver.com/
+- name: Set up Caddy
+  tags: caddy
+  hosts: legacy-of-lunatic-kingdom
+  become: true
+  vars:
+    version: "{{ versions.caddy }}"
+  tasks:
+
+    - name: Assert distribution is Debian
+      ansible.builtin.assert:
+        that:
+          - ansible_facts["distribution"] == "Debian"
+        fail_msg: "This playbook only supports Debian distributions"
+
+    - name: Make Caddy data directory
+      ansible.builtin.file:
+        path: "{{ (data_dir, 'caddy/data') | path_join }}"
+        state: directory
+        mode: "0755"
+
+    - name: Set up Caddyfile
+      ansible.builtin.template:
+        src: templates/Caddyfile
+        dest: "{{ (data_dir, 'caddy/Caddyfile') | path_join }}"
+        mode: "0644"
+      notify: Restart caddy
+
+    - name: Create Tailscale auth key secret
+      containers.podman.podman_secret:
+        name: caddy_tsauthkey
+        data: "{{ tailscale.auth_key }}"
+        state: present
+      no_log: true
+      notify: Restart caddy
+
+    - name: Set up podman network unit
+      ansible.builtin.copy:
+        content: |
+          [Network]
+          NetworkName=legacy_of_lunatic_kingdom
+        dest: /etc/containers/systemd/legacy_of_lunatic_kingdom.network
+        mode: "0644"
+      notify: Restart caddy
+
+    - name: Set up Caddy container unit
+      ansible.builtin.template:
+        src: templates/caddy.container
+        dest: /etc/containers/systemd/caddy.container
+        mode: "0644"
+      notify: Restart caddy
+
+    - name: Enable and start Caddy
+      ansible.builtin.systemd:
+        name: caddy.service
+        enabled: true
+        state: started
+        daemon_reload: true
+
+  handlers:
+    - name: Restart caddy
+      ansible.builtin.systemd:
+        name: caddy.service
+        state: restarted
+        daemon_reload: true
+
+# vim: ft=yaml.ansible
diff --git a/legacy-of-lunatic-kingdom/main.yml b/legacy-of-lunatic-kingdom/main.yml
index 06dd8ba..346c8e8 100644
--- a/legacy-of-lunatic-kingdom/main.yml
+++ b/legacy-of-lunatic-kingdom/main.yml
@@ -82,6 +82,7 @@
 # TODO disallow network access from non-tailscale interfaces
 - import_playbook: ../playbooks/tailscale.yml           # noqa: name[play]
 - import_playbook: ../playbooks/podman.yml              # noqa: name[play]
+- import_playbook: caddy.yml                            # noqa: name[play]
 - import_playbook: ../playbooks/syncthing.yml           # noqa: name[play]
 - import_playbook: ../playbooks/unattended-upgrades.yml # noqa: name[play]
 - import_playbook: ../playbooks/journal-upload.yml      # noqa: name[play]
diff --git a/legacy-of-lunatic-kingdom/templates/Caddyfile b/legacy-of-lunatic-kingdom/templates/Caddyfile
new file mode 100644
index 0000000..bfb5910
--- /dev/null
+++ b/legacy-of-lunatic-kingdom/templates/Caddyfile
@@ -0,0 +1,28 @@
+{
+	log default {
+		output stdout
+		format json
+		include http.log.access tls
+	}
+
+	metrics
+
+	tailscale {
+		auth_key {env.TS_AUTHKEY}
+		state_dir /data/tailscale
+	}
+}
+
+# Tailnet-bound sites: internal TLS, a dedicated tailscale node, and access
+# logging routed to the default logger (shipped to VictoriaLogs via journald).
+(ts) {
+	tls internal
+	bind tailscale/{args[0]}
+	log
+}
+
+:2019 {
+	metrics /metrics
+}
+
+# vim: ts=4
diff --git a/legacy-of-lunatic-kingdom/templates/caddy.container b/legacy-of-lunatic-kingdom/templates/caddy.container
new file mode 100644
index 0000000..783a3d0
--- /dev/null
+++ b/legacy-of-lunatic-kingdom/templates/caddy.container
@@ -0,0 +1,18 @@
+[Unit]
+Description=Caddy
+
+[Container]
+ContainerName=caddy
+Image=ghcr.io/kejadlen/caddy-kejadlen:{{ version }}
+Secret=caddy_tsauthkey,type=env,target=TS_AUTHKEY
+PublishPort=2019:2019
+Volume={{ data_dir }}/caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+Volume={{ data_dir }}/caddy/data:/data
+Network=legacy_of_lunatic_kingdom.network
+
+[Service]
+TimeoutStartSec=900
+MemoryMax=1G
+
+[Install]
+WantedBy=multi-user.target
diff --git a/requirements.yml b/requirements.yml
index 310417d..15bd7d3 100644
--- a/requirements.yml
+++ b/requirements.yml
@@ -1,3 +1,4 @@
 collections:
   - name: community.general
   - name: community.sops
+  - name: containers.podman