diff --git a/Caddyfile b/Caddyfile
index dc88cf2..47e973c 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -6,26 +6,62 @@
 #   1. Point 3 DNS records at this machine: your app domain, your api
 #      subdomain, and your cdn subdomain (matching FRONTEND_URL / APP_URL /
 #      S3_PUBLIC_URL in apps/api/.env and VITE_APP_URL / VITE_API_URL in
-#      apps/web/.env).
+#      apps/web/.env). Either edit the three domains below directly, or set
+#      the FRONTEND_DOMAIN / API_DOMAIN / CDN_DOMAIN env vars before running
+#      Caddy and leave the placeholders as-is.
 #   2. Install Caddy (https://caddyserver.com/docs/install) directly on this
 #      host — it is NOT part of docker-compose.yml, so it binds host ports
 #      80/443 directly and reverse-proxies to the containers' published
 #      ports below.
 #   3. Copy this file to /etc/caddy/Caddyfile (or wherever your install
-#      expects it), filling in the three domains.
+#      expects it).
 #   4. sudo systemctl reload caddy   (or: caddy run --config Caddyfile)
 #
 # Caddy issues and renews Let's Encrypt certificates automatically the first
 # time each domain is requested — no manual cert steps needed.
 
-yourdomain.com {
-	reverse_proxy localhost:4650
+{
+	servers {
+		# Only matters once something else (Cloudflare, another load balancer)
+		# sits in front of this Caddy instance and forwards its own
+		# X-Forwarded-For — trusts that header from private/loopback ranges so
+		# {http.request.header.X-Real-IP} below reflects the real visitor, not
+		# whatever's immediately upstream of Caddy. Harmless no-op if Caddy is
+		# the outermost edge (the common case for a single self-hosted box).
+		trusted_proxies static private_ranges
+		client_ip_headers X-Forwarded-For X-Real-IP
+	}
 }
 
-api.yourdomain.com {
-	reverse_proxy localhost:3024
+{$FRONTEND_DOMAIN:yourdomain.com} {
+	encode gzip zstd
+
+	reverse_proxy localhost:4650 {
+		header_up X-Real-IP {http.request.header.X-Real-IP}
+	}
+
+	handle_errors {
+		respond "Frontend temporarily unavailable" 502
+	}
 }
 
-cdn.yourdomain.com {
-	reverse_proxy localhost:3900
+{$API_DOMAIN:api.yourdomain.com} {
+	encode gzip zstd
+
+	# server.js already sets `app.set('trust proxy', 1)` for the rate
+	# limiter — Caddy's reverse_proxy adds X-Forwarded-For automatically, so
+	# real client IPs reach express-rate-limit without extra config here.
+	reverse_proxy localhost:3024 {
+		header_up X-Real-IP {http.request.header.X-Real-IP}
+	}
+
+	handle_errors {
+		respond "API temporarily unavailable" 502
+	}
+}
+
+{$CDN_DOMAIN:cdn.yourdomain.com} {
+	reverse_proxy localhost:3900 {
+		header_up X-Real-IP {http.request.header.X-Real-IP}
+	}
 }