first try

caddy/Caddyfile

@@ -0,0 +1,22 @@
+{
+	admin off
+	auto_https off
+}
+
+:{$LISTEN_PORT} {
+	# 1. nur erlaubte Netze (localhost, LAN, NetBird) – siehe ALLOWED_NETS in .env
+	@blocked not remote_ip {$ALLOWED_NETS}
+	respond @blocked "forbidden" 403
+
+	# 2. API-Key als Bearer-Token
+	@noauth not header Authorization "Bearer {$LLM_API_KEY}"
+	respond @noauth "unauthorized" 401
+
+	# 3. an llama-swap; flush_interval -1 = Streaming (SSE) sofort durchreichen
+	reverse_proxy 127.0.0.1:{$BACKEND_PORT} {
+		flush_interval -1
+		transport http {
+			read_timeout 30m
+		}
+	}
+}