diff --git a/caddy/Caddyfile.domain b/caddy/Caddyfile.domain
new file mode 100644
index 0000000000..ec17879bde
--- /dev/null
+++ b/caddy/Caddyfile.domain
@@ -0,0 +1,13 @@
+{{DOMAIN}} {
+    request_body {
+        max_size 1024MB
+    }
+
+    reverse_proxy puter:4100 {
+        flush_interval -1
+    }
+}
+
+s3.{{DOMAIN}} {
+    reverse_proxy s3:9000
+}
diff --git a/caddy/Caddyfile.local b/caddy/Caddyfile.local
new file mode 100644
index 0000000000..0b2e485dea
--- /dev/null
+++ b/caddy/Caddyfile.local
@@ -0,0 +1,13 @@
+
+:80 {
+    @s3 host s3.puter.localhost
+    reverse_proxy @s3 s3:9000
+
+    request_body {
+        max_size 1024MB
+    }
+
+    reverse_proxy puter:4100 {
+        flush_interval -1
+    }
+}
diff --git a/docker-compose.yml b/docker-compose.yml
index e3955bd021..801663467f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -270,24 +270,24 @@ services:
       retries: 3
       start_period: 30s
 
-  nginx:
-    image: nginx:1.27-alpine
-    container_name: puter-nginx
+  caddy:
+    image: caddy:2
+    container_name: puter-caddy
     restart: unless-stopped
+  
     depends_on:
       puter:
         condition: service_started
+  
     ports:
       - "${HTTP_PORT:-80}:80"
-      # Uncomment when you enable TLS in nginx/nginx.conf:
-      # - "${HTTPS_PORT:-443}:443"
+      - "${HTTPS_PORT:-443}:443"
+  
     volumes:
-      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro,z
-      # TLS certs (fullchain.pem + privkey.pem). Read-only inside.
-      - ./puter/tls:/etc/nginx/tls:ro,z
-    healthcheck:
-      test: ["CMD-SHELL", "wget -qO- --tries=1 --timeout=2 http://localhost/ || exit 1"]
-      interval: 10s
-      timeout: 3s
-      retries: 5
-      start_period: 5s
+      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+
+volumes:
+  caddy_data:
+  caddy_config:
diff --git a/install.sh b/install.sh
index 2008c9eb5c..7f286e9b45 100755
--- a/install.sh
+++ b/install.sh
@@ -84,13 +84,25 @@ curl -fsSL "$PUTER_URL/docker-compose.yml" -o docker-compose.yml \
 # nginx is mounted as `./nginx/nginx.conf:/etc/nginx/nginx.conf:ro` — if
 # the host file is missing, docker silently creates a directory at that
 # path and the mount fails with "not a directory" at container start.
-log "downloading nginx/nginx.conf from $PUTER_URL"
-mkdir -p nginx
-# If the path was previously auto-created as a dir by a failed `compose up`,
-# remove it so curl can write the file.
-[ -d nginx/nginx.conf ] && rmdir nginx/nginx.conf 2>/dev/null || true
-curl -fsSL "$PUTER_URL/nginx/nginx.conf" -o nginx/nginx.conf \
-    || die "could not fetch $PUTER_URL/nginx/nginx.conf"
+log "downloading Caddy templates from $PUTER_URL"
+
+mkdir -p caddy
+
+curl -fsSL "$PUTER_URL/caddy/Caddyfile.local" \
+    -o caddy/Caddyfile.local \
+    || die "could not fetch Caddyfile.local"
+
+curl -fsSL "$PUTER_URL/caddy/Caddyfile.domain" \
+    -o caddy/Caddyfile.domain \
+    || die "could not fetch Caddyfile.domain"
+
+if [ "$PUTER_DOMAIN" = "puter.localhost" ]; then
+    cp caddy/Caddyfile.local caddy/Caddyfile
+else
+    sed "s/{{DOMAIN}}/$PUTER_DOMAIN/g" \
+        caddy/Caddyfile.domain > caddy/Caddyfile
+fi
+
 
 # ── Step 4: secrets, .env, config.json ──────────────────────────────
 write_config=1