diff --git a/nixos/caddy.nix b/nixos/caddy.nix
new file mode 100644
index 0000000..72fb937
--- /dev/null
+++ b/nixos/caddy.nix
@@ -0,0 +1,16 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}: {
+  services.caddy = {
+    enable = true;
+    virtualHosts."localhost" = {
+      extraConfig = ''
+        respond "Hello, world!"
+      '';
+      listen = [ ":9091" ];
+    };
+  };
+}
diff --git a/nixos/firewall.nix b/nixos/firewall.nix
index c3cad28..419b623 100644
--- a/nixos/firewall.nix
+++ b/nixos/firewall.nix
@@ -1,14 +1,15 @@
 {pkgs, ...}: {
   networking.firewall.allowedTCPPorts = [
-    80
-    22
-    443
-    8009
-    222 #ubuntu vm
+    80 #nginx/http
+    22 #ssh
+    222 #ubuntu vm ssh
+    443 #ssl
+
+    2200 #forgejo ssh
+    3000 #forgejo http
 
     9090 #sync.io
 
-    3000 #forgejo
-    2200 #forgejo
+    9091 #caddy
   ];
 }
diff --git a/nixos/linux.nix b/nixos/linux.nix
index c027f4b..2307dd9 100644
--- a/nixos/linux.nix
+++ b/nixos/linux.nix
@@ -39,9 +39,10 @@
   '';
 in {
   imports = [
+    (import ./caddy.nix {inherit pkgs lib config;})
     (import ./cloned_repos {inherit pkgs pullomatic lib;})
-    (import ./nginx.nix {inherit pkgs lib config;})
     (import ./firewall.nix {inherit pkgs;})
+    (import ./nginx.nix {inherit pkgs lib config;})
     (import ./system/users.nix {inherit pkgs config lib nix-index-database;})
   ];