diff --git a/vps/Caddyfile b/vps/Caddyfile
new file mode 100644
index 0000000..73c62f3
--- /dev/null
+++ b/vps/Caddyfile
@@ -0,0 +1,13 @@
+# Caddy TLS termination for the radio stream.
+# Caddy auto-issues/renews Let's Encrypt certs. Replace radio.example.com.
+#
+# NOTE (learned the hard way on wiki-jokes): the app/origin must not fight
+# Caddy over headers. Caddy adds security headers; icecast's own are fine.
+
+radio.example.com {
+	# Stream + static files: proxy everything to icecast (serves webroot too).
+	reverse_proxy icecast:8000
+
+	# Stream-friendly: no buffering weirdness for long-lived connections.
+	header X-Robots-Tag "noindex"
+}