diff --git a/templates/docker-compose-caddy.yml.tpl b/templates/docker-compose-caddy.yml.tpl
new file mode 100644
index 0000000..03946e6
--- /dev/null
+++ b/templates/docker-compose-caddy.yml.tpl
@@ -0,0 +1,25 @@
+# Caddy Docker Compose — rendered by phase8_cutover.sh
+# Caddy with Cloudflare DNS-01 support for wildcard TLS.
+# CF_API_TOKEN env var is only needed when TLS_MODE=cloudflare.
+
+version: "3"
+
+services:
+  caddy:
+    image: slothcroissant/caddy-cloudflaredns:latest
+    container_name: caddy
+    restart: unless-stopped
+    environment:
+${CADDY_ENV_VARS}
+    volumes:
+      - ${CADDY_DATA_PATH}/Caddyfile:/etc/caddy/Caddyfile
+      - ${CADDY_DATA_PATH}/data:/data
+      - ${CADDY_DATA_PATH}/config:/config
+${CADDY_EXTRA_VOLUMES}
+    networks:
+      gitea_net:
+        ipv4_address: ${CADDY_CONTAINER_IP}
+
+networks:
+  gitea_net:
+    external: true