diff --git a/hosts/asusmini/atproto.nix b/hosts/asusmini/atproto.nix
index a0bba98..1623bbb 100644
--- a/hosts/asusmini/atproto.nix
+++ b/hosts/asusmini/atproto.nix
@@ -47,25 +47,11 @@
 
   services.automerge-repo-sync-server.enable = true;
 
-  services.caddy = {
-    enable = true;
-    virtualHosts = {
-      "knot.commonscomputer.com".extraConfig = ''
-        reverse_proxy http://localhost:5555
-      '';
-      "pds.commonscomputer.com".extraConfig = ''
-        reverse_proxy http://localhost:5556
-      '';
-      "spindle.commonscomputer.com".extraConfig = ''
-        reverse_proxy http://localhost:6555
-      '';
-      "automerge.commonscomputer.com".extraConfig = ''
-        reverse_proxy http://localhost:3030
-      '';
-    };
-  };
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
+  # Public edge moved 2026-09-28: 205.250.24.44 -> pve Caddy LXC (192.168.1.11)
+  # now fronts pds/knot/spindle/automerge (see cc-ansible wiki / onboard plan).
+  # PL63 no longer terminates public TLS; its Caddy is removed and the four
+  # vhosts are served by the edge. Services keep binding the local ports.
+  # (services.caddy block removed — nothing LAN-local needs it.)
+  # networking.firewall.allowedTCPPorts = [ 80 443 ]; is likewise gone;
+  # 80/443 on eth0 are no longer used now that the public forwards moved.
 }
diff --git a/hosts/asusmini/default.nix b/hosts/asusmini/default.nix
index 5da03d2..622dd99 100644
--- a/hosts/asusmini/default.nix
+++ b/hosts/asusmini/default.nix
@@ -103,7 +103,7 @@
   # the public forwards move off this box (205.250.24.44 -> pve Caddy LXC
   # .1.11), leaving LAN (Z_DMZ) + tailnet as the only ingress paths.
   # Tailnet traffic already bypasses this (tailscale0 not restricted).
-  networking.firewall.allowedTCPPorts = [ 22 80 443 5555 5556 6555 3030 ];
+  networking.firewall.allowedTCPPorts = [ 22 5555 5556 6555 3030 ];
   # networking.firewall.allowedUDPPorts = [ ... ];
   # Or disable the firewall altogether.
   # networking.firewall.enable = false;