Quick answer: put Caddy on public ports 80 and 443, keep the application on a loopback address such as 127.0.0.1:3000, and leave Caddy's administration endpoint local. Check DNS and the upstream first, validate every Caddyfile change, reload instead of restarting, then test both the public route and ...