What problem does it solve? Caddy is the only thing standing between the browser and this sandbox VM: it terminates TLS and reverse-proxies the web terminal. A single bad hand-edit to the Caddyfile kills all browser access to the machine, and because Caddy runs under runit with admin off, the usual reload/stop commands do not work. This Skill provides a safe, validated path for changing Caddy's site configuration without risking a lockout. ## Core Features & Use Cases - Validated site management: Add or remove HTTPS reverse-proxy sites with tribes-caddy add <host> <upstream> and tribes-caddy rm <host>, which write a candidate config, validate it, swap it atomically, and health-poll the web terminal after restart. - Automatic rollback: A last-known-good config is kept and restored automatically if anything goes wrong, so a bad change causes a ~1s blip instead of a lockout. - Built-in guardrails: add and rm refuse to touch the terminal's own hostname, and no DNS step is needed because a platform wildcard already resolves every name under the sandbox apex. - Use Case: You start a dev server on port 3000 inside the sandbox and want it reachable over HTTPS. Run tribes-caddy add app.hish.zipbox.ai 127.0.0.1:3000 and Caddy obtains an ACME certificate and serves the site immediately. ## Quick Start Ask the agent to add an HTTPS site for your local server, for example: "Add a Caddy site for app.hish.zipbox.ai proxying to 127.0.0.1:3000 using tribes-caddy."
