diff --git a/bin/quickstart-verify b/bin/quickstart-verify
index f18c1113..4ecc4358 100755
--- a/bin/quickstart-verify
+++ b/bin/quickstart-verify
@@ -52,6 +52,7 @@ end
 config = compose_config
 services = config.fetch('services') { abort('quickstart verify failed: missing top-level services map') }
 web = fetch_service!(services, 'html2rss-web')
+caddy = fetch_service!(services, 'caddy')
 fetch_service!(services, 'botasaurus')
 
 assert_equal!(web['image'], EXPECTED_WEB_IMAGE, 'html2rss-web image')
@@ -59,6 +60,6 @@ environment = web.fetch('environment') { abort('quickstart verify failed: html2r
 assert_equal!(environment['RACK_ENV'], EXPECTED_RACK_ENV, 'html2rss-web RACK_ENV')
 assert_equal!(environment['HTML2RSS_ACCESS_TOKEN'], EXPECTED_ACCESS_TOKEN, 'html2rss-web HTML2RSS_ACCESS_TOKEN')
 assert_equal!(environment['BOTASAURUS_SCRAPER_URL'], EXPECTED_SCRAPER_URL, 'html2rss-web BOTASAURUS_SCRAPER_URL')
-assert_port_mapping!(web['ports'])
+assert_port_mapping!(caddy['ports'])
 
 puts 'quickstart verify passed'
diff --git a/docker-compose.quickstart.yml b/docker-compose.quickstart.yml
index b21c9cf9..f0bcc09b 100644
--- a/docker-compose.quickstart.yml
+++ b/docker-compose.quickstart.yml
@@ -1,8 +1,34 @@
 services:
-  html2rss-web:
-    image: ${HTML2RSS_WEB_IMAGE:-html2rss/web:1}
+  caddy:
+    image: caddy:2-alpine
+    restart: unless-stopped
     ports:
       - "127.0.0.1:4000:4000"
+    volumes:
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      - html2rss-web
+    command:
+      - sh
+      - -c
+      - |
+        caddy run --config - --adapter caddyfile <<EOF
+        {
+          admin off
+          ${CADDY_GLOBAL_OPTIONS:-}
+        }
+        https://localhost:4000 {
+          reverse_proxy html2rss-web:4000 {
+            header_up   X-Forwarded-For {client_ip}
+            header_up   X-Real-IP       {client_ip}
+            header_down -Via
+          }
+        }
+        EOF
+
+  html2rss-web:
+    image: ${HTML2RSS_WEB_IMAGE:-html2rss/web:1}
     environment:
       RACK_ENV: development
       HTML2RSS_ACCESS_TOKEN: CHANGE_ME_ADMIN_TOKEN
@@ -10,3 +36,7 @@ services:
 
   botasaurus:
     image: html2rss/botasaurus-scrape-api:latest
+
+volumes:
+  caddy_data:
+  caddy_config:
diff --git a/docker-compose.yml b/docker-compose.yml
index 5a8d4e57..2e00663d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,11 +2,38 @@
 # This is the default configuration - customize as needed
 
 services:
+  caddy:
+    image: caddy:2-alpine
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - caddy_data:/data
+      - caddy_config:/config
+    depends_on:
+      - html2rss-web
+    command:
+      - sh
+      - -c
+      - |
+        caddy run --config - --adapter caddyfile <<EOF
+        {
+          admin off
+          ${CADDY_GLOBAL_OPTIONS:-}
+        }
+        https://${CADDY_HOST:-localhost} {
+          reverse_proxy html2rss-web:4000 {
+            header_up   X-Forwarded-For {client_ip}
+            header_up   X-Real-IP       {client_ip}
+            header_down -Via
+          }
+        }
+        EOF
+
   html2rss-web:
     image: html2rss/web
     restart: unless-stopped
-    ports:
-      - "127.0.0.1:4000:4000"
     env_file:
       - path: .env
         required: false
@@ -15,6 +42,8 @@ services:
       PORT: 4000
       BUILD_TAG: ${BUILD_TAG:-local}
       GIT_SHA: ${GIT_SHA:-local}
+      AUTO_SOURCE_ENABLED: ${AUTO_SOURCE_ENABLED:-false}
+      HTML2RSS_ACCESS_TOKEN: ${HTML2RSS_ACCESS_TOKEN:-}
       HTML2RSS_SECRET_KEY: ${HTML2RSS_SECRET_KEY:?set HTML2RSS_SECRET_KEY}
       HEALTH_CHECK_TOKEN: ${HEALTH_CHECK_TOKEN:?set HEALTH_CHECK_TOKEN}
       SENTRY_DSN: ${SENTRY_DSN:-}
@@ -31,14 +60,6 @@ services:
     #     target: /app/config/feeds.yml
     #     read_only: true
 
-  watchtower:
-    image: containrrr/watchtower
-    restart: unless-stopped
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - "${HOME}/.docker/config.json:/config.json"
-    command: --cleanup --interval 7200
-
   browserless:
     image: "ghcr.io/browserless/chromium"
     restart: unless-stopped
@@ -48,3 +69,7 @@ services:
       PORT: 4002
       CONCURRENT: 10
       TOKEN: ${BROWSERLESS_IO_API_TOKEN:?set BROWSERLESS_IO_API_TOKEN}
+
+volumes:
+  caddy_data:
+  caddy_config: