fix: single Caddyfile block with host matchers

generate-caddyfile.sh

@@ -1,15 +1,17 @@
 #!/bin/bash
 # Generate Caddyfile from sites/*/site.yaml
-# Reads domain and aliases from each site config, outputs Caddyfile to stdout
+# Single :80 block with host-based matchers (Traefik handles TLS)
 set -euo pipefail
 
 SITES_DIR="${1:-sites}"
 
-# Global options - disable automatic HTTPS (Traefik handles TLS)
 cat <<'HEADER'
 {
     auto_https off
+    admin off
 }
+
+:80 {
 HEADER
 
 for site_dir in "$SITES_DIR"/*/; do
@@ -26,26 +28,25 @@ for site_dir in "$SITES_DIR"/*/; do
     hosts="$domain"
     if [ -n "$aliases" ]; then
         for alias in $aliases; do
-            hosts="$hosts, $alias"
+            hosts="$hosts $alias"
         done
     fi
 
-    cat <<EOF
+    # Sanitize domain for matcher name (replace . and - with _)
+    matcher=$(echo "$domain" | tr ".-" "__")
 
-:80 {
+    cat <<EOF
-    @${domain//[.-]/_} host ${hosts}
+    @${matcher} host ${hosts}
-    handle @${domain//[.-]/_} {
+    handle @${matcher} {
         root * /srv/${domain}
         file_server
     }
-}
 EOF
 done
 
-# Append catch-all at the end
 cat <<'FOOTER'
-
+    handle {
-:80 {
+        respond "Not Found" 444
-    respond "Not Found" 444
+    }
 }
 FOOTER