diff --git a/internal/machine/api/pb/caddy.pb.go b/internal/machine/api/pb/caddy.pb.go
new file mode 100644
index 00000000..dae4ef8a
--- /dev/null
+++ b/internal/machine/api/pb/caddy.pb.go
@@ -0,0 +1,176 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.34.2
+// 	protoc        v5.27.3
+// source: internal/machine/api/pb/caddy.proto
+
+package pb
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type GetCaddyConfigResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The generated Caddyfile content.
+	Caddyfile string `protobuf:"bytes,1,opt,name=caddyfile,proto3" json:"caddyfile,omitempty"`
+	// Timestamp when the config was last modified.
+	ModifiedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=modified_at,json=modifiedAt,proto3" json:"modified_at,omitempty"`
+}
+
+func (x *GetCaddyConfigResponse) Reset() {
+	*x = GetCaddyConfigResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_machine_api_pb_caddy_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetCaddyConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetCaddyConfigResponse) ProtoMessage() {}
+
+func (x *GetCaddyConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_machine_api_pb_caddy_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetCaddyConfigResponse.ProtoReflect.Descriptor instead.
+func (*GetCaddyConfigResponse) Descriptor() ([]byte, []int) {
+	return file_internal_machine_api_pb_caddy_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GetCaddyConfigResponse) GetCaddyfile() string {
+	if x != nil {
+		return x.Caddyfile
+	}
+	return ""
+}
+
+func (x *GetCaddyConfigResponse) GetModifiedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ModifiedAt
+	}
+	return nil
+}
+
+var File_internal_machine_api_pb_caddy_proto protoreflect.FileDescriptor
+
+var file_internal_machine_api_pb_caddy_proto_rawDesc = []byte{
+	0x0a, 0x23, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x61, 0x64, 0x64, 0x79, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x61, 0x70, 0x69, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74,
+	0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x73, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x43,
+	0x61, 0x64, 0x64, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x61, 0x64, 0x64, 0x79, 0x66, 0x69, 0x6c, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x61, 0x64, 0x64, 0x79, 0x66, 0x69, 0x6c, 0x65,
+	0x12, 0x3b, 0x0a, 0x0b, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x52, 0x0a, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x41, 0x74, 0x32, 0x49, 0x0a,
+	0x05, 0x43, 0x61, 0x64, 0x64, 0x79, 0x12, 0x40, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1b, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x47, 0x65, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b,
+	0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70,
+	0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_internal_machine_api_pb_caddy_proto_rawDescOnce sync.Once
+	file_internal_machine_api_pb_caddy_proto_rawDescData = file_internal_machine_api_pb_caddy_proto_rawDesc
+)
+
+func file_internal_machine_api_pb_caddy_proto_rawDescGZIP() []byte {
+	file_internal_machine_api_pb_caddy_proto_rawDescOnce.Do(func() {
+		file_internal_machine_api_pb_caddy_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_machine_api_pb_caddy_proto_rawDescData)
+	})
+	return file_internal_machine_api_pb_caddy_proto_rawDescData
+}
+
+var file_internal_machine_api_pb_caddy_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_internal_machine_api_pb_caddy_proto_goTypes = []any{
+	(*GetCaddyConfigResponse)(nil), // 0: api.GetCaddyConfigResponse
+	(*timestamppb.Timestamp)(nil),  // 1: google.protobuf.Timestamp
+	(*emptypb.Empty)(nil),          // 2: google.protobuf.Empty
+}
+var file_internal_machine_api_pb_caddy_proto_depIdxs = []int32{
+	1, // 0: api.GetCaddyConfigResponse.modified_at:type_name -> google.protobuf.Timestamp
+	2, // 1: api.Caddy.GetConfig:input_type -> google.protobuf.Empty
+	0, // 2: api.Caddy.GetConfig:output_type -> api.GetCaddyConfigResponse
+	2, // [2:3] is the sub-list for method output_type
+	1, // [1:2] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_internal_machine_api_pb_caddy_proto_init() }
+func file_internal_machine_api_pb_caddy_proto_init() {
+	if File_internal_machine_api_pb_caddy_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_internal_machine_api_pb_caddy_proto_msgTypes[0].Exporter = func(v any, i int) any {
+			switch v := v.(*GetCaddyConfigResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_internal_machine_api_pb_caddy_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_internal_machine_api_pb_caddy_proto_goTypes,
+		DependencyIndexes: file_internal_machine_api_pb_caddy_proto_depIdxs,
+		MessageInfos:      file_internal_machine_api_pb_caddy_proto_msgTypes,
+	}.Build()
+	File_internal_machine_api_pb_caddy_proto = out.File
+	file_internal_machine_api_pb_caddy_proto_rawDesc = nil
+	file_internal_machine_api_pb_caddy_proto_goTypes = nil
+	file_internal_machine_api_pb_caddy_proto_depIdxs = nil
+}
diff --git a/internal/machine/api/pb/caddy.proto b/internal/machine/api/pb/caddy.proto
new file mode 100644
index 00000000..5425ab6e
--- /dev/null
+++ b/internal/machine/api/pb/caddy.proto
@@ -0,0 +1,20 @@
+syntax = "proto3";
+
+package api;
+
+option go_package = "github.com/psviderski/uncloud/internal/machine/api/pb";
+
+import "google/protobuf/empty.proto";
+import "google/protobuf/timestamp.proto";
+
+service Caddy {
+  // GetConfig retrieves the current Caddy configuration from the machine.
+  rpc GetConfig(google.protobuf.Empty) returns (GetCaddyConfigResponse);
+}
+
+message GetCaddyConfigResponse {
+  // The generated Caddyfile content.
+  string caddyfile = 1;
+  // Timestamp when the config was last modified.
+  google.protobuf.Timestamp modified_at = 2;
+}
\ No newline at end of file
diff --git a/internal/machine/api/pb/caddy_grpc.pb.go b/internal/machine/api/pb/caddy_grpc.pb.go
new file mode 100644
index 00000000..ab140a5f
--- /dev/null
+++ b/internal/machine/api/pb/caddy_grpc.pb.go
@@ -0,0 +1,124 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v5.27.3
+// source: internal/machine/api/pb/caddy.proto
+
+package pb
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	Caddy_GetConfig_FullMethodName = "/api.Caddy/GetConfig"
+)
+
+// CaddyClient is the client API for Caddy service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type CaddyClient interface {
+	// GetConfig retrieves the current Caddy configuration from the machine.
+	GetConfig(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*GetCaddyConfigResponse, error)
+}
+
+type caddyClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewCaddyClient(cc grpc.ClientConnInterface) CaddyClient {
+	return &caddyClient{cc}
+}
+
+func (c *caddyClient) GetConfig(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*GetCaddyConfigResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetCaddyConfigResponse)
+	err := c.cc.Invoke(ctx, Caddy_GetConfig_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// CaddyServer is the server API for Caddy service.
+// All implementations must embed UnimplementedCaddyServer
+// for forward compatibility.
+type CaddyServer interface {
+	// GetConfig retrieves the current Caddy configuration from the machine.
+	GetConfig(context.Context, *emptypb.Empty) (*GetCaddyConfigResponse, error)
+	mustEmbedUnimplementedCaddyServer()
+}
+
+// UnimplementedCaddyServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedCaddyServer struct{}
+
+func (UnimplementedCaddyServer) GetConfig(context.Context, *emptypb.Empty) (*GetCaddyConfigResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetConfig not implemented")
+}
+func (UnimplementedCaddyServer) mustEmbedUnimplementedCaddyServer() {}
+func (UnimplementedCaddyServer) testEmbeddedByValue()               {}
+
+// UnsafeCaddyServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to CaddyServer will
+// result in compilation errors.
+type UnsafeCaddyServer interface {
+	mustEmbedUnimplementedCaddyServer()
+}
+
+func RegisterCaddyServer(s grpc.ServiceRegistrar, srv CaddyServer) {
+	// If the following call pancis, it indicates UnimplementedCaddyServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&Caddy_ServiceDesc, srv)
+}
+
+func _Caddy_GetConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CaddyServer).GetConfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Caddy_GetConfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CaddyServer).GetConfig(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// Caddy_ServiceDesc is the grpc.ServiceDesc for Caddy service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Caddy_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "api.Caddy",
+	HandlerType: (*CaddyServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetConfig",
+			Handler:    _Caddy_GetConfig_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "internal/machine/api/pb/caddy.proto",
+}
diff --git a/internal/machine/caddyconfig/controller.go b/internal/machine/caddyconfig/controller.go
index c4053451..bc0bfe92 100644
--- a/internal/machine/caddyconfig/controller.go
+++ b/internal/machine/caddyconfig/controller.go
@@ -128,7 +128,7 @@ func (c *Controller) generateCaddyfile(ctx context.Context, containers []store.C
 }
 
 func (c *Controller) generateJSONConfig(containers []store.ContainerRecord) error {
-	serviceContainers := make([]api.ServiceContainer, 0, len(containers))
+	serviceContainers := make([]api.ServiceContainer, len(containers))
 	for i, cr := range containers {
 		serviceContainers[i] = cr.Container
 	}
diff --git a/internal/machine/caddyconfig/server.go b/internal/machine/caddyconfig/server.go
new file mode 100644
index 00000000..7e6154b4
--- /dev/null
+++ b/internal/machine/caddyconfig/server.go
@@ -0,0 +1,39 @@
+package caddyconfig
+
+import (
+	"context"
+	"os"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+)
+
+// Server implements the gRPC Caddy service.
+type Server struct {
+	pb.UnimplementedCaddyServer
+	service *Service
+}
+
+func NewServer(service *Service) *Server {
+	return &Server{service: service}
+}
+
+// GetConfig retrieves the current Caddy configuration from the machine.
+func (s *Server) GetConfig(ctx context.Context, _ *emptypb.Empty) (*pb.GetCaddyConfigResponse, error) {
+	caddyfile, modifiedAt, err := s.service.Caddyfile()
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, status.Errorf(codes.NotFound, err.Error())
+		}
+		return nil, status.Errorf(codes.Internal, err.Error())
+	}
+
+	return &pb.GetCaddyConfigResponse{
+		Caddyfile:  caddyfile,
+		ModifiedAt: timestamppb.New(modifiedAt),
+	}, nil
+}
diff --git a/internal/machine/caddyconfig/service.go b/internal/machine/caddyconfig/service.go
new file mode 100644
index 00000000..4ba72ba9
--- /dev/null
+++ b/internal/machine/caddyconfig/service.go
@@ -0,0 +1,35 @@
+package caddyconfig
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// Service provides methods to interact with the Caddy configuration on the machine.
+type Service struct {
+	configDir string
+}
+
+// NewService creates a new Service instance with the specified Caddy configuration directory.
+func NewService(configDir string) *Service {
+	return &Service{configDir: configDir}
+}
+
+// Caddyfile retrieves the current Caddy configuration (Caddyfile) from the machine's config directory.
+func (s *Service) Caddyfile() (string, time.Time, error) {
+	path := filepath.Join(s.configDir, "Caddyfile")
+	content, err := os.ReadFile(path)
+	if err != nil {
+		return "", time.Time{}, fmt.Errorf("read Caddyfile from file '%s': %w", path, err)
+	}
+
+	// Get the file modification time.
+	fileInfo, err := os.Stat(path)
+	if err != nil {
+		return "", time.Time{}, fmt.Errorf("get Caddyfile file info '%s': %w", path, err)
+	}
+
+	return string(content), fileInfo.ModTime(), nil
+}
diff --git a/internal/machine/machine.go b/internal/machine/machine.go
index 22416c0b..d0b4823a 100644
--- a/internal/machine/machine.go
+++ b/internal/machine/machine.go
@@ -263,7 +263,8 @@ func NewMachine(config *Config) (*Machine, error) {
 	m.dockerServer = machinedocker.NewServer(dockerService, db, internalDNSIP,
 		machinedocker.WithNetworkReady(m.IsNetworkReady),
 		machinedocker.WithWaitForNetworkReady(m.WaitForNetworkReady))
-	m.localMachineServer = newGRPCServer(m, c, m.dockerServer)
+	caddyServer := caddyconfig.NewServer(caddyconfig.NewService(config.CaddyConfigDir))
+	m.localMachineServer = newGRPCServer(m, c, m.dockerServer, caddyServer)
 
 	if m.Initialised() {
 		m.initialised <- struct{}{}
@@ -272,11 +273,12 @@ func NewMachine(config *Config) (*Machine, error) {
 	return m, nil
 }
 
-func newGRPCServer(m pb.MachineServer, c pb.ClusterServer, d pb.DockerServer) *grpc.Server {
+func newGRPCServer(m pb.MachineServer, c pb.ClusterServer, d pb.DockerServer, caddy pb.CaddyServer) *grpc.Server {
 	s := grpc.NewServer()
 	pb.RegisterMachineServer(s, m)
 	pb.RegisterClusterServer(s, c)
 	pb.RegisterDockerServer(s, d)
+	pb.RegisterCaddyServer(s, caddy)
 	return s
 }