spy-ops host — provisioning ok (Caddy+TLS live)