diff --git a/modules/hosts/ruan/default.nix b/modules/hosts/ruan/default.nix
index 4ca27d6..3e50d96 100644
--- a/modules/hosts/ruan/default.nix
+++ b/modules/hosts/ruan/default.nix
@@ -55,11 +55,6 @@
         };
       };
 
-      age.secrets."dns-token" = {
-        file = ./secrets/dns-token.age;
-      };
-      systemd.services.caddy.serviceConfig.EnvironmentFile = config.age.secrets."dns-token".path;
-
       environment.persistence.data.enable = config.local.persistence.enable;
 
       services.komga.enable = true;
diff --git a/modules/hosts/ruan/secrets/_secrets.nix b/modules/hosts/ruan/secrets/_secrets.nix
index 5effa64..5b97d33 100644
--- a/modules/hosts/ruan/secrets/_secrets.nix
+++ b/modules/hosts/ruan/secrets/_secrets.nix
@@ -12,6 +12,5 @@ builtins.listToAttrs (
     [
       "transmission-credentials.json.age"
       "miniflux-credentials.age"
-      "dns-token.age"
     ]
 )
diff --git a/modules/hosts/ruan/secrets/dns-token.age b/modules/hosts/ruan/secrets/dns-token.age
deleted file mode 100644
index f225015..0000000
--- a/modules/hosts/ruan/secrets/dns-token.age
+++ /dev/null
@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 BXZanA yjXgmhyhxQoSOea7Aei59TiK1Y8w3N9y71jbk5nZ0l8
-pldB37ROJUChX/ulccsY+lQyNdWhhPu9pdByfYNRCbk
--> ssh-ed25519 0mYitQ 853r1rBKePJPBJFsWCVmRTNlfSIV8J0zJNsNat5/eUw
-4zSvfIxJO8WSWRQWvf6ZItmGVAYYHGmfeYg45Vi1D50
---- AfG8+b5a4e/npA7CsdoELtK7SULwsWjerxvMxoYvCus
-��؈��?�H�FV@*��e�A�6�^�]��A���w��>��i���(S�w��r##ڍ��-�wx5�I��5�C��oU���k��
\ No newline at end of file
diff --git a/modules/nixos/caddy.nix b/modules/nixos/caddy.nix
index 866fdb7..f5c3a77 100644
--- a/modules/nixos/caddy.nix
+++ b/modules/nixos/caddy.nix
@@ -4,23 +4,17 @@
     { config, pkgs, ... }:
     let
       cfg = config.local.caddy;
-      enable = cfg.virtualHosts != { } || cfg.reverseProxies != { } || cfg.internalProxies != { };
+      enable = cfg.virtualHosts != { } || cfg.reverseProxies != { };
     in
     {
       options.local.caddy = {
         virtualHosts = lib.mkOption { default = { }; };
         reverseProxies = lib.mkOption { default = { }; };
-        internalProxies = lib.mkOption { default = { }; };
       };
 
       config = lib.mkIf enable {
         services.caddy = {
           enable = true;
-          package = pkgs.caddy.withPlugins {
-            # TODO replace with DNS-PERSIST once supported https://github.com/caddyserver/caddy/issues/7495
-            plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-            hash = "sha256-RIqZlp7sV+Qka9stLN1NshgmvuSfUZdi4D9hP862jpQ=";
-          };
           enableReload = true;
           globalConfig = ''
             admin :40013
@@ -30,16 +24,7 @@
           '';
           virtualHosts =
             cfg.virtualHosts
-            // builtins.mapAttrs (_: dest: { extraConfig = "reverse_proxy ${dest}"; }) cfg.reverseProxies
-            // builtins.mapAttrs (_: dest: {
-              extraConfig = ''
-                reverse_proxy ${dest}
-                tls {
-                  dns cloudflare {env.DNS_API_TOKEN}
-                  resolvers 185.71.138.138
-                }
-              '';
-            }) cfg.internalProxies;
+            // builtins.mapAttrs (_: dest: { extraConfig = "reverse_proxy ${dest}"; }) cfg.reverseProxies;
         };
 
         environment.persistence.nixos.directories = [ "/var/lib/caddy" ];
diff --git a/modules/nixos/yggdrasil/endpoints.nix b/modules/nixos/yggdrasil/endpoints.nix
index 378ebf7..c2d480a 100644
--- a/modules/nixos/yggdrasil/endpoints.nix
+++ b/modules/nixos/yggdrasil/endpoints.nix
@@ -61,13 +61,9 @@ in
             }
           );
 
-        local.caddy.internalProxies =
-          (lib.mapAttrs' (
-            name: vhost: lib.nameValuePair vhost.fqdn "[${vhost.address}]:${toString vhost.port}"
-          ) cfg.endpoints)
-          // (lib.mapAttrs' (
-            name: vhost: lib.nameValuePair "http://${vhost.fqdn}" "[${vhost.address}]:${toString vhost.port}"
-          ) cfg.endpoints);
+        local.caddy.reverseProxies = lib.mapAttrs' (
+          name: vhost: lib.nameValuePair "http://${vhost.fqdn}" "[${vhost.address}]:${toString vhost.port}"
+        ) cfg.endpoints;
 
         local.testScript = ''
           interface = machine.succeed(
diff --git a/modules/services/forgejo.nix b/modules/services/forgejo.nix
index e68a61f..303a8ab 100644
--- a/modules/services/forgejo.nix
+++ b/modules/services/forgejo.nix
@@ -5,8 +5,7 @@ let
   domains.external = "code.pvsr.dev";
 in
 {
-  flake.modules.nixos.core.networking.hosts.${hosts.ruan.config.local.ip} = [ domains.external ];
-  local.desktops.ruan.local.caddy.internalProxies.${domains.external} = "${domains.internal}";
+  local.servers.crossbell.local.caddy.reverseProxies.${domains.external} = domains.internal;
 
   local.containers."code.ruan" =
     { config, pkgs, ... }: