compose.shared-host.yaml — for boxes that already run a reverse proxy (your PDS Caddy, an existing nginx, Traefik, …). Drops the bundled Caddy service from the default compose; binds the app to 127.0.0.1:8080 so the host's reverse proxy reaches it without port-fighting. README gains Caddy + nginx site-block snippets. gs config — view-only command that prints every stored config value grouped by area (Setup / PDS / Ghost / Bridge / Publication). Secrets (atproto_app_password, ghost_admin_api_key, webhook_secret) are shown as "(set, N chars)" — confirms presence and length without leaking the bytes. gs logs — tails /data/webhook.log with pretty colorized output. The log file is JSON-Lines, append-only, one delivery per line. Written by the webhook handler on every accepted/rejected delivery (status: ok / failed / ignored / rejected). Persistent across container restarts so post- mortem is easy. Uses BusyBox tail -F for the actual follow. Setup keeps the existing webhook_secret by default on re-runs (with a confirm() prompt to opt into rotation). Previously the secret was regenerated unconditionally — meaning a re-run-for-credential-rotation silently invalidated all four already-configured Ghost webhooks.