diff --git a/clan.nix b/clan.nix
index 962dd99..184a61f 100644
--- a/clan.nix
+++ b/clan.nix
@@ -79,6 +79,7 @@ in
           in
           {
             settings = {
+              enableOmada = true;
               wan = {
                 interface = "enp1s0";
                 vlanId = null;
diff --git a/modules/clan/gw-router/default.nix b/modules/clan/gw-router/default.nix
index 8c31786..1ebe972 100644
--- a/modules/clan/gw-router/default.nix
+++ b/modules/clan/gw-router/default.nix
@@ -120,6 +120,43 @@
             description = "TP-Link Omada SDN controller (podman container)";
           };
 
+          proxy = {
+
+            enable = lib.mkEnableOption "internal reverse proxy (Caddy, wildcard cert via DNS-01)";
+
+            services = lib.mkOption {
+              type = lib.types.attrsOf (
+                lib.types.submodule {
+
+                  options = {
+                    backend = lib.mkOption {
+                      type = lib.types.str;
+                      example = "https://127.0.0.1:8043";
+                      description = "URL Caddy forwards to (internal/mesh address).";
+                    };
+                    insecureSkipVerify = lib.mkOption {
+                      type = lib.types.bool;
+                      default = false;
+                      description = "Skip TLS verification towards the backend.";
+                    };
+                  };
+
+                }
+              );
+              default = { };
+              description = "Proxied services";
+            };
+
+            allowVlans = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [
+                "mgmt"
+                "lan"
+              ];
+              description = "VLANs whose clients may reach the proxy (443, plus 80 for the redirect).";
+            };
+          };
+
           vlans = lib.mkOption {
             type = lib.types.attrsOf (lib.types.submodule vlanModule);
             description = "VLANs setup for this router";
@@ -314,5 +351,7 @@
     ./iperf.nix
     ./ipv6.nix
     ./pppoe.nix
+    ./omada.nix
+    ./proxy.nix
   ];
 }
diff --git a/modules/clan/gw-router/proxy.nix b/modules/clan/gw-router/proxy.nix
new file mode 100644
index 0000000..a09f300
--- /dev/null
+++ b/modules/clan/gw-router/proxy.nix
@@ -0,0 +1,25 @@
+{
+  roles.default.perInstance = { settings, ... }: {
+    nixosModule =
+      {
+        config,
+        lib,
+        ...
+      }:
+      let
+      in
+      {
+
+        config = lib.mkIf (settings.proxy.enable) {
+          assertions = [
+            {
+              assertion = lib.all (v: settings.vlans ? ${v}) settings.proxy.allowVlans;
+              message = "cnx.router.proxy.allowVlans must name VLANs defined in cnx.router.vlans.";
+            }
+          ];
+
+        };
+
+      };
+  };
+}