diff --git a/deploy.mts b/deploy.mts
index b595327..6c87c4d 100644
--- a/deploy.mts
+++ b/deploy.mts
@@ -10,16 +10,21 @@ import {
   spinner,
 } from "@clack/prompts";
 import { spawn } from "node:child_process";
-import { readdir, readFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
+import { mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 export type ScriptChoice = "default" | "auto-events";
-export type Destination = "cdn" | "custom";
+export type Destination = "cdn" | "caddy";
 export type EmbedVariant = "latest" | "sri" | "light" | "proxy";
 export type FileStatus = "create" | "replace" | "unchanged" | "blocked";
 type FileKind = "javascript" | "source-map";
-type ContentTransform = "none" | "cdn-sri-javascript" | "cdn-sri-map";
+type ContentTransform =
+  | "none"
+  | "cdn-sri-javascript"
+  | "cdn-sri-map"
+  | "caddy-ssi";
 
 export interface DeploySelections {
   scripts: ScriptChoice[];
@@ -65,8 +70,30 @@ interface DeploymentResult {
 }
 
 const ROOT = dirname(fileURLToPath(import.meta.url));
-const CUSTOM_HOST = "app@external.simpleanalytics.com";
-const CUSTOM_ROOT = "/var/www/default";
+// Caddy injects the request hostname at serve time with its templates
+// directive, so the nginx SSI directives are rewritten to Go template
+// placeholders (or their static defaults) on upload.
+const CADDY_HOST = "user@esapp05.simpleanalytics.com";
+const CADDY_ROOT = "/home/user/apps/custom-domains-www";
+const CADDY_SSI_REPLACEMENTS: ReadonlyArray<readonly [string, string]> = [
+  ['<!--# echo var="http_host" default="" -->', "{{.Req.Host}}"],
+  // Substituted from the proxy-product query parameters at serve time
+  // (docs.simpleanalytics.com/proxy), like nginx's `set $proxy_hostname
+  // $arg_hostname`. Custom-domain requests carry no such args, so these
+  // render as "" there — matching the old nginx vhost's defined-but-empty
+  // variables (its SSI defaults never applied). Go's Query.Get
+  // percent-decodes, which covers nginx's %2F-rewrite hack too. Escape the
+  // decoded values before inserting them into the script's string literal.
+  [
+    '<!--# echo var="proxy_hostname" default="" -->',
+    '{{js (.Req.URL.Query.Get "hostname")}}',
+  ],
+  [
+    '<!--# echo var="proxy_path" default="/simple" -->',
+    '{{js (.Req.URL.Query.Get "path")}}',
+  ],
+];
+
 const CDN_PUBLIC_ROOT = "https://scripts.simpleanalyticscdn.com";
 const CDN_STORAGE_ROOT = "https://storage.bunnycdn.com/sa-cdn";
 const CDN_PURGE_URL =
@@ -127,8 +154,13 @@ function addScriptPair(
     kind: "source-map",
     localPath: `${localPath}.map`,
     remotePath: `${remotePath}.map`,
+    // Source maps carry the SSI directive too, so caddy-ssi applies to both.
     transform:
-      transform === "cdn-sri-javascript" ? "cdn-sri-map" : "none",
+      transform === "cdn-sri-javascript"
+        ? "cdn-sri-map"
+        : transform === "caddy-ssi"
+          ? "caddy-ssi"
+          : "none",
     version,
   });
 }
@@ -145,6 +177,17 @@ export function createManifest(
     selections.variants.includes(variant);
   const needsSri = hasScript("default") && hasVariant("sri");
 
+  const addCaddyPair = (
+    input: Omit<Parameters<typeof addScriptPair>[1], "destination">,
+  ) => {
+    if (!hasDestination("caddy")) return;
+    addScriptPair(files, {
+      ...input,
+      destination: "caddy",
+      transform: "caddy-ssi",
+    });
+  };
+
   if (needsSri && version === undefined) {
     throw new Error("An SRI version is required when SRI is selected.");
   }
@@ -169,24 +212,19 @@ export function createManifest(
       });
     }
 
-    if (hasDestination("custom")) {
-      addScriptPair(files, {
-        destination: "custom",
-        localPath: "dist/latest/custom/latest.js",
-        remotePath: "latest.js",
-      });
-      addScriptPair(files, {
-        destination: "custom",
-        localPath: "dist/latest/custom/e.js",
-        remotePath: "events.js",
-      });
-      addScriptPair(files, {
-        destination: "custom",
-        localPath: "dist/latest/custom/latest.dev.js",
-        remotePath: "latest.dev.js",
-        sourceMap: false,
-      });
-    }
+    addCaddyPair({
+      localPath: "dist/latest/custom/latest.js",
+      remotePath: "latest.js",
+    });
+    addCaddyPair({
+      localPath: "dist/latest/custom/e.js",
+      remotePath: "events.js",
+    });
+    addCaddyPair({
+      localPath: "dist/latest/custom/latest.dev.js",
+      remotePath: "latest.dev.js",
+      sourceMap: false,
+    });
   }
 
   if (needsSri) {
@@ -201,15 +239,12 @@ export function createManifest(
       });
     }
 
-    if (hasDestination("custom")) {
-      addScriptPair(files, {
-        destination: "custom",
-        immutable: true,
-        localPath: `dist/v${version}/custom/app.js`,
-        remotePath: `v${version}/app.js`,
-        version,
-      });
-    }
+    addCaddyPair({
+      immutable: true,
+      localPath: `dist/v${version}/custom/app.js`,
+      remotePath: `v${version}/app.js`,
+      version,
+    });
   }
 
   if (hasScript("default") && hasVariant("light")) {
@@ -221,39 +256,33 @@ export function createManifest(
       });
     }
 
-    if (hasDestination("custom")) {
-      addScriptPair(files, {
-        destination: "custom",
-        localPath: "dist/latest/custom/light.js",
-        remotePath: "light.js",
-      });
+    addCaddyPair({
+      localPath: "dist/latest/custom/light.js",
+      remotePath: "light.js",
+    });
 
-      if (needsSri) {
-        addScriptPair(files, {
-          destination: "custom",
-          immutable: true,
-          localPath: `dist/v${version}/custom/light.js`,
-          remotePath: `v${version}/light.js`,
-          version,
-        });
-      }
+    if (needsSri) {
+      addCaddyPair({
+        immutable: true,
+        localPath: `dist/v${version}/custom/light.js`,
+        remotePath: `v${version}/light.js`,
+        version,
+      });
     }
   }
 
   if (
     hasScript("default") &&
     hasVariant("proxy") &&
-    hasDestination("custom")
+    hasDestination("caddy")
   ) {
-    addScriptPair(files, {
-      destination: "custom",
+    addCaddyPair({
       localPath: "dist/latest/custom/proxy.js",
       remotePath: "proxy.js",
     });
 
     if (needsSri) {
-      addScriptPair(files, {
-        destination: "custom",
+      addCaddyPair({
         immutable: true,
         localPath: `dist/v${version}/custom/proxy.js`,
         remotePath: `v${version}/proxy.js`,
@@ -271,22 +300,18 @@ export function createManifest(
       });
     }
 
-    if (hasDestination("custom")) {
-      addScriptPair(files, {
-        destination: "custom",
-        localPath: "dist/latest/custom/auto-events.js",
-        remotePath: "auto-events.js",
-      });
+    addCaddyPair({
+      localPath: "dist/latest/custom/auto-events.js",
+      remotePath: "auto-events.js",
+    });
 
-      if (needsSri) {
-        addScriptPair(files, {
-          destination: "custom",
-          immutable: true,
-          localPath: `dist/v${version}/custom/auto-events.js`,
-          remotePath: `v${version}/auto-events.js`,
-          version,
-        });
-      }
+    if (needsSri) {
+      addCaddyPair({
+        immutable: true,
+        localPath: `dist/v${version}/custom/auto-events.js`,
+        remotePath: `v${version}/auto-events.js`,
+        version,
+      });
     }
   }
 
@@ -314,6 +339,27 @@ async function discoverSriVersion(): Promise<number> {
 
 export function transformContent(file: DeployFile, content: Buffer): Buffer {
   if (file.transform === "none") return content;
+
+  if (file.transform === "caddy-ssi") {
+    let source = content.toString("utf8");
+    // Caddy's templates directive would choke on (or execute) stray actions,
+    // turning a bad build into per-request 500s — fail the deploy instead.
+    if (source.includes("{{")) {
+      throw new Error(
+        `${file.localPath} contains Go template delimiters ("{{"); Caddy's templates directive cannot serve it safely.`,
+      );
+    }
+    for (const [pattern, replacement] of CADDY_SSI_REPLACEMENTS) {
+      source = source.replaceAll(pattern, replacement);
+    }
+    if (source.includes("<!--#")) {
+      throw new Error(
+        `${file.localPath} contains an SSI directive with no Caddy replacement.`,
+      );
+    }
+    return Buffer.from(source);
+  }
+
   if (file.version === undefined) {
     throw new Error(`Missing version for ${file.localPath}.`);
   }
@@ -471,7 +517,7 @@ function shellQuote(value: string): string {
   return `'${value.replaceAll("'", `'"'"'`)}'`;
 }
 
-async function readCustomFiles(
+async function readCaddyFiles(
   remotePaths: string[],
 ): Promise<Map<string, Buffer | null>> {
   const uniquePaths = [...new Set(remotePaths)];
@@ -482,7 +528,7 @@ async function readCustomFiles(
   const command = [
     `for relative_path in ${pathArguments}; do`,
     `printf '__SA_FILE__:%s\\n' "$relative_path";`,
-    `full_path=${shellQuote(CUSTOM_ROOT)}/$relative_path;`,
+    `full_path=${shellQuote(CADDY_ROOT)}/$relative_path;`,
     'if test -f "$full_path"; then',
     `printf '__SA_DATA__:'; base64 "$full_path" | tr -d '\\n'; printf '\\n';`,
     "else printf '__SA_MISSING__\\n'; fi;",
@@ -490,7 +536,7 @@ async function readCustomFiles(
   ].join(" ");
   const { stdout } = await runCommand(
     "ssh",
-    ["-o", "BatchMode=yes", "-o", "ConnectTimeout=10", CUSTOM_HOST, command],
+    ["-o", "BatchMode=yes", "-o", "ConnectTimeout=10", CADDY_HOST, command],
     { timeout: 45_000 },
   );
 
@@ -517,32 +563,31 @@ async function readCustomFiles(
 
   for (const remotePath of uniquePaths) {
     if (!result.has(remotePath)) {
-      throw new Error(`Custom server did not return a result for ${remotePath}.`);
+      throw new Error(`Caddy server did not return a result for ${remotePath}.`);
     }
   }
   return result;
 }
 
 async function inspectFiles(files: PreparedFile[]): Promise<PreviewFile[]> {
-  const cdnPaths = files
-    .filter((file) => file.destination === "cdn")
-    .map((file) => file.remotePath);
-  const customPaths = files
-    .filter((file) => file.destination === "custom")
-    .map((file) => file.remotePath);
-
-  const [cdnEntries, customFiles] = await Promise.all([
+  const pathsFor = (destination: Destination) =>
+    files
+      .filter((file) => file.destination === destination)
+      .map((file) => file.remotePath);
+
+  const [cdnEntries, caddyFiles] = await Promise.all([
     Promise.all(
-      cdnPaths.map(async (remotePath) => [remotePath, await readCdnFile(remotePath)] as const),
+      pathsFor("cdn").map(
+        async (remotePath) => [remotePath, await readCdnFile(remotePath)] as const,
+      ),
     ),
-    readCustomFiles(customPaths),
+    readCaddyFiles(pathsFor("caddy")),
   ]);
   const cdnFiles = new Map(cdnEntries);
 
   return files.map((file) => {
-    const remoteContent =
-      (file.destination === "cdn" ? cdnFiles : customFiles).get(file.remotePath) ??
-      null;
+    const remoteFiles = file.destination === "cdn" ? cdnFiles : caddyFiles;
+    const remoteContent = remoteFiles.get(file.remotePath) ?? null;
     return {
       ...file,
       remoteContent,
@@ -556,9 +601,8 @@ async function inspectFiles(files: PreparedFile[]): Promise<PreviewFile[]> {
 }
 
 function remoteLabel(file: DeployFile): string {
-  return file.destination === "cdn"
-    ? `${CDN_PUBLIC_ROOT}/${file.remotePath}`
-    : `${CUSTOM_HOST}:${CUSTOM_ROOT}/${file.remotePath}`;
+  if (file.destination === "cdn") return `${CDN_PUBLIC_ROOT}/${file.remotePath}`;
+  return `${CADDY_HOST}:${CADDY_ROOT}/${file.remotePath}`;
 }
 
 function statusLabel(status: FileStatus): string {
@@ -599,13 +643,17 @@ function renderPreview(
     "Deployment preview",
   );
 
-  for (const destination of ["cdn", "custom"] as const) {
+  const destinationLabels: Record<Destination, string> = {
+    caddy: "Caddy",
+    cdn: "CDN",
+  };
+  for (const destination of ["cdn", "caddy"] as const) {
     const destinationFiles = files.filter(
       (file) => file.destination === destination,
     );
     if (destinationFiles.length === 0) continue;
 
-    console.log(`\n  ${ansi.bold(destination === "cdn" ? "CDN" : "Custom domain")}`);
+    console.log(`\n  ${ansi.bold(destinationLabels[destination])}`);
     for (const file of destinationFiles) {
       console.log(
         `  ${statusLabel(file.status).padEnd(process.stdout.isTTY ? 19 : 8)} ${ansi.cyan(
@@ -655,7 +703,8 @@ async function readCurrentFile(
   if (file.destination === "cdn") {
     return readCdnFile(file.remotePath, credentials?.accessKey);
   }
-  return (await readCustomFiles([file.remotePath])).get(file.remotePath) ?? null;
+  const remoteFiles = await readCaddyFiles([file.remotePath]);
+  return remoteFiles.get(file.remotePath) ?? null;
 }
 
 async function uploadCdnFile(
@@ -678,31 +727,33 @@ async function uploadCdnFile(
   }
 }
 
-async function uploadCustomFile(file: PreparedFile): Promise<void> {
+async function uploadCaddyFile(file: PreparedFile): Promise<void> {
   assertSafeRemotePath(file.remotePath);
-  if (file.transform !== "none") {
-    throw new Error(`Custom uploads cannot transform ${file.localPath}.`);
-  }
-
-  if (file.immutable) {
-    const remoteDirectory = dirname(`${CUSTOM_ROOT}/${file.remotePath}`);
-    await runCommand("ssh", [
-      "-o",
-      "BatchMode=yes",
-      "-o",
-      "ConnectTimeout=10",
-      CUSTOM_HOST,
-      `sudo mkdir -p -- ${shellQuote(remoteDirectory)}`,
-    ]);
-  }
-
-  const args = ["--quiet", "--rsync-path=sudo rsync"];
-  if (file.immutable) args.push("--ignore-existing");
-  args.push(
-    resolve(ROOT, file.localPath),
-    `${CUSTOM_HOST}:${CUSTOM_ROOT}/${file.remotePath}`,
-  );
-  await runCommand("rsync", args, { timeout: 120_000 });
+
+  // SSI directives become Caddy template placeholders, so upload the
+  // transformed content from a temporary file.
+  const remoteDirectory = dirname(`${CADDY_ROOT}/${file.remotePath}`);
+  await runCommand("ssh", [
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    "ConnectTimeout=10",
+    CADDY_HOST,
+    `mkdir -p -- ${shellQuote(remoteDirectory)}`,
+  ]);
+
+  const temporaryDirectory = await mkdtemp(join(tmpdir(), "sa-deploy-"));
+  try {
+    const temporaryPath = join(temporaryDirectory, basename(file.remotePath));
+    await writeFile(temporaryPath, file.localContent);
+
+    const args = ["--quiet"];
+    if (file.immutable) args.push("--ignore-existing");
+    args.push(temporaryPath, `${CADDY_HOST}:${CADDY_ROOT}/${file.remotePath}`);
+    await runCommand("rsync", args, { timeout: 120_000 });
+  } finally {
+    await rm(temporaryDirectory, { force: true, recursive: true });
+  }
 }
 
 async function purgeCdn(credentials: CdnCredentials): Promise<void> {
@@ -721,12 +772,12 @@ async function verifyUploadedFiles(
   credentials?: CdnCredentials,
 ): Promise<void> {
   const cdnFiles = files.filter((file) => file.destination === "cdn");
-  const customFiles = files.filter((file) => file.destination === "custom");
-  const [cdnContents, customContents] = await Promise.all([
+  const caddyFiles = files.filter((file) => file.destination === "caddy");
+  const [cdnContents, caddyContents] = await Promise.all([
     Promise.all(
       cdnFiles.map((file) => readCdnFile(file.remotePath, credentials?.accessKey)),
     ),
-    readCustomFiles(customFiles.map((file) => file.remotePath)),
+    readCaddyFiles(caddyFiles.map((file) => file.remotePath)),
   ]);
 
   for (const [index, file] of cdnFiles.entries()) {
@@ -734,9 +785,9 @@ async function verifyUploadedFiles(
       throw new Error(`CDN verification failed for ${file.remotePath}.`);
     }
   }
-  for (const file of customFiles) {
-    if (!customContents.get(file.remotePath)?.equals(file.localContent)) {
-      throw new Error(`Custom-domain verification failed for ${file.remotePath}.`);
+  for (const file of caddyFiles) {
+    if (!caddyContents.get(file.remotePath)?.equals(file.localContent)) {
+      throw new Error(`Caddy verification failed for ${file.remotePath}.`);
     }
   }
 }
@@ -790,7 +841,7 @@ async function deployFiles(
           if (!credentials) throw new Error("Missing CDN credentials.");
           await uploadCdnFile(file, credentials);
         } else {
-          await uploadCustomFile(file);
+          await uploadCaddyFile(file);
         }
         progress.stop(`Uploaded ${file.remotePath} to ${file.destination}`);
       } catch (error) {
@@ -860,6 +911,11 @@ function selectedValue<T>(value: T | symbol): T {
 async function main(): Promise<void> {
   intro("Simple Analytics script deployment");
 
+  const caddyOnly = process.argv.includes("--caddy-only");
+  if (caddyOnly) {
+    log.info("Deploying only to Caddy (--caddy-only).");
+  }
+
   const dryRun = selectedValue(
     await confirm({
       initialValue: true,
@@ -883,17 +939,19 @@ async function main(): Promise<void> {
       required: true,
     }),
   );
-  const destinations = selectedValue(
-    await multiselect<Destination>({
-      initialValues: ["cdn", "custom"],
-      message: "Where do you want to deploy these scripts?",
-      options: [
-        { label: "CDN", value: "cdn" },
-        { label: "Custom domain", value: "custom" },
-      ],
-      required: true,
-    }),
-  );
+  const destinations: Destination[] = caddyOnly
+    ? ["caddy"]
+    : selectedValue(
+        await multiselect<Destination>({
+          initialValues: ["cdn", "caddy"],
+          message: "Where do you want to deploy these scripts?",
+          options: [
+            { label: "CDN", value: "cdn" },
+            { label: "Caddy", value: "caddy" },
+          ],
+          required: true,
+        }),
+      );
 
   let variants: EmbedVariant[] = [];
   if (scripts.includes("default")) {
@@ -902,7 +960,7 @@ async function main(): Promise<void> {
       { label: "SRI", value: "sri" },
       { label: "Light", value: "light" },
     ];
-    if (destinations.includes("custom")) {
+    if (destinations.includes("caddy")) {
       options.push({ label: "Proxy", value: "proxy" });
     }
     variants = selectedValue(
@@ -962,7 +1020,7 @@ async function main(): Promise<void> {
   renderDeploymentResult(result);
   if (variants.includes("sri")) {
     log.warn(
-      "Add the SRI version to /etc/nginx/sa-client-site-with-ssl.conf and update https://docs.simpleanalytics.com/sri.",
+      "Update https://docs.simpleanalytics.com/sri with the SRI version.",
     );
   }
   outro("Scripts deployed successfully.");
diff --git a/test/deploy.test.mts b/test/deploy.test.mts
index 3ae7408..170a6a9 100644
--- a/test/deploy.test.mts
+++ b/test/deploy.test.mts
@@ -16,7 +16,7 @@ import {
 describe("deployment manifest", () => {
   it("maps latest and its legacy companions to both destinations", () => {
     const files = createManifest({
-      destinations: ["cdn", "custom"],
+      destinations: ["cdn", "caddy"],
       scripts: ["default"],
       variants: ["latest"],
     });
@@ -29,11 +29,11 @@ describe("deployment manifest", () => {
         "cdn:hello.js",
         "cdn:hello.js.map",
         "cdn:latest.dev.js",
-        "custom:latest.js",
-        "custom:latest.js.map",
-        "custom:events.js",
-        "custom:events.js.map",
-        "custom:latest.dev.js",
+        "caddy:latest.js",
+        "caddy:latest.js.map",
+        "caddy:events.js",
+        "caddy:events.js.map",
+        "caddy:latest.dev.js",
       ],
     );
   });
@@ -41,7 +41,7 @@ describe("deployment manifest", () => {
   it("includes every selected current and versioned file", () => {
     const files = createManifest(
       {
-        destinations: ["cdn", "custom"],
+        destinations: ["cdn", "caddy"],
         scripts: ["default", "auto-events"],
         variants: ["latest", "sri", "light", "proxy"],
       },
@@ -49,6 +49,12 @@ describe("deployment manifest", () => {
     );
 
     assert.equal(files.length, 30);
+    assert.equal(
+      files
+        .filter((file) => file.destination === "caddy")
+        .every((file) => file.transform === "caddy-ssi"),
+      true,
+    );
     assert.deepEqual(
       files
         .filter((file) => file.immutable)
@@ -56,21 +62,21 @@ describe("deployment manifest", () => {
       [
         "cdn:sri/v12.js",
         "cdn:sri/v12.js.map",
-        "custom:v12/app.js",
-        "custom:v12/app.js.map",
-        "custom:v12/light.js",
-        "custom:v12/light.js.map",
-        "custom:v12/proxy.js",
-        "custom:v12/proxy.js.map",
-        "custom:v12/auto-events.js",
-        "custom:v12/auto-events.js.map",
+        "caddy:v12/app.js",
+        "caddy:v12/app.js.map",
+        "caddy:v12/light.js",
+        "caddy:v12/light.js.map",
+        "caddy:v12/proxy.js",
+        "caddy:v12/proxy.js.map",
+        "caddy:v12/auto-events.js",
+        "caddy:v12/auto-events.js.map",
       ],
     );
   });
 
   it("deploys standalone auto-events without implicit SRI files", () => {
     const files = createManifest({
-      destinations: ["cdn", "custom"],
+      destinations: ["cdn", "caddy"],
       scripts: ["auto-events"],
       variants: [],
     });
@@ -80,8 +86,8 @@ describe("deployment manifest", () => {
       [
         "cdn:auto-events.js",
         "cdn:auto-events.js.map",
-        "custom:auto-events.js",
-        "custom:auto-events.js.map",
+        "caddy:auto-events.js",
+        "caddy:auto-events.js.map",
       ],
     );
     assert.equal(files.some((file) => file.immutable), false);
@@ -118,7 +124,7 @@ describe("deployment manifest", () => {
 
   it("never invents a source map for latest.dev.js", () => {
     const files = createManifest({
-      destinations: ["cdn", "custom"],
+      destinations: ["cdn", "caddy"],
       scripts: ["default"],
       variants: ["latest"],
     });
@@ -206,3 +212,77 @@ describe("preview helpers", () => {
     );
   });
 });
+
+describe("Caddy custom-domains destination", () => {
+  it("maps Caddy-only files with the caddy-ssi transform", () => {
+    const files = createManifest(
+      {
+        destinations: ["caddy"],
+        scripts: ["default"],
+        variants: ["latest", "sri"],
+      },
+      12,
+    );
+
+    assert.deepEqual(
+      files.map((file) => `${file.destination}:${file.remotePath}`),
+      [
+        "caddy:latest.js",
+        "caddy:latest.js.map",
+        "caddy:events.js",
+        "caddy:events.js.map",
+        "caddy:latest.dev.js",
+        "caddy:v12/app.js",
+        "caddy:v12/app.js.map",
+      ],
+    );
+    assert.equal(
+      files.every((file) => file.transform === "caddy-ssi"),
+      true,
+    );
+  });
+
+  const caddyFile: DeployFile = {
+    destination: "caddy",
+    immutable: false,
+    kind: "javascript",
+    localPath: "dist/latest/custom/latest.js",
+    remotePath: "latest.js",
+    transform: "caddy-ssi",
+  };
+
+  it("rewrites SSI directives to Caddy template placeholders", () => {
+    assert.equal(
+      transformContent(
+        caddyFile,
+        Buffer.from(
+          'a("<!--# echo var="http_host" default="" -->","<!--# echo var="proxy_hostname" default="" -->","<!--# echo var="proxy_path" default="/simple" -->")',
+        ),
+      ).toString(),
+      'a("{{.Req.Host}}","{{js (.Req.URL.Query.Get "hostname")}}","{{js (.Req.URL.Query.Get "path")}}")',
+    );
+  });
+
+  it("passes through files without directives unchanged", () => {
+    const content = Buffer.from("plain();\n");
+    assert.equal(transformContent(caddyFile, content).toString(), "plain();\n");
+  });
+
+  it("rejects stray Go template delimiters", () => {
+    assert.throws(
+      () => transformContent(caddyFile, Buffer.from('var a = "{{oops"')),
+      /Go template delimiters/,
+    );
+  });
+
+  it("rejects SSI directives without a replacement", () => {
+    assert.throws(
+      () =>
+        transformContent(
+          caddyFile,
+          Buffer.from('a("<!--# echo var="unknown_var" default="" -->")'),
+        ),
+      /no Caddy replacement/,
+    );
+  });
+});