Bernard Siebens
98e5f22873
The "behind an existing Caddy" section assumed the DNS plugin was being set up from scratch. The realistic case is a box whose Caddy already does Cloudflare DNS-01 for another domain, so it now covers that: set acme_dns once globally and every site inherits it, or scope a token per zone with a snippet. Leads with the failure that will actually happen -- a Cloudflare token is scoped to named zones, so the existing one grants DNS:Edit on the domain it was made for and nothing else, and the new site fails its challenge on a permissions error whose text does not say so. Also spells out that *.test.rosterchief.app does NOT match test.rosterchief.app: a wildcard covers exactly one label, so leaving the bare host off the site line gives the club subdomains a certificate and the control panel none. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>