diff --git a/home-apps/demo-service-caddy.yaml b/home-apps/demo-service-caddy.yaml
new file mode 100644
index 0000000..1025c40
--- /dev/null
+++ b/home-apps/demo-service-caddy.yaml
@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: demo-caddy-config
+  namespace: home-apps
+data:
+  Caddyfile: |
+    # Caddy for Demo Service — internal server, TLS handled by Nginx Ingress
+    
+    :80 {
+        log {
+            output stdout
+            format json
+        }
+    
+        # ── Custom error pages (canvas animation, served directly by Caddy) ──
+        handle_errors {
+            @html_errors expression `{err.status_code} in [401, 403, 404]`
+            handle @html_errors {
+                root * /app/static
+                rewrite * /error-page.html
+                file_server
+            }
+        }
+    
+        # Management API → Python service
+        handle /api/* {
+            reverse_proxy localhost:3000 {
+                header_up Host {host}
+                header_up X-Forwarded-For {remote_host}
+                header_up X-Forwarded-Proto https
+            }
+        }
+    
+        # Admin Web UI → Python service
+        handle /admin {
+            reverse_proxy localhost:3000
+        }
+        handle /admin/* {
+            reverse_proxy localhost:3000
+        }
+    
+        # ── Site content: API handles visibility + auth ──
+        # Public sites served without auth; drafts require login
+        handle {
+            rewrite * /site-content{uri}
+            reverse_proxy localhost:3000 {
+                header_up Host {host}
+                header_up X-Forwarded-For {remote_host}
+                header_up X-Forwarded-Proto https
+                header_up Cookie {http.request.header.Cookie}
+            }
+        }
+    
+        header {
+            X-Content-Type-Options nosniff
+            X-Frame-Options SAMEORIGIN
+            -Server
+        }
+    }
diff --git a/home-apps/demo-service.yaml b/home-apps/demo-service.yaml
index de9ad58..c0ec3e1 100644
--- a/home-apps/demo-service.yaml
+++ b/home-apps/demo-service.yaml
@@ -11,62 +11,6 @@ spec:
       storage: 10Gi
   storageClassName: nfs-client
 ---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: demo-caddy-config
-  namespace: home-apps
-data:
-  Caddyfile: |
-    # Caddy for Demo Service — internal server, TLS handled by Nginx Ingress
-    # Auth is handled by the Python API
-
-    :80 {
-        log {
-            output stdout
-            format json
-        }
-
-        handle /api/* {
-            reverse_proxy localhost:3000 {
-                header_up Host {host}
-                header_up X-Forwarded-For {remote_host}
-                header_up X-Forwarded-Proto https
-            }
-        }
-
-        handle /admin {
-            reverse_proxy localhost:3000
-        }
-        handle /admin/* {
-            reverse_proxy localhost:3000
-        }
-
-        handle / {
-            reverse_proxy localhost:3000
-        }
-
-        # Block access to internal files
-        @blocked path_regexp blocked \.(draft|bak)$
-        handle @blocked {
-            error 404
-        }
-
-        # Static demo sites — public
-        handle_path /* {
-            root * /data/demos
-            file_server {
-                index index.html
-            }
-        }
-
-        header {
-            X-Content-Type-Options nosniff
-            X-Frame-Options SAMEORIGIN
-            -Server
-        }
-    }
----
 apiVersion: apps/v1
 kind: Deployment
 metadata: