diff --git a/infra/ansible/roles/deploy/templates/Caddyfile.j2 b/infra/ansible/roles/deploy/templates/Caddyfile.j2
index d3c5be7..31fa740 100644
--- a/infra/ansible/roles/deploy/templates/Caddyfile.j2
+++ b/infra/ansible/roles/deploy/templates/Caddyfile.j2
@@ -1,4 +1,4 @@
-# Managed by Ansible — do not edit manually on the server.
+# Managed by Ansible — do not edit manually.
 
 api.{{ domain }} {
   reverse_proxy localhost:8888 {
@@ -6,7 +6,12 @@ api.{{ domain }} {
   }
 }
 
-app.{{ domain }} {
+# Frontend is served on the bare domain, not app.{{ domain }}: only drb and api
+# have public DNS records. A vhost for a name with no A record still starts,
+# but Caddy retries ACME against it forever and logs a failure each time.
+# To move it to app.{{ domain }}, create the A record first, then change this
+# line — the reverse_proxy target stays the same either way.
+{{ domain }} {
   reverse_proxy localhost:3000 {
     header_up X-Forwarded-For {remote_host}
   }