diff --git a/Caddyfile b/Caddyfile
index 0ac8042..bb4877d 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -150,6 +150,25 @@ photos.hubris.network {
 	reverse_proxy 192.168.8.136:3000
 }
 
+photos-new.hubris.network {
+	# mule-image @new branch — PhotoPrism M0 test on LXC 127 (192.168.8.181)
+	tls {
+		dns ionos {env.IONOS_AUTH_API_TOKEN}
+	}
+	encode zstd gzip
+	# PhotoPrism API + OIDC callback first (matched before Vite catch-all)
+	@pp path /api/v1/* /api/v1 /static/* /library/* /share/*
+	reverse_proxy @pp 192.168.8.181:2342
+	# Sidecar (mule-sidecar Go service) — keeps the /api/sidecar/ prefix
+	@sc path /api/sidecar/*
+	reverse_proxy @sc 192.168.8.181:8000
+	# Catch-all → Vite dev server. Host rewritten so the catch-all reaches Vite
+	# without tripping Vite allowedHosts.
+	reverse_proxy 192.168.8.181:5173 {
+		header_up Host localhost:5173
+	}
+}
+
 auth.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}
@@ -176,7 +195,6 @@ artifacto.hubris.network {
 	}
 }
 
-
 plato.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}