diff --git a/Caddyfile b/Caddyfile
index e706f0f..1c1e6fd 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -236,23 +236,8 @@ zimaos.hubris.network {
 
 # Homelab MCP server (read-only context + management tools).
 # Mesh+LAN-gated by the service itself + nftables; no SSO so agent clients work.
+# ─── Oikos MCP (mac-mini Docker) ───
 mcp.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	reverse_proxy 192.168.8.205:9810
-}
-
-# Per-client age-key issuance (mesh-only via source-IP gating in the service).
-# No SSO — agents call this during bootstrap; identity is mesh peer + hostname.
-secrets.hubris.network {
-	tls {
-		dns ionos {env.IONOS_AUTH_API_TOKEN}
-	}
-	reverse_proxy 192.168.8.205:9820
-}
-
-# Authentik LAN forward-auth outpost (external_host for domain-level providers)
 sso.hubris.network {
 	tls {
 		dns ionos {env.IONOS_AUTH_API_TOKEN}