diff --git a/cli/tests/conftest.py b/cli/tests/conftest.py
index 41961e2..f20aa33 100644
--- a/cli/tests/conftest.py
+++ b/cli/tests/conftest.py
@@ -55,9 +55,7 @@ def castle_root(tmp_path: Path) -> Generator[Path, None, None]:
                         "health_path": "/health",
                     }
                 },
-                "proxy": {
-                    "caddy": {"path_prefix": "/test-svc"},
-                },
+                "proxy": True,
                 "manage": {
                     "systemd": {},
                 },
diff --git a/core/src/castle_core/config.py b/core/src/castle_core/config.py
index fbbd311..185c071 100644
--- a/core/src/castle_core/config.py
+++ b/core/src/castle_core/config.py
@@ -158,10 +158,12 @@ def resolve_env_split(
     (routing them through a mode-0600 env file) while inlining the rest.
 
     - ``${secret:NAME}`` reads `~/.castle/secrets/NAME`.
-    - ``${port}`` / ``${data_dir}`` / ``${name}`` (and anything else in
-      ``context``) expand to castle's computed values, so a service maps them to
-      whatever env var its program reads (e.g. ``MY_PORT: ${port}``) without
-      hardcoding or castle silently injecting a guessed var name.
+    - ``${port}`` / ``${data_dir}`` / ``${name}`` / ``${public_url}`` (and
+      anything else in ``context``) expand to castle's computed values, so a
+      service maps them to whatever env var its program reads (e.g.
+      ``MY_PORT: ${port}``) without hardcoding or castle silently injecting a
+      guessed var name. ``${public_url}`` is the service's gateway-facing base
+      URL (``https://<name>.<domain>`` under acme) — the origin an app allowlists.
     """
     context = context or {}
     plain: dict[str, str] = {}
@@ -329,7 +331,6 @@ _STRUCTURAL_KEYS = {
     "systemd",
     "expose",
     "proxy",
-    "caddy",
 }
 
 
diff --git a/core/src/castle_core/generators/caddyfile.py b/core/src/castle_core/generators/caddyfile.py
index 1b6e04e..8dd7524 100644
--- a/core/src/castle_core/generators/caddyfile.py
+++ b/core/src/castle_core/generators/caddyfile.py
@@ -55,8 +55,8 @@ def service_proxy_targets(name: str, svc: ServiceSpec) -> ProxyTargets:
 
     The single source of truth shared by the registry build (``deploy``) and
     route computation (``compute_routes``), so they never disagree. ``expose`` is
-    the checkbox (``proxy.caddy`` present and enabled); the subdomain is always the
-    service name, so there's nothing else to derive.
+    the checkbox (``proxy: true``); the subdomain is always the service name, so
+    there's nothing else to derive.
     """
     port = None
     if svc.expose and svc.expose.http: