diff --git a/group_vars/all/domains.yml b/group_vars/all/domains.yml
index cbcffd7..88f5c2c 100644
--- a/group_vars/all/domains.yml
+++ b/group_vars/all/domains.yml
@@ -26,6 +26,7 @@ subdomains:
   gotify: "gotify.{{ primary_domain }}"  # Gotify notifications
   gotify_assistant: "gotify-assistant.{{ primary_domain }}"  # iGotify iOS assistant
   listmonk: "listmonk.{{ secondary_domain }}"  # Listmonk mailing list
+  dir2opds: "opds.{{ primary_domain }}"  # dir2opds OPDS catalog
 
 # Email domains for notifications
 email_domains:
diff --git a/roles/docker/tasks/infrastructure/caddy.yml b/roles/docker/tasks/infrastructure/caddy.yml
index fbe0c77..41f7646 100644
--- a/roles/docker/tasks/infrastructure/caddy.yml
+++ b/roles/docker/tasks/infrastructure/caddy.yml
@@ -5,9 +5,24 @@
   loop:
     - /opt/stacks/caddy
 
-- name: copy Caddyfile
-  ansible.builtin.copy:
-    src: Caddyfile
+- name: Install apache2-utils for htpasswd
+  ansible.builtin.apt:
+    name: apache2-utils
+    state: present
+  become: true
+  when: vault_dir2opds is defined
+
+- name: Generate bcrypt hash for dir2opds basic auth
+  ansible.builtin.shell: |
+    htpasswd -bnB "{{ vault_dir2opds.basic_auth_user }}" "{{ vault_dir2opds.basic_auth_password }}" | awk -F: '{print $1, $2}'
+  register: dir2opds_basic_auth_hash_result
+  changed_when: false
+  no_log: true
+  when: vault_dir2opds is defined
+
+- name: template Caddyfile
+  ansible.builtin.template:
+    src: Caddyfile.j2
     dest: /opt/stacks/caddy/Caddyfile
     owner: root
     mode: 644
diff --git a/roles/docker/files/Caddyfile b/roles/docker/templates/Caddyfile.j2
similarity index 91%
rename from roles/docker/files/Caddyfile
rename to roles/docker/templates/Caddyfile.j2
index d7acc0d..77f26f3 100644
--- a/roles/docker/files/Caddyfile
+++ b/roles/docker/templates/Caddyfile.j2
@@ -109,3 +109,12 @@ listmonk.nerder.land {
 repaircafe.nerder.land {
     redir /volunteer-signup https://listmonk.nerder.land/subscription/form 301
 }
+
+{% if vault_dir2opds is defined %}
+opds.thesatelliteoflove.com {
+    basicauth {
+        {{ dir2opds_basic_auth_hash_result.stdout }}
+    }
+    reverse_proxy dir2opds:8080
+}
+{% endif %}
diff --git a/roles/docker/templates/dir2opds-compose.yml.j2 b/roles/docker/templates/dir2opds-compose.yml.j2
index 5b9233b..314e622 100644
--- a/roles/docker/templates/dir2opds-compose.yml.j2
+++ b/roles/docker/templates/dir2opds-compose.yml.j2
@@ -17,7 +17,7 @@ services:
     labels:
       glance.name: dir2opds
       glance.icon: si:book
-      glance.url: http://docker-01:8080
+      glance.url: https://{{ subdomains.dir2opds }}/
       glance.description: OPDS book catalog
       mag37.dockcheck.update: true
 networks: