diff --git a/Caddyfile.example b/Caddyfile.example
new file mode 100644
index 0000000..857fcc3
--- /dev/null
+++ b/Caddyfile.example
@@ -0,0 +1,35 @@
+# Caddyfile.example - reverse proxy for claude-remote
+#
+# Option 1: Tailscale IP restriction (recommended)
+# Only allows connections from Tailscale network (100.64.0.0/10)
+
+claude-remote.yourdomain.com {
+	@tailscale remote_ip 100.64.0.0/10
+	handle @tailscale {
+		reverse_proxy localhost:7200
+	}
+	respond "Forbidden" 403
+}
+
+# Option 2: Basic auth (if you need public access)
+# Generate hash with: caddy hash-password
+
+# claude-remote.yourdomain.com {
+# 	basicauth {
+# 		user $2a$14$your_hashed_password_here
+# 	}
+# 	reverse_proxy localhost:7200
+# }
+
+# Option 3: Both (belt and suspenders)
+
+# claude-remote.yourdomain.com {
+# 	@tailscale remote_ip 100.64.0.0/10
+# 	handle @tailscale {
+# 		basicauth {
+# 			user $2a$14$your_hashed_password_here
+# 		}
+# 		reverse_proxy localhost:7200
+# 	}
+# 	respond "Forbidden" 403
+# }