diff --git a/Caddyfile b/Caddyfile
index e982a8f..6467e75 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -11,7 +11,7 @@
 # Reusable matcher — blocks anything not on the LAN.
 # Usage: import internal_only inside any site block.
 (internal_only) {
-	@blocked not remote_ip 192.168.1.0/24
+	@blocked not remote_ip 192.168.1.0/24 172.16.0.0/12 127.0.0.1
 	respond @blocked "Access denied" 403
 }
 
@@ -208,3 +208,26 @@ auth.ginnoir.com {
 dev.ginnoir.com {
        reverse_proxy 192.168.1.74:3000
 }
+
+# =============================================================
+# MANAGEMENT — internal only
+# =============================================================
+portainer.ginnoir.com {
+	import internal_only
+	reverse_proxy portainer:9000
+}
+
+uptime.ginnoir.com {
+	import internal_only
+	reverse_proxy uptime-kuma:3001
+}
+
+homarr.ginnoir.com {
+	import internal_only
+	reverse_proxy homarr:7575
+}
+
+router.ginnoir.com {
+	import internal_only
+	reverse_proxy 192.168.1.1
+}
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index 92a6491..9dc572c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -75,6 +75,7 @@ services:
       - media
       - famapp
       - authentik
+      - management
     ports:
       - "80:80"
       - "443:443"
@@ -594,6 +595,43 @@ services:
     depends_on:
       - hbbr
 
+  # ============================================================
+  # MANAGEMENT
+  # ============================================================
+  portainer:
+    container_name: portainer
+    image: portainer/portainer-ce:latest
+    restart: unless-stopped
+    networks:
+      - management
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /config/portainer:/data
+
+  uptime-kuma:
+    container_name: uptime_kuma
+    image: louislam/uptime-kuma:2
+    restart: unless-stopped
+    networks:
+      - management
+    volumes:
+      - /config/uptime-kuma:/app/data
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+
+  homarr:
+    container_name: homarr
+    image: ghcr.io/homarr-labs/homarr:latest
+    restart: unless-stopped
+    environment:
+      - SECRET_ENCRYPTION_KEY=98989838bf06c9e42d77944ce848963a22ab316b55a09b0d199652ef0934394f
+    networks:
+      - management
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /config/homarr/configs:/app/data/configs
+      - /config/homarr/icons:/app/public/icons
+      - /config/homarr/data:/data
+
   # ============================================================
   # UTILITIES
   # ============================================================
@@ -788,6 +826,7 @@ networks:
   media:
   famapp:
   authentik:
+  management:
 
 volumes:
   minio_data: