Status: IN
The Caddy rule's action phase is idempotent: `copy` overwrites the Caddyfile, `firewalld` with `state="enabled"` is a no-op if already enabled, and `service` with `state="started"` is a no-op if already running.
Source: entries/2026/05/11/deployments-catbeez-rules-ensure_arcade_caddy.md
# From cloudflare-stargate/rules/ensure_stargate_caddy.py pattern
# Observe checks if Caddy is running and config is correct
# Action writes config and restarts only if condition detected drift
await ftl["stargate"].copy(content=caddyfile, dest="/etc/caddy/Caddyfile", mode="0644")
await ftl["stargate"].service(name="caddy", state="restarted")