diff --git a/plays/setup-caddy-ha.yml b/plays/setup-caddy-ha.yml
index a4b73665..4c3f37c8 100644
--- a/plays/setup-caddy-ha.yml
+++ b/plays/setup-caddy-ha.yml
@@ -92,15 +92,48 @@
       vars:
         keepalived_vip: "{{ vip }}"
 
+    - name: Gather Facts
+      setup:
+
+    - name: Force Source IP for Backend Subnet (Fix Timeout)
+      vars:
+        # Determine physical IP. If only VIP exists, fallback to VIP (and skip task).
+        physical_ip: "{{ ansible_all_ipv4_addresses | reject('equalto', vip) | first | default(vip) }}"
+      command: >
+        ip route replace 10.2.40.0/24 
+        via 10.2.45.1 
+        dev {{ ansible_default_ipv4.interface }}
+      when: physical_ip != vip
+      changed_when: false
+
+    - name: Fetch Authentik Certificate
+      get_url:
+        url: https://authentik.renner.uno
+        dest: /usr/local/share/ca-certificates/authentik.crt
+        validate_certs: false
+// ...existing code...
+      notify: Update CA Trust
+
     - name: Configure Default Site with Hostname
       replace:
+// ...existing code...
         path: /etc/caddy/Caddyfile
-        regexp: '(?s)caddy\.renner\.uno \{.*?\}'
+        regexp: '(?s)caddy\.renner\.uno \{.*?\n\}'
         replace: |
           caddy.renner.uno {
             import cloudflare
             respond "Gateway: {system.hostname}"
           }
+
+    - name: Configure Global Trusted Proxies (Fix Client IP)
+      blockinfile:
+        path: /etc/caddy/Caddyfile
+        insertafter: '^\{'
+        block: |
+            servers {
+              trusted_proxies static 127.0.0.1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+            }
+      notify: Reload Caddy
       delegate_to: "{{ primary_host }}"
       run_once: true
       notify: Reload Caddy
@@ -176,8 +209,52 @@
           when: keepalived_state == 'BACKUP'
           ignore_errors: true # In case file is missing
           notify: Reload Caddy
+
+        - name: Check for Cloudflared Config on Primary
+          stat:
+            path: /etc/cloudflared
+          register: cf_conf_chk
+          when: keepalived_state == 'MASTER'
+          run_once: true
+
+        - name: Archive Cloudflared Config
+          command: tar -czf /tmp/cloudflared_conf.tar.gz -C /etc/cloudflared .
+          when: keepalived_state == 'MASTER' and cf_conf_chk.stat.exists
+          run_once: true
+
+        - name: Fetch Cloudflared Archive
+          fetch:
+            src: /tmp/cloudflared_conf.tar.gz
+            dest: /tmp/cloudflared_conf.tar.gz
+            flat: yes
+          when: keepalived_state == 'MASTER' and cf_conf_chk.stat.exists
+          run_once: true
+
+        - name: Push Cloudflared Archive
+          copy:
+            src: /tmp/cloudflared_conf.tar.gz
+            dest: /tmp/cloudflared_conf.tar.gz
+          when: keepalived_state == 'BACKUP'
+
+        - name: Ensure Cloudflared Dir Exists
+          file:
+            path: /etc/cloudflared
+            state: directory
+          when: keepalived_state == 'BACKUP'
+
+        - name: Restore Cloudflared Config
+          unarchive:
+            src: /tmp/cloudflared_conf.tar.gz
+            dest: /etc/cloudflared
+            remote_src: yes
+          when: keepalived_state == 'BACKUP'
+          notify: Restart Cloudflared
   
   handlers:
+    - name: Update CA Trust
+      command: update-ca-certificates
+      listen: "Update CA Trust"
+
     - name: Reload Caddy
       service:
         name: caddy
@@ -191,6 +268,10 @@
       when: caddy_restart_result is failed
       listen: "Reload Caddy"
 
+    - name: Save IPTables
+      command: netfilter-persistent save
+      listen: "Save IPTables"
+
     - name: Restart Cloudflared
       service:
         name: cloudflared
diff --git a/roles/caddy-ha/tasks/main.yml b/roles/caddy-ha/tasks/main.yml
index d1b33af3..77ab9ec0 100644
--- a/roles/caddy-ha/tasks/main.yml
+++ b/roles/caddy-ha/tasks/main.yml
@@ -6,6 +6,8 @@
       - debian-archive-keyring
       - apt-transport-https
       - keepalived
+      - iptables-persistent
+      - netfilter-persistent
     state: present
     update_cache: yes
   register: result
@@ -33,6 +35,16 @@
   retries: 20
   delay: 10
 
+- name: Download Cloudflared
+  get_url:
+    url: https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
+    dest: /tmp/cloudflared.deb
+
+- name: Install Cloudflared
+  apt:
+    deb: /tmp/cloudflared.deb
+    state: present
+
 - name: Ensure IP forwarding is enabled
   sysctl:
     name: net.ipv4.ip_nonlocal_bind