diff --git a/Containers/apache/Caddyfile b/Containers/apache/Caddyfile
index 0fafb46f..00177969 100644
--- a/Containers/apache/Caddyfile
+++ b/Containers/apache/Caddyfile
@@ -1,4 +1,6 @@
 {
+    admin off
+
     auto_https disable_redirects
 
     storage file_system {
@@ -9,8 +11,19 @@
         # trusted_proxies placeholder
     }
 
+    # The endpoint below is plain http on purpose, so limit it to h1 to avoid caddy warning that
+    # HTTP/2 and HTTP/3 were skipped. Excluding the `http` logger would also hide acme messages.
+    servers :23973 {
+        protocols h1
+    }
+
+    # apache-port protocols placeholder
+
     log {
-        level ERROR
+        level {$CADDY_LOG_LEVEL}
+        # Below ERROR, caddy prints 'admin endpoint disabled' on every start, which is expected
+        # since we set `admin off` above.
+        exclude admin
     }
 }
 
diff --git a/Containers/apache/start.sh b/Containers/apache/start.sh
index 5d278df5..3d74418f 100644
--- a/Containers/apache/start.sh
+++ b/Containers/apache/start.sh
@@ -9,6 +9,8 @@ if [ -z "$NC_DOMAIN" ]; then
     exit 1
 fi
 
+CADDY_LOG_LEVEL="$(echo "$AIO_LOG_LEVEL" | tr '[:lower:]' '[:upper:]')"
+export CADDY_LOG_LEVEL
 if [ "$AIO_LOG_LEVEL" = 'debug' ]; then
     export AIO_ACCESS_LOG=/proc/self/fd/1
 else
@@ -64,6 +66,13 @@ else
 fi
 echo "$CADDYFILE" > /tmp/Caddyfile
 
+# In case of reverse proxies the APACHE_PORT listener is plain http, so limit it to h1 to avoid
+# caddy warning that HTTP/2 and HTTP/3 were skipped. See the Caddyfile for further details.
+if [ "$APACHE_PORT" != '443' ]; then
+    CADDYFILE="$(sed "s|# apache-port protocols placeholder|servers :$APACHE_PORT {\n\t\tprotocols h1\n\t}|" /tmp/Caddyfile)"
+    echo "$CADDYFILE" > /tmp/Caddyfile
+fi
+
 # Remove additional domain if not given
 if [ -z "$ADDITIONAL_TRUSTED_DOMAIN" ]; then
     CADDYFILE="$(sed '/ADDITIONAL_TRUSTED_DOMAIN/d' /tmp/Caddyfile)"
diff --git a/Containers/mastercontainer/acme.Caddyfile b/Containers/mastercontainer/acme.Caddyfile
index 77d7df9e..39e2885e 100644
--- a/Containers/mastercontainer/acme.Caddyfile
+++ b/Containers/mastercontainer/acme.Caddyfile
@@ -10,10 +10,16 @@
 	}
 
 	log {
-		level ERROR
+		level {$CADDY_LOG_LEVEL}
 		# We need to exclude the remote-host plugin from logging as it would spam the logs
 		# See https://github.com/nextcloud/all-in-one/pull/7006#issuecomment-4003238239 
 		exclude http.matchers.remote_host
+		# Below ERROR, caddy prints 'admin endpoint disabled' on every start, which is expected
+		# since we set `admin off` above. The on-demand TLS warning is suppressed by the `ask` below.
+		exclude admin
+		# Below ERROR, caddy warns that the `http://:80` block only listens on the HTTP port, which
+		# is expected as it merely redirects to https while `https://:8443` handles the certificates.
+		exclude http.auto_https
 	}
 
 	servers {
diff --git a/Containers/mastercontainer/internal.Caddyfile b/Containers/mastercontainer/internal.Caddyfile
index 9890acc0..fe9f6137 100644
--- a/Containers/mastercontainer/internal.Caddyfile
+++ b/Containers/mastercontainer/internal.Caddyfile
@@ -9,10 +9,16 @@
 	}
 
 	log {
-		level ERROR
+		level {$CADDY_LOG_LEVEL}
 		# We need to exclude the remote-host plugin from logging as it would spam the logs
 		# See https://github.com/nextcloud/all-in-one/pull/7006#issuecomment-4003238239 
 		exclude http.matchers.remote_host
+		# Below ERROR, caddy prints 'admin endpoint disabled' on every start, which is expected
+		# since we set `admin off` above.
+		exclude admin
+		# Below ERROR, caddy reports that the http -> https redirects are disabled, which is
+		# expected since we set `auto_https disable_redirects` above (acme.Caddyfile handles them).
+		exclude http.auto_https
 	}
 
 	servers {
@@ -20,6 +26,12 @@
 		protocols h1
 	}
 
+	# This endpoint always allows as the internal issuer below only creates self-signed certificates.
+	# It is only needed to silence caddy's warning about unprotected on-demand TLS.
+	on_demand_tls {
+		ask http://127.0.0.1:9876/internal
+	}
+
 	skip_install_trust
 }
 
diff --git a/Containers/mastercontainer/start.sh b/Containers/mastercontainer/start.sh
index b58ecde2..ade97a4c 100755
--- a/Containers/mastercontainer/start.sh
+++ b/Containers/mastercontainer/start.sh
@@ -352,6 +352,9 @@ if [ "$AIO_LOG_LEVEL" != 'debug' ]; then
     sed -i 's|^options = shares-console|#options = shares-console|' /etc/dinit.d/domain-validator
 fi
 
+CADDY_LOG_LEVEL="$(echo "$AIO_LOG_LEVEL" | tr '[:lower:]' '[:upper:]')"
+export CADDY_LOG_LEVEL
+
 # Check if ghcr.io is reachable
 # Solves issues like https://github.com/nextcloud/all-in-one/discussions/5268
 if ! curl --no-progress-meter https://ghcr.io/v2/ >/dev/null; then
diff --git a/php/domain-validator.php b/php/domain-validator.php
index 55fb110f..101afa06 100644
--- a/php/domain-validator.php
+++ b/php/domain-validator.php
@@ -6,7 +6,11 @@ if (isset($_GET['domain']) && is_string($_GET['domain'])) {
     $domain = $_GET['domain'];
 }
 
-if (!str_contains($domain, '.')) { 
+// The internal caddy instance on port 8080 accepts any hostname as it only issues self-signed
+// certificates. It needs this endpoint to silence caddy's unprotected on-demand TLS warning.
+if (($_SERVER['REQUEST_URI'] ?? '') === '/internal' || str_starts_with($_SERVER['REQUEST_URI'] ?? '', '/internal?')) {
+    http_response_code(200);
+} elseif (!str_contains($domain, '.')) {
     http_response_code(400);
 } elseif (str_contains($domain, '/')) { 
     http_response_code(400);