diff --git a/hosts/chunk/garage.nix b/hosts/chunk/garage.nix
index b046a4b..ae37251 100644
--- a/hosts/chunk/garage.nix
+++ b/hosts/chunk/garage.nix
@@ -46,5 +46,20 @@
         reverse_proxy localhost:3902
       '';
     };
+    "dl.cy7.sh".extraConfig = ''
+      import common
+      fs dl
+      file_server {
+        browse
+      }
+    '';
   };
+
+  services.caddy.globalConfig = ''
+    filesystem dl s3 {
+      bucket caddy-dl
+      region us-east-1
+      endpoint https://s3.cy7.sh
+    }
+  '';
 }
diff --git a/modules/caddy.nix b/modules/caddy.nix
index 3e6ca63..17325d2 100644
--- a/modules/caddy.nix
+++ b/modules/caddy.nix
@@ -20,8 +20,9 @@ in
           # error message will tell you the correct version tag to use
           # (still need the @ to pass nix config check)
           "github.com/caddy-dns/cloudflare@v0.0.0-20250228175314-1fb64108d4de"
+          "github.com/sagikazarmark/caddy-fs-s3@v0.7.1-0.20250228151755-8e8ed9e5aab9"
         ];
-        hash = "sha256-YYpsf8HMONR1teMiSymo2y+HrKoxuJMKIea5/NEykGc=";
+        hash = "sha256-7IdAmp3O5yTUPFwWkwKAQpAqbNUazB5yG3b/WCq8GP0=";
       };
       logFormat = lib.mkForce "level INFO";
       acmeCA = "https://acme-v02.api.letsencrypt.org/directory";
diff --git a/secrets/services/caddy.yaml b/secrets/services/caddy.yaml
index 5f3ea62..fb2cc85 100644
--- a/secrets/services/caddy.yaml
+++ b/secrets/services/caddy.yaml
@@ -1,5 +1,5 @@
 caddy:
-    env: ENC[AES256_GCM,data:fyP1pPJgO9jN0ypC09s0Sz+HlUX42fl6DxWevYYevKdlKTgz5VHQfbELhy6vejmg9v+zFB3/AtSZfWJQB2dNX4Zm/L42wf5QZ7oYoa9QTujJjRgE96OXM77ioNy2DzFzpGw3w16QoC7zaR8UHSN1KL6qRj5xxKw0U6Apxhc0AuBoLvNHOgn8CHY92Q4OBcA1tJn8tgLB9uZB5Ge/2BlEjdSQ0sZMLkE+dHC4/0IILVFrrv1sWRXvXt6t5njF,iv:tF5GRPFYZSuKRgDAY1e8/J7jNQAEqDpgXlpwWW+1P4E=,tag:lK/BUErXNIPgqXPzGJvPTQ==,type:str]
+    env: ENC[AES256_GCM,data:NBE8mVyz1lN+W6UHNa0KYnEYNtyK6bTQH/HgZ2OsGXSBXrse38Ga3CRw/rHgKrLSkjSx7faUrn0s1/8nNWY4gz2Ntv9N+HtKgQhXaxXhgp9BpH6ClVEL65s7F81Gr3SsZ3SlLra4cDDZ9ytX8/RxZ+httllVhODOmTyVtow9abNRwTJogdqf5gRBQvd1LnjXR6ET7VMZFTM2JETnxiax/LS1DSsp5XgJtQfmhL8eZ3hz6SZxReD1DC+5pg4=,iv:d/R4Fi3Ylqv4I2EIOX9Pzfpep8U5ctgrIRMEFTsL8e0=,tag:aV/6Z3k6ZjnF0/z49liwIw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -33,8 +33,8 @@ sops:
             Q2hBZE1FOHJ3aW5rVmoyK045eG11cmsKFOmP5iWONREZvxu0rM+fKMPQKgnYq5LH
             AKMZFsP7nnUxjdCXEA18sDg4Rf0qp8i3uQK3D6P7417j9ye/YZA4BQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-08T21:05:07Z"
-    mac: ENC[AES256_GCM,data:vgGCrCJMBxjiCWZYymlaPKTekA1Weprwgtc4xcoPVlDsuljkXDth+aAZPpnakE/nSXhGC6jGJOHdtrsIUTkH2R9WQHIdZDBy+VrVQoV6xE3ijfWyIujcIPwz3s1MGBqRFUYum1XMU5FAcIASiYV7PDxj/f6fsLbjKZCc9/kG3GE=,iv:PSvlssl+Gx+Gcw6/zccIKJDeNz3dJ0kHnPmCrAdBnqQ=,tag:6F/JKBFNxKEgMTyYZ3W0Vg==,type:str]
+    lastmodified: "2025-03-29T05:03:16Z"
+    mac: ENC[AES256_GCM,data:94JoFG2sBvPOD4lquq8Ck1sGzNIiPDjufRuBz2mXbLA0Lx11xL2/dkdQA2A9Eb2DE0TRtPPMl8JHwGWcUac+dWdeYXcu0LRxZxWHp/ajoHnYHbBRzxdM2gRtb0igkBTCMxDtBH8zOoMNn/g1U/m1m8G/fAoWf4VCB2wGpy7WrRA=,iv:OqQzOf6QRYZiHqerE0Cn8JPrhzcgHkSn2tdhDLbFEq4=,tag:LwRgqPNj+fNhM70Bq7vIXw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4