diff --git a/config/Caddyfile b/config/Caddyfile
index 5756ffb2..dac4e1cb 100644
--- a/config/Caddyfile
+++ b/config/Caddyfile
@@ -1,5 +1,5 @@
 # TFM aInventory - Caddy Patched IP Configuration
-# Version 1.9.15 - The Dynamic Shield (On-Demand TLS)
+# Version 1.9.16 - The Open Gateway (Valid Permission check)
 
 {
     admin off
@@ -11,9 +11,9 @@
     
     # Configure on-demand TLS for private network IPs
     on_demand_tls {
-        # Using a dummy check or local health endpoint to allow any IP in private range
-        # For simplicity in this env, we use the frontend's existence as the check
-        ask http://frontend:3000/api/health
+        # Pointing to the backend root which returns 200 OK
+        # This allows Caddy to generate internal certs for any IP/domain.
+        ask http://backend:8000/
     }
 }
 
@@ -23,9 +23,6 @@ https:// {
         on_demand
     }
     
-    # Route based on the port (Caddy handles multiple listeners in this catch-all)
-    # But since we have specific container ports, we'll split them for clarity
-    # to avoid port collision in the catch-all.
     reverse_proxy frontend:3000
     
     header {
diff --git a/frontend/VERSION.json b/frontend/VERSION.json
index 1da4a22a..62056036 100644
--- a/frontend/VERSION.json
+++ b/frontend/VERSION.json
@@ -1 +1 @@
-{"version": "1.9.14", "last_build": "2026-04-13-2237", "codename": "ProtocolLock", "commit": "94f1a515"}
+{"version": "1.9.15", "last_build": "2026-04-13-2243", "codename": "DynamicShield", "commit": "826b264a"}