diff --git a/.gitignore b/.gitignore
index 022a176..b7add2d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,5 @@ node_modules
 /build
 /test
 .env
+public/hp_ssh.wasm
+public/wasm_exec.js
diff --git a/Caddyfile b/Caddyfile
new file mode 100644
index 0000000..a036a72
--- /dev/null
+++ b/Caddyfile
@@ -0,0 +1,10 @@
+https://localhost {
+    reverse_proxy headscale:8080
+	tls /certs/localhost.pem /certs/localhost-key.pem
+
+    header {
+        Access-Control-Allow-Origin  *
+        Access-Control-Allow-Headers *
+        Access-Control-Allow-Methods GET, POST, OPTIONS
+    }
+}
diff --git a/compose.yaml b/compose.yaml
index 439515b..b20d969 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -7,6 +7,22 @@ networks:
     name: "headplane-dev"
     driver: "bridge"
 services:
+  caddy:
+    image: "caddy:2"
+    container_name: "headplane-caddy"
+    restart: "unless-stopped"
+    depends_on:
+      - "headscale"
+    networks:
+      - "headplane-dev"
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - "./Caddyfile:/etc/caddy/Caddyfile"
+      - "./test/caddy/data:/data"
+      - "./test/caddy/config:/config"
+      - "./test/caddy/certs:/certs"
   headscale:
     image: "headscale/headscale:0.26.0-debug"
     container_name: "headscale"
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index 539b8d4..947a1a5 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -45,3 +45,9 @@ before commit to make these changes automatically.
 > All of these guidelines are fairly simple to follow and are flexible if needed.
 > I won't automatically close PRs or issues if they don't follow these rules,
 > but instead we can discuss them and see if we can come to a compromise.
+
+### Contribution Tooling
+If you plan to work with the WASM SSH agent, you will need to install
+`mkcert` or an equivalent to create certificates in `./test/caddy/certs`.
+It expects a `localhost.pem` and `localhost-key.pem` file to be present in that
+directory. PNPM has a script to do it with `pnpm mkcert` already already.
diff --git a/mise.toml b/mise.toml
new file mode 100644
index 0000000..f92272c
--- /dev/null
+++ b/mise.toml
@@ -0,0 +1,27 @@
+[tools]
+"go" = "1.24.4"
+"node" = "22"
+
+[tasks.copy-wasm-shim]
+alias = ["gojs"]
+description = "Copies Go's wasm_exec.js to the public directory"
+run = [
+	"echo $(go version) > public/wasm_exec.js",
+	"cat $(go env GOROOT)/lib/wasm/wasm_exec.js >> public/wasm_exec.js",
+]
+
+[tasks.build-go-wasm]
+alias = ["wasm"]
+depends = ["copy-wasm-shim"]
+description = "Builds the Go WebAssembly module for Tailscale SSH"
+env = { GOOS = "js", GOARCH = "wasm" }
+run = "go build -o public/hp_ssh.wasm ./cmd/hp_ssh"
+
+[tasks.generate-caddy-certs]
+alias = ["mkcert"]
+dir = "{{cwd}}/test/caddy/certs"
+run = [
+	"mkdir -p {{cwd}}/test/caddy/certs",
+	"mkcert -install",
+	"mkcert localhost"
+]