The deploy chain works.

agent container -> ssh deploy@asam-prod-01 -> rootless docker -> 127.0.0.1:8199 -> Caddy -> public TLS.