diff --git a/caddy/cf-sync.py b/caddy/cf-sync.py
index dfef9b1..a0d3a07 100755
--- a/caddy/cf-sync.py
+++ b/caddy/cf-sync.py
@@ -52,14 +52,16 @@ def caddy_sites():
     sites, site = {}, None
     with open(os.path.join(HERE, "Caddyfile"), encoding="utf-8") as fh:
         for line in fh:
-            m = re.match(r"^([a-z0-9.-]+\.%s)\s*\{" % re.escape(ZONE), line)
+            # Block-Header: ein oder mehrere Hostnamen (kommagetrennt) vor "{"
+            m = re.match(r"^([a-z0-9.-]+(?:\s*,\s*[a-z0-9.-]+)*\.%s)\s*\{" % re.escape(ZONE), line)
             if m:
                 site = m.group(1)
                 continue
             if site:
                 m2 = re.search(r"reverse_proxy\s+(\S+)", line)
                 if m2:
-                    sites[site] = m2.group(1)
+                    for host in site.split(","):
+                        sites[host.strip()] = m2.group(1)
                     site = None
     return sites
 
@@ -94,16 +96,20 @@ def main():
 
     drift = []
 
-    # 1) Ingress gegen Caddyfile
+    # 1) Ingress gegen Caddyfile.
+    #    Zielbild (TP31): CF-Ingress zeigt auf Caddy (10.40.20.40), Caddy aufs Origin.
+    #    Zeigt CF direkt auf ein Origin (nicht Caddy), ist das die alte Architektur = Drift.
     for host, (tun, svc) in sorted(ingress.items()):
         if svc.startswith("ssh://"):
             continue
         if host not in caddy:
             drift.append(f"NUR-CF     {host:<32} {tun}: {svc}  (in Caddy nicht vorhanden)")
-        elif caddy[host] != svc:
-            drift.append(f"ABWEICHEND {host:<32} CF={svc}  Caddy={caddy[host]}")
+        elif not svc.startswith(f"http://{CADDY_IP}"):
+            drift.append(f"ABWEICHEND {host:<32} CF={svc}  (zeigt nicht auf Caddy {CADDY_IP})")
+    # Caddy-Sites ohne CF-Ingress: nur die suffixlosen Namen sind potenziell Drift.
+    # *.bf.*-Namen sind bewusst intern (Split-Horizon) und brauchen keinen Ingress.
     for host, svc in sorted(caddy.items()):
-        if host not in ingress:
+        if host not in ingress and not host.endswith(".bf." + ZONE):
             drift.append(f"NUR-CADDY  {host:<32} {svc}  (kein CF-Ingress — intern oder bewusst)")
 
     # 2) CNAMEs, die auf einen Tunnel zeigen, aber keine Ingress-Regel mehr haben
diff --git a/docs/cf-backup/bf-nas-ingress-20260829-vor-grafana-removal.json b/docs/cf-backup/bf-nas-ingress-20260829-vor-grafana-removal.json
new file mode 100644
index 0000000..7ddc473
--- /dev/null
+++ b/docs/cf-backup/bf-nas-ingress-20260829-vor-grafana-removal.json
@@ -0,0 +1,23 @@
+{
+  "success": true,
+  "errors": [],
+  "messages": [],
+  "result": {
+    "tunnel_id": "220c9958-401b-4111-9451-f3db09bba2d5",
+    "version": 4,
+    "config": {
+      "ingress": [
+        {"service": "http://10.40.20.157:3000", "hostname": "gitea.emsenhuber.net"},
+        {"service": "http://10.40.20.109:3000", "hostname": "grafana.emsenhuber.net"},
+        {"service": "http://10.40.20.173:3000", "hostname": "pve-mcp.emsenhuber.net"},
+        {"service": "http://10.40.20.127", "hostname": "vw.emsenhuber.net"},
+        {"service": "http://10.40.20.10:8080", "hostname": "ds-bf.emsenhuber.net"},
+        {"service": "ssh://10.40.20.10:22", "hostname": "3k23uow7.emsenhuber.net"},
+        {"service": "http_status:404"}
+      ],
+      "warp-routing": {"enabled": true}
+    },
+    "source": "cloudflare",
+    "created_at": "2026-08-24T08:28:18.806844Z"
+  }
+}