diff --git a/.dev-config.yml b/.dev-config.yml
index df4a59c..7dc50b6 100644
--- a/.dev-config.yml
+++ b/.dev-config.yml
@@ -2,6 +2,15 @@ origin:
   store_dir_path: /tmp/domani_dev_env/origin
 domain:
   store_dir_path: /tmp/domani_dev_env/domain
+  builtins:
+    foo:
+      kind: proxy
+      url: ok
+    bar:
+      kind: git
+      url: a
+      branch_name: b
+      public: true
 service:
   http:
     form_method: GET
diff --git a/README.md b/README.md
index ceab2cc..8169574 100644
--- a/README.md
+++ b/README.md
@@ -31,7 +31,7 @@ origin:
   # etc...) will be stored.
   #
   # This should be different than any other store_dir_paths.
-  store_dir_path: REQUIRED
+  #store_dir_path: REQUIRED
 
 domain:
 
@@ -39,7 +39,7 @@ domain:
   # certificates, etc...) will be stored.
   #
   # This should be different than any other store_dir_paths.
-  store_dir_path: REQUIRED
+  #store_dir_path: REQUIRED
 
   #dns:
 
@@ -59,17 +59,26 @@ domain:
   #builtins:
 
     # An example built-in domain backed by a git repo.
-    #example.com:
+    #git.example.com:
     #  kind: git
     #  url: "https://somewhere.com/some/repo.git"
-    #  branch: main
+    #  branch_name: main
     #  public: false
 
+    # An example built-in domain backed by a reverse-proxy to some other
+    # web-service. Proxies are currently limited in the following ways:
+    # * url must be to an http endpoint (not https)
+    # * dns.resolver_addr is ignored and the system-wide dns is used
+    #
+    #proxy.example.com:
+    #  kind: proxy
+    #  url: "http://some.other.service.com"
+
 service:
 
   # Passphrase which must be given by users who are configuring new domains via
   # the web interface.
-  passphrase: foobar
+  #passphrase: REQUIRED
 
   # DNS records which users must add to their domain's DNS so that
   # Domani can serve the domains. All records given must route to this Domani
diff --git a/src/config.rs b/src/config.rs
index a30db94..5bbb1b9 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1,6 +1,6 @@
-use serde::Deserialize;
+use serde::{Deserialize, Serialize};
 
-#[derive(Deserialize)]
+#[derive(Deserialize, Serialize)]
 pub struct Config {
     pub origin: crate::origin::Config,
     pub domain: crate::domain::Config,
diff --git a/src/domain.rs b/src/domain.rs
index 34a7d56..4b3d336 100644
--- a/src/domain.rs
+++ b/src/domain.rs
@@ -19,6 +19,7 @@ use sha2::{Digest, Sha256};
 /// Defines how a domain will behave when it is accessed. These are configured by the owner of the
 /// domain during setup.
 pub struct Settings {
+    #[serde(flatten)]
     pub origin_descr: origin::Descr,
 }
 
diff --git a/src/domain/config.rs b/src/domain/config.rs
index c3ab0c9..10308f8 100644
--- a/src/domain/config.rs
+++ b/src/domain/config.rs
@@ -1,6 +1,6 @@
 use std::{collections, net, path, str::FromStr};
 
-use serde::Deserialize;
+use serde::{Deserialize, Serialize};
 
 use crate::domain;
 
@@ -8,7 +8,7 @@ fn default_resolver_addr() -> net::SocketAddr {
     net::SocketAddr::from_str("1.1.1.1:53").unwrap()
 }
 
-#[derive(Deserialize)]
+#[derive(Deserialize, Serialize)]
 pub struct ConfigDNS {
     #[serde(default = "default_resolver_addr")]
     pub resolver_addr: net::SocketAddr,
@@ -22,25 +22,26 @@ impl Default for ConfigDNS {
     }
 }
 
-#[derive(Deserialize)]
+#[derive(Deserialize, Serialize)]
 pub struct ConfigACME {
     pub contact_email: String,
 }
 
-#[derive(Deserialize)]
-pub struct BuiltinDomain {
+#[derive(Deserialize, Serialize)]
+pub struct ConfigBuiltinDomain {
     #[serde(flatten)]
     pub settings: domain::Settings,
 
+    #[serde(default)]
     pub public: bool,
 }
 
-#[derive(Deserialize)]
+#[derive(Deserialize, Serialize)]
 pub struct Config {
     pub store_dir_path: path::PathBuf,
     #[serde(default)]
     pub dns: ConfigDNS,
     pub acme: Option<ConfigACME>,
     #[serde(default)]
-    pub builtins: collections::HashMap<domain::Name, BuiltinDomain>,
+    pub builtins: collections::HashMap<domain::Name, ConfigBuiltinDomain>,
 }
diff --git a/src/domain/store.rs b/src/domain/store.rs
index dccd786..fbd1c01 100644
--- a/src/domain/store.rs
+++ b/src/domain/store.rs
@@ -99,13 +99,13 @@ impl Store for FSStore {
 
 pub struct StoreWithBuiltin<S: Store> {
     inner: S,
-    domains: collections::HashMap<domain::Name, domain::config::BuiltinDomain>,
+    domains: collections::HashMap<domain::Name, domain::config::ConfigBuiltinDomain>,
 }
 
 impl<S: Store> StoreWithBuiltin<S> {
     pub fn new(
         inner: S,
-        builtin_domains: collections::HashMap<domain::Name, domain::config::BuiltinDomain>,
+        builtin_domains: collections::HashMap<domain::Name, domain::config::ConfigBuiltinDomain>,
     ) -> StoreWithBuiltin<S> {
         StoreWithBuiltin {
             inner,
diff --git a/src/main.rs b/src/main.rs
index ca78e00..58b09a5 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -28,6 +28,9 @@ struct Cli {
         env = "DOMANI_CONFIG_PATH"
     )]
     config_path: path::PathBuf,
+
+    #[arg(long, help = "Dump the full process configuration to stdout and exit")]
+    dump_config: bool,
 }
 
 #[tokio::main]
@@ -78,6 +81,12 @@ async fn main() {
         config
     };
 
+    if cli.dump_config {
+        let stdout = std::io::stdout().lock();
+        serde_yaml::to_writer(stdout, &config).expect("writing config to stdout");
+        return;
+    };
+
     let origin_store = domani::origin::git::FSStore::new(&config.origin)
         .expect("git origin store initialization failed");
 
diff --git a/src/origin/config.rs b/src/origin/config.rs
index d1592d0..45c52fa 100644
--- a/src/origin/config.rs
+++ b/src/origin/config.rs
@@ -1,7 +1,7 @@
-use serde::Deserialize;
+use serde::{Deserialize, Serialize};
 use std::path;
 
-#[derive(Deserialize)]
+#[derive(Deserialize, Serialize)]
 pub struct Config {
     pub store_dir_path: path::PathBuf,
 }
diff --git a/src/origin/descr.rs b/src/origin/descr.rs
index a525a15..5cbd81b 100644
--- a/src/origin/descr.rs
+++ b/src/origin/descr.rs
@@ -6,7 +6,10 @@ use sha2::{Digest, Sha256};
 #[serde(tag = "kind")]
 /// A unique description of an origin, from where a domain might be served.
 pub enum Descr {
+    #[serde(rename = "git")]
     Git { url: String, branch_name: String },
+
+    #[serde(rename = "proxy")]
     Proxy { url: String },
 }
 
diff --git a/src/service/config.rs b/src/service/config.rs
index f8f11d2..7dc9ffc 100644
--- a/src/service/config.rs
+++ b/src/service/config.rs
@@ -24,7 +24,7 @@ impl From<ConfigDNSRecord> for domain::checker::DNSRecord {
     }
 }
 
-#[derive(Deserialize)]
+#[derive(Deserialize, Serialize)]
 pub struct Config {
     pub passphrase: String,
     pub dns_records: Vec<ConfigDNSRecord>,
diff --git a/src/service/http/config.rs b/src/service/http/config.rs
index 85cb5f0..491561f 100644
--- a/src/service/http/config.rs
+++ b/src/service/http/config.rs
@@ -1,11 +1,11 @@
-use serde::Deserialize;
+use serde::{Deserialize, Serialize};
 use std::{net, str::FromStr};
 
 fn default_http_addr() -> net::SocketAddr {
     net::SocketAddr::from_str("[::]:3030").unwrap()
 }
 
-#[derive(Deserialize)]
+#[derive(Deserialize, Serialize)]
 pub enum ConfigFormMethod {
     GET,
     POST,
@@ -35,7 +35,7 @@ impl AsRef<hyper::Method> for ConfigFormMethod {
     }
 }
 
-#[derive(Deserialize)]
+#[derive(Deserialize, Serialize)]
 pub struct Config {
     #[serde(default = "default_http_addr")]
     pub http_addr: net::SocketAddr,