# TheLink-Spot Caddyfile — Reverse Proxy / TLS Termination
# Uses Caddy's internal CA for self-signed certs (no external CA needed).
# All services are proxied through Caddy on the LAN; no direct port access needed.

# ─── Internal domain (self-signed TLS via Caddy internal CA) ──
{$TLS_INTERNAL_DOMAIN} {
	# Set TLS to internal CA (self-signed, trusted on LAN after installing root cert)
	tls internal

	# ─── Keycloak (SSO / Identity) ────────────────────────────
	handle /auth/* {
		reverse_proxy keycloak:8080
	}

	# ─── Grafana (Monitoring Dashboards) ──────────────────────
	handle /grafana/* {
		reverse_proxy grafana:3000
	}

	# ─── MinIO Console (Object Storage UI) ────────────────────
	handle /minio/* {
		uri strip_prefix /minio
		reverse_proxy minio:9001
	}

	# ─── NATS Monitoring ─────────────────────────────────────
	handle /nats/* {
		reverse_proxy nats:8222
	}

	# ─── Prometheus ──────────────────────────────────────────
	handle /prometheus/* {
		uri strip_prefix /prometheus
		reverse_proxy prometheus:9090
	}

	# ─── TheLink-Spot Web UI (uncomment when built) ───────────
	# handle /* {
	# 	reverse_proxy web:80
	# }

	# ─── TheLink-Spot API (uncomment when built) ─────────────
	# handle /api/* {
	# 	uri strip_prefix /api
	# 	reverse_proxy api:3001
	# }

	# Security headers
	header {
		X-Content-Type-Options nosniff
		X-Frame-Options DENY
		Referrer-Policy strict-origin-when-cross-origin
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
	}

	# Access log to Loki
	log {
		output stdout
		format json
	}
}

# ─── If you have a real domain (uncomment and configure) ──────
# {$TLS_REAL_DOMAIN} {
# 	tls /data/caddy/cert.pem /data/caddy/key.pem
#
# 	handle /auth/* {
# 		reverse_proxy keycloak:8080
# 	}
# 	handle /grafana/* {
# 		reverse_proxy grafana:3000
# 	}
# 	handle /* {
# 		reverse_proxy web:80
# 	}
# }
