# TLS termination and reverse proxy for the coordinator.
# Caddy obtains and renews the Let's Encrypt certificate automatically
# (needs public ports 80 and 443). install.sh substitutes the hostname.

{
	admin off
	# The ACME account: expiry notices, and ZeroSSL (the fallback issuer) requires one.
	email admin@clank.rodecomp.online
}

clank.rodecomp.online {
	encode gzip

	# Who requested what and how many bytes went out (to tell heavy downloads from abuse).
	log {
		output file /var/log/caddy/access.log {
			roll_size 50MiB
			roll_keep 5
		}
		format json
	}

	header {
		Strict-Transport-Security "max-age=31536000"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "no-referrer"
		Permissions-Policy "interest-cohort=()"
		-Server
	}

	request_body {
		max_size 8MB
	}

	# Git dashboard (Forgejo), configured with ROOT_URL https://<host>/git/.
	redir /git /git/ 308
	handle_path /git/* {
		reverse_proxy 127.0.0.1:3000
	}

	handle {
		reverse_proxy 127.0.0.1:8080
	}
}


# The test instance (togetherdecomp-test, deploy with tools/deploy.sh --test): its own coordinator
# and data; changes are tried here before they go to the main site.
test.clank.rodecomp.online {
	encode gzip

	log {
		output file /var/log/caddy/test-access.log {
			roll_size 50MiB
			roll_keep 3
		}
		format json
	}

	header {
		Strict-Transport-Security "max-age=31536000"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "no-referrer"
		Permissions-Policy "interest-cohort=()"
		-Server
	}

	request_body {
		max_size 8MB
	}

	handle {
		reverse_proxy 127.0.0.1:8090
	}
}