# Caddy for Demo Service — internal server, TLS handled by Nginx Ingress

:80 {
    log {
        output stdout
        format json
    }

    # ── Custom error pages (canvas animation, served directly by Caddy) ──
    handle_errors {
        @html_errors expression `{err.status_code} in [401, 403, 404]`
        handle @html_errors {
            root * /app/static
            rewrite * /error-page.html
            file_server
        }
    }

    # Management API → Python service
    handle /api/* {
        reverse_proxy localhost:3000 {
            header_up Host {host}
            header_up X-Forwarded-For {remote_host}
            header_up X-Forwarded-Proto https
        }
    }

    # Admin Web UI → Python service
    handle /admin {
        reverse_proxy localhost:3000
    }
    handle /admin/* {
        reverse_proxy localhost:3000
    }

    # ── Site content: API handles visibility + auth ──
    # Public sites served without auth; drafts require login
    handle {
        rewrite * /site-content{uri}
        reverse_proxy localhost:3000 {
            header_up Host {host}
            header_up X-Forwarded-For {remote_host}
            header_up X-Forwarded-Proto https
            header_up Cookie {http.request.header.Cookie}
        }
    }

    header {
        X-Content-Type-Options nosniff
        X-Frame-Options SAMEORIGIN
        -Server
    }
}
