# Caddy for Demo Service — internal server, TLS handled by Nginx Ingress

:80 {
    log {
        output stdout
        format json
    }

    # ── Custom error pages (canvas animation, served directly by Caddy) ──
    handle_errors {
        @html_errors expression `{err.status_code} in [401, 403, 404]`
        handle @html_errors {
            root * /app/static
            rewrite * /error-page.html
            file_server
        }
    }

    # Management API → Python service
    handle /api/* {
        reverse_proxy localhost:3000 {
            header_up Host {host}
            header_up X-Forwarded-For {remote_host}
            header_up X-Forwarded-Proto https
        }
    }

    # Admin Web UI → Python service
    handle /admin {
        reverse_proxy localhost:3000
    }
    handle /admin/* {
        reverse_proxy localhost:3000
    }

    # Root → redirect to admin
    handle / {
        reverse_proxy localhost:3000
    }

    # Static demo sites — public, no auth
    handle_path /* {
        root * /data/demos
        file_server {
            index index.html
        }
    }

    header {
        X-Content-Type-Options nosniff
        X-Frame-Options SAMEORIGIN
        -Server
    }
}
