apiVersion: v1
kind: ConfigMap
metadata:
  name: demo-caddy-config
  namespace: home-apps
data:
  Caddyfile: |
    # Caddy for Demo Service — internal server, TLS handled by Nginx Ingress
    
    :80 {
        log {
            output stdout
            format json
        }
    
        # ── Custom error pages (canvas animation, served directly by Caddy) ──
        handle_errors {
            @html_errors expression `{err.status_code} in [401, 403, 404]`
            handle @html_errors {
                root * /app/static
                rewrite * /error-page.html
                file_server
            }
        }
    
        # ── Root path: API handles auth (logged in → /admin, else → error page) ──
        handle_path / {
            reverse_proxy localhost:3000
        }

        # Management API → Python service
        handle /api/* {
            reverse_proxy localhost:3000 {
                header_up Host {host}
                header_up X-Forwarded-For "{http.request.header.X-Forwarded-For}, {remote_host}"
                header_up X-Forwarded-Proto https
            }
        }
    
        # Admin Web UI → Python service
        handle /admin {
            reverse_proxy localhost:3000
        }
        handle /admin/* {
            reverse_proxy localhost:3000
        }
    
        # ── Site content: API handles visibility + auth ──
        # Public sites served without auth; drafts require login
        handle {
            rewrite * /site-content{uri}
            reverse_proxy localhost:3000 {
                header_up Host {host}
                header_up X-Forwarded-For "{http.request.header.X-Forwarded-For}"
                header_up X-Forwarded-Proto https
                header_up Cookie {http.request.header.Cookie}
            }
        }
    
        header {
            X-Content-Type-Options nosniff
            X-Frame-Options SAMEORIGIN
            -Server
        }
    }