# Caddy reverse proxy: automatic HTTPS for the public site, app and billing.
# App-level accounts handle access; no basic auth here.

{$SITE_DOMAIN}, www.{$SITE_DOMAIN} {
	encode zstd gzip
	redir /privacy https://{$APP_DOMAIN}/privacy 302
	redir /terms https://{$APP_DOMAIN}/terms 302
	root * /srv/site
	file_server
	header {
		-Server
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "no-referrer"
		X-Frame-Options "DENY"
	}
}

{$APP_DOMAIN} {
	encode zstd gzip

	# Audio uploads can be large; cap request bodies at 40 MB.
	request_body {
		max_size 40MB
	}

	header {
		-Server
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
	}

	reverse_proxy harmonious:8000
}

{$BILLING_DOMAIN} {
	encode zstd gzip

	header {
		-Server
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
	}

	reverse_proxy billing:8090
}
