# Caddy reverse proxy for the DGB RPC backend.
# Terminates TLS via Let's Encrypt. Proxies to Core RPC on localhost:14022.
# Rate-limits per client IP. Forwards Authorization header for Core basic auth.
#
# The @DOMAIN@ token is substituted by setup.sh.

@DOMAIN@ {
    encode zstd gzip

    # Basic security hardening for the endpoint
    header {
        # No caching of RPC responses
        Cache-Control "no-store"
        # Disable browser MIME sniffing
        X-Content-Type-Options "nosniff"
        # No referrer bleed
        Referrer-Policy "no-referrer"
        # Strict transport security (2 years)
        Strict-Transport-Security "max-age=63072000; includeSubDomains"
        # Remove server identification
        -Server
    }

    # Rate limit — 60 requests per minute per IP, per remote endpoint.
    # Requires github.com/mholt/caddy-ratelimit plugin.
    rate_limit {
        zone rpc_zone {
            key {client.ip}
            events 60
            window 1m
        }
    }

    # Only POST (JSON-RPC). Reject everything else.
    @not_post {
        not method POST
    }
    respond @not_post "Method Not Allowed" 405

    # Proxy JSON-RPC to Core. Basic-auth is passed through unchanged;
    # Core validates rpcuser/rpcpassword against digibyte.conf.
    reverse_proxy 127.0.0.1:14022 {
        header_up Host {host}
        header_up X-Real-IP {remote}
        header_up X-Forwarded-For {remote}
        header_up X-Forwarded-Proto {scheme}
        transport http {
            keepalive 30s
            keepalive_idle_conns 8
        }
    }

    # Structured access log; journalctl -u caddy
    log {
        output stdout
        format json
        level INFO
    }
}