# Caddy reverse proxy — BNS/self-signed variant.
# TLS uses an on-disk cert whose SHA-256 is pinned on-chain (@dgb-wallet/bns).
# No ACME, no Let's Encrypt, no domain validation.
#
# Tokens replaced by ops/setup.sh:
#   @BNS_NAME@   the BNS name (e.g. rpc.dgb)
#   @CERT_FILE@  path to server.crt
#   @KEY_FILE@   path to server.key

{
    auto_https off
}

:443 {
    tls @CERT_FILE@ @KEY_FILE@

    encode zstd gzip

    header {
        Cache-Control "no-store"
        X-Content-Type-Options "nosniff"
        Referrer-Policy "no-referrer"
        -Server
    }

    # Rate limit — 60 requests/min per IP. Requires caddy-ratelimit plugin.
    # (Kept as a rate_limit block; if caddy is compiled without the plugin,
    # comment this block out and rely on Core's rpcworkqueue + fail2ban.)
    # rate_limit {
    #     zone rpc_zone {
    #         key {client.ip}
    #         events 60
    #         window 1m
    #     }
    # }

    @not_post {
        not method POST
    }
    respond @not_post "Method Not Allowed" 405

    reverse_proxy 127.0.0.1:14022 {
        header_up Host {host}
        header_up X-Real-IP {remote}
        header_up X-Forwarded-For {remote}
        header_up X-Forwarded-Proto {scheme}
        transport http {
            keepalive 30s
            keepalive_idle_conns 8
        }
    }

    log {
        output stdout
        format json
        level INFO
    }
}