# Snippet — merge into whatever Caddyfile already serves digibyte.x.
# Meant for the layout "wallet lives at /web/, other content owns /".
#
# The two `handle_path` blocks are order-sensitive: /p2p/* MUST come
# BEFORE /web/* so daemon traffic never falls into the SPA fallback.
#
# Tokens replaced by ops/deploy-wallet-web.sh (or by hand):
#   @SITE_ROOT@   filesystem path to the deployed dist/ bundle
#                 (dist/ is a plain production build: relative
#                 <script src="./assets/…"> plus an inline runtime
#                 <base href="<origin>/web/"> fix in index.html, so
#                 assets resolve to /web/assets/… under this path)

# --- START DGB WALLET SNIPPET ---

# /p2p/* → local dgb-daemon. Strip the prefix so daemon sees
# /health, /balance, /broadcast at the roots it registered.
handle_path /p2p/* {
    reverse_proxy 127.0.0.1:5174 {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        transport http {
            keepalive 30s
            keepalive_idle_conns 4
        }
    }
}

# /web/* → static wallet SPA. Note: NOT handle_path — we keep the
# /web prefix so Vite's asset URLs (built with base=/web/) resolve.
handle /web/* {
    root * @SITE_ROOT@
    # SPA fallback — any unknown /web path serves the index; the tab
    # switcher is entirely client-side so no server routing to break.
    try_files {path} /web/index.html
    file_server

    header {
        Cache-Control "no-store"
        X-Content-Type-Options "nosniff"
        Referrer-Policy "no-referrer"
        Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; frame-ancestors 'none'"
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
        -Server
    }

    @assets path /web/assets/*
    header @assets Cache-Control "public, max-age=31536000, immutable"
}

# --- END DGB WALLET SNIPPET ---