# Caddy fronts the whole Hephaestus stack.
# - Automatic Let's Encrypt cert for code.silentmode.st (HTTP-01 challenge on :80)
# - Path-based routing:
#     /auth/* → auth-proxy container (prefix stripped before forwarding)
#     /       → Forgejo container
# - HTTPS-only for browser traffic; SSH git access stays on port 2222 outside Caddy.
#
# {$SITE_HOSTNAME} is provided by docker-compose from .env (SITE_HOSTNAME).

{$SITE_HOSTNAME} {
    encode gzip zstd

    # Auth-proxy under /auth/*. handle_path STRIPS the /auth prefix before proxying,
    # so /auth/challenge upstream is just /challenge on auth-proxy.
    handle_path /auth/* {
        reverse_proxy auth-proxy:4000
    }

    # Everything else → Forgejo. Big body size so git push + LFS + release uploads work.
    handle {
        reverse_proxy forgejo:3000
        request_body {
            max_size 2GB
        }
    }
}