# Caddy fronts the whole Hephaestus stack.
#
# TWO HOSTNAMES:
#   code.silentmode.st   Traditional DNS + Let's Encrypt HTTP-01 cert. Same as before.
#   hephaestus.x         BCNR name (chipnet). TLS cert issued by Silent Mode's own
#                        root CA (Argonautica) — trusted by Theseus/Ariadne users;
#                        other browsers see a self-signed-style warning. hephaestus.x
#                        also serves static content from /srv/hephaestus.x/* (the
#                        landing pages) BEFORE falling through to Forgejo, so
#                        marketing/docs pages don't get eaten by Forgejo's routes.
#
# ROUTING (both hostnames):
#   /auth/*       → auth-proxy container (prefix stripped)
#   /             → Forgejo container    (with per-hostname behaviour below)
#
# {$SITE_HOSTNAME} comes from docker-compose .env (SITE_HOSTNAME=code.silentmode.st).

# --- code.silentmode.st: unchanged from before ---
{$SITE_HOSTNAME} {
    encode gzip zstd

    handle_path /auth/* {
        reverse_proxy auth-proxy:4000
    }

    # Make BCH-wallet login the DEFAULT for /user/login. Old-school
    # username/password stays reachable via `/user/login?password=1`
    # (unmatched by this rule; falls through to Forgejo).
    @plain_login {
        path /user/login
        not query password=1
    }
    redir @plain_login /user/oauth2/hephaestus-wallet 302

    handle {
        reverse_proxy forgejo:3000
        request_body {
            max_size 2GB
        }
    }
}

# --- hephaestus.x: static-first, Forgejo-fallback, Silent Mode CA cert ---
hephaestus.x {
    encode gzip zstd

    # TLS cert from Silent Mode's Argonautica CA (name-constrained to permitted TLDs).
    # Theseus + Ariadne users have this CA in their trust store per the setup docs.
    tls /etc/caddy/certs/hephaestus.x.crt /etc/caddy/certs/hephaestus.x.key

    handle_path /auth/* {
        reverse_proxy auth-proxy:4000
    }

    # Same wallet-login-as-default as code.silentmode.st. Old-school
    # password login still reachable via /user/login?password=1.
    @plain_login {
        path /user/login
        not query password=1
    }
    redir @plain_login /user/oauth2/hephaestus-wallet 302

    # Static-file-first, Forgejo-fallback. If /srv/hephaestus.x/{path} (or {path}/index.html)
    # exists, serve it. Otherwise the request falls through to Forgejo so all git/api/user
    # routes still work.
    root * /srv/hephaestus.x
    @static file {path} {path}index.html {path}/index.html
    handle @static {
        try_files {path} {path}index.html {path}/index.html
        file_server
    }
    handle {
        reverse_proxy forgejo:3000
        request_body {
            max_size 2GB
        }
    }
}