# KHUB reverse proxy.
#
# Local/dev (default): plain HTTP on :80 inside the container, mapped to
# ${HTTP_PORT} on the host (see docker-compose.yml / .env). Visit
# http://localhost:8080 (or http://khub.local:8080 if you add a hosts entry).
#
# Production: replace the `:80` site address below with your real domain
# (e.g. `khub.example.com`) and Caddy will automatically provision and
# renew a Let's Encrypt TLS certificate — no other changes needed.

:80 {
	encode gzip zstd

	# Git smart-HTTP (clone/fetch/push) and the REST API both live on the
	# API service; everything else is the Next.js frontend.
	@backend path /api/* /git/*
	handle @backend {
		reverse_proxy api:4000 {
			# Large pushes/pulls stream pack data — don't buffer it.
			flush_interval -1
		}
	}

	handle {
		reverse_proxy web:3000
	}

	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
	}

	log {
		output stdout
		format console
	}
}
