(proxy_common) {
	header_up X-Forwarded-Proto https
	header_up X-Forwarded-Port 443

	transport http {
		keepalive 30s
	}
}

vpn.example.com {
	# Live event streams used by nodes and the admin UI: disable buffering so
	# speedtest progress and node events reach users in real time.
	@sse path_regexp sse ^(?:/api/nodes/events|/api/wireguard/speedtest/run/stream/[^/]+|/api/nodes/[^/]+/speedtest/stream)$
	reverse_proxy @sse localhost:8000 {
		import proxy_common
		flush_interval -1
	}

	# Default reverse proxy
	reverse_proxy localhost:8000 {
		import proxy_common
	}

	# Compression
	encode gzip

	# Cache static assets (1 year)
	@static path /static/*
	header @static Cache-Control "public, max-age=31536000, immutable"

	# Security headers
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		X-Content-Type-Options nosniff
		X-Frame-Options SAMEORIGIN
		Referrer-Policy strict-origin-when-cross-origin
		-Server
		-X-Powered-By
	}

	# Request body limit
	request_body {
		max_size 100MB
	}

	# Logging
	log {
		output file /var/log/caddy/access.log {
			roll_size 10mb
		}
	}
}