# Sotto Caddy site fragment template.
# Rendered by scripts/deploy.sh to /etc/caddy/conf.d/<stack>.conf
# (sotto.conf for the primary stack). The shared /etc/caddy/Caddyfile must
# import /etc/caddy/conf.d/*.
#
# Blue-green deploy: both slots listed, Caddy auto-routes to whichever is healthy.
# During normal operation only one slot is up. During transitions both are briefly up.
#
# Optional-block markers must stay at column 0 — deploy.sh matches them exactly.

__SOTTO_APP_DOMAIN__ {
	reverse_proxy localhost:__SOTTO_WEB_PORT_BLUE__ localhost:__SOTTO_WEB_PORT_GREEN__ {
		lb_policy first
		health_uri /api/v1/health
		health_interval 5s
		health_timeout 10s
		health_status 200
	}

	encode gzip zstd

	# Transport-level headers only — Next.js owns per-route CSP, X-Frame-Options,
	# Permissions-Policy, X-Content-Type-Options, and Referrer-Policy via headers()
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		-Server
	}

	# Cache static assets
	@static path /fonts/* /_next/static/* /favicon.ico /manifest.json /sw.js
	header @static Cache-Control "public, max-age=31536000, immutable"

	log {
		output file /var/log/caddy/__SOTTO_STACK__-access.log {
			roll_size 50MiB
			roll_keep 5
		}
	}
}

# BEGIN_OPTIONAL_WWW
__SOTTO_WWW_DOMAIN__ {
	# Telegram webhook — proxy directly when a deployment registers webhooks on the www host.
	handle /api/v1/telegram/webhook {
		reverse_proxy localhost:__SOTTO_WEB_PORT_BLUE__ localhost:__SOTTO_WEB_PORT_GREEN__ {
			lb_policy first
			health_uri /api/v1/health
			health_interval 5s
			health_timeout 10s
			health_status 200
		}
	}

	# Everything else redirects to apex
	handle {
		redir https://__SOTTO_APP_DOMAIN__{uri} permanent
	}
}
# END_OPTIONAL_WWW