# Caddy config for inoreader-mcp. Deployed via compose.yml.
#
# Set INOREADER_MCP_PUBLIC_HOST to the public DNS name and
# INOREADER_MCP_LETSENCRYPT_EMAIL to the contact email; Caddy provisions
# a Let's Encrypt cert automatically.

{
    email {$INOREADER_MCP_LETSENCRYPT_EMAIL}
}

{$INOREADER_MCP_PUBLIC_HOST} {
    encode zstd gzip

    # Proxy everything to the app container. Trust the X-Forwarded-* headers
    # we set so Starlette sees the real host/proto when emitting OAuth
    # discovery + redirect URIs.
    reverse_proxy app:8765 {
        header_up X-Forwarded-Host {host}
        header_up X-Forwarded-Proto {scheme}
    }

    # Health endpoint (no auth required at the proxy level — anyone hitting
    # this just learns Caddy is up).
    @health path /healthz
    respond @health 200
}
