# Caddyfile for hivemind services
# - registry.hivemind.rithul.dev: API + Web (reverse proxy)
# - hivemind.rithul.dev: Docs (static files)

# ── Registry ─────────────────────────────────────────────────────────────

registry.hivemind.rithul.dev {
    # Block external access to internal endpoints.
    handle /internal/* {
        respond "Not Found" 404
    }

    handle /api/* {
        reverse_proxy api:8080
    }
    handle /simple/* {
        reverse_proxy api:8080
    }
    handle /health {
        reverse_proxy api:8080
    }
    handle /ready {
        reverse_proxy api:8080
    }
    handle {
        reverse_proxy web:3000
    }

    header {
        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        Referrer-Policy strict-origin-when-cross-origin
        Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
        Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https://api.github.com https://registry.hivemind.rithul.dev"
        -Server
    }

    log {
        output file /var/log/caddy/access.log
        format json
    }
}

# ── Docs ─────────────────────────────────────────────────────────────────

hivemind.rithul.dev {
    root * /srv/docs
    file_server

    # SPA fallback for Docusaurus client-side routing
    try_files {path} /index.html

    # Cache static assets aggressively
    @assets path /assets/* /img/*
    header @assets Cache-Control "public, max-age=31536000, immutable"

    header {
        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        Referrer-Policy strict-origin-when-cross-origin
        -Server
    }

    log {
        output file /var/log/caddy/docs-access.log
        format json
    }
}
