# Caddy v2 reverse proxy + static file server for the sanoptis_admin Reflex
# app. Caddy binds :8000 (the public port exposed by the Container App) and
# fronts the Reflex backend on localhost:8001.
#
# Routing contract:
#   - WebSocket events, ping, and upload endpoints go to the backend.
#   - Everything else (including /auth/callback) is served as the exported
#     Reflex SPA from /srv. The SPA then establishes a WebSocket via
#     /_event/* and the on_load handler for /auth/callback runs on the
#     backend, where it reads the OAuth code from the URL query params
#     (Reflex forwards router state across the WebSocket).
#
# The try_files chain serves {path}/index.html directly to avoid the 308
# directory redirect that would strip OAuth query parameters on the
# /auth/callback path — this is the same fix m365-extract uses.

:8000 {
    encode gzip

    header Permissions-Policy "unload=self"

    # Backend routes: Reflex WebSocket + upload endpoints, plus the
    # /api/* tree served by the FastAPI sub-app mounted on Reflex's
    # underlying app (POST /api/secrets/<plugin>/<name> returns the
    # decrypted secret to authorised plugin clients).
    @backend path /_event/* /ping /_upload /_upload/* /api/*
    handle @backend {
        reverse_proxy localhost:8001
    }

    root * /srv
    route {
        try_files {path} {path}/index.html {path}/ /index.html
        file_server
    }
}
