# Caddy 2.x — Reverse-Proxy für das Cockpit.
# Lokal: http://localhost
# Produktion: cockpit.tool-ctrl.de

{$COCKPIT_HOST:cockpit.tool-ctrl.de} {
	encode zstd gzip

	# /internal/* darf nur über das interne Netz erreichbar sein.
	@internal path /internal/*
	respond @internal 403

	# API + tRPC → Backend
	@api path /api/* /trpc/*
	reverse_proxy @api api:3000

	# Static frontend
	root * /srv
	try_files {path} /index.html
	file_server

	# Security-Headers (CSP wird in Story 6.x feinjustiert)
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "camera=(), microphone=(), geolocation=()"
		-Server
	}
}