# Production Caddyfile for the VM (/opt/musicstack/Caddyfile). This file is the source of
# truth; copy it up and `docker exec caddy caddy reload` rather than editing it in place.
#
# Three sites, and each one is deliberate:
#
#   chough.app                     the website. Static files only, no proxy to the app.
#   api.chough.app                 the app server. Everything the phone talks to.
#   {$CHOUGH_HOST}                 the old sslip.io host, kept alive so an app installed
#                                  before the api.chough.app switch can still reach
#                                  /api/app/latest and update itself. Retire it once every
#                                  phone reports the newer versionCode.
#
# chough.app is Cloudflare-proxied and the zone is in SSL mode "full", so Cloudflare
# connects to this origin over HTTPS; Caddy's own Let's Encrypt cert satisfies it and the
# HTTP-01 challenge passes through the proxy. api.chough.app is NOT proxied.

chough.app {
	root * /srv/site
	file_server
	encode zstd gzip

	header {
		# The page is entirely self-contained: inline CSS, inline SVG, local images, and
		# no JavaScript at all. The policy says exactly that, so a stray third-party
		# request or injected script cannot load.
		Content-Security-Policy "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
		Referrer-Policy no-referrer
		X-Content-Type-Options nosniff
		Strict-Transport-Security "max-age=31536000"
	}
}

api.chough.app {
	reverse_proxy chough:8080
}

{$CHOUGH_HOST} {
	reverse_proxy chough:8080
}
