# pewpewstudio's front: the SPA at /, /api/* to the backend with the prefix STRIPPED (the backend has no /api routes and
# no CORS, so both must be one origin). The backend's TrustedHost accepts localhost, so Host is rewritten to it.
# No request-body cap here: asset uploads are capped at 32 MB by the app itself. LAN/mesh only, no auth in v1.
:80 {
	encode zstd gzip
	# `route` keeps this literal order; outside it Caddy sorts `respond` AFTER handle/handle_path, and the Host check
	# would never run (measured: a foreign Host got 200 before this was a route).
	route {
		# Keep the backend's TrustedHost meaning (DNS-rebinding defence): the proxy rewrites Host to localhost below,
		# so it must refuse any Host the app would refuse. Add a name here when one is published for it.
		@foreign not host 10.100.50.40 nh3-docker.nh3.internal
		respond @foreign 400
		handle_path /api/* {
			reverse_proxy api:8000 {
				header_up Host localhost
			}
		}
		root * /srv
		file_server
	}
}