{
	email lkraven@lkraven.com
	# Own admin port (2026-10-10). ttyd-caddy (stock caddy, ~/.config/caddy) also binds localhost:2019 and both sockets
	# use SO_REUSEPORT, so a `reload` on 2019 landed on EITHER instance: this config was rejected by the stock binary
	# (no cloudflare module), and ttyd's valid config could have replaced this one. ExecReload reads this address.
	admin localhost:2021
}

# Fleet internal TLS — caddy is the WILDCARD CERT AUTHORITY for *.nh3.phasefinal.com
# (publicly-trusted LE via Cloudflare DNS-01, renewed automatically). Consumers:
#   * self-terminate with a copy of this cert (talk: ~/talk/certs, kept fresh by
#     fleet-tls-cert-check.timer), OR
#   * front here via a reverse_proxy handle block on @<tool> host <tool>.nh3.phasefinal.com
*.nh3.phasefinal.com {
	tls {
		dns cloudflare {env.CF_API_TOKEN}
		resolvers 1.1.1.1 8.8.8.8
	}
	# Scriberr (fv-ml1:8080, plain HTTP). Fronted so the browser recorder gets a SecureContext:
	# getUserMedia is refused on http:// origins ("Failed to initialize recorder"). 2026-10-01.
	# Scriberr's ALLOWED_ORIGINS must list this name (fv-ml1 /opt/docker/compose/scriberr/.env).
	@scriberr host scriberr.nh3.phasefinal.com
	handle @scriberr {
		reverse_proxy 10.251.50.54:8080 {
			flush_interval -1
		}
	}
	# SVOS U13 (2026-10-10, Prime-approved; svoperatingsystem docs/operations/u13-svos-edit.md "Before the edit" 2,
	# svos docs/u13-cutover-runbook.md B3/B4). Two app origins on nh3-dev's LOOPBACK, reachable only from nh3-svos
	# (10.100.50.43), whose kernel signs every call it makes to them. Until each app runs (the U13 edit) they answer 502.
	# - svos-seathost: app-terminal, which moves to nh3-dev at the edit (svos-terminal, listener 127.0.0.1:8404).
	#   The kernel's instance.toml names this as app-terminal's base_url. No buffering (the app has long-lived routes).
	# - svos-highseat: app-high-seat, the High Seat's signed-only listener (127.0.0.1:8773, enabled at the edit's E1).
	@svos_seathost host svos-seathost.nh3.phasefinal.com
	handle @svos_seathost {
		@not_nh3_svos not remote_ip 10.100.50.43
		handle @not_nh3_svos {
			respond 403
		}
		handle {
			reverse_proxy 127.0.0.1:8404 {
				flush_interval -1
			}
		}
	}
	# - svos-miranda: app-miranda (svos-miranda 0.0.3, 127.0.0.1:8408), beside the Hermes gateway it calls on loopback;
	#   added 2026-10-10 per svoperatingsystem dc241f8 u13-svos-edit.md item 4. Not started before the edit.
	@svos_miranda host svos-miranda.nh3.phasefinal.com
	handle @svos_miranda {
		@not_nh3_svos not remote_ip 10.100.50.43
		handle @not_nh3_svos {
			respond 403
		}
		handle {
			reverse_proxy 127.0.0.1:8408
		}
	}
	@svos_highseat host svos-highseat.nh3.phasefinal.com
	handle @svos_highseat {
		@not_nh3_svos not remote_ip 10.100.50.43
		handle @not_nh3_svos {
			respond 403
		}
		handle {
			reverse_proxy 127.0.0.1:8773
		}
	}
	handle {
		respond "nh3 fleet TLS authority — no tool fronted here (talk self-terminates on :8092)" 404
	}
}