# SVOS front door on nh3-svos (eshpfi configs/svos-front/), 2026-10-05. Prime: mesh-only, svos.phasefinal.com.
# - Listens ONLY on the tailnet address (100.64.0.9:443). There is no LAN or internet listener and no :80 redirect server.
# - Cert: Let's Encrypt via Cloudflare DNS-01 with a phasefinal.com-only token (env CF_API_TOKEN, /etc/caddy/env).
# - Identity: every request goes through forward_auth to svos-whois-auth on 127.0.0.1:8405, which resolves the
#   SOCKET peer ({http.request.remote.host}:{port}; no trusted_proxies, so never a client header) with tailscaled
#   WhoIs and returns Tailscale-User-Login only for allow-listed logins. Fail closed (403) otherwise.
# - Client-supplied identity/forwarding headers are deleted BEFORE auth; the verified login is the only one sent.
#   reverse_proxy sets X-Forwarded-Proto=https and X-Forwarded-For itself; Host passes through; Origin untouched.
# - App side (svos-dev): kernel 127.0.0.1:8400 (/api/* with the prefix stripped, /api/health is the kernel's),
#   connector 127.0.0.1:8403 (/health, /verbs/ping|pins|pin|unpin, /openapi.json), static UI /opt/svos/current/static.
{
	email lkraven@lkraven.com
	auto_https disable_redirects
	admin localhost:2019
}

https://svos.phasefinal.com:443 {
	bind 100.64.0.9
	tls {
		dns cloudflare {env.CF_API_TOKEN}
		resolvers 1.1.1.1 8.8.8.8
	}
	route {
		request_header -Tailscale-User-Login
		request_header -Tailscale-User-Name
		request_header -Tailscale-User-Profile-Pic
		request_header -Tailscale-Headers-Info
		request_header -X-Forwarded-For
		request_header -X-Forwarded-Proto
		request_header -X-Forwarded-Host
		request_header -X-Real-IP
		request_header -Forwarded
		request_header -X-SVOS-Peer

		forward_auth 127.0.0.1:8405 {
			uri /auth
			header_up X-SVOS-Peer {http.request.remote.host}:{http.request.remote.port}
			copy_headers Tailscale-User-Login
		}

		handle_path /api/* {
			reverse_proxy 127.0.0.1:8400
		}
		@connector path /health /verbs/ping /verbs/pins /verbs/pin /verbs/unpin /openapi.json
		handle @connector {
			reverse_proxy 127.0.0.1:8403
		}
		handle {
			root * /opt/svos/current/static
			try_files {path} /index.html
			file_server
		}
	}
}