# Production Caddyfile - rhomev1.duckdns.org wildcard
# All internal services bind 0.0.0.0 on host, Caddy proxies via 172.19.0.1 (docker gateway)

# ===== PUBLIC SERVICES (no auth) =====
atlasv9.duckdns.org {
    @api {
        path /docs*
        path /openapi.json
        path /health*
        path /api/*
    }
    reverse_proxy @api api:8000
    reverse_proxy frontend:3000
    encode gzip
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' ws: wss:"
    }
    log {
        output file /var/log/caddy/access.log
        format json
    }
}

# HTTP to HTTPS redirect for atlas
http://atlasv9.duckdns.org {
    redir https://{host}{uri} permanent
}
http://dpv1.duckdns.org {
    redir https://{host}{uri} permanent
}

# ===== INTERNAL SERVICES =====

# Hermes WebUI
hermes.rhomev1.duckdns.org {
    reverse_proxy 172.19.0.1:8787
    encode gzip
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
    }
}

# Hermes Dashboard (own auth - no basic_auth)
hermesv2.rhomev1.duckdns.org {
    reverse_proxy 172.19.0.1:9119
    encode gzip
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
    }
}

# Hermes Dashboard - hrmsv1
hrmsv1.duckdns.org {
    reverse_proxy 172.19.0.1:9119
    encode gzip
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
    }
}

# HTTP to HTTPS redirect for hrmsv1
http://hrmsv1.duckdns.org {
    redir https://{host}{uri} permanent
}

# opencode (own auth - no basic_auth)
opencode.rhomev1.duckdns.org {
    reverse_proxy 172.19.0.1:4096
    encode gzip
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
    }
}

# 9router
9router.rhomev1.duckdns.org {
    reverse_proxy 172.19.0.1:20129
    encode gzip
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
    }
}

# File Browser — menggunakan autentikasi internal aplikasi
file.rhomev1.duckdns.org {
    reverse_proxy 172.19.0.1:8080
    encode gzip
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
    }
}

# Nextcloud — menggunakan autentikasi internal aplikasi
nxc.rhomev1.duckdns.org {
    reverse_proxy app-nextcloud:80
    encode gzip
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
    }
}

# Hermes Workspace (own auth - HERMES_PASSWORD login page)
workspace.rhomev1.duckdns.org {
    reverse_proxy 172.19.0.1:3010
    encode gzip
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
    }
}

# Meridian Dashboard (own auth - DASHBOARD_PASSWORD_HASH Basic Auth)
meridian.rhomev1.duckdns.org {
    reverse_proxy 172.19.0.1:3001
    encode gzip
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
    }
}

# HTTP to HTTPS redirect for workspace
http://workspace.rhomev1.duckdns.org {
    redir https://{host}{uri} permanent
}

# Alterlife (disabled for now - uncomment when needed)
# alter.rhomev1.duckdns.org {
#     import basic_auth_internal
#     reverse_proxy 172.19.0.1:XXXX
#     encode gzip
# }

# HTTP to HTTPS redirect for internal subdomains
http://hermes.rhomev1.duckdns.org {
    redir https://{host}{uri} permanent
}
http://hermesv2.rhomev1.duckdns.org {
    redir https://{host}{uri} permanent
}
http://opencode.rhomev1.duckdns.org {
    redir https://{host}{uri} permanent
}
http://9router.rhomev1.duckdns.org {
    redir https://{host}{uri} permanent
}
http://alter.rhomev1.duckdns.org {
    redir https://{host}{uri} permanent
}

# ===== MERIDIAN EDITION (fork Masrama98/hermes-webui) =====
# Hermes WebUI v3 — custom fork, own state dir, does NOT touch :8787
hermesv3.rhomev1.duckdns.org {
    reverse_proxy 172.19.0.1:8789
    encode gzip
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
    }
}

http://hermesv3.rhomev1.duckdns.org {
    redir https://{host}{uri} permanent
}