# ===========================================================================
# Caddyfile - the public HTTPS edge of Huanghua Online
#
# Only this process listens on the internet (80 and 443). Nomad, the Agent,
# GameWorld, the account and operator APIs and the observatory all stay on
# loopback. The admin panel is refused here and also checks the host itself.
# Certificates come from Let's Encrypt and renew automatically.
#
# The game's /api and the site's /api are different services, so they live
# on separate hosts: the site on the bare name, the game on play.
# ===========================================================================

{
	# No local configuration API: nothing but this file changes the edge.
	admin off
	log {
		output file D:/opensro/launcher/logs/caddy.log {
			roll_size 10mb
			roll_keep 3
		}
		level WARN
	}
}

(security_headers) {
	header {
		Strict-Transport-Security "max-age=86400"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "strict-origin-when-cross-origin"
		-Server
	}
}

huanghua.duckdns.org {
	import security_headers
	encode zstd gzip

	@admin path /admin /admin/* /admin.html /admin.js /editor.js /picker.js /api/admin /api/admin/*
	respond @admin 404

	reverse_proxy 127.0.0.1:8080
}

play.huanghua.duckdns.org {
	import security_headers

	handle /api/* {
		route {
			@private_api path /api/development/* /api/debug/* /api/internal/*
			respond @private_api 404
			uri strip_prefix /api
			reverse_proxy 127.0.0.1:8787
		}
	}

	handle /shards/global-official/transport/* {
		uri strip_prefix /shards/global-official
		reverse_proxy 127.0.0.1:8788
	}

	# The page and its hashed bundles.
	@page path / /index.html
	handle @page {
		header Cache-Control "no-cache"
		root * D:/opensro/apps/client-next/temp/artifacts/dist
		rewrite * /index.html
		file_server
	}

	@bundle file {
		root D:/opensro/apps/client-next/temp/artifacts/dist
	}
	handle @bundle {
		root * D:/opensro/apps/client-next/temp/artifacts/dist
		file_server
	}

	# Everything else is published game data. Never compress the packs here:
	# they are read with Range requests and carry their own gzip.
	handle {
		root * D:/opensro/.generated/client-public
		file_server {
			precompressed gzip
		}
	}
}
