# Knovaryn reverse-proxy Caddyfile (spec WP K2).
# Terminates (or passes through) TLS and routes to the api service.
:80 {
    # Plain HTTP behind an ingress/TLS terminator. To terminate TLS here,
    # replace `:80` with your FQDN (e.g. `knovaryn.example.com`) and Caddy
    # will obtain certificates automatically.

    # REST + JSON surface — `handle_path` strips the /api prefix so
    # /api/v1/projects reaches the API as /v1/projects (defect 4.11: plain
    # `handle /api/*` forwarded the prefix and 404'd every REST route).
    handle_path /api/* {
        reverse_proxy api:8000
    }

    # Console + static assets
    handle {
        reverse_proxy api:8000
    }

    # Deny common probes/crawlers explicitly rather than serving them
    @blocked {
        path /proc/* /etc/* /var/* /admin
    }
    handle @blocked {
        respond 403
    }

    header {
        # Baseline security headers on every response
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        Referrer-Policy no-referrer
        -Server
    }

    encode gzip
}
