# Caddy reverse proxy for volunteer hub
#
# - Auto-TLS via Let's Encrypt (just point DNS at this server)
# - Only read-only paths are exposed to the public internet
# - Write methods (POST/PUT/PATCH/DELETE) are rejected at the proxy layer
#   before they reach the backend; the server's ReadOnlyMiddleware
#   provides a second layer of protection
# - Domain is injected by the provision script via HUB_DOMAIN env var

{env.HUB_DOMAIN} {
    # Block all write methods at the proxy — return a friendly message
    @write method POST PUT PATCH DELETE
    handle @write {
        respond "Read-only hub. Submit tasks via the CLI: https://github.com/get-bernstein/bernstein" 405
    }

    # Proxy read-only paths to the internal hub
    @public path /dashboard /dashboard/* /events /health /status /tasks /tasks/* /agents /agents/*
    handle @public {
        reverse_proxy bernstein-hub:8053 {
            header_up X-Forwarded-Proto {scheme}
        }
    }

    # Root redirect → dashboard
    handle / {
        redir /dashboard permanent
    }

    # Anything else → 404 (don't expose internal API endpoints like /a2a, /cluster)
    handle {
        respond 404
    }

    # Compress responses
    encode gzip

    log {
        output stderr
        format console
    }
}
