# Preview-grade TLS termination for a single-node Vinctor deployment.
# For localhost, Caddy uses a local CA. For a public hostname, Caddy attempts
# normal ACME certificate issuance. Keep vinctor-service behind this proxy.

{$VINCTOR_PREVIEW_HOSTNAME:localhost} {
	# Cap request bodies at the proxy. Legitimate Vinctor bodies are tiny JSON;
	# this matches the server-side MAX_BODY_BYTES (64 KiB) defense-in-depth.
	request_body {
		max_size 64KB
	}
	reverse_proxy vinctor:8765
}
