# Description: Caddy configuration for TLS termination.
# Description: Proxies HTTPS requests to the LM MCP server.

{$DOMAIN:localhost} {
    # Caddy terminates TLS only. Request authentication is enforced by the
    # server when LM_HTTP_AUTH_TOKEN is set: clients send
    # "Authorization: Bearer <token>" on /mcp and /api/v1/*, while / and
    # /health* stay open for probes.
    reverse_proxy lm-mcp:8080

    # Enable compression
    encode gzip

    # Add security headers
    header {
        X-Content-Type-Options nosniff
        X-Frame-Options DENY
        Referrer-Policy strict-origin-when-cross-origin
    }

    # Health check passthrough
    handle /health* {
        reverse_proxy lm-mcp:8080
    }
}
