{$PUBLIC_WEB_HOST:localhost} {
    handle /app-html/* {
        reverse_proxy abi:9879 {
            header_up X-Forwarded-Proto {scheme}
            header_up X-Forwarded-Host {host}
        }
    }
    handle {
        reverse_proxy nexus-web:3000 {
            header_up X-Forwarded-Proto {scheme}
            header_up X-Forwarded-Host {host}
        }
    }
}

{$PUBLIC_API_HOST:api.localhost} {
    reverse_proxy abi:9879 {
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
    }
}

{% if INCLUDE_HEADSCALE %}
{$HEADSCALE_SERVER_URL:headscale.localhost} {
    reverse_proxy headscale:8080 {
        header_up X-Forwarded-Proto {scheme}
    }
}
{% endif %}

graph-explorer.{$PUBLIC_WEB_HOST:localhost} {
    @allowed remote_ip 127.0.0.1/32 ::1/128 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 100.64.0.0/10 fd7a:115c:a1e0::/48
    handle @allowed {
        @root path /
        redir @root /explorer 308

        reverse_proxy https://graph-explorer:443 {
            transport http {
                tls_insecure_skip_verify
            }
            header_up X-Forwarded-Proto {scheme}
        }
    }
    handle {
        respond "Forbidden" 403
    }
}

{% if INCLUDE_CODING %}
# Coder control plane + per-workspace app subdomains (the browser IDE). Same
# registrable domain as the web UI so the editor's session cookie is first-party
# inside the Nexus iframe. Caddy preserves the Host header (Coder needs it for
# subdomain app routing) and proxies WebSockets automatically. The wildcard
# label needs a DNS-challenge cert in production; locally Caddy's internal CA
# covers it.
coder.{$PUBLIC_WEB_HOST:localhost}, *.coder.{$PUBLIC_WEB_HOST:localhost} {
    reverse_proxy coder:7080 {
        header_up X-Forwarded-Proto {scheme}
    }
}

# Forgejo - git host + in-app review backend. Proxied so git clone/push and the
# REST API the Nexus review UI calls work; users review inside Nexus, not here.
git.{$PUBLIC_WEB_HOST:localhost} {
    reverse_proxy forgejo:3000 {
        header_up X-Forwarded-Proto {scheme}
    }
}
{% endif %}
