# Caddyfile for Assistant

# HTTPS site
ea.mgmtcnsltng.com {
    # Reverse proxy to app container
    reverse_proxy app:8000

    # Security headers
    header {
        X-Frame-Options "DENY"
        X-Content-Type-Options "nosniff"
        X-XSS-Protection "1; mode=block"
        Referrer-Policy "strict-origin-when-cross-origin"
        Content-Security-Policy "default-src 'self'"
    }

    # Compression
    encode zstd gzip

    # Log format
    log {
        output file /var/log/caddy/access.log
    }
}

# HTTP to HTTPS redirect
http:// {
    # Redirect all HTTP to HTTPS
    redir https://{host}{uri} permanent
}
