# One name, two upstreams, and TLS for both: Caddy is the only thing on the box that answers 443.
# The domain arrives as PINECALL_DOMAIN out of /etc/pinecall/box.env (caddy/pinecall.conf points
# Caddy's unit at it), so this file is the same on every box and nothing is rendered.
#
# Media does NOT pass through here: WebRTC (7881/tcp, 7882/udp) and SIP (5060, 10000-10199/udp)
# reach the host's own ports directly. A proxy in front of media is a proxy inside every call.

{$PINECALL_DOMAIN} {
	# LiveKit's own paths, signalling included: a browser's WebSocket is upgraded by Caddy and
	# handed to the SFU, which is how the room token ever reaches it over TLS. /agent is the
	# socket a WORKER registers on — a worker on a box of its own dials wss://<this domain>/agent.
	@livekit path /rtc* /twirp* /validate* /agent*
	handle @livekit {
		reverse_proxy 127.0.0.1:7880
	}

	# Everything else is the runtime's control plane: the app socket, the log, /v1/*.
	handle {
		reverse_proxy 127.0.0.1:8080
	}
}
