# Reference restricted-developer Caddyfile. The generated Caddyfile selects
# this HTTP mode only behind an explicit source-CIDR firewall, or renders the
# supplied FQDN for Caddy automatic HTTPS.
:80 {
    route {
        @admin_unauthorized {
            path /api/*
            not header Authorization "Bearer {env.ADMINISTRATION_API_KEY}"
        }
        respond @admin_unauthorized "Administration credential required" 401
        @inference_unauthorized {
            path /v1/*
            not header Authorization "Bearer {env.INFERENCE_API_KEY}"
        }
        respond @inference_unauthorized "Inference credential required" 401
        handle /api/* {
            reverse_proxy ollama:11434
        }
        handle /v1/* {
            reverse_proxy ollama:11434
        }
        handle {
            reverse_proxy open-webui:8080
        }
    }
}
