siftd.smoke.local, localhost {
    tls internal

    log {
        output file /data/caddy-access.log
        format json
        # TODO: scrub Authorization headers from access logs.
        # Caddy's built-in `format filter` log encoder (caddy-filter module) can
        # do this, but is not bundled in the stock caddy:2-alpine image:
        #
        #   format filter {
        #       wrap json
        #       fields {
        #           request>headers>Authorization replace [REDACTED]
        #       }
        #   }
        #
        # Until that module is available, avoid enabling full header logging
        # in production. See README.md "Known TODOs".
    }

    # LOCKSTEP: this value must match serve.request_max_body_size in
    # siftd-serve.config.toml. Both use SI/decimal MB (1 MB = 1 000 000 bytes).
    # Caddy cannot read siftd's config at runtime, so the two must be changed
    # together. Raising one without the other creates a silent gap.
    request_body {
        max_size 500MB
    }

    reverse_proxy siftd-serve:8484
}
