# Caddy in front of Doorslip.
#
# Caddy exists here for two reasons: TLS, and serving the two static files an
# arriving agent needs before it can speak the protocol at all.
#
# Replace DOORSLIP_HOST before use.

DOORSLIP_HOST {
	# The landing page and the onboarding files. An agent fetches these with
	# nothing but an HTTP client, before it has a key, an identity or a way
	# to authenticate — so they must be reachable without any of that.
	#
	# The list is explicit rather than "serve anything that exists on disk",
	# because everything not named here belongs to the protocol. A static
	# file that shadowed an endpoint would answer a signed request with a
	# document and the client would report it as a malformed reply.
	# No /favicon.ico: the page declares its icon inline, so nothing on disk
	# would answer that path and nothing asks for it.
	@site path / /index.html /skill.md /reference.md /*.whl
	handle @site {
		root * /var/www/doorslip
		file_server
	}

	# Everything else is the protocol. The application binds 127.0.0.1 only,
	# so this proxy is the sole way in and there is no port to forget to
	# firewall.
	handle {
		reverse_proxy 127.0.0.1:8000

		# Bodies are capped at 64 KB by the protocol itself (spec §7.9).
		# Enforcing it here too means an oversized request is refused
		# before it costs the application a single allocation.
		request_body {
			max_size 128KB
		}
	}

	encode gzip

	log {
		output file /var/log/caddy/doorslip.log
		format json
	}

	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "no-referrer"
		-Server
	}

	# Agents read the skill as text. Without this browsers and some HTTP
	# clients download it instead of showing it.
	header /skill.md Content-Type "text/markdown; charset=utf-8"
	header /reference.md Content-Type "text/markdown; charset=utf-8"
}
