# Caddy sits between cloudflared and the apps. TLS is terminated at Cloudflare's edge and the tunnel
# carries traffic to caddy:80 over the private "edge" network, so Caddy serves plain HTTP here.
{
	auto_https off
	admin off
}

:80 {
	encode zstd gzip
	header {
		X-Content-Type-Options nosniff
		X-Frame-Options DENY
		Referrer-Policy strict-origin-when-cross-origin
		-Server
	}
	request_body {
		max_size 1MB
	}

	handle /healthz {
		respond "ok" 200
	}
	handle_path /rag/* {
		reverse_proxy rag-api:8004
	}
	handle_path /agent/* {
		reverse_proxy agent-api:8005
	}
	handle_path /listings/* {
		reverse_proxy listing-api:8003
	}
	handle {
		respond "Kettle & Kiln AI platform" 404
	}

	log {
		output stdout
		format json
	}
}
