# Production host. The app gates itself (its own accounts, SITE_ACCESS), so there is no
# gate here: Caddy terminates TLS, compresses, sets the browser headers and proxies to the
# app's bridge-bound port.
#
# Certificate: a Cloudflare Origin CA certificate (15 years) in /srv/caddy/origin/, trusted
# by Cloudflare's edge and nothing else, which is fine because the zone is proxied and no
# browser ever reaches the origin directly. Chosen on 10 Sep after Let's Encrypt's remote
# validators could not reach the zone for the DNS challenge fifteen times running; the DNS
# module and its token stay in place for any host that is not proxied.
www.dutyfreeprofessor.com {
	tls /etc/caddy/origin/dutyfreeprofessor.com.pem /etc/caddy/origin/dutyfreeprofessor.com.key
	redir https://dutyfreeprofessor.com{uri} permanent
}

dutyfreeprofessor.com {
	tls /etc/caddy/origin/dutyfreeprofessor.com.pem /etc/caddy/origin/dutyfreeprofessor.com.key
	encode gzip zstd
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		X-Frame-Options "SAMEORIGIN"
		Referrer-Policy "strict-origin-when-cross-origin"
		-Server
	}
	reverse_proxy host.docker.internal:3149
}