# Managed by Ansible (multica_docker) - local changes will be overwritten
{
{% if caddy_acme_email | length > 0 %}
	email {{ caddy_acme_email }}
{% endif %}
{% if caddy_http_port | int != 80 %}
	http_port {{ caddy_http_port }}
{% endif %}
{% if caddy_https_port | int != 443 %}
	https_port {{ caddy_https_port }}
{% endif %}
{% if caddy_tls_mode == 'cloudflare_dns' %}
	acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
{% endif %}
}

{% if multica_layout == 'single' %}
{{ multica_domain }} {
{% if caddy_tls_mode == 'internal' %}
	tls internal
{% endif %}
	# CLI reachability probe: `multica setup` GETs <server-url>/health and needs a 200
	handle /health {
		reverse_proxy 127.0.0.1:{{ _multica_backend_port }}
	}

	# Browser realtime WebSocket (the web image cannot proxy WS upgrades)
	handle /ws {
		reverse_proxy 127.0.0.1:{{ _multica_backend_port }} {
			flush_interval -1
		}
	}

	# Daemon long-connection WebSocket: daemons dial {server-url}/api/daemon/ws
	handle /api/daemon/ws {
		reverse_proxy 127.0.0.1:{{ _multica_backend_port }} {
			flush_interval -1
		}
	}

	# Everything else goes to the frontend, which forwards API and login requests
	handle {
		reverse_proxy 127.0.0.1:{{ _multica_frontend_port }}
	}
}
{% else %}
{{ multica_app_domain }} {
{% if caddy_tls_mode == 'internal' %}
	tls internal
{% endif %}
	# Hand browser WebSockets straight to the backend
	@ws path /ws /ws/*
	handle @ws {
		reverse_proxy 127.0.0.1:{{ _multica_backend_port }} {
			flush_interval -1
		}
	}

	# Everything else goes to the frontend, which forwards API and login requests
	handle {
		reverse_proxy 127.0.0.1:{{ _multica_frontend_port }}
	}
}

{{ multica_api_domain }} {
{% if caddy_tls_mode == 'internal' %}
	tls internal
{% endif %}
	reverse_proxy 127.0.0.1:{{ _multica_backend_port }} {
		flush_interval -1
	}
}
{% endif %}