oxynote/docker/Caddyfile

{
	admin off # disable the admin API
}

(common) {
	request_body {
		max_size 10MB # must be higher than file upload limit
	}

	header -Server
}

:8080 {
	import common

	# /api/x/* is core's internal, auth-less service-to-service surface —
	# it must never be reachable through the front door.
	handle /core/api/x/* {
		respond 403
	}

	# /api/internal/* is auth-realtime's unauthenticated service-to-service
	# surface (core calls it directly over the container network) — it must
	# never be reachable through the front door either.
	handle /auth-realtime/api/internal/* {
		respond 403
	}

	handle_path /core/* {
		reverse_proxy core:8080
	}

	handle_path /auth-realtime/* {
		reverse_proxy auth-realtime:8081
	}

	handle {
		reverse_proxy web:3000
	}
}

:8081 {
	import common

	reverse_proxy minio:9001
}

:8082 {
	import common

	reverse_proxy changedetection:5000
}

:8084 {
	import common

	reverse_proxy mailpit:8025
}