# TLS reverse proxy for the Wipro/Ema combined-service demo (design §12).
# Terminates HTTPS:443 and proxies to the combined app on :8080 (COMBINED_HTTP_PORT).
#
# {$SITE_ADDRESS} comes from deploy/.env.azure (compose passes it into the caddy service):
#   - Demo / self-signed VM:  SITE_ADDRESS=:443   + the `tls internal` line below
#     (Caddy mints its own local CA cert — no public DNS or ACME needed). Ema must then
#     trust that CA or skip verification (curl -k) for the demo.
#   - Real cert:              SITE_ADDRESS=wipro-demo.example.com   and DELETE `tls internal`
#     so Caddy auto-provisions a Let's Encrypt cert (requires public DNS + ports 80/443
#     reachable). For an internal CA cert instead, replace with: tls /certs/server.crt /certs/server.key

# Global options. default_sni lets raw-IP / no-SNI clients (Ema calling by IP, curl -k)
# complete the TLS handshake against the `tls internal` cert — without it Caddy returns
# "tlsv1 alert internal error" to SNI-less callers. (Confirmed live on the VM.)
#
# {$DEFAULT_SNI} comes from deploy/.env.azure, same mechanism as {$SITE_ADDRESS} below;
# defaults to "localhost" (the old hardcoded value) when unset, so deployments that
# never set it behave exactly as before. Set it to the VM's actual public IP, not
# "localhost", to fix direct-IP callers — per RFC 6066 §3, TLS clients
# don't send SNI at all when the target host is a literal IP address (confirmed: curl
# and Node's fetch both omit it for https://<ip>/...). With default_sni=localhost,
# every such SNI-less connection got the "localhost" cert instead, which never covers
# the IP — so http.Client callers hitting the VM by IP failed cert validation even
# after the IP was added to SITE_ADDRESS below (openssl with an explicit
# -servername <ip> got the right cert; plain curl/fetch by IP did not, because they
# send no SNI to match against). Any client that DOES send explicit SNI (e.g. the
# "localhost" tunnel path) is unaffected — default_sni only applies to the no-SNI case.
# If the VM's public IP ever changes, update DEFAULT_SNI (and SITE_ADDRESS) in
# .env.azure and restart caddy — no Caddyfile edit needed.
{
	default_sni {$DEFAULT_SNI:localhost}
}

# For a DNS-less demo set SITE_ADDRESS to the names/IPs you'll call, e.g.
#   SITE_ADDRESS=localhost, 127.0.0.1, <private-ip>, <public-ip>
{$SITE_ADDRESS} {
	# Demo default: Caddy's internal self-signed CA. Remove this line for a real/ACME cert.
	tls internal

	# Forward everything to the app. It handles /health, /scan, /register, /ingest-logs
	# and the MCP mount at /mcp/ (GR /enforce is not deployed — COMBINED_GR_SERVICE_ENABLED=false).
	reverse_proxy combined:8080 {
		# Stream the MCP Streamable-HTTP endpoint without buffering.
		flush_interval -1
	}

	encode gzip

	log {
		output stdout
		format console
	}
}
