{
    # Caddy admin API — used by DigiServer to reload config after HTTPS is enabled
    admin 0.0.0.0:2019
}

# Default: serve the app on HTTP port 80
# Once HTTPS is configured via Admin → HTTPS Config, Caddy will reload
# this file and start provisioning a Let's Encrypt certificate automatically.
:80 {
    reverse_proxy digiserver-app:5000 {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-Proto {scheme}
        transport http {
            read_timeout 300s
            write_timeout 300s
        }
    }

    request_body {
        max_size 2GB
    }

    encode gzip

    header {
        X-Frame-Options "SAMEORIGIN"
        X-Content-Type-Options "nosniff"
        X-XSS-Protection "1; mode=block"
    }

    log {
        output file /var/log/caddy/access.log
    }
}