{
	email admin@caterium.ru
}

api.caterium.ru {
	encode gzip zstd

	# Storage uploads (photos, docs) — match FILE_SIZE_LIMIT in .env (50 MB default).
	request_body {
		max_size 50MB
	}

	# WebSocket upgrade for Realtime (Kong proxies to the realtime service).
	@websockets {
		header Connection *Upgrade*
		header Upgrade    websocket
	}
	reverse_proxy @websockets 127.0.0.1:8000

	reverse_proxy 127.0.0.1:8000 {
		header_up Host {host}
		header_up X-Real-IP {remote_host}
		header_up X-Forwarded-For {remote_host}
		header_up X-Forwarded-Proto {scheme}
		flush_interval -1
	}

	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "strict-origin-when-cross-origin"
	}

	log {
		output file /var/log/caddy/api.caterium.ru.log {
			roll_size 50mb
			roll_keep 5
		}
	}
}

# Supabase Studio (admin dashboard) — not part of the public API surface.
# Kept on a separate host, gated by HTTP basic auth (DASHBOARD_USERNAME/PASSWORD from .env,
# hash with `caddy hash-password`), and NOT referenced by the Caterium frontend at all.
# Point a DNS record at this host only if/when you want browser access; otherwise reach
# Studio via `ssh -L 3000:127.0.0.1:3000 timeweb-caterium-vps` and open http://127.0.0.1:3000.
studio.caterium.ru {
	basic_auth {
		# Replace with: caddy hash-password --plaintext '<DASHBOARD_PASSWORD>'
		{$DASHBOARD_USERNAME} {$DASHBOARD_PASSWORD_HASH}
	}
	reverse_proxy 127.0.0.1:3000
}