# Caddyfile for mitbringsl – behind external reverse proxy mode.
#
# Use this when your own reverse proxy (nginx, Traefik, etc.) handles TLS
# termination and routes traffic to Caddy over plain HTTP on the internal
# Docker network.
#
# In docker-compose.yml, mount this file instead of the default Caddyfile:
#   volumes:
#     - ./Caddyfile.behind-proxy:/etc/caddy/Caddyfile:ro
#
# Your external proxy should set:
#   X-Forwarded-For   <client-ip>
#   X-Forwarded-Proto https
#   Host              <your-domain>
{
	# Disable auto-HTTPS – TLS is handled by the outer proxy.
	auto_https off
}

:80 {
	# Trust the private-network upstream so X-Forwarded-* headers are accepted.
	# Change to a specific IP/CIDR if your proxy has a fixed address.
	trusted_proxies private_ranges

	reverse_proxy backend:8080 {
		# Forward the real client IP to the backend.
		header_up X-Real-IP        {http.request.header.X-Forwarded-For}
		header_up X-Forwarded-For  {http.request.header.X-Forwarded-For}
		header_up X-Forwarded-Proto {http.request.header.X-Forwarded-Proto}
	}

	# Enforce a sensible request body size limit.
	request_body {
		max_size 2MB
	}

	log {
		output stdout
		format console
	}
}