# Caddyfile for mitbringsl – standalone mode (default).
# Caddy automatically obtains and renews a Let's Encrypt certificate when the
# site address is a real domain. For local development it falls back to an
# internal CA / self-signed cert automatically.
#
# To run behind your own reverse proxy instead, mount Caddyfile.behind-proxy.
{
	# email you@example.com   # optional, for ACME account registration
}

{$SITE_ADDRESS:localhost} {
	reverse_proxy backend:8080 {
		header_up X-Real-IP        {remote_host}
		header_up X-Forwarded-For  {remote_host}
		header_up X-Forwarded-Proto {scheme}
	}

	# Useful default security headers
	header {
		Strict-Transport-Security "max-age=31536000"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "no-referrer"
	}

	request_body {
		max_size 2MB
	}

	log {
		output stdout
		format console
	}
}