# HTTPS certificates are fetched and renewed automatically for {$DOMAIN}.
# Port 80 only redirects to https. Caddy overwrites any X-Forwarded-For sent by
# a visitor with the real address, which the API's rate limits rely on.
{$DOMAIN} {
	# Empty on a real server. `install.sh --local-certs` puts a `tls internal` snippet here for rehearsals.
	import /etc/caddy/tls/*.caddy

	encode zstd gzip

	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "camera=(), microphone=(), geolocation=()"
		-Server
	}

	request_body {
		max_size 12MB
	}

	reverse_proxy web:3000
}
