Caddyfile

# Caddy configuration for automatic HTTPS
# The DOMAIN environment variable will be injected at runtime

{$DOMAIN:localhost} {
    # TLS configuration - always use provided certificates generated by tls-keygen
    tls /run/tls/fullchain.pem /run/tls/privkey.pem

    # Reverse proxy to your Node.js application
    # Modify the port to match your application (default: 3000)
    reverse_proxy localhost:{$APP_PORT:3000} {
        # Health check configuration
        health_uri /health
        health_interval 30s
        health_timeout 5s
        health_status 200
    }

    # Custom headers
    header {
        # Security headers
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        X-XSS-Protection "1; mode=block"
        Referrer-Policy "strict-origin-when-cross-origin"

        # Remove server header
        -Server
    }

    # Logging
    log {
        output stdout
        format console
        level INFO
    }

    # Request size limits
    request_body {
        max_size 10MB
    }
}

# HTTP endpoint (optional, for health checks or redirects)
:80 {
    # Redirect to HTTPS only when host isn't localhost
    @for_domain expression {host} != "localhost"
    redir @for_domain https://{host}{uri} permanent

    # Health check endpoint (always available via HTTP)
    handle /health {
        respond "OK" 200
    }
}