# TFM aInventory - Caddy Patched IP Configuration
# Version 1.9.12 - Secure Seal & IP Stability

{
    admin off
    auto_https disable_redirects
    
    # Trust local CA for internal certificate issuance
    local_certs
}

# Frontend SSL Proxy (8919 -> 443)
https://{$SERVER_IP:192.168.84.113}:443 {
    tls internal {
        on_demand
    }
    reverse_proxy frontend:3000
    
    # Security Headers for PWA
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-XSS-Protection "1; mode=block"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
        Referrer-Policy "strict-origin-when-cross-origin"
    }
}

# Backend SSL Proxy (8918 -> 444)
https://{$SERVER_IP:192.168.84.113}:444 {
    tls internal {
        on_demand
    }
    reverse_proxy backend:8000
}