# TFM aInventory - Caddy Patched IP Configuration
# Version 1.9.15 - The Dynamic Shield (On-Demand TLS)

{
    admin off
    debug
    
    # Global TLS options for self-signed certificates
    local_certs
    skip_install_trust
    
    # Configure on-demand TLS for private network IPs
    on_demand_tls {
        # Using a dummy check or local health endpoint to allow any IP in private range
        # For simplicity in this env, we use the frontend's existence as the check
        ask http://frontend:3000/api/health
    }
}

# Dynamic SSL Proxy (Matches ANY IP or hostname)
https:// {
    tls internal {
        on_demand
    }
    
    # Route based on the port (Caddy handles multiple listeners in this catch-all)
    # But since we have specific container ports, we'll split them for clarity
    # to avoid port collision in the catch-all.
    reverse_proxy frontend:3000
    
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-XSS-Protection "1; mode=block"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
        Referrer-Policy "strict-origin-when-cross-origin"
    }
}

# Specific port listener for backend (8918 -> 444)
https://:444 {
    tls internal {
        on_demand
    }
    reverse_proxy backend:8000
}