# Caddy configuration for a co-op marketplace.
# Caddy obtains and renews the TLS certificate automatically - no certbot, no cron job.
# Install Caddy, then: sudo cp deploy/Caddyfile /etc/caddy/Caddyfile && sudo systemctl reload caddy

market.example.coop {                 # CHANGE ME to the co-op's real domain
    encode zstd gzip

    # Security headers. Nothing here needs a third-party script, so nothing is allowed to load one.
    header {
        Strict-Transport-Security "max-age=31536000"
        X-Content-Type-Options "nosniff"
        Referrer-Policy "no-referrer"
        X-Frame-Options "DENY"
        -Server
    }

    # The public request form is the only endpoint exposed to the open internet.
    # Uncomment to slow down spam without blocking real customers.
    # rate_limit {
    #     zone public_form {
    #         key {remote_host}
    #         events 20
    #         window 1m
    #     }
    # }

    # Everything goes to the app, which listens only on localhost.
    reverse_proxy 127.0.0.1:8080 {
        header_up X-Real-IP {remote_host}
        transport http {
            read_timeout 30s
        }
    }

    log {
        output file /var/log/caddy/coopmarket-access.log
        format json
    }
}
