# https://caddyserver.com/docs/caddyfile/options
# docker run --rm -v "./system_files/jumphost/etc/caddy/:/etc/caddy" docker.io/library/caddy:2 caddy fmt --config /etc/caddy/Caddyfile --overwrite
{
	admin off
}
:8080 {
	basic_auth {
		{$BASIC_USER} {$BASIC_PASS_HASH}
	}

	header {
		-Server
		X-Frame-Options "SAMEORIGIN"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "strict-origin-when-cross-origin"
	}

	# Proxy to local HTTPS backend; verify with backend CA
	reverse_proxy https://127.0.0.1:8443 {
		header_up Host internal.service.local
		header_up X-Real-IP {remote}
		transport http {
			# SNI must match the backend cert's name
			tls_server_name internal.service.local

			# Trust the backend's CA (copied to /etc/caddy/upstream_ca.pem below)
			tls_trust_pool file {
				pem_file /etc/caddy/upstream_ca.pem
			}
		}
	}
}
