:{$PORT:5173} {
	root * /usr/share/caddy
	encode zstd gzip

	# Set SERVICE_HOST_REGEX=^$ when this instance runs only as an app preview
	# behind another Deputies service host and should not route service hosts itself.
	@service_host header_regexp Host {$SERVICE_HOST_REGEX:^s-}
	handle @service_host {
		reverse_proxy {$API_UPSTREAM:http://control-plane:3583} {
			header_up X-Original-Host {host}
			header_up X-Forwarded-Host {host}
			header_up X-Forwarded-Proto {scheme}
		}
	}

	@api path /health /auth* /agent-profiles* /automations* /environments* /sessions* /events* /repositories* /models* /notepads* /setup* /skills* /snippets* /telemetry* /users* /webhooks*
	handle @api {
		reverse_proxy {$API_UPSTREAM:http://control-plane:3583} {
			header_up X-Original-Host {host}
			header_up X-Forwarded-Host {host}
			header_up X-Forwarded-Proto {scheme}
		}
	}

	@assets path /assets/*
	handle @assets {
		header Cache-Control "public, max-age=31536000, immutable"
		file_server
	}

	handle {
		header Cache-Control "no-cache"
		try_files {path} /index.html
		file_server
	}
}
