{
    email {$ACME_EMAIL:admin@kucial.com}

    servers {
        # cloudflared and Docker's gateways sit on private ranges. Take the real
        # client IP from their headers instead of reporting their own address;
        # upstreams receive it in X-Forwarded-For.
        trusted_proxies static private_ranges
        client_ip_headers Cf-Connecting-Ip X-Forwarded-For
    }
}

# Reusable TLS block using Cloudflare DNS-01 ACME challenge (Let's Encrypt / ZeroSSL)
(cloudflare_tls) {
    tls {
        dns cloudflare {env.CLOUDFLARE_API_TOKEN}
    }
}

# Synotrip (PHP 8.3 / MariaDB / Redis)
synotrip.kucial.com {
    import cloudflare_tls
    reverse_proxy host.docker.internal:3200
}

npm.kucial.com {
    import cloudflare_tls
    reverse_proxy host.docker.internal:4873
}

# Blog (PHP 8.3 / MariaDB)
blog.kucial.com {
    import cloudflare_tls
    reverse_proxy host.docker.internal:3201
}


# Gitea on Z2Pro
gitea.kucial.com {
    import cloudflare_tls
    reverse_proxy 192.168.50.228:8081
}

*.ddev.kucial.com {
    tls {
        dns cloudflare {env.CLOUDFLARE_API_TOKEN}
    }

    @api host gig-api.ddev.kucial.com
    handle @api {
        reverse_proxy https://192.168.50.160:443 {
            header_up Host gig-platform.ddev.site
            transport http {
                tls_server_name gig-platform.ddev.site
                # The public device-facing certificate is still fully trusted.
                # This applies only to the fixed, private Caddy-to-DDEV hop.
                tls_insecure_skip_verify
            }
        }
    }

    @socket host gig-socket.ddev.kucial.com
    handle @socket {
        reverse_proxy http://192.168.50.160:6001 {
            header_up Host gig-platform.ddev.site
        }
    }

    @voice host gig-voice.ddev.kucial.com
    handle @voice {
        reverse_proxy http://192.168.50.160:7880 {
            header_up Host gig-platform.ddev.site
        }
    }

    @static host gig-static.ddev.kucial.com
    handle @static {
        reverse_proxy https://192.168.50.160:443 {
            header_up Host gig-platform.ddev.site
            transport http {
                tls_server_name gig-platform.ddev.site
                tls_insecure_skip_verify
            }
        }
    }

    respond 404
}

# Per-project sites, one file each (sites/*.caddy). Project instances are
# reached over the shared `edge` Docker network by container alias rather than
# host ports — see sites/gig-platform.caddy.
import sites/*.caddy