# DashCaddy Caddyfile
# Generated by DashCaddy Installer

# Global options
{
  # The default `admin localhost:2019` binds to the loopback interface, so
  # Caddy's `enforce_origin` CSRF guard is never engaged and no `origins`
  # directive is required. (Note: glibc resolves `localhost` to `::1`
  # first per RFC 3484, so `admin localhost:2019` typically binds BOTH
  # IPv4 and IPv6 loopback — the actionable point is that any loopback
  # bind skips enforce_origin, not the exact IPv4/IPv6 split.)
  #
  # If a non-loopback bind is adopted later (e.g. `admin 0.0.0.0:2019 { ... }`
  # so a docker container on the host's bridge can reach admin via
  # 172.17.0.1:2019), the admin block MUST include an `origins` allowlist.
  # On Linux, `localhost` resolves to `::1` FIRST per glibc RFC 3484 (because
  # /etc/hosts has `::1 localhost`), so allowlist entries must include the
  # IPv6 literal form `http://[::1]:2019` AND `http://ip6-localhost:2019`
  # (the glibc alias) — `http://localhost:2019` alone will 403 every probe
  # that resolves localhost to `::1`. See DC-051 + DC-069 in repo history.
  admin localhost:2019
  auto_https off
}

# Dashboard
:{{PORT}} {
  root * {{DASHBOARD_PATH}}
  file_server
  encode gzip

  # API proxy
  handle /api/* {
    reverse_proxy localhost:{{API_PORT}}
  }

  # SPA fallback
  try_files {path} /index.html
}