{
	email {$ACME_EMAIL}
	# Em dev local (*.localhost) Caddy emite cert interno automaticamente.
	# Em produção, Let's Encrypt entra pelos hostnames reais.
}

# ----- Gitea (UI + git over HTTPS) -----
gitea.{$DOMAIN_BASE} {
	encode zstd gzip
	reverse_proxy gitea:3000 {
		transport http {
			response_header_timeout 10m
			dial_timeout 30s
		}
	}
}

# ----- Wedding (app dos noivos) -----
wedding.{$DOMAIN_BASE} {
	encode zstd gzip
	request_body {
		max_size 600MB
	}
	reverse_proxy wedding_app:3000 {
		transport http {
			response_header_timeout 10m
			dial_timeout 30s
		}
	}
}

# ----- Finance (lronetto-finance, repo à parte) -----
finance.{$DOMAIN_BASE} {
	encode gzip zstd
	header {
		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "geolocation=(), microphone=(), camera=()"
		Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.pluggy.ai; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https://api.pluggy.ai; frame-src https://connect.pluggy.ai; frame-ancestors 'self'; base-uri 'self'; form-action 'self'"
		-Server
	}
	reverse_proxy finance_app:8000
}

# ----- Claudeweb (lronetto-claudeweb, repo à parte) — subdomínio é "code", não "claudeweb" -----
code.{$DOMAIN_BASE} {
	encode zstd gzip

	@backend path /api/* /healthz /ws/*
	handle @backend {
		reverse_proxy claudeweb-api:8300
	}

	handle {
		reverse_proxy claudeweb-web:80
	}
}

# ----- pgAdmin -----
pgadmin.{$DOMAIN_BASE} {
	encode gzip
	reverse_proxy pgadmin:80
}

# ----- MinIO console (admin web) -----
minio.{$DOMAIN_BASE} {
	encode gzip
	reverse_proxy minio:9001
}

# ----- MinIO S3 API público (uploads/downloads do bucket) -----
media.{$DOMAIN_BASE} {
	encode gzip
	# NÃO reescrever o Host: as URLs pré-assinadas (SigV4) incluem o header
	# `host` na assinatura, calculado com `media.{DOMAIN_BASE}`. O Caddy
	# repassa o Host original por padrão; reescrever pra `minio:9000`
	# quebraria a assinatura (SignatureDoesNotMatch / 403 no PUT).
	reverse_proxy minio:9000
}