Caddyfile

# Caddy uses the APP_DOMAIN environment variable from docker-compose.prod.yml.
# Example: APP_DOMAIN=libero.example.com
{$APP_DOMAIN} {
	# Brotli-like zstd plus gzip gives small responses with low CPU overhead.
	encode zstd gzip

	# Baseline browser hardening. Secrets remain server-side; these headers help
	# reduce accidental content sniffing and clickjacking in the customer portal.
	header {
		X-Content-Type-Options "nosniff"
		X-Frame-Options "DENY"
		Referrer-Policy "strict-origin-when-cross-origin"
		Permissions-Policy "geolocation=(), microphone=(), camera=()"
	}

	# Caddy terminates TLS and forwards plain HTTP over the private Docker
	# network to the FastAPI container. The web service is not exposed publicly.
	reverse_proxy web:8000
}