Caddyfile

# Omni Reverse Proxy Configuration

# Global options
{
    # Enable admin API for metrics (optional)
    # admin localhost:2019
    
    # Disable admin API in production
    admin off
    
    # Email for Let's Encrypt HTTPS certificates
    email {$ACME_EMAIL:admin@localhost}
    
    # ACME CA for certificates (use Let's Encrypt staging for testing)
    # acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
    
    # HTTP->HTTPS redirect
    https_port 443
}

# Import environment variable for domain (defaults to localhost for development)
{$OMNI_DOMAIN:localhost} {
    # Logging
    log {
        output stdout
        format json
        level INFO
    }

    # Handle Google webhook notifications (must be before OAuth routes)
    handle /google-webhook {
        # Rewrite path to connector's webhook endpoint
        rewrite /google-webhook /webhook

        reverse_proxy google-connector:{$GOOGLE_CONNECTOR_PORT} {
            # Health check for the connector
            health_uri /health
            health_interval 30s
            health_timeout 5s

            # Headers for webhook notifications
            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-Proto {scheme}
            header_up X-Forwarded-Host {host}

            # Preserve all webhook headers from Google
            header_up X-Goog-* {>X-Goog-*}
        }
    }

    # Handle Google API endpoints (sync, webhook management)
    handle /google/* {
        reverse_proxy google-connector:{$GOOGLE_CONNECTOR_PORT} {
            health_uri /health
            health_interval 30s
            health_timeout 5s

            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-Proto {scheme}
        }
    }

    # Handle Atlassian webhook notifications
    handle /webhook/atlassian {
        rewrite /webhook/atlassian /webhook
        reverse_proxy atlassian-connector:{$ATLASSIAN_CONNECTOR_PORT} {
            health_uri /health
            health_interval 30s
            health_timeout 5s

            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-Proto {scheme}
            header_up X-Forwarded-Host {host}
        }
    }

    # Health check endpoint for monitoring
    handle /health {
        respond "OK" 200
    }

    # All other routes go to the SvelteKit web application
    handle {
        reverse_proxy web:{$WEB_PORT} {
            # Load balancing configuration (for future scaling)
            lb_policy round_robin
            lb_try_duration 5s
            lb_try_interval 250ms

            # Health checking
            health_uri /health
            health_interval 10s
            health_timeout 3s
            health_status 200

            # Headers
            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-For {remote_host}
            header_up X-Forwarded-Proto {scheme}
            header_up X-Forwarded-Host {host}

            # Timeouts
            transport http {
                read_timeout 60s
                write_timeout 60s
                dial_timeout 10s
            }
        }
    }

    # Response encoding
    encode {
        gzip
        zstd
        # Minimum size for compression (1KB)
        minimum_length 1024
    }

    # Security headers
    header {
        # Remove server header
        -Server
        
        # Security headers
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        X-XSS-Protection "1; mode=block"
        Referrer-Policy "strict-origin-when-cross-origin"
        Permissions-Policy "geolocation=(), microphone=(), camera=()"
        
        # HSTS (only for HTTPS)
        ?Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        
        # CSP - adjust based on your needs
        Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none';"
    }

    # Request size limits
    request_body {
        # 100MB max request size (for file uploads)
        max_size 100MB
    }

    # Error handling
    handle_errors {
        @404 {
            expression {http.error.status_code} == 404
        }
        handle @404 {
            respond "Page not found" 404
        }

        @5xx {
            expression {http.error.status_code} >= 500
        }
        handle @5xx {
            respond "Internal server error" 500
        }

        handle {
            respond "An error occurred" {http.error.status_code}
        }
    }
}

# Redirect www to non-www (if using a custom domain)
www.{$OMNI_DOMAIN:localhost} {
    redir https://{$OMNI_DOMAIN:localhost}{uri} permanent
}