adding a bunch of untested files

clio-api/nixos/Caddyfile

@@ -0,0 +1,46 @@
+# Caddyfile snippet for phone-recorder
+# Add this to your global /etc/caddy/Caddyfile
+#
+# Caddy will automatically obtain and renew HTTPS certificates
+
+recordings.hallocks.xyz {
+    # Proxy everything to FastAPI
+    reverse_proxy localhost:8000
+
+    # Security headers
+    header {
+        X-Content-Type-Options nosniff
+        X-Frame-Options SAMEORIGIN
+        Referrer-Policy strict-origin-when-cross-origin
+        -Server
+    }
+
+    # Logging for fail2ban
+    log {
+        output file /var/log/caddy/recordings.log {
+            roll_size 10mb
+            roll_keep 5
+        }
+        format json
+    }
+}
+
+# ============================================================
+# Other services (for reference when setting them back up):
+# ============================================================
+
+# todo.hallocks.xyz {
+#     reverse_proxy localhost:3456  # Vikunja
+#     log {
+#         output file /var/log/caddy/todo.log
+#         format json
+#     }
+# }
+
+# passwords.hallocks.xyz {
+#     reverse_proxy localhost:8080  # Vaultwarden
+#     log {
+#         output file /var/log/caddy/passwords.log
+#         format json
+#     }
+# }