# Caddyfile snippet for phone-recorder
# Add this to your global /etc/caddy/Caddyfile
#
# Caddy will automatically obtain and renew HTTPS certificates

recordings.hallocks.xyz {
    # Proxy everything to FastAPI
    reverse_proxy localhost:8000

    # Security headers
    header {
        X-Content-Type-Options nosniff
        X-Frame-Options SAMEORIGIN
        Referrer-Policy strict-origin-when-cross-origin
        -Server
    }

    # Logging for fail2ban
    log {
        output file /var/log/caddy/recordings.log {
            roll_size 10mb
            roll_keep 5
        }
        format json
    }
}

# ============================================================
# Other services (for reference when setting them back up):
# ============================================================

# todo.hallocks.xyz {
#     reverse_proxy localhost:3456  # Vikunja
#     log {
#         output file /var/log/caddy/todo.log
#         format json
#     }
# }

# passwords.hallocks.xyz {
#     reverse_proxy localhost:8080  # Vaultwarden
#     log {
#         output file /var/log/caddy/passwords.log
#         format json
#     }
# }