# Caddyfile — Metastro TLS terminator on the GCP astro-server VM.
#
# Path on the live VM: /etc/caddy/Caddyfile
# Source of truth: this file. Ship changes with infra/deploy-caddy.sh.
#
# Behavior:
#   * Listens on :80 (HTTP) and :443 (HTTPS).
#   * Caddy auto-redirects HTTP -> HTTPS for the configured host.
#   * Cert: Let's Encrypt via ACME HTTP-01 challenge on port 80.
#     Auto-renewed by Caddy (no certbot, no cron).
#   * Reverse-proxies astro.meteormeta.com -> 127.0.0.1:8000 (uvicorn).
#   * Long timeouts (6 min) accommodate the worst-case PDF render
#     (~222s cold for South Jathakam, per project memory).
#   * Forwarded headers: X-Forwarded-Proto / X-Forwarded-For so the
#     FastAPI app (started with --proxy-headers) sees the real client.

{
    # Global options. Email is used by Let's Encrypt for renewal
    # warnings; replace if a different ops mailbox is preferred.
    email gauthamvr11@gmail.com
}

astro.meteormeta.com {
    encode zstd gzip

    log {
        output stdout
        format console
        level INFO
    }

    reverse_proxy 127.0.0.1:8000 {
        # Pass real client to uvicorn (it's started with --proxy-headers).
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-Proto {scheme}

        # Cold PDF render is ~222s on e2-micro; give 6 min of headroom.
        transport http {
            response_header_timeout 6m
            read_timeout 6m
            write_timeout 6m
            dial_timeout 10s
        }
    }
}
