Caddyfile

# Hermes Reverse Proxy Configuration
# 
# This file controls how requests are routed to your Hermes services.
# You can customize this for your domain, SSL certificates, and routing rules.
#
# Quick Start:
#   - For local development: Leave as-is
#   - For production with domain: Replace :80 with your domain (e.g., hermes.yourdomain.com)
#   - Caddy will automatically obtain Let's Encrypt certificates for domains

# Basic HTTP configuration (default - works locally)
:80 {
    # Health check endpoint (for load balancers and monitoring)
    handle /health {
        respond "healthy" 200
    }

    # SSE Events endpoint - MUST come before general API handler
    # Critical: flush_interval -1 prevents buffering of SSE events
    handle /api/v1/events/* {
        reverse_proxy api:8000 {
            # Forward client information headers
            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-For {remote_host}
            header_up X-Forwarded-Proto {scheme}
            header_up X-Forwarded-Host {host}

            # CRITICAL for SSE: Disable buffering
            flush_interval -1

            # Keep connection alive for SSE
            transport http {
                keepalive 90s
                keepalive_idle_conns 10
            }
        }
    }

    # API routes - proxy to backend service
    handle /api/* {
        reverse_proxy api:8000 {
            # Forward client information headers
            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-For {remote_host}
            header_up X-Forwarded-Proto {scheme}
            header_up X-Forwarded-Host {host}

            # Health checks for the backend
            health_uri /api/v1/health/
            health_interval 30s
            health_timeout 10s
        }
    }

    # Frontend - serve static files
    handle {
        root * /app
        
        # Try to serve file, fallback to index.html for SPA routing
        try_files {path} /index.html
        file_server
        
        # Cache static assets aggressively
        @static {
            path *.js *.css *.png *.jpg *.jpeg *.gif *.ico *.svg *.woff *.woff2 *.ttf *.eot
        }
        header @static {
            Cache-Control "public, max-age=31536000, immutable"
        }
        
        # Security headers for all responses
        header {
            X-Frame-Options "SAMEORIGIN"
            X-Content-Type-Options "nosniff"
            X-XSS-Protection "1; mode=block"
            Referrer-Policy "strict-origin-when-cross-origin"
            # Note: Strict CSP might need adjustment based on your needs
        }
        
        # Don't cache HTML files
        @html {
            path *.html /
        }
        header @html {
            Cache-Control "no-cache, no-store, must-revalidate"
        }
    }

    # Optional: Enable access logging for debugging
    # Uncomment the lines below to log requests
    # log {
    #     output file /var/log/caddy/access.log
    #     format json
    # }
}

# ==============================================================================
# PRODUCTION CONFIGURATION EXAMPLE
# ==============================================================================
# 
# Uncomment and customize the section below for production deployment with a domain.
# Caddy will automatically obtain and renew Let's Encrypt SSL certificates.
#
# ==============================================================================
# SEPARATE DOMAINS EXAMPLE
# ==============================================================================
# For separate API and frontend domains (e.g., hermes-api.example.com and hermes.example.com)
#
# hermes-api.example.com {
#     # Caddy automatically enables HTTPS and obtains certificates
#     tls admin@example.com
#
#     # Health check
#     handle /health {
#         respond "healthy" 200
#     }
#
#     # API routes only
#     handle /api/v1/* {
#         reverse_proxy api:8000 {
#             header_up X-Real-IP {remote_host}
#             header_up X-Forwarded-For {remote_host}
#             header_up X-Forwarded-Proto {scheme}
#             header_up X-Forwarded-Host {host}
#
#             # Health checks for the backend
#             health_uri /api/v1/health/
#             health_interval 30s
#             health_timeout 10s
#         }
#     }
#
#     # Block all other requests
#     handle {
#         respond "Not Found" 404
#     }
# }
#
# hermes.example.com {
#     # Caddy automatically enables HTTPS and obtains certificates
#     tls admin@example.com
#
#     # Redirect API calls to separate API domain
#     handle /api/* {
#         redir https://hermes-api.example.com{uri} permanent
#     }
#
#     # Frontend static files
#     handle {
#         root * /app
#         try_files {path} /index.html
#         file_server
#
#         @static {
#             path *.js *.css *.png *.jpg *.jpeg *.gif *.ico *.svg *.woff *.woff2 *.ttf *.eot
#         }
#         header @static Cache-Control "public, max-age=31536000, immutable"
#
#         header {
#             X-Frame-Options "SAMEORIGIN"
#             X-Content-Type-Options "nosniff"
#             Referrer-Policy "strict-origin-when-cross-origin"
#             Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
#         }
#     }
# }
#
# ==============================================================================
# SINGLE DOMAIN EXAMPLE
# ==============================================================================
# For single domain with API proxy (e.g., hermes.example.com)
#
# hermes.example.com {
#     # Caddy automatically enables HTTPS and obtains certificates
#     tls admin@example.com
#
#     # Health check
#     handle /health {
#         respond "healthy" 200
#     }
#
#     # API proxy
#     handle /api/* {
#         reverse_proxy api:8000 {
#             header_up X-Real-IP {remote_host}
#             header_up X-Forwarded-For {remote_host}
#             header_up X-Forwarded-Proto {scheme}
#             header_up X-Forwarded-Host {host}
#
#             # Health checks for the backend
#             health_uri /api/v1/health/
#             health_interval 30s
#             health_timeout 10s
#         }
#     }
#
#     # Frontend static files
#     handle {
#         root * /app
#         try_files {path} /index.html
#         file_server
#
#         @static {
#             path *.js *.css *.png *.jpg *.jpeg *.gif *.ico *.svg *.woff *.woff2 *.ttf *.eot
#         }
#         header @static Cache-Control "public, max-age=31536000, immutable"
#
#         header {
#             X-Frame-Options "SAMEORIGIN"
#             X-Content-Type-Options "nosniff"
#             Referrer-Policy "strict-origin-when-cross-origin"
#             Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
#         }
#     }
#
#     # Enable access logs
#     log {
#         output file /data/access.log
#         format json
#     }
# }