Caddyfile

# ──────────────────────────────────────────────────────────────
# Caddyfile — reverse proxy for the SIN-Code WebUI stack.
#
# Topology (docker compose):
#   :80                    → webui:3000      (Next.js standalone)
#
# In production, point a real domain at this and Caddy auto-issues
# Let's Encrypt certs. In dev, use scripts/tunnel-up.sh for a free
# *.trycloudflare.com URL.
# ──────────────────────────────────────────────────────────────

{
    # Email for Let's Encrypt notifications in production.
    # admin{$HOSTNAME}
}

# Dev: HTTP only, single port.
:80 {
    # Standard reverse proxy with custom headers.
    # header_up X-Forwarded-* is set automatically by reverse_proxy,
    # but we also set Host so Next.js sees the real host header.
    reverse_proxy webui:3000 {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        # Long-lived SSE responses (the /api/chat stream).
        flush_interval -1
        transport http {
            dial_timeout 30s
            response_header_timeout 0
        }
    }

    # Security headers.
    header {
        # Tighten in production.
        # Strict-Transport-Security "max-age=31536000; includeSubDomains"
        # X-Content-Type-Options "nosniff"
        # Referrer-Policy "strict-origin-when-cross-origin"
        # Permissions-Policy "geolocation=(), microphone=(), camera=()"
        -Server
    }

    # Encode responses.
    encode {
        gzip 6
        zstd
    }
}

# Optional: expose the sin-code stdio bridge on a separate port.
# Used by tools like `sin-code client` to talk to the same server
# the webui is talking to. Disabled by default to reduce attack surface.
# :8090 {
#     reverse_proxy sin-code:8090
# }