{
    admin off
}

:80 {
    # IP Whitelist - SECURITY.md Section 3.2
    # Replace with actual NOC/VPN IPs
    # @blocked not remote_ip 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.1
    # respond @blocked 403

    # Security Headers
    header {
        X-Frame-Options "DENY"
        X-Content-Type-Options "nosniff"
        X-XSS-Protection "1; mode=block"
        Referrer-Policy "strict-origin-when-cross-origin"
        Strict-Transport-Security "max-age=31536000; includeSubDomains"
        -Server
    }

    root * /var/www/html/public
    encode gzip

    # Laravel PHP-FPM — handles try_files + SCRIPT_FILENAME automatically
    php_fastcgi app:9000

    file_server

    log {
        output file /var/log/caddy/access.log
        format json
    }
}

:9090 {
    # ACS CWMP SaaS Tenant Routing
    reverse_proxy genieacs:7547 {
        header_up X-Forwarded-Host {host}
        header_up X-Real-IP {remote}
        flush_interval -1
    }
}
