Caddyfile

# Public entrypoint for the ReadIssue simulator.
#
# SITE_ADDRESS controls TLS:
#   - a domain (e.g. readissue.example.com)  -> automatic HTTPS via Let's Encrypt
#   - :80                                     -> plain HTTP (local testing only)
#
# Everything is gated behind HTTP basic auth. Generate the password hash with:
#   docker run --rm caddy:2.8 caddy hash-password --plaintext 'your-password'
# and put the result in BASIC_AUTH_HASH (see .env.sim.example).

{$SITE_ADDRESS} {
	basic_auth {
		{$BASIC_AUTH_USER} {$BASIC_AUTH_HASH}
	}

	# Reverse-proxy the whole app (dashboard + /api + /ws) to the sim
	# container. Caddy detects the WebSocket upgrade on /ws automatically.
	reverse_proxy sim:8000

	encode gzip

	header {
		# Basic hardening headers for a public demo.
		X-Content-Type-Options nosniff
		X-Frame-Options SAMEORIGIN
		Referrer-Policy no-referrer
	}
}