{
    auto_https off
    # Only TCP HTTPS for the minimal prototype; no public HTTP redirect listener.
    servers {
        protocols h1 h2
    }
}

https://join.secret.town {
    # Must be the actual IPv4 on the VPS interface (not an upstream NAT address).
    bind {$ST_PUBLIC_IP}
    tls /etc/secret-town/tls/join/fullchain.pem /etc/secret-town/tls/join/privkey.pem
    request_body {
        max_size 2KB
    }
    header Strict-Transport-Security "max-age=31536000"
    reverse_proxy 127.0.0.1:8080
    # Do NOT enable access logs: profile download paths are bearer capabilities.
}

# Explicitly reject unknown hostnames on the public listener instead of Caddy's
# default empty 200 response. This block never proxies to a private backend.
https://:443 {
    bind {$ST_PUBLIC_IP}
    tls /etc/secret-town/tls/join/fullchain.pem /etc/secret-town/tls/join/privkey.pem
    respond "Unknown public service" 421
}

https://home.coolkids.secret.town, https://radio.coolkids.secret.town, https://wall.coolkids.secret.town {
    # Separate listener: spoofing Host/SNI on the public IP cannot reach this route.
    bind 10.77.0.1
    tls /etc/secret-town/tls/private/fullchain.pem /etc/secret-town/tls/private/privkey.pem
    header Strict-Transport-Security "max-age=31536000"
    reverse_proxy 127.0.0.1:8081
}
