# HTTPS on this server's own address in the local network (no domain): Caddy signs the
# certificate itself (its own small certificate authority, kept in the caddy-data volume) and
# renews it by itself. setup.sh 「區網 IP」 writes this with LAN_IP replaced by the address.
#
# Each phone and computer trusts that authority once: open http://LAN_IP/anybot-ca.crt and
# install it (iPhone: then 設定 › 一般 › 關於本機 › 憑證信任設定, turn it on). After that the
# browser and AnyBot connect to https://LAN_IP without warnings.
{
	# A browser asking for an IP address doesn't say which name it wants (no SNI).
	default_sni LAN_IP
	# The authority lives in this container only; nothing is installed on the server itself.
	skip_install_trust
}

https://LAN_IP {
	tls internal
	encode gzip
	reverse_proxy relay:8080 {
		# The phone's "anything new?" request waits up to 35 s. Each AnyBot also keeps one
		# WebSocket open here (pinged every 15–20 s, so it never sits idle for 60 s).
		transport http {
			read_timeout 60s
		}
		# Reloading this file doesn't cut those connections at once.
		stream_close_delay 5m
	}
}

# Plain http only hands out the certificate to trust (it's public anyway), and sends
# everything else to https.
http://LAN_IP {
	handle /anybot-ca.crt {
		root * /data/caddy/pki/authorities/local
		rewrite * /root.crt
		header Content-Type application/x-x509-ca-cert
		file_server
	}
	handle {
		redir https://LAN_IP{uri}
	}
}