caddyfile3

{
	log default {
		output stdout
		format json
		include admin.api
	}

	log access {
		output file /data/caddy/log/access.log {
			mode 600
			roll_size 100MiB
			roll_at 00:00
			roll_uncompressed
			roll_keep 1000
			roll_keep_for 2160h
		}

		format json
		exclude admin.api
	}

	metrics {
		per_host
	}

	grace_period 5m
	shutdown_delay 0s

	email joel.wejdenstal@gmail.com

	servers {
		timeouts {
			read_body 1h
			read_header 5m
			write 1h
			idle 2m
		}

		keepalive_interval 15s
		max_header_size 16KiB
		log_credentials
		enable_full_duplex
	}
}

(serve-robots) {
	@robots path /robots.txt /.well-known/robots.txt
	handle @robots {
		rewrite * /robots.txt
		file_server {
			root /srv
		}
	}
}

(enable-compression) {
	encode {
		zstd
		gzip

		minimum_length 1100
	}
}

(normalize-trailing) {
	@trailing_slash `!{path}.startsWith("/.within.website/") && path_regexp('normalized_path', '^(.*)/$')`
	rewrite @trailing_slash {re.normalized_path.1}
}

(proxy-headers) {
	header_up X-Http-Version {http.request.proto}
	header_up X-Real-Ip {http.request.remote.host}
	header_up X-Tls-Version {http.request.tls.version}
}

(proxy-stream-conf) {
	stream_timeout 24h
	stream_close_delay 5m
}

(proxy-transport) {
	transport http {
		read_buffer 4KiB
		write_buffer 4KiB
		max_response_header 8KiB

		dial_timeout 3s
		dial_fallback_delay 300ms

		response_header_timeout 5m
		expect_continue_timeout 5m

		read_timeout 5m
		write_timeout 5m

		keepalive 2m
		keepalive_idle_conns_per_host 32

		compression off
	}
}

(site-cfg-default) {
	request_body {
		max_size 512KiB
	}

	import enable-compression
	import normalize-trailing
	import serve-robots
}

(site-cfg-forgejo) {
	request_body {
		max_size 512MiB
	}

	import enable-compression
	import normalize-trailing
	import serve-robots
}

(anubis-serve) {
	@anubis path /.within.website/*
	handle @anubis {
		reverse_proxy anubis:3000 {
			import proxy-headers
			import proxy-stream-conf
			import proxy-transport
		}
	}
}

(anubis-auth) {
	reverse_proxy anubis:3000 {
		import proxy-headers
		import proxy-stream-conf
		import proxy-transport

		method GET
		rewrite /.within.website/x/cmd/anubis/api/check

		@challenge status 401
		handle_response @challenge {
			redir * /.within.website/?redir={uri} temporary
		}

		@deny status 403
		handle_response @deny {
			respond "forbidden" 403
		}

		@good status 2xx
		handle_response @good {
		}
	}
}

(site) {
	{args[0]} {
		import {args[0]}
	}

	www.{args[0]} {
		redir https://{args[0]} temporary
	}
}

(acrimon.net) {
	import site-cfg-default
	respond "acrimon.net"
}

(git.acrimon.net) {
	import site-cfg-forgejo
	import anubis-serve

	handle /metrics {
		respond "unauthorized" 403
	}

	handle {
		import anubis-auth

		@archive_check {
			path_regexp ^/[^/]+/[^/]+/archive/.*$
			method POST
		}

		respond @archive_check "{\"complete\":true}" 200

		@archive_download {
			path_regexp ^/[^/]+/[^/]+/archive/.*$
			method GET
		}

		reverse_proxy @archive_download forgejo:3000 {
			import proxy-headers
			import proxy-stream-conf
			import proxy-transport

			method GET
			rewrite /user/settings

			@unauthenticated status 303
			handle_response @unauthenticated {
				redir * /user/login 303
			}

			@good status 2xx
			handle_response @good {
			}
		}

		reverse_proxy forgejo:3000 {
			import proxy-headers
			import proxy-stream-conf
			import proxy-transport

			header_down Cache-Control "^(.+, )?no-transform(, .+)?$" "$1$2"
		}
	}
}

(wanderer.acrimon.net) {
	import site-cfg-default
	import anubis-serve

	handle {
		import anubis-auth

		reverse_proxy wanderer:8000 {
			import proxy-headers
			import proxy-stream-conf
			import proxy-transport
		}
	}
}

(etel.acrimon.net) {
	import site-cfg-default
	import anubis-serve

	handle /metrics {
		respond "unauthorized" 403
	}

	handle {
		import anubis-auth

		reverse_proxy etel:3000 {
			import proxy-headers
			import proxy-stream-conf
			import proxy-transport
		}
	}
}

import site acrimon.net
import site git.acrimon.net
import site wanderer.acrimon.net
import site etel.acrimon.net