thermograph/infra/deploy/Caddyfile

# /etc/caddy/Caddyfile on the VPS.
# Each domain's A/AAAA record must already point at this VPS — Caddy provisions a
# Let's Encrypt cert on first request and auto-renews. Nothing else to do for TLS
# (just make sure ports 80 and 443 are open).
#
# Layout:
#   thermograph.org/*              -> the Thermograph app (path-split across
#                                      backend/frontend -- see below)
#   emigriffith.dev/               -> static portfolio site (served straight from disk)
#   emigriffith.dev/thermograph*   -> permanent redirect to thermograph.org (the app moved)
#
# Thermograph now owns thermograph.org's root, so both services run with
# THERMOGRAPH_BASE=/ (see /etc/thermograph.env) — pages, assets and API all sit
# at "/" with no sub-path prefix. Repo-split Stage 4: backend and frontend are
# two containers now (docker-compose.yml), each on its own loopback port --
# Caddy path-splits directly to whichever owns a given path, so the browser
# still sees one apparent origin. Repo-split Stage 7a flipped which side owns
# the enumerated list: frontend now owns everything (content pages, the
# interactive tool's SPA shells, every static asset, the dynamic IndexNow key
# file) except the short, stable set below, which mirrors backend/web/app.py's
# own routing exactly (a single catch-all proxy to frontend for everything
# else) -- unlike frontend's paths, backend's don't grow every time a new
# static asset filename is added. A gap in this list still just degrades to
# "one extra hop" through backend's own proxy fallback, never a 404.

thermograph.org {
	encode zstd gzip

	@backend_paths path /api/* /digest /discord/interactions

	# Active health check on the same cheap /healthz route each container's own
	# HEALTHCHECK uses (Dockerfile) — so a deploy that's still restarting/booting
	# never gets proxied into (a reload alone has no gate, hop-1 runbook hazard #10).
	# 15s (was 5s): plenty responsive for a process that only restarts on a deploy,
	# and a quarter of the polling load.
	handle @backend_paths {
		reverse_proxy 127.0.0.1:8137 {
			health_uri /healthz
			health_interval 15s
			health_timeout 3s
			health_status 2xx
		}
	}

	handle {
		reverse_proxy 127.0.0.1:8080 {
			health_uri /healthz
			health_interval 15s
			health_timeout 3s
			health_status 2xx
		}
	}

	# Access-log hygiene: the default JSON encoder serializes full request headers,
	# the TLS block, and response headers on every line (measured ~1,133B/line) --
	# strip those with the `filter` format encoder. Also strip the query string from
	# the logged URI: Caddy's default logger records request.uri *including* the
	# query string, so every `?q=<search text>` a visitor typed sat in Loki next to
	# their client IP for the full 30-day retention -- a real privacy leak, not just
	# noise. Bot/crawler skipping stays out of here: `log_skip` needs Caddy >= 2.7
	# and an upgrade is out of scope, so that's handled downstream in Alloy's
	# loki.process "caddy" stage instead (see observability/alloy/config.alloy).
	log {
		output file /var/log/caddy/thermograph.log {
			roll_size 20MiB
			roll_keep 5
		}
		format filter {
			wrap json
			fields {
				request>headers delete
				request>tls delete
				resp_headers delete
				request>uri regexp \?.* ""
			}
		}
	}
}

emigriffith.dev {
	encode zstd gzip

	# Thermograph moved to its own domain. Send the old sub-path there with a
	# permanent redirect, stripping the /thermograph prefix so deep links map
	# straight across (…/thermograph/calendar -> thermograph.org/calendar). The
	# bare /thermograph (no trailing slash) goes to the new root.
	handle_path /thermograph/* {
		redir https://thermograph.org{uri} permanent
	}
	handle /thermograph {
		redir https://thermograph.org/ permanent
	}

	# Portfolio at the root. Point `root` at the built static site (for the Astro
	# portfolio that's its `dist/` output). file_server serves index.html for
	# directories and returns a real 404 for missing paths.
	handle {
		root * /var/www/emigriffith
		file_server
	}

	log {
		output file /var/log/caddy/emigriffith.log
	}
}

# Old bookmarks to the raw IP (the pre-domain URL) would otherwise get bounced to
# HTTPS-on-the-IP, which has no cert and fails. Redirect them to the portfolio domain.
http://75.119.132.91 {
	redir https://emigriffith.dev{uri} permanent
}

# Optional: redirect www -> apex for either domain. Add the www CNAME/A record
# first, then uncomment the matching block.
# www.emigriffith.dev {
# 	redir https://emigriffith.dev{uri} permanent
# }
# www.thermograph.org {
# 	redir https://thermograph.org{uri} permanent
# }